Private Website – Login Required

0.3.2

• Bugfix: Serve uploaded media files directly using PHP when user is logged in (prevents 404/broken images caused by .htaccess redirection).

0.3.1

• Security: Block wp-comments-post.php for non-logged-in users (bypassed template_redirect).
• Security: Block wp-admin/admin-post.php for non-logged-in users (prevents nopriv form actions).
• Security: Block wp-mail.php for non-logged-in users.
• Compatibility: Dynamic uploads path detection — supports custom content directories.
• Compatibility: AJAX whitelist is now filterable via private_website_allowed_ajax_actions (for 2FA plugins etc.).
• Compatibility: XML-RPC disable is now filterable via private_website_xmlrpc_enabled (for Jetpack etc.).
• Compatibility: Updated “Tested up to” for WordPress 7.0.
• Compatibility: Raised minimum PHP version to 7.4 (matching WordPress 7.0 requirements).

0.3.0

• Security: Protect direct access to uploaded files (images, PDFs, videos) via .htaccess in uploads directory.
• Security: Restrict REST API access to authenticated users only (prevents data leaking via /wp-json/).
• Security: Disable XML-RPC completely (prevents brute-force attacks and content leaking via xmlrpc.php).
• Security: Block RSS/Atom feeds for non-logged-in users (prevents content leaking via /feed/).
• Security: Restrict AJAX requests to a whitelist of allowed actions for non-logged-in users.
• Security: Disable XML sitemaps for non-logged-in users to prevent site structure leaking.
• Security: Make robots.txt fully restrictive (Disallow: /) to prevent search engine indexing.
• Improvement: Creates a self-contained .htaccess in wp-content/uploads/ instead of modifying the root .htaccess.
• Improvement: Show admin notice when .htaccess cannot be created or when Nginx is detected.
• Improvement: Clean up .htaccess on plugin deactivation. Supports subdirectory installs.

0.2.9

• Ask for Appsero consent again after each admin login until consent is granted (re-prompts post-login).

0.2.8

• Show tracking status badge directly in the plugin description (Plugins screen).

0.2.7

• Add opt-in/out action link directly in the Plugins screen for this plugin (enables/disables Appsero tracking).