Melapress Login Security changelog

This is the plugin’s changelog, which is mainly a detailed list of all the plugin changes and bug fixes introduced in every version update. Refer to the plugin release notes for a high level overview of what is new and improved with every plugin version update.

2.4.1 (2026-09-03)

Note: This is a premium only release.

Plugin improvement

• Updated the uninstall function of the plugin, making it compatible with both Freemius and our new in-house licensing system.

2.4.0 (2026-09-02)

New features & functionality

• Added search and filtering options to the Locked Users table, including username, email, user ID, user role, and block reason.
• Added a new policy requiring users to enter their current password before setting a new one.
• Added a new policy, requiring users to answer their security questions before changing their own email address.
• Added Lock user and Unlock user actions to WordPress user profile pages for administrators.
• Added a two-factor authentication option that installs and activates the free WP 2FA plugin, or opens its settings when it is already installed.
• Added support for the new self-hosted licensing system while maintaining support for existing Freemius licences.
• Added an email notification for new logins when the user already has an active session.
• Added a known devices list to the user profile page, allowing users to view the known devices associated with their account.

Functionality & plugin improvements

• Increased the minimum supported PHP version to 8.0.
• Split password, session, device, and login policies into separate groups that administrators can enable or disable independently.
• Improved unrecognized device detection by using a secure device cookie instead of the browser User-Agent.
• Added a Recognized device duration setting with options for 1 month, 3 months, 6 months, or 1 year.
• Centralized user lock handling so users can have only one active lock. The original lock reason is preserved, and one unlock action now clears the lock.
• Manual user locks now record when the lock was applied and show this value in the Locked since column.
• Improved the forced password reset process after unlocking an account. Users cannot create an authenticated session with their old password while a required reset is pending.
• Added email address columns to the Locked Users and Reports pages.
• The Expired Passwords report now shows the actual expiry date and time under the Password expired on column.
• Improved server-side validation for policy limits, login credential options, failed-login unlock options, IP addresses, redirect URLs, country codes, and login-page messages.
• Improved settings exports so licence credentials are not included in exported files.
• Updated plugin emails in Free and Premium to use a simpler plain-text layout without logos or background images. Free emails include a Melapress Login Security attribution link, which Premium users can customize.
• Improved direct file access protection, output escaping, and request verification following a WordPress Plugin Check review.
• Updated the Premium Features tab to distinguish between Premium and Enterprise functionality.
• Updated the plugin update notice and added a smaller Premium features banner.
• Other plugin notices are now hidden on Melapress Login Security admin pages to reduce distractions.
• Moved Account / Manage License to the last position in the plugin menu.
• Renamed Run Inactive Check Now to Refresh users lock status in Free and Premium.
• Improved the policy exclusions and Enterprise email formatting help text.
• The password expiry notification controls now show the full “send up to” text only when the setting is enabled.
• Removed the notice count badge from the plugin menu.
• Updated the deactivation feedback form to version 1.1.
• Removed the Ad link URL from the plugin details displayed on the WordPress Plugins page for non-Enterprise plans.

Bug fixes

• Role-specific password policies are now correctly applied when creating users instead of falling back to the site-wide policy.
• The Do not enforce password policies for this role setting is now respected when creating users, changing passwords, editing profiles, and resetting passwords.
• Added missing separators between multiple password validation messages.
• Fixed an HTTP 500 error that could occur after password expiry when the reset email could not be sent. Expired users are now correctly directed through the required reset process.
• Fixed settings imports that could disable enabled password rules when boolean values were stored in the exported file.
• Fixed imports from older plugin versions deleting settings introduced in newer versions.
• Fixed incomplete imports of policy settings, email template customizations, HTML message content, and excluded users.
• Fixed password policies being disabled when importing settings exported from version 2.3.0.
• Fixed expiry notification periods being changed incorrectly when the notification and expiry periods used different time units.
• Fixed the weekly summary email day dropdown not matching stored values because of letter-case differences.
• Fixed Enterprise timed-login restrictions remaining active on days that were unchecked.
• Fixed incorrect inactivity durations and filtering on the Reports page.
• Fixed the User Password Age report showing last activity information instead of password age and returning incorrect results.
• Fixed a PHP warning and incorrect timed-unlock calculation when a failed login was submitted using an email address.
• Fixed a fatal PHP error on plugin admin pages when another plugin or theme used an anonymous callback for an admin notice.
• Fixed WordPress 7.x layout overlaps on the Locked Users and Reports pages.
• Fixed the editable Unknown username notice reverting to its default value after saving.
• Fixed a state where the Login Security Policies page could not be saved when the excluded special characters setting was enabled without a value.
• Fixed Enterprise IP restrictions treating limits containing zero incorrectly.
• Fixed the inactive-user control appearing without working functionality in the Free edition.
• Fixed device policy labels that could move the browser to the bottom of the page or respond inconsistently when clicked.
• Fixed out-of-range numeric policy values being accepted when settings were submitted outside the browser validation.
• Fixed an administrator email being sent after terminating an unrecognized-device session when that notification was disabled.
• Fixed the Do not auto-generate a new password on reset option remaining enabled after it was unchecked.
• Fixed disabled user-unlock and multiple-session emails continuing to be sent.
• Fixed the manual inactive-user check returning incorrect feedback and logging an undefined variable warning.
• Fixed a fatal PHP error on PHP 8 when a custom login URL was configured.
• Fixed a fatal PHP error during password reset when password recycle policies were disabled and the password history value was empty or non-numeric.
• Fixed later lock policies overwriting the original reason for an existing manual, inactivity, or failed-login lock.

2.3.0 (2026-01-26)

New features

• Added a new feature to manually lock users and prevent them from logging in.
• Added a new setting in the Temporary logins setting to exclude temp users from 2FA enforcement.
• Implemented a custom plugin deactivation form to assist with user feedback collection.
• Implemented a new setting that allows admins to control the number of password reset emails sent on login attempts to user with expired passwords.

Plugin improvements

• Added a new feature to manually lock users and prevent them from logging in.
• Added a new setting in the Temporary logins setting to exclude temp users from 2FA enforcement.
• Implemented a custom plugin deactivation form to assist with user feedback collection.
• Implemented a new setting that allows admins to control the number of password reset emails sent on login attempts to user with expired passwords.

Bug fixes

• Fixed: A visual bug affecting Reports page when there are no users present in the tabs.
• Fixed: A variety of user-reported PHP warnings Warning: Attempt to read property “ID” on false inside /class-failed-logins.php.
• Fixed: User exclusion dropdown on Settings page now correctly extracts user suggestion while typing.
• Fixed: an edge case where unlocked users with WP 2FA could login without required password reset.
• Fixed: Fixed a few bugs related to the “Reset all users” feature affecting email deliverability of password reset emails.
• Fixed: a user-reported Fatal error: Uncaught TypeError: strtotime(): inside /app/class-melapress-login-security.php on line 497.
• Fixed: {reset_url} tag now correctly generates password reset URL in email templates.
• Fixed: Password expiry notice showing again after dismissal when “show again” option is disabled.

2.2.1 (2025-11-19)

Plugin & functionality improvements

• Improved handling of banner display logic to ensure consistent behavior throughout the campaign window.
• Updated plugin’s admin bar icon (correct size, alignment, and colors).
• Added the Black Friday campaign banners.
• General code and stability improvements.

Bug fixes

• Fixed a login check issue in class-failed-logins.php.
• Fixed a number of authentication conflicts with WP Cerber plugin ensuring full compatibility.
• Fixed a number of PHP warnings in class-thirdparties.php, class-check-user-expiry.php, and class-device-detection.php.
• Fixed a number of additional minor warnings reported in certain specific environments.

2.2.0 (2025-07-15)

Security fix

• Fixed a security vulnerability reported by Kr0d.

Plugin & functionality improvements

• Adjusted all emails sent by the plugin to include the new Melapress logo.
• Added more UI/UX elements to better assist the site admin during plugin configuration (e.g. Policies per role tabs).
• Added Various code sanitization checks and adjustments throughout the plugin for improved overall security.

Bug fixes

• Fixed a few logic errors that could cause “Reset all users” passwords to malfunction when certain password policies were enabled.
• Fixed a bug that caused custom role policies to not be enforced correctly and instead use the “site-wide” policies.
• Fixed the “Delete” button which was not working in the list of temporary login users.
• Fixed an issue with bulk-sending password resets from the Users page, which could have bypassed plugin policies that disallow initiating password resets.
• Fixed a user-reported 503 HTTP that could occur when password resets were initiated.
• Fixed a user-reported PHP error that could occur when editing pages on specific site/server setups.
• Fixed a bug that prevented WordPress native error messages from being hidden when the login URL had been changed.
• Fixed a user-reported bug in which users were unable to reset their password even when the disallow password resets option was disabled on a multisite network.
• Fixed an issue where the password recycling feature was not enforced on the WooCommerce password update form unless site-wide policies were active.
• Fixed a scenario that caused users excluded from all password policies to be unable to initiate a password reset.
• Fixed the aesthetics of the password policies list inside the LearnDash registration form.
• Fixed a bug that could cause the “Reset password on next login” option to not be enforced correctly for some users.
• “Restrict login based on email address or username only” now works as expected when enforced for certain roles – previously was only working as expected when used as a site-wide policy.
• Fixed support for Easy Digital Downloads forms—now fully compatible with the latest version of Easy Digital Downloads.
• Revisited all third party supported plugins and made small visual tweaks (alignment fixes, display errors etc).

2.1.1 (2025-04-07)

Plugin improvements

• Users excluded from the policies are now also exempt from Security Questions enforcement.
• Users with an expired password can now log in if the password expiry policy is disabled after their password is expired.
• Improved Temporary Logins UI with a more compact layout.
• Strengthened the overall code security by adding additional nonce and capability checks across the plugin.

Security fix

• Fixed a vulnerability reported by Wordfence: Missing authorization leading to unauthenticated arbitrary temporary user deletion.

Bug fixes

• Resolved a UI issue in the calendar view for the Temporary Logins custom expiry date filter.
• Fixed a bug that prevented the “Hide WordPress native errors on login form” feature from working correctly when the login URL was changed or when running on a multisite network.
• Multisite: Addressed PHP errors that occurred when certain plugin cron jobs were executed.
• Multisite: Addressed a bug which was causing the “User notification templates” page to be hidden on certain site setups.
• Fixed a bug preventing “Disallow old passwords” feature to work on 3rd party forms, unless “Password policies” are globally active in plugin settings.
• Fixed an internal plugin conflict between “Disallow old passwords” feature and Temporary logins, which in some edge cases could prevent new Temporary logins to be made

2.1.0 (2025-03-27)

New features

• Create temporary Logins without passwords: easily create temporary users and login links to allow users to easily access your website temporarily.
• Plain Text Email Option: Added a setting to switch all plugin email templates to plain text, stripping out all styling and HTML code.
• Customizable failed WordPress login notification: Added an option to override the default WordPress error messages for incorrect usernames or passwords for improved security.

Plugin improvements

• Improved the file validation checks when importing users for password resets from a file (txt or csv).
• All the plugin emails have a new Melapress branded theme (this can be disabled by enabling the option to send plain text emails).
• Added a new variable tag {remaining_time} which can be used in user notification templates to show how long a user is locked for.
• Improved the processing and saving of data within the plugin for better performance.
• Third-party plugin checkboxes in the Forms and Placements page are now grayed out if the relevant plugin is not installed.
• Updated the links and imagery on several plugin pages.
• Improved the code to improve performance and user processing speed on multisite networks.
• The Import/Export feature now includes all the custom email and message templates.

Security fix

• Fixed a vulnerability reported by Phan Trong Quan from VNPT Cyber Immunity.

Bug fixes

• Fixed a number of cursor focus problems on certain elements within the Settings page.
• Fixed an issue in which the correct number of remaining questions was not displayed or updated properly.
• Resolved a bug preventing answers from being saved if the required number of answers wasn’t met.
• Fixed a bug where the system information file was not being generated properly on multisite networks.
• Resolved a conflict between failed login policies and the “Reset password on first login” feature.
• Fixed an issue where password expiration policies could not be disabled in some edge cases.
• Auto populate did not work in the users filter field in “reset all passwords” form when the password policies were disabled.
• Fixed various PHP deprecation notices and warnings in different parts of the plugin to better support the most recent versions of PHP.
• Resolved an issue where users were marked as inactive despite the inactivity policy not being enabled.
• Added a number of checks to prevent multiple weekly email summaries from being sent with the wrong year.
• Fixed a bug where the global password reset feature was blocked by conflicting plugin policies.

2.0.2 (2025-01-07) – Premium edition only

Plugin features improvements & enhancements

• Introduced a new {remaining_time} shortcode in the “User Notification Templates” tab. This can be used to notify users of the remaining time before they are automatically allowed from logging in (Failed Logins policies).
• Updated Freemius SDK to version 2.11.0.
• Repositioned the “Reset all users” button to its original, more visible location, ensuring accessibility even when plugin policies are disabled.

Bug fixes

• Fixed issues with certain plugin input labels being incorrectly named.
• Resolved a bug where the Summary email was sent with an incorrect year date.
• Multisite Fix: Addressed a bug with the “disable password reset links” feature, which allowed some users to initiate a password reset from the frontend.
• Fixed a bug in the Professional (legacy license plan) and Premium plan in which users were unable to view the “User notification template” page in the Settings.

2.0.1 (2024-12-10)

New feature

• Added a setting to the login time restrictions feature that terminates user sessions when the allowed login time period expires.

Plugin improvements

• Various UI and text improvements to policies / reset all passwords area.
• * WP 2FA + Unrecognised Device policies now operate in harmony, enforcing only after 2FA has been passed.

Bug fixes

• Fixed bug which caused expired user logins to count as a failure.
• Fixed potential error caused on specific custom password-less registration methods.
• Fixed bug which stopped multiple users from being unlocked at once.
• Fixed formatting of email templates.
• Summary email: fixed ‘random’ readout of year.
• Fixed some small PHP deprecation warnings.

2.0.0 (2024-11-05)

New features

• Security questions: require users to configure security questions that can be used to verify users when resetting passwords and unlocking user accounts, thus the website administrator does not need to be involved.
• Unrecognized devices policy: users will be alerted via email each time there is a login with their username from a device that was not used before, and are also given the option to remotely log out that session.
• IP address restriction setting for the login page: restrict access to the login page by IP address(es).
• Session cookies settings: configure the expiration time of the WordPress session cookies, including those used when the user checks the “Remember me” option in the login page.
• Added the shortcode mls_user_password_expiry_notice so admins can add the password expiry notice on custom user portals etc.
• Added the hook mls_user_set_as_inactive that can be used when a user’s account is disabled by the Inactive users policy.
• Setting to restrict logins by either username or email address only. By default you can login to WordPress by using any.
• New option in the “Reset all passwords” feature that requires all users to change their password on their next login, instead of resetting the passwords of all users and sending them an email. This is mostly used for users who do not / cannot receive emails to reset their passwords.
• Setting to disable the built-in WordPress password auto suggestion when resetting or changing the password.
• Setting in the “Password expiration policy” to configure when the user should be notified of the password expiration date after dismissing the notification.
• Added out-of-the-box support for Easy Digital Downloads and ProfilePress; enforce the login and password policies on these plugins’ forms with just one-click.
• Added a “Last login time” column in the users’ page, giving the admin an easy overview of users’ login activity.

Plugin improvements

• Generic / overall code updates and enhancements – ensuring code adheres to the WordPress coding standards, added comments where needed, improved nonce checks and much more.
• Applied several coding updates that result in noticeable overall better plugin performance and resources usage.
• Every password policy can now be enabled / disabled individually, rather than all together.
• Reorganized the order of the policies in the settings, and grouped the password, user account and login policies.
• Updated all the prefixes in the plugin’s code and also in the settings to MLS_. Included a manual updating process to handle the update.
• Improved overall support for Paid Membership Pro.
• Standardized the spacing, help text placement and settings’ layout for a more uniform and easy to use UI.
• All emails the plugin uses are now available as templates that can be edited.
• Moved all wp_mail functions to a single emailer class.
• Added a default value to the “password expiry” notification setting.
• Updated several strings / help text in the plugin for better explanation and guidance for users.
• Added a default notification for when the sending of password reset links is disabled.
• Updated the email and notifications templates section; separated the notifications from the email templates, making it much easier for the user to edit them.
• Updated the default email and notification templates.
• Bumped up the minimum version of PHP to 7.3.

Bug fixes

• Fixed the check for password expiry emails – in some cases plugin was sending multiple emails to users.
• Fixed: Excluded user with admin role still locked due to inactive users policy.
• Fixed: Conflict with WP Engine MU plugin – WP Engine’s plugin does not account for an error if passed to it even if the hook returns both WP_User and WP_Error.
• Fixed: plugin was not considering the full stop character, and other characters as a special character in passwords (had a specific hardcoded list).
• Fixed: Locked users page was not showing up when using a Professional plan license.
• Fixed: Upgrade admin notice not showing up in a multisite environment.
• Fixed: Login page consent / GDPR notification shows in the login page after migration even when the setting is disabled.
• Fixed: weekly summary email reports new users as having reset their passwords.
• Fixed an edge case in which a just unlocked user cannot log in to the multisite network due to too many redirects error.
• Fixed: multiple password policies settings changes not saved when one of the changes is to set the password minimum length policy to 5.
• Fixed: failed login attempts was adding up the failed logins of multiple users when they are logging in from the same IP address, resulting in locked accounts that should have not been locked.
• Fixed: several issues with enforcing password policies on WooCommerce pages, and also improved the logic of when specific notifications should be shown on WooCommerce pages.
• Fixed: Password history feature was allowing some of the old passwords to be reused in some edge cases.
• Fixed a PHP fatal error in class-optionshelper.php which was caused when upgrading from a much older version of the plugin to the most recent one.

Previous versions changelog:

Version 1