LC Anti-Spam Registration

1.4.20 (September 18, 2026)

• AUTHENTICATED MEMBER RATE-LIMIT EXEMPTION — Exempted is_user_logged_in() from check_request(), ensuring logged-in subscribers, customers, students, and community members browsing tabs or using real-time features (chat lounges, presence heartbeats) are never throttled or blocked.
• RATE LIMITING THROTTLE VS PUNITIVE 24-HOUR BLACKLIST — Eliminated permanent 24-hour IP blacklisting ($this->block_ip()) from request rate limiting. Breaches now return a clean, temporary HTTP 429 status with Retry-After: 60 and nocache_headers(), allowing visitors to resume access automatically once requests subside without administrative intervention. Permanent 24-hour IP blocks are strictly reserved for brute-force login attacks and manual admin bans.
• CLOUDFLARE & REVERSE PROXY IP RESOLUTION — Upgraded get_client_ip() to inspect HTTP_CF_CONNECTING_IP and HTTP_X_FORWARDED_FOR, preventing visitors behind Cloudflare or reverse proxies from sharing edge IPs and triggering shared false-positive blocks.
• REAL-TIME POLLING & HEARTBEAT SAFEGUARDS — Automatically exempted WordPress AJAX heartbeats (action === 'heartbeat') and background CLI/cron jobs, and raised default request threshold to 120 requests per 5-minute window for unauthenticated traffic.

1.4.19 (September 14, 2026)

• FLAGGED USER EMAIL VISIBILITY & FORENSIC REVIEW — Enhanced the Flagged Accounts review table to ensure administrators can always see and verify user emails before deciding to delete or safelist accounts.
• EXPLICIT “EMAIL MISSING” STATUS BADGE — Added a high-contrast warning badge (Email missing) when accounts have no registered email address in WordPress or metadata (e.g. legacy social/Facebook registrations without email scopes), eliminating confusing blank table cells.
• WOOCOMMERCE BILLING EMAIL FALLBACK — Added automatic fallback resolution from billing_email in usermeta with a dedicated billing source badge, preventing legitimate store customers from being mischaracterized as email-less accounts.
• CLICKABLE EMAIL & USER PROFILE INSPECTION — Formatted valid emails with clickable mailto: links with dashicons and made user display names clickable directly to /wp-admin/user-edit.php for instant forensic inspection.
• SENSEI LMS STUDENT & SOCIAL LOGIN DETECTION — Integrated account origin and LMS enrollment tracking (Enrolled (N courses), Social Login) directly into the review tags, protecting active students and social login members from accidental deletion.
• RETROSPECTIVE SCAN STUDENT IMMUNITY — Hardened check_existing_user() to exempt active Sensei LMS students and use effective billing emails during scans, eliminating false-positive flags on legitimate members.

1.4.18 (September 14, 2026)

• USER CACHE PRIMING COMPATIBILITY — Implemented canonical lcasr_prime_user_caches() cache priming helper, safely delegating to core _prime_user_caches() or falling back to cache_users() and update_meta_cache(). Resolves unhandled fatal error on live WordPress sites during full user directory scans.
• SCANNER MEMORY BOUNDING & CHUNK OPTIMIZATION — Replaced monolithic upfront cache priming in scan_all_users() with bounded chunking (100 users per batch) and per-record runtime memory eviction via clean_user_cache(), eliminating memory exhaustion crashes across high-capacity user directories.
• AJAX SCAN ERROR HANDLING HARDENING — Wrapped handle_manual_scan() and handle_manual_cleanup() in try / catch (\Throwable) blocks to return structured JSON error payloads, preventing raw HTTP 500 crashes and providing actionable admin notifications.

1.4.17 (September 13, 2026)

• IP RATE LIMITING, BRUTE FORCE & DYNAMIC FIREWALL HARDENING (PIPELINE 3) — Completed end-to-end audit and hardening of the request rate limiter, brute-force login monitor, and dynamic IP firewall engine.
• CRITICAL BRUTE-FORCE SECURITY LOOPHOLE CLOSED — Closed critical security flaw in handle_failed_login() where brute-force login attacks against administrator accounts were erroneously bypassed from failure counters. Untrusted IPs targeting administrator or regular accounts are now strictly tracked and blocked once the failure threshold is met.
• SUCCESSFUL AUTHENTICATION RESET — Added handle_successful_login() hook on wp_login to immediately purge transient failed-login attempts upon valid password entry, eliminating false-positive lockouts from previous typographical errors.
• IMMEDIATE 429 RESPONSES ON RATE-LIMIT FLOODS — Updated check_request() to immediately halt execution with HTTP 429 Too Many Requests status when the rate limit is exceeded, preventing abusive traffic from consuming server CPU rendering time.
• CRON & CLI EXECUTION SAFEGUARDS — Added execution safeguards to automatically exempt wp_doing_cron() and WP-CLI (WP_CLI) from rate-limiting and blocking.
• PUBLIC INSPECTION & UNBLOCK APIS — Converted is_ip_blocked(), block_ip(), and get_client_ip() to public APIs; implemented unblock_ip() and get_blocked_ips() for administrative control and contract test verification.
• DUAL HOOK EMISSION & EXEMPTION PARITY — Supported both lcasr_firewall_request_exempt and sad_firewall_request_exempt, and emit both lcasr_ip_blocked/sad_ip_blocked and lcasr_ip_unblocked/sad_ip_unblocked.
• AUTOMATED SECURITY EMAIL NOTIFICATION — Added administrative email alert dispatch via wp_mail() when option lcasr_notify_admin_brute_force is active and an attacker is blocked.

1.4.16 (September 13, 2026)

• ALGORITHMIC USERNAME ENTROPY & DISPOSABLE EMAIL DEFENSE (PIPELINE 2) — Completed full audit and hardening of the algorithmic username entropy and disposable inbox defense engines.
• SHANNON ENTROPY CALCULATION — Implemented calculate_entropy() computing information entropy H(X) in bits per character to mathematically distinguish machine-generated pseudo-random identifiers from genuine human choices.
• FALSE-POSITIVE HUMAN COMPOUND ELIMINATION — Fixed critical registration-blocking bug where legitimate human names and compound nouns (christopher, alexsmith, blacksmith, manchester, birmingham, strathmore, williamson) were erroneously denied registration due to broad consonant cluster boundaries. Refined heuristics with natural English trigraph detection (chr, str, tch, cks, mth, nch, ngh, etc.) and tightened vowel scarcity thresholds.
• DISPOSABLE EMAIL PROVIDER CATALOG & SUBDOMAIN MATCHING — Added get_disposable_email_domains() providing a comprehensive 40+ provider catalog with filter lcasr_disposable_email_domains and wildcard subdomain defense (*.mailinator.com, etc.).
• PRE-REGISTRATION DISPOSABLE EMAIL INTERCEPTION — Added proactive blocking in check_registration_limits() with lcasr_disposable_email_blocked audit action trigger before user records touch the database.
• SUSPICIOUS EMAIL STRUCTURE HEURISTICS — Hardened is_suspicious_email_structure() with sub-addressing abuse detection (+temp..., +987654321) and high-risk TLD pattern heuristics with filter lcasr_is_suspicious_email_structure.
• PCRE UNAMBIGUOUS CAPTURE GROUPS — Standardized regex backreferences to PCRE \g{1} and \g{2} syntax across doubled-vowel detector routines to eliminate string escape ambiguities across PHP versions.

1.4.15 (September 13, 2026)

• REGISTRATION BOT TRAP & BEHAVIORAL TIMING HARDENING (PIPELINE 1) — Fully audited and hardened the registration bot trapping and submission velocity verification engine.
• CRYPTOGRAPHIC ANTI-TAMPERING TIMING TOKENS — Injected server-signed verification tokens (wp_hash('lcasr_time_' . $start_time)) alongside registration timestamps to prevent malicious bots from forging past timestamps.
• WOOCOMMERCE & MULTISITE PROTECTION PARITY — Extended honeypot injection and human velocity verification hooks to woocommerce_register_form, woocommerce_process_registration_errors, and signup_extra_fields.
• ACCESSIBLE HONEYPOT MARKUP — Added hidden accessible <label> markup and filterable honeypot field names (lcasr_honeypot_field_name) for zero screen reader impact and customizable obfuscation.
• SCRAPER & HEADLESS BROWSER DETECTION — Expanded automated client blocking to intercept empty User-Agents and modern scraper frameworks (scrapy, aiohttp, headlesschrome) with filterable pattern overrides (lcasr_bot_ua_regex).
• THREAT AUDIT ACTION HOOKS — Added lcasr_honeypot_triggered, lcasr_registration_timing_failed, and lcasr_bot_ua_blocked action triggers for threat logging and Pro telemetry integration.
• REGISTRATION QUOTA BOUNDING — Capped in-memory registration tracking arrays to 500 items max to guarantee zero database option table bloat under high concurrency.
• DUAL BOOTSTRAP COMPATIBILITY HOOKS — Attached both lcasr_base_plugin_ready and sad_base_plugin_ready to guarantee instant synchronization with Pro add-ons and legacy integrations.