Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)

Changelog

9.4.0

• Improvement: More detailed feedback when using CLI commands.
• Improvement: On activation, detect EXTENDIFY_PARTNER_ID constant and run wp rsssl activate_recommended_features.
• Improvement: Standardize RSS onboarding hoster list to brand names.
• Verbetering: “Gebruikersopsomming uitschakelen” retourneert nu 401 Unauthorized (in plaats van 404 Not Found) voor niet-geauthenticeerde aanvragen naar het /wp/v2/users/ endpoint.
• Include SimplyBook in “onboarding” and “other plugins” sections.
• Fix: Adjust plugin initialization timing to prevent a textdomain warning.
• Fix: Fixed the feedback when an email is resend during Two-Factor Authentication setup.
• Fix: Fixed the Single Sign on link to support custom login urls.

9.3.5

• April 29th, 2025
• Improvement: Tested up to WordPress 6.8
• Improvement: Some translation updates
• Improvement: Check for autoloader in cron
• Fix: 2FA methods can now be set on profile page

9.3.3

• April 2nd, 2025
• Improvement: Added multiple WP-CLI commands to better align with recent plugin features
• Verbetering: ondersteuning toegevoegd voor aangepaste/meerdere rollen in twee-factor authenticatie

9.3.2.1

• March 20th, 2025
• Fix: Properly handle unknown plugins in upgrade requests, preventing unintended behavior.

9.3.2

• March 5th, 2025
• Improvement: Added filters to customize Let’s Encrypt Wizard behavior
• Fix: Removed default checkbox behavior from configuration settings.
• Fix: Handle multiple tooltip reasons for disabled select fields

9.3.1

• February 12th, 2025
• Improvement: Not able to use email needed functions when email is not yet verified.
• Fix: All instruction links are now correct.
• Oplossing: ongedefinieerde array sleutel “m” bij het tonen van kwetsbaarheidsdetails.
• Fix: Prevent errors when downgrading to free.
• Fix: Compatibility between 2FA and JetPack “Log in using WordPress.com account” setting

9.2.0

• January 20th, 2025
• Fix: Added nonce check to certificate re-check button.
• Fix: In some cases the review notice was not properly dismissible.

9.1.4

• Improvement: do not track 404’s for logged in users
• Improvement: implemented the rsssl_wpconfig_path filter in all wp-config functions
• Improvement: Faster onboarding completion after clicking Finish button
• Improvement: CSS. Shields in user interface on datatables are no longer cut off

9.1.3

• November 28th
• Improvement: Width Vulnerabilities -> configuration
• Verbetering: 2Fa uitsluiting bericht
• Verbetering: gebruik van short init in advanced-headers bestand opvangen
• Improvement: string improvements and translator comments
• Verbetering: Bitnami ondersteuning voor rsssl_find_WordPress_base_path()
• Verbetering: sitediagnose meldingen integreren met Solid Security
• Improvement: Enhanced random password generation in Rename Admin User feature
• Improvement: Always return string in wpconfig_path() function
• Improvement: Removes configuration options for a user in edit user.
• Fix: Remove duplicate site URL.
• Fix: ensure rsssl_sanitize_uri_value() function always returns a string, to prevent errors.
• Fix: multisite users who have enabled roles couldn’t use the 2fa if an other role than theirs has been forced.
• Fix: The ‘Skip Onboarding’ button presented an undefined page after selecting the email method as an option.
• Fix: Update translation loading according to the new 6.7 method.

9.1.2

• security: authentication bypass

9.1.1.1

• November 5th, 2024
  *Improvement: updated black friday dates

9.1.1

• November 5th, 2024
• Improvement: setting a rsssl-safe-mode.lock file now also enables safe mode and deactivates the Firewall, 2FA and LLA for debugging purposes.
• Improvement: update to system status
• Improvement: textual changes
• Improvement: Updated instructions URLs
• Verbetering: berichten over de sitediagnose gewijzigd van kritiek naar aanbevolen
• Improvement: dropped obsolete react library
• Fix: fixed a bug where the 2FA grace period was kept active after a reset

9.1.0

• October 22nd
• Improvement: Allow scanning for security headers via http://scan.really-simple-ssl.com with one click
• Improvement: Remove unnecessary rsssl_update_option calls.
• Fix: prevent potential errors with login feedback..
• Fix: Catch type error when $transients is not an array.

9.0.2

• Fix: issue with deactivating 2fa

9.0.0

• September 16th
• Fix: Instructions URL in the Firewall settings.
• Fix: Fixed incorrect instructions URL
• Fix: Let’s Encrypt returning an old certificate on auto-renewed certificates
• Verbetering: omdat de X-Frame-Options is verouderd en vervangen door frame voorouders, laten we de header als aanbeveling vallen.
• Improvement: save and continue in vulnerabilities overview not working correctly

8.3.0.1

• Fix: Issues with the decryption model

8.3.0

• August 12th, 2024
• Feature: Password security scan. This feature scans your users for weak passwords, and allows you to enforce non-compromised passwords.
• Fix: Fixed some strings that were not translatable. This has been resolved.
• Fix: Premium support link did not work. Now links to the correct page.
• Verbetering: schakel de cron planningen uit bij deactivering.
• Fix: Links in emails were sometimes not correct. This has been fixed.
• Fix: Fatal error on permission detection. This has been resolved.
• Improvement: Custom header for the license checks for better compatibility with some hosting environments.
• Verbetering: optie toegevoegd om X-powered-by header uit te schakelen.
• Improvement: New improved encryption method for some settings.

8.1.5

• June 21th, 2024
• Fix: documentation links to website broken
• Improvement: some text changes in helptexts
• Improvement: new structure to upgrade database tables

8.1.4

• June 11th, 2024
• Improvement: dropdown in onboarding not entirely visible
• Improvement: Styling of locked XML RPC overview
• Fix: Not loading cookie expiration change
• Oplossing: Visual Composer compatibiliteit icw Sterk wachtwoord afdwingen
• Fix: Multiple CloudFlare detected notices in onboarding
• Fix: Checkbox position in onboarding

8.1.3

• May 16th, 2024
• Oplossing: WP Rocket compatibiliteit veroorzaakt een probleem als advanced-headers.php niet bestaat

8.1.2

• May 16th, 2024
• Oplossing: upgrade het bestand advanced-headers.php zodat het bestand eerder kan worden opgenomen. De ABSPATH gedefinieerde controle veroorzaakt problemen bij vroege opname en moet daarom worden verwijderd.

8.1.1

• May 14th, 2024
• New: detection of non-recommended permissions on files
• New: Configure region restrictions for your site
• Improvement: Textual change on premium overlay
• Improvement: Upgraded minimum required PHP version to 7.4
• Improvement: compatibility with Bitnami
• Verbetering: compatibiliteit van Limit Login Attempts met WooCommerce
• Improvement: remove duplicate X-Really-Simple-SSL-Test from advanced-headers-test.php
• Improvement: clear notice about .htaccess writable if do_not_edit_htaccess is enabled
• Fix: upgrade from <6.0 version to >8.0 causing a fatal error
• Fix: URL to details of detected vulnerabilities was incorrect

8.1.0

• Improvement: some string corrections
• Fix: show ‘self’ as default in Frame Ancestors
• Improvement: catch not existing rsssl_version_compare
• Verbetering: controleer op het bestaan van openSSL modules
• Improvement: set default empty array for options, for legacy upgrades
• Improvement: disable custom login URL when plain permalinks are enabled
• New: Limit Login Attempts Captcha integration
• Improvement: drop renamed folder notice, not needed anymore
• Improvement: enable advanced headers in onboarding
• Improvement: is_object check in updater

8.0.1

• Fix: enable 2FA during onboarding when not selected by user
• Improvement: better CSP defaults
• Fix: on upgrade to pro, free settings were cleared if “clear settings on deactivation” was enabled
• Fix: catch several array key not existing errors

8.0.0

• New: hide remember me checkbox
• New: extend blocking of malicious admin creation to multisite
• Verbetering: prefetch-src verwijderen uit content beveiligingsbeleid
• Verbetering: two-fa uitschakelen wanneer login beveiliging is uitgeschakeld

7.2.8

• Fix: clear cron schedules on deactivation
• Improvement: translations update
• Notice: inform users about upcoming merge of free and pro plugin, not action needed, everything will be handled automatically

7.2.7

• Improvement: added integration with FlyingPress and Fastest Cache
• Improvement: fix exiting a filter, causing a compatibility issue with BuddyPress

7.2.6

• Improvement: text changes
• Improvement: css on login error message
• Improvement: header detection improved by always checking the last url in the redirect chain
• New: Added option to limit login cookie expiration time
• Fix: custom 404 pages i.c.w. custom login url

7.2.5

• Fix: IP detection header order
• Oplossing: tabel aanmaak bij activeren van LLA module

7.2.4

• Fix: PHP warning in Password Security module
• Fix: change login url feature not working with password protected pages
• Improvement: move database table creation to Limit Login Attempts module
• Improvement: prevent php error caused by debug.log file hardening feature

7.2.3

• Fix: CSP data not showing in datatable

7.2.2

• Improvement: improved check for PharData class

7.2.1

• Fix: Config for CSP preventing Learning mode from completing
• Fix: datatable styling
• Fix: using deactivate_https with wp-cli did not remove htaccess rules
• Improvement: add query parameter to enforce email verification &rsssl_force_verification
• Improvement: css for check certificate manually button

7.2.0

• Fix: changed link to article
• Fix: remove flags .js file which was added twice, props @adamainsworth
• Oplossing: typfout in ontbrekend bericht advanced-headers.php
• Verbetering: vang PHP waarschuwing op wanneer script src leeg is bij gebruik van verborgen wp versie, props @chris-yau
• Improvement: new save & continue feedback
• Improvement: datatable styling
• Improvement: new react based modal
• Improvement: menu re-structured
• Improvement: re-check vulnerability status after core update
• Improvement: link in the email security notification to the vulnerability page instead of to a general explanation

7.1.3

• October 11th 2023
• Fix: React ErrorBoundary preventing Let’s Encrypt generation to complete.

7.1.2

• October 6th 2023
• Fix: hook change in integrations loader causing modules not to load. props @rami5342

7.1.1

• October 5th 2023
• Fix: incorrect function usage, props @heutger

7.1.0

• October 4th 2023
• Verbetering: detectie of het bestand advanced-headers.php actief is

7.0.9

• September 5th 2023
• Improvement: typo update word
• Improvement: translatability in several strings.

7.0.8

• August 8th 2023
• Improvement: WordPress tested up to 6.3
• Improvement: improve file existence check json
• Fix: handling of legacy options in php 8.1
• Fix: count remaining tasks

7.0.7

• July 25th 2023
• Verbetering: modal icoon plaatsing in wizard op kleinere schermen
• Verbetering: gedetecteerde headers in de cache verlopen vijf minuten na het opslaan van de instellingen
• Fix: handling of legacy options in php 8.1
• Fix: prevent issues with CloudFlare when submitting support form from within the plugin
• Oplossing: vertalingen enkelvoud/meervoud voor Japanse vertalingen @maboroshin

7.0.6

• July 4th 2023
• Improvement: support custom wp-content directory in advanced-headers.php
• Improvement: prevent usage of subdirectories in custom login url
• Oplossing: vertalingen laden niet voor chunked react componenten
• Verbetering: optie toevoegen om kwetsbaarheden handmatig opnieuw te controleren ‘&rsssl_check_vulnerabilities’, props @fawp

7.0.5

• Fix: some users with a non www site reporting issues on the login page over http://www, due to the changes in the wp redirect. Reverting to the old method. props @pedalnorth, @mossifer.

7.0.4

• June 14th 2023
• Improvement: notice informing about the new free vulnerability detection feature
• Improvement: improved the php redirect method
• Verbetering: maak het bericht wp-config.php niet schrijfbaar negeerbaar
• Fix: feedback on hardening features enable action not showing as enabled, props @rtpHarry

7.0.3

• Fix: fix false positives on some plugins
• Improvement: vulnerability notifications in site health, if notifications are enabled.

7.0.2

• Improvement: improve matching precision on plugins with vulnerabilities.

7.0.1

• Oplossing: als de Rest API niet beschikbaar is, moet de Ajax fallback in werking treden, wat niet correct werkte in 7.0. Props @justaniceguy

7.0.0

• New: Vulnerability Detection is in Beta – Read more or Get Started
• Improvement: move onboarding rest api to do_action rest_route
• Improvement: catch several edge situations in SSL Labs api
• Improvement: SSL Labs block responsiveness
• Improvement: more robust handling of wp-config.php detection

6.3.0

• Improvement: added support for the new Let’s Encrypt staging environment

6.2.5

• Verbetering: optie voor waarschuwingswaarschuwing toevoegen
• Fix: capability mismatch in multisite. props @verkkovaraani

6.2.4

• Improvement: optionally enable notification emails in onboarding wizard
• Improvement: onboarding styling
• Fix: catch non array value from notices array, props @kenrichman
• Oplossing: typfout in documentatielink, props @bookman53

6.2.3

• Improvement: Changed Back-end react to functional components
• Improvement: multisite notice should link to network admin page
• Verbetering: bestaande CAA records detecteren om compatibiliteit met Let’s Encrypt te controleren
• Improvement: tested up to wp 6.2
• Improvement: UX improvement learning mode

6.2.2

• Fix: capability mismatch for a non administrator in multisite admin, props @jg-visual

6.2.1

• Fix: race condition when activating SSL through wp-cli, because of upgrade script
• Fix: missing disabled state in textarea and checkboxes
• Fix: some strings not translatable
• Fix: Let’s Encrypt renewal with add on
• Improvement: permissions check re-structuring
• Improvement: notice on subsite within multisite environment about wildcard updated

6.2.0

• New: optional email notifications on advanced settings
• Improvement: added tooltips
• Verbetering: waarschuwingen toegevoegd voor .htaccess omleiding
• Improvement: don’t send user email change on renaming admin user, as the email doesn’t actually change
• Improvement: Use BASEPATH only for wp-load.php, so symlinked folders will load based on ABSPATH
• Improvement: Improved support for environments where Rest API is blocked

6.1.1

• Oplossing: WP CLI voltooit SSL niet wanneer de optie site_has_ssl niet is ingesteld als de site nog niet eerder is bezocht, props @oolongm
• Improvement: prevent ‘undefined’ status showing up in api calls on settings page
• Improvement: show notice if users are using an <2.0 Let’s Encrypt shell add-on which is not compatible with 6.0

6.1.0

• Improvement: some UX changes
• Verbetering: beperk het aantal berichten in het dashboard
• Verbetering: Rest Api aanvraag URL over https laden als site over https wordt geladen
• Fix: empty menu item visible in Let’s Encrypt menu

6.0.14

• Fix: settings page when using plain permalinks, props @mvsitecreator, props @doug2son

6.0.13

• Verbetering: verbeteren methode voor het neerzetten van lege menu-items in instellingen dashboard
• Verbetering: dynamische links in auto installer
• Verbetering: let’s Encrypt Auto installer werkt niet goed, props @mirkolofio
• Improvement: change rest_api method to core wp apiFetch()
• Improvement: scroll highlighted setting into view after clicking “fix” on a task
• Improvement: run http method test in batches, and set a default, to prevent possibility of curl timeouts on systems with CURL issues
• Verbetering: code-execution.php bestand opschonen na test, props @spinhead
• Verbetering: geef een melding als ‘DISABLE_FILE_EDITING’ is ingesteld op false in de wp-config.PHP props @joeri1977
• Improvement: drop some unnecessary translations
• Improvement: set better default, and change transients to option for more persistent behavior in wp version test, props @photomaldives
• Fix: Burst Statistics not activating after installation
• Fix: CSS for blue labels in progress dashboard below 1080px
• Oplossing: WPCLI SSL activering werkt niet vanwege capaciteitscontroles, props @oolongm
• Fix: catch invalid account error in Let’s Encrypt generation, props @bugsjr
• Fix: do not block user enumeration for gutenberg

6.0.12

• Fix: on multisite, the test for users with admin username did not use the correct prefix, $wpdb->base_prefix, props @jg-visual
• Verbetering: submenu toestaan in back-end react toepassing
• Improvement: Skip value update when no change has been made
• Improvement: no redirect on dismiss of admin notice, props @gangesh, @rtpHarry, @dumel
• Improvement: remove obsolete warning
• Improvement: qtranslate support on settings page

6.0.11

• Fix: on some environments, the HTTP_X_WP_NONCE is not available in the code, changed logged in check to accomodate such environments
• Fix: dismiss on admin notices not immediately dismissing, requiring dismiss through dashboard, props @dumel

6.0.10

• Fix: Apache 2.4 support for the block code execution in the uploads directory hardening feature, props @overlake
• Oplossing: bij gebruik met Varnish cache werden Rest API get aanvragen in de cache geplaatst, waardoor de instellingenpagina niet werd geüpdatet.
• Fix: Ensure manage_security capability for users upgraded from versions before introduction of this capability
• Fix: allow for custom rest api prefixes, props @coderevolution
• Fix: bug in Let’s Encrypt generation with DNS verification: saving of ‘disable_ocsp’ setting, create_bundle_or_renew action with quotes
• Fix: change REST API response method to prevent script errors on environments with PHP warnings and errors, causing blank settings page
• Improvement: Simplify user enumeration test
• Verbetering: vang onverwachte reactie op in SSL Labs object
• Improvement: z-index on on boarding modal on smaller screen sizes, props @rtpHarry
• Verbetering: gebruikersnaam veld verbergen als er geen beheer gebruikersnaam aanwezig is, props @rtpHarry

6.0.9

• Fix: incorrectly disabled email field in Let’s Encrypt wizard, props @cburgess
• Improvement: on rename admin user, catch existing username, and strange characters
• Verbetering: vang openBaseDir beperking op in cpanel detectiefunctie, props @alofnur
• Improvement: remove 6.0 update notices on subsites in a multisite network, props @wpcoderca, (@collizo4sky

6.0.8

• Improvement: Lets Encrypt wizard CSS styling
• Improvement: re-add link to article about Let’s Encrypt so users can easily find the URL
• Improvement: let user choose a new username when selecting “rename admin user”

6.0.7

• Fix: restrict conditions in which htaccess rewrite runs, preventing conflicts with other rewriting plugins

6.0.6

• Fix: drop upgrade of .htaccess file in upgrade script

6.0.5

• Fix: race condition in .htaccess update script, where multiple updates simultaneously caused issues with the .htaccess file

6.0.4

• Oplossing: het gebruik van de .htaccess omleiding in combinatie met de blok code uitvoering in uploads veroorzaakt een probleem in de .htaccess omleiding
• Fix: deactivating Really Simple SSL does not completely remove the wp-config.php fixes, causing errors, props @minalukic812

6.0.3

• Fix: Rest Optimizer causing other plugins to deactivate when recommended plugins were activated, props @sardelich

6.0.2

• Fix: do not show WP_DEBUG_DISPLAY notice if WP_DEBUG is false, props @janv01
• Fix: empty cron schedule, props @gilvansilvabr
• Improvement: several typo’s and string improvements
• Fix: auto installer used function not defined yet
• Fix: rest api optimizer causing an error in some cases @giorgos93

6.0.1

• Fix translations not loading for scripts

6.0.0

• Getest tot en met WordPress 6.1.0
• Improvement: User Interface
• New: Server Health Check – powered by SSLLabs
• New: WordPress Hardening Features