WP Cerber Security 10

WP Cerber 10 brings a host of important changes to Traffic Inspector, the malware scanner, REST API access control, and the WordPress admin area. We tightened how the plugin handles untrusted data, improved the consistency of security checks, and corrected several problems affecting authentication and session tracking.

This release also improves compatibility with hosting environments where the PHP mbstring extension is missing. For administrators troubleshooting email notifications, we’ve added optional diagnostic logging to help identify where delivery problems occur.

Key Highlights

• Safer upload inspection. Traffic Inspector now restricts file inspection and removal to genuine uploads, with more consistent checks for prohibited file names.
• Improved REST API protection. WP Cerber now applies configured access restrictions consistently across additional REST API request formats.
• More reliable malware scanning. Improved file name handling protects scanner operations and admin displays, while fixing problems with files containing unusual characters.
• Stronger admin-area safeguards. We improved the handling of untrusted content and tightened permission checks for user information.
• More accurate login tracking. Expired and revoked sessions are now distinguished from genuine failed logins, with new Activity Log events for easier investigation.
• Better compatibility without mbstring. Fallback handling prevents several critical PHP errors, while System Readiness explains which functionality still requires the extension.
• New configuration options. Two wp-config.php constants enable email notification diagnostics and let administrators remove the documentation link from WP Cerber’s 403 page.

New Features

Diagnostics for missing email notifications

Troubleshooting missing security notifications can be difficult, especially when test emails arrive successfully but certain alerts do not. The new CERBER_MAIL_DEBUG constant enables diagnostic logging that helps identify what triggered a notification and what happened when WP Cerber attempted to send it.

Logging is disabled by default. Unless the constant is explicitly enabled, WP Cerber collects no additional email diagnostic data. Enabling logging does not change how email sending succeeds or fails.

Please refer to this guide: Troubleshooting WP Cerber Email Notifications

Option to hide the documentation link on the 403 page

WP Cerber’s built-in 403 page includes a “Know more: Documentation” link to wpcerber.com. Previously, removing this link required modifying the plugin code.

You can now hide it by adding the following constant to wp-config.php:

define( 'CERBER_HIDE_403_DOC_LINK', true );

When enabled, WP Cerber omits the documentation paragraph from the 403 page.

Breaking Changes

REST API restrictions on sites using PATHINFO permalinks

WP Cerber now applies REST API access restrictions more consistently on sites using PATHINFO-style permalinks, including certain server configurations that do not pass PATH_INFO to PHP. Depending on your existing REST API settings, some requests that were previously allowed may now be blocked.

Prohibited file name checks now cover multi-file uploads

Traffic Inspector now checks prohibited file names in upload fields that accept multiple files, including nested fields. Files with names that violate the existing restrictions will receive an HTTP 403 response.

Each request is also limited to 100 uploaded files. Requests exceeding this limit are rejected and recorded in the Activity Log.

Alert subscriptions for cookie signature failures

Authentication cookies with invalid signatures now receive the new “Cookie signature mismatch” status in the Activity Log.

Because alert subscriptions match specific event statuses, subscriptions configured for the statuses previously assigned to these failures will no longer match them.

If you rely on status-based alerts for authentication cookie failures, review your alert subscriptions after updating. Historical Activity Log entries retain their original statuses.

Security Changes

Safer file handling during upload inspection

Traffic Inspector examines uploaded files for malicious content and removes files that fail its security checks. For this to work correctly, the plugin must distinguish actual uploads from other data supplied with an HTTP request.

We’ve tightened this handling so that Traffic Inspector reads and removes only files that PHP identifies as uploads belonging to the current request. This correction keeps file inspection focused on genuine uploads and prevents unrelated files from being affected by upload processing.

The existing handling of detected malicious uploads remains in place. Traffic Inspector continues to remove the uploaded file, record the event, and apply a soft IP lockout.

Consistent validation of prohibited upload file names

File name restrictions are an important part of Traffic Inspector’s upload protection. This release improves how WP Cerber applies those restrictions across different upload field structures. Each uploaded file is now checked individually, whether a request contains a single file, multiple files, or nested upload fields. The validation also handles the upload data consistently without processing the same file more than once.

To keep upload processing within defined limits, WP Cerber now accepts a maximum of 100 uploaded files per request. Requests exceeding this limit are rejected with HTTP 403 and recorded under the new status “Exceeded the allowed number of uploaded files”. This condition does not trigger an IP lockout.

More consistent REST API access control

WordPress supports several ways of routing requests to its REST API. WP Cerber’s access restrictions need to apply consistently to the requests WordPress recognizes, regardless of the site’s permalink configuration.

We’ve updated REST API request handling to improve consistency between WordPress routing and WP Cerber’s access-control checks. The changes cover the existing “Block access to users’ data via REST API” and “Disable REST API” settings.

Safer display of lockout information

Lockout reasons can contain information originating from untrusted sources. WP Cerber displays these reasons in several administration screens, where they must be handled as text rather than executable content.

We’ve corrected how lockout reasons are rendered in the Lockouts page, dashboard widgets, and related IP detail views in the Activity Log and Traffic Inspector.

The updated output handling also covers lockouts associated with prohibited usernames. Previously cached IP details are not reused after the update. These changes ensure that lockout information is displayed safely while preserving the details administrators need when investigating blocked activity.

For Cerber.Hub users: Each managed website renders the information displayed by the main Cerber.Hub website. Update every managed website to WP Cerber 10 to apply these corrections across your installation.

Improved file name handling in the malware scanner

The malware scanner works with file names and extensions from directories that may contain unexpected or unusual values. These values must be processed consistently when the scanner queries its records, builds reports, or displays file information in the WordPress admin area.

We improved file name handling across several scanner operations, including the file viewer, bulk actions, and Insights reports.

File names and extensions are now treated as data during database operations and rendered as plain text in admin views. This prevents unexpected values from affecting scanner records or being interpreted as markup.

The changes also improve the accuracy of file extension statistics and the handling of scanner results. Any extension records affected by the previous behavior are corrected during the next full scan.

Cached Insights reports created by earlier versions are rebuilt rather than reused.

Tighter permissions for user information

WP Cerber adds security-related information to the WordPress Users screen. Access to the underlying user details must follow the appropriate WordPress permissions.

We updated these lookups to require either WP Cerber manager permissions or the WordPress list_users capability.

On WordPress multisite installations, additional membership checks restrict access to user details belonging to the current site where applicable. Requests containing invalid or unauthorized user IDs are rejected.

Improved authentication and session handling

We’ve refined how WP Cerber handles rejected authentication cookies and records failed login attempts.

When a session cookie is expired or revoked, WP Cerber now clears stale authentication cookies only when doing so is safe. This avoids interfering with valid authentication credentials or an active two-factor authentication process.

We also corrected an interaction between session validation and failed-login tracking. Genuine failed login attempts are now recorded and counted correctly, even when a rejected session cookie is encountered during the same request.

Admin Experience

Clearer distinction between session problems and failed logins

An expired session is not necessarily a failed login. Until now, WP Cerber could record expired or revoked session cookies as failed sign-in attempts, making the Activity Log less precise.

The new “Session cookie rejected” event records session validation failures separately from unsuccessful login attempts.

Two statuses explain why a session was rejected:

• Session cookie expired: The cookie’s authentication period has ended.
• Session token no longer valid: The session is no longer recognized as valid.

These events appear in the Login Issues activity group.

Authentication cookies with invalid signatures are recorded with the new “Cookie signature mismatch” status.

This distinction makes it easier to investigate login problems without confusing expired sessions with unsuccessful attempts to sign in.

System Readiness now explains missing mbstring support

The System Readiness widget now provides a clearer explanation when the PHP mbstring extension is missing. It identifies the missing requirement, describes the affected functionality, and explains how to enable the extension. A separate message covers installations where mbstring is available but the regular expression functions required by WP Cerber are not.

More accurate malware scanner error messages

We’ve improved how the malware scanner reports database and file lookup errors.

A database failure is no longer presented as a missing file. The file viewer displays an appropriate error, while bulk operations report “Unable to look up <file> in the scan results” instead of the less informative “Unknown file”.

Reliability Improvements

More graceful handling when PHP mbstring is unavailable

WP Cerber requires the PHP mbstring extension for full functionality. However, some hosting environments may have it disabled or may not provide all the functions the plugin expects.

Previously, this could cause critical PHP errors in several parts of a WordPress website. In some cases, a plugin update on a server without mbstring could leave both the website and its login page inaccessible.

The improvements cover:

• Plugin updates and regular website requests. The affected code paths no longer cause repeated critical errors when mbstring is missing.
• Login and registration. Authentication and registration requests can continue without fatal errors caused by prohibited-username regular expression handling.
• Subdirectory installations. Websites installed in a subfolder with pretty permalinks no longer fail because of the affected functions.
• Activity alerts. Alert matching no longer interrupts the WordPress action being recorded.
• Multisite administration. Network admin pages no longer fail during the affected upload directory lookups.
• Settings management. Settings filtering and redirects after saving continue to work, preserving the existing filter behavior.
• Traffic Inspector. The traffic log remains accessible, with User-Agent classification falling back to “Unknown” when necessary.

These changes improve fault tolerance, but they do not eliminate the mbstring requirement.

Some functionality remains limited without the extension. Regular expression rules in the prohibited-username list are skipped, although exact-match rules continue to work. Activity alert searches use fallback matching without equivalent Unicode case-insensitive behavior. The malware scanner still requires mbstring.

Tested compatibility

We tested this release with PHP 7.4.33, 8.0.30, 8.1.34, 8.2.35, 8.3.36, 8.4.27, and 8.5.12.

WordPress versions tested include 6.6.6, 6.7.6, 6.8.7, 6.9.6, and 7.1.4

Bugfixes

• Expired or revoked sessions incorrectly counted as failed logins. These events no longer consume an IP address’s failed-login allowance, contribute to Citadel or IP lockouts, generate fail2ban entries, trigger failed-login alerts, or produce an HTTP 403 response. One edge case remains: changing a password or rehashing it during sign-in can invalidate the signature of an older cookie and cause it to be counted as a failed login.
• Scanner operations failed for file names containing quotes or backslashes. Files with these characters can now be opened in the file viewer and processed using Delete or Ignore. Bulk action messages display their names correctly, and Insights extension links work with these characters.
• Scanner links failed for certain special characters. We’ve corrected the handling of file names and extensions containing characters such as &, #, +, and %. The file viewer and Insights extension links now open the corresponding results correctly.
• Delete and Ignore results were inconsistent. Completed actions now remove only the affected rows from the results display. File names containing quotation marks no longer prevent the result popup from appearing.
• Invalid scanner requests could produce PHP warnings or critical errors. The scanner now handles unexpected file name values and malformed request parameters without triggering these errors. Invalid entries in bulk requests receive the message “Invalid file name in the request”, and the file viewer no longer displays duplicate errors after rejecting an invalid name.

Have any questions?

If you have a question regarding WordPress security or WP Cerber, leave them in the comments section below or get them answered here: G2.COM/WPCerber.