SecuPress Pro - WordPress Security Plugin v2.7.1 Nulled

SecuPress Pro - Premium WordPress Security Plugin v2.7.1 Nulled
= 2.7.1 =
* 25 Sep 2026
* New: Firewall Learning Mode for 8G (observe signatures, review hits, allow globally or per URL prefix, auto-calibrate).
* Improvement: WAF revamp: 8G signatures are now optional per filter, with local exceptions.
* Improvement: Block Bad Referers is now available in Free.
* Improvement: Hide WP, WooCommerce and PHP session cookies from the Support ID.
* Improvement: Malware scanner still lists malware files when WP core checksums are missing, and matches "file" signatures on the filename.
* Improvement: Deactivating a wp-config module no longer leaves the file or the setting in a bad state.
* Improvement: Anti-spam comment delay now finds the comment form via the WordPress core field, so custom theme form IDs no longer break the timer.
* Fix: Mixed content replacement now handles namespaced XML/SVG.
* Fix: Authors and other lower roles could not edit or create content with Stop User Enumeration.
* Fix: Apache bad URL access rules were missing the "-" substitution, so flags were ignored.
* Fix: "Expired license" displayed incorrectly on the dashboard widget.
* Fix: PHP warning when headers are already sent.
* Fix: Undefined variable notice in the System Status widget.
* Fix: reset() call on the pointers tour steps.
* Security Fix: Directory traversal in the class file loader (administrators).

SecuPress Pro - Premium WordPress Security Plugin v2.7 Nulled
= 2.7 =
* 12 Sep 2026
* New: Pause the security for 30 minutes (settings kept, auto-resume, email warning).
* New: Dashboard widget "System Status".
* New: Alerts when an application password is added to an account.
* New: Expert settings for Anti Hotlink (allowed referers, redirection type, webp/avif/svg).
* New: Password protection for backup ZIP files.
* Improvement: Application Passwords alerts are no longer enabled by default.
* Improvement: Firewall updated to 8G (query, URI, host, cookie, user-agent, referer).
* Improvement: Store backups outside the web root when possible.
* Improvement: Strong passwords are now enforced on the password reset form. PasswordLess users cannot reset.
* Improvement: Export/import restricted to configuration keys only (no logs, transients, scans, or banned IPs).
* Improvement: HTTPS redirection now generates IIS rules.
* Improvement: Compatibility fallbacks when the mbstring PHP extension is missing.
* Improvement: Hide sensitive COOKIE values in block reports.
* Improvement: Self-unban emails no longer leak whether an address exists.
* Improvement: Updated forbidden file extensions list.
* Fix: Rewrite rules and current URL for subdirectory, subdomain, siteurl and own-directory installs (readme.html, changelogs, bad URL/file access, Move Login).
* Fix: User enumeration via REST routes, language URL prefixes like /fr/, and ?_embed=.
* Fix: Possible PasswordLess bypass after last fix from Protect User Creation.
* Fix: (again) Possible fatal error "Call to undefined method ::is_processing()" if WooCommerce loads an older async lib (file monitoring, bad plugins, bad themes).
* Fix: Bad themes deactivation hooks.
* Fix: Unlock admin callback used a wrong message.
* Fix: A plugin returning to the repository was still listed as closed/old.
* Fix: Fake Google Bots filter.
* Fix: Wrong return type in rewrite bases helper.
* Fix: String/array issue in the database malware scan.
* Fix: Safely remove the PasswordLess option and fix the affected role check.
* Security Fix: Unauthenticated Authentication Bypass via 'secupress_auto_login_token' Parameter.
* Security Fix: Possible RCE when writing constants into wp-config.php.
* Security Fix: SQL Injection by administrators when deleting logs.

SecuPress Pro - Premium WordPress Security Plugin v2.6.3 Nulled
== Changelog ==

= 2.6.3 =
* 21 July 2026
* Fix: "Uncaught TypeError: str_rot13(): Argument #1 ($string) must be of type string, array given"
* Fix: antispam.min.js error
* Fix: is_process_running() error again.

SecuPress Pro - Premium WordPress Security Plugin v2.6.2 Nulled
== Changelog ==

= 2.6.2 =
* 25 Juin 2026
* Fix: Possible fatal error when the data files are not correctly extracted.
* Fix: Users with same email domain present before the activation of the same name module were still tagged as bad.
* Fix: Fatal error on empty JSON
* Fix: Users from REST API still visible, it's CASE SENSITIVE!?
* Fix: Require module tools on submodule activation
* Improvement: User secupress.me instead of google.com for testing
* Improvement: Do not unvalidate passwordless email on plugin deactivation or licence deco

SecuPress Pro - Premium WordPress Security Plugin v2.6.1 Nulled
= 2.6.1 = 03 April 2026

• Improvement: Remove the ping on google.com, set it to secupress.me.
• Improvement: Refactored the database scan logic in SecuPress_File_Monitoring to use background processing for scanning posts, options, and custom post types for malware patterns. Better perf, quicker scans incoming on big sites.
• Fix: (again) Possible fatal error “Call to undefined method SecuPress_Background_Process_Bad_Plugins::is_processing()” if WooCommerce is installed since THEY include the obsolete version of the async lib before us…
• Fix: Warning notice when saving captcha style.
• Fix: Re-add the “monthly” index for cron schedules.
• Fix: Do not unvalidate passwordless email on plugin deactivation or licence deconnection
• Fix: Remove the usage of shell_exec() and host $ip that can overconsume resources on your host, bringing down your site (even if this was in SecuPress since 8 years, only now this cause an issue)

SecuPress Pro - Premium WordPress Security Plugin v2.6
= 2.6 — 16 January 2026

• New: GeoIP Location on Login
• New: Search field in admin UI.
• New: Scanner for malwares in our 35 scanners.
• Improvement: UI for Malware Scanner has been improved, and will be again You’ll find a “WP File Integrity” which has always been there since 1.0, just not mentionned as is.
• Improvement: Add WP 2FA compatibility to Easy Login scan
• Fix: Dashboard Widget not displaying graphs
• Fix: PHP Version Scanner was saying that the last version was “ok tier”
• Fix: PasswordLess activation checkbox was not checked after reload
• Fix: Remove secupress-data directory on uninstall (I forgot, my bad)
• Fix: “wp-includes/version.php” should not be tagged “different” anymore if you use a localised zip (in malware scanners)
• Fix: Possible fatal error when deactivating the module “Disable all actions on plugins” + “disable all actions on FTP”
• Fix: Possible fatal error “Call to undefined method SecuPress_Background_Process_Bad_Plugins::is_processing()“

SecuPress Pro - Premium WordPress Security Plugin v2.5 Nulled
= 2.5 =
* 02 December 2025
* New: Colored notices can be added up in the plugins page to help you prioritize updates by showing you since when the update is available.
* New: The standalone "SF Move Login" is now renamed "SP Move Login" and since it's the same feature as the one here, it will be deactivated and this feature here activated.
* New: "Move Login" feature can now display a Honeypot instead of a message or page. This is an expert setting, also, only available if you only have Admins on your site (or lusers will be banned trying to log-in, I know them)
* New: Translations are now done using the new `.l10n.php` format
* Improvement: "Move login" feature will now display every other slugs, it now depends on the login one. "Register" is only available is the registration is open.
* Improvement: Dashboard widget finally get a skin, can display a graph to check evolution of monthly attacks.
* Improvement: All the messages from the "unlock yourself as an admin" on login page have been set to the same one to prevent guessing an admin email. props to Lohen Florent
* Fix: JS Error when Antispam Comment Timer module is active
* Fix: Correct custom validity for roles in some cases
* Fix: Warning for undefined SECUPRESS_INSTALLED_MUPLUGINS constant
* Fix: Warning when the distant DB was not accessible
* Fix: Passwords couldn't be updated when Passwordless was active, even if your role was not targeted, or module activatjon not validated yet
* Fix: Changelogs couldn't be opened in the iframe popup in plugins.php page when "Prevent Actions on Plugins" feature was activated

SecuPress Pro v2.4 - WordPress Security Plugin
2.4 — 24 September 2025

• New: Force Better Encryption System (Users & Login) to prevent logins from old encryption and to prevent duplicated hashes
• Improvement: Add the filter secupress.get_wp_directory() to make a better compat with BedRock (with which we are not compatible natively)
• Improvement: Password reset cannot be asked for account using PasswordLess
• Improvement: Add a message on “Forbid user enumeration” to recall that author front pages will be replaced by homepage.
• Fix: Remove AJAX call from antispam delay module to prevent unwanted indexed ajax URL
• Fix: Password reset was not possible for some roles, due to activation+deactivation of the PasswordLess module
• Fix: Some notices where duplicated

SecuPress Pro v2.3.20.1 - WordPress Security Plugin
= 2.3.20.1 =
* 30 June 2025
* Fix: Password not updating in "Force Strong Passwords" module

SecuPress Pro v2.3.19.1 - WordPress Security Plugin
= v2.3.19.1 = 24 June 2025
* Fix: Check allowed IP before auth_redirect in "bad usernames" module
* Update: Allowed IP List