Security Ninja Premium v5.305 – WordPress Security Plugin & Firewall

* IMPROVED: German – The bundled translation now uses Du, the same terms throughout (Schwachstelle, Core-Scanner, Malware-Scanner, Korrekturen, Anmeldung), and the strings that were still English are translated.
* FIX: Tests – A wp-config.php moved one level above the WordPress root now scores as a pass. A file still in the root stays a warning. Thank you Robert.
* IMPROVED: Updated Freemius SDK to the latest version.
* NEW: Agent skill – SKILL.md in the plugin folder tells Cursor and Claude-style agents how to configure Security Ninja, read scan results, and work through a harden checklist. This is separate from the WordPress Abilities API. Thank you Gabe.
* IMPROVED: Vulnerability Scanner – When vulnerabilities are found, the warning is the only headline. “Vulnerability Scanner” stays when the scan is clean or still running. Collapsed Details no longer leaves an empty white bar.
* FIX: Auto Fixer – File backups are stored as .wfbkp data files again (not .php), so the Malware Scanner no longer flags our own backups. Existing .wfbkp.php backups are migrated automatically. Thank you Tom and Masahiro.
* IMPROVED: Tests – Permissions-Policy example now uses current header syntax and a shorter default that leaves fullscreen, autoplay, and encrypted media alone so embedded video keeps working. Thank you Lee.
* IMPROVED: Tests – Permissions-Policy default no longer disables payment, so Apple Pay and Google Pay checkouts keep working. Thank you Robert.
* IMPROVED: Tests – Content-Security-Policy help and Fixes examples use a WordPress-safe enforcing policy. Script limits stay an advanced step and will not pass the test while they are Report-Only. Thank you Robert.
* IMPROVED: Tests – MySQL permissions warns when the account has ALL PRIVILEGES on this site’s database, and fails on global grants or GRANT OPTION. The help text lists the privileges WordPress, updates, and backups need. Thank you Robert.
* IMPROVED: Tests – Security header help cleanup: removed obsolete X-Frame-Options ALLOW-FROM, fixed CSP Apache Header set syntax, and aligned X-Content-Type-Options, X-Frame-Options, HSTS, and Referrer-Policy PHP examples with the wp_headers filter.
* IMPROVED: Fixes – Hide WP Version now also clears the generator on RSS/Atom feeds and strips matching WordPress core ?ver= from CSS/JS asset URLs. Plugin and theme cache-busting versions are left alone.
* FIX: Scheduled Scanner – Scans started through Action Scheduler’s async admin-ajax runner no longer die on a Security Ninja test nonce check (403). Internal runners skip that AJAX nonce; UI AJAX still verifies it. Thank you Kevin.
* IMPROVED: Firewall – Block IP Network now uses api.wpsecurityninja.com. User-agent matches stay local and are no longer sent to the shared list. Sites with the feature on download the shared list once a day.
* IMPROVED: Firewall – Block IP Network reports are queued locally and flushed in batches (every 15 minutes or at 25 unique IPs), with a local hit count per IP.
* IMPROVED: Firewall – Early Firewall 8G blocks are reported to the Block IP Network when WordPress imports them. User-agent matches stay local.
* FIX: Firewall – Repeated failed logins are reported to the Block IP Network as repeat_failed_login, which is the type the shared list accepts.
* IMPROVED: Events Logger – Selected firewall and block events, including Early Firewall blocks and lost-password bans, are kept for 90 days. Other events still follow the retention you set.
* IMPROVED: Firewall – Country block selection stays as you set it when you press Enter in another field on the Firewall settings page.
* IMPROVED: Firewall – Request URI checks use the path only. Query parameters are checked separately, so long tokens in URLs (for example WooCommerce download links) are not mistaken for exploit paths.