Free 1.1.0 (current release)
New
- See how your security score changes over time.
- Security holes that hackers are actively using are now flagged and shown first, so you know what to fix today.
- Undo button. Your last 10 settings changes are saved, and you can undo any of them with one click.
- Optional safety net. If a settings change breaks your site, the plugin can put it back for you.
- Switching from Wordfence, Solid Security or All In One WP Security? Bring your login settings with you.
- A page that shows which other security plugins you have and where they do the same job.
- Locked out? Users can ask for an unlock email. And an "Add my IP" button helps you never block yourself.
- Try risky settings safely first with Test Mode, and try new firewall rules for a day before they block anyone.
- Connect ChatGPT, Claude or Cursor so they can answer questions about your site's security. Read only, off until you turn it on, and you can disconnect any time.
- Find hidden text on your site that tries to trick AI tools, and remove it safely. Off until you turn it on.
- See which AI bots visit your site. Off until you turn it on.
- "Explain" and "Ask your AI" buttons turn security messages into plain language. Private details are removed first.
- Agencies using MainWP see more about each site, like the score trend and serious security holes.
Fixed
- A vulnerability scan no longer gets stuck.
- Password confirmation works smoothly when you install or delete plugins and themes, or create app passwords.
- Lockouts are counted correctly in reports.
- Turning off AI app sign-in always disconnects every app.
- AI tools get less private information, such as full IP addresses.
- A technical notice that some sites saw on WordPress 6.7 and later is gone.
Improvements
- Fewer false alarms on the Troubleshoot page.
- Admin pages load faster.
Free 1.0.42
New
- Security Fixes page. Everything that needs attention, most serious first, with fixes you can preview before they run.
- Security Events page. Recent sign-ins, failed sign-ins, lockouts and other security events from the last day or week, with search.
- Application Passwords page. See every application password, who owns it and when it was last used, and remove any you do not recognise. You can turn them off for the whole site or for chosen roles.
- Confirm Risky Actions (off by default). Asks for your password before important changes, such as installing plugins or adding an Administrator.
- API & Agent Access page. See which apps and AI tools can reach your site, and which plugin opened each way in.
- Security Baseline. Save your settings as "how the site should be" and see any setting that changes later.
- Outbound Connections (off by default). See which outside services your plugins talk to, and spot one you do not expect. Nothing is blocked.
- Troubleshoot page. Checks the things your security features need, such as scheduled tasks and emails, and shows a plain fix for anything that is not working.
- Optional access for AI tools (off by default). A connected AI tool can read your security summary and suggest fixes. It cannot make changes.
- Password managers now follow your password rules, and the "Generate password" button does too.
- The Users screen shows who has no two-factor and who is online now.
- Staging and local copies of your site are recognised, and alert emails pause there, so a copy never acts as your live site.
- When uninstalling, choose separately whether to remove settings, logs or users' two-factor setup.
Security
- Stronger protection for two-factor sign-in, with an email alert when someone keeps entering wrong codes.
- Changing your own two-factor settings may ask for a two-factor code first.
Fixed
- Two-factor sign-in works reliably on sites that use a cache such as Redis.
- Changing your custom login address no longer leaves visitors on an old page.
- Dismissed notices stay dismissed, and the support report keeps more private details out.
- The "vulnerability scan completed" email is sent once, not twice.
- Changing the Confirm Risky Actions settings now asks for your password, then saves.
Improvements
- Sign-ins and other security events are now kept in separate logs. Existing entries are moved automatically when you update.
- Settings pages warn you when another admin saved changes after you opened the page.
- The Uploads folder protection can now allow plugin and theme installs.
- The dashboard shows that a scan is still running.
- The header search and menus include all the new pages.
Also
- Important: users who sign in with two-factor can no longer use application passwords unless you allow it (Login → Two-Factor). If the WordPress mobile app, Jetpack or another app signs in as one of these users, turn that setting on after updating.