WP Cerber Security 10
WP Cerber 10 brings a host of important changes to Traffic Inspector, the malware scanner, REST API access control, and the WordPress admin area. We tightened how the plugin handles untrusted data, improved the consistency of security checks, and corrected several problems affecting authentication and session tracking. This release also [...]
Troubleshooting WP Cerber Email Notifications
If a WP Cerber notification doesn’t arrive, email diagnostics can help you find out what happened when the plugin tried to send it. This is especially useful when test emails arrive but security alerts or scheduled reports do not. Email diagnostics record WP Cerber’s email sending attempts. They do not track messages from other [...]
Critical PHP Vulnerabilities: What WordPress Site Owners Need to Know
PHP released fixes for two critical vulnerabilities on October 21, 2026. Updating WordPress or plugins does not fix them. Learn how to check whether your hosting environment is affected and what steps to take. In brief: what happened On October 21, 2026, the PHP project released fixes for two critical vulnerabilities in the PHP [...]
WP Cerber Security 9.10
In this release we strengthened two-factor authentication against repeated attempts, closed a gap in REST API user-data protection, and improved how untrusted data is handled in WP Cerber admin screens. We also corrected error reporting during GDPR personal data export and erasure, so Activity Log database failures are no longer mistaken [...]
Cloudflare Add-On 2.5
Version 2.5 is the first Cloudflare Add-On release since 1.3. It focuses on how WP Cerber keeps Cloudflare IP Access Rules synchronized with your current Access Lists and the lockouts the add-on normally mirrors to Cloudflare. The add-on now rebuilds its existing Cloudflare rule set once after the update, keeps lockout and IP Access List [...]
What to expect when updating the Cloudflare add-on to version 2.5
Cloudflare Add-On 2.5 changes how WP Cerber keeps track of the Cloudflare IP Access Rules it manages. When you update from an older version, the add-on rebuilds those existing rules automatically from the current state of WP Cerber instead of trying to migrate each historical rule record in place. For most websites, no manual rule [...]
WP Cerber Security 9.9.5
This release is about closing the distance between a security event and the setting that caused it. We rebuilt how WP Cerber links from the Activity log to the exact setting behind a decision, fixed two admin UI defects, and hardened the way the plugin escapes URLs in the admin area. Under the hood, we also started storing admin [...]
WP Cerber Security 9.9.3
We built version 9.9.3 around correctness in the places you rely on when something goes wrong. This release repairs how WP Cerber behaves during fatal PHP failures, fixes IPv6 range matching in the Access Control Lists, and makes all admin notices render in your own language. Key Highlights Fatal PHP failures are handled correctly again. [...]
Under the Hood of WP Cerber 9.9
This release is mostly about the parts of WP Cerber you never notice until something goes wrong. We spent it hardening how settings are stored and recovered, how the Traffic Inspector reads obfuscated JavaScript, and how the plugin behaves on older hosting stacks. We also finished a long-running migration off the WordPress Settings API. [...]
WP Cerber Security 9.9
At a Glance WP Cerber 9.9 is here, and this release is all about resilience. We built a self-healing mechanism for your plugin settings, closed several detection bypasses in the Traffic Inspector’s obfuscated JavaScript detector, and fixed a class of fatal errors that could take a site down on certain hosting environments. If you run WP [...]
Under the Hood of WP Cerber 9.8.3
This release is a maintenance and hardening cycle rather than a feature launch. Most of the work happened where site owners rarely look: the data layer that reads your security logs, the code that composes notification emails, and the export paths that hand you a CSV of your activity records. None of it changes how the plugin looks, but [...]
WP Cerber Security 9.8.3
At a glance We tightened how external and user-supplied data moves through the plugin scanner, security emails, and log exports. We also rebuilt large activity log exports to behave more predictably under memory pressure and fixed several issues that made triage and reporting less precise. No configuration changes are required after [...]
WP Cerber Security 9.8
This release concentrates on the parts of WP Cerber that you rely on every day but rarely think about: how we identify the real visitor behind a request, how access decisions are reported in your logs, and how reliably the integrity scanner runs on your WordPress. We closed a cross-site scripting vector in the Cerber.Hub management [...]
WP Cerber Security 9.7.4
A short note from the team behind WP Cerber: this release is a focused round of stability, security, and admin-experience work. Key Highlights A deterministic fix for fail2ban log timestamps on servers where the system clock and WordPress clock disagree. Hardened sanitization of values written into the fail2ban log file. Visual alignment [...]
WP Cerber Security 9.7.3
With Artemis II already on its way back from the Moon, it felt like the right moment to take a hard look at our own systems. It would be awkward if our heroes make it back to Earth while we are still chasing avoidable warnings in server logs. So we focused on the unglamorous work: tightening validation at configuration time, improving [...]