Changelog
What’s new in Gate House
1.21.1
October 13, 2026 · Requires WordPress 7.1+ and PHP 8.1+ · Tested up to WordPress 7.1.2
- Weekly protection summaries now show unavailable activity honestly and report mail submission, failure and retry status. Activity-read failures and rejected mail submissions receive up to three retries within 24 hours while preserving the weekly schedule. Overlapping and stale callbacks are deduplicated, and opting out cancels retries. Uncertain mail outcomes are not retried automatically; WordPress acceptance is distinguished from inbox delivery. The complete edition retains its existing protection, settings and private update channel.
1.21.0
October 12, 2026 · Requires WordPress 7.1+ and PHP 8.1+ · Tested up to WordPress 7.1.2
- Moves Gate House to its own shield-icon entry in the WordPress admin sidebar while retaining the existing dashboard tabs and permissions. Existing Settings and Tools links redirect to the matching page, and digest, account-cleanup and held-order links use the new address. The bundled Pro is updated together with the base; protection settings, stored data and the complete edition update channel are unchanged.
1.18.0
October 2, 2026 · Requires WordPress 7.1+ and PHP 8.1+ · Tested up to WordPress 7.1.2
- The complete legacy edition gains WPForms protection: every WPForms form gets the per-form check ladder (Off, Invisible, Human check) and rate limits like the built-in forms; a blocked attempt surfaces as WPForms' own error and stores nothing, and successful submissions complete the flow so Coverage confirms from real use. The Coverage tab's entry-points card counts WPForms forms and reports them covered. Verified against WPForms Lite 2.0.2.1 on the isolated fixture; AJAX and classic submissions share the same gate.
1.17.0
October 1, 2026 · Requires WordPress 7.1+ and PHP 8.1+ · Tested up to WordPress 7.1.2
- Shared Cloud IP, IP-range and email-domain rule lists, with separate site consent, exact previews, confirmed multi-site rollout and rollback. Local rules remain independent. Existing protection stays in place while offline or after consent is disabled.
1.16.0
October 1, 2026 · Requires WordPress 7.1+ and PHP 8.1+ · Tested up to WordPress 7.1.2
- Versioned Cloud templates, reviewed multi-site rollout and conflict-aware rollback for local attempt limits and account-abuse settings. Separately opt-in; current local protection keeps working offline. Includes the assigned directory identity and compatibility work from 1.15.2.
1.14.0
October 1, 2026 · Requires WordPress 7.1+ and PHP 8.1+ · Tested up to WordPress 7.1.2
- Preserves the complete product using the shared Pro module while introducing separate Free and Pro distributions. Existing advanced protection and paid entitlements remain in place. Removes anonymous store check-ins and corrects Automatic/CF7/REST setup report compatibility.
1.13.0
October 1, 2026 · Requires WordPress 7.1+ and PHP 8.1+ · Tested up to WordPress 7.1.2
- Adds universal form discovery: the Coverage tab now opens with an entry-points card reporting every form entry point Gate House found on your site — the built-in WordPress and WooCommerce surfaces plus detected form plugins (Contact Form 7, Gravity Forms, WPForms, Fluent Forms, Formidable, Ninja Forms, Elementor form widgets, Mailchimp for WordPress, Newsletter) — and which of them its checks and adapters cover. Form counts are read-only estimates from your own database; a detected plugin's code is never executed, unreadable counts say unknown, and plugins without adapters are listed plainly as not covered. Detection is reporting only — protection for those plugins ships as one adapter release each, in demand order.
1.12.0
October 1, 2026 · Requires WordPress 7.1+ and PHP 8.1+ · Tested up to WordPress 7.1.2
- Account cleanup now reads like incident triage instead of database administration; the safety model is unchanged. The page opens with what Gate House saw — flagged sign-ups in recent activity become a headline with a one-click "Scan those days" that prefills the dates — and quarantined accounts get a standing ledger showing who is restricted, since when, and when deletion review unlocks, visible with or without a scan. A live Scan → Review → Act indicator replaces the static explainer; once a scan exists the review takes over and the form collapses to "Scan a different range". Plain words throughout: "Find accounts to review" and "Scan registrations" instead of "Build a preview", one footnote instead of a five-constraint preamble, the repeated-identity threshold tucked behind an Advanced control with real guidance, "Fresh for another 8 minutes" instead of a raw UTC expiry, and deletion waits shown in relative time. Same operations, acknowledgement, batch cap and 24-hour wait as before; all four bundled translations updated at 100%.
1.11.0
October 1, 2026 · Requires WordPress 7.1+ and PHP 8.1+ · Tested up to WordPress 7.1.2
- A plain-language admin pass; protection behavior is unchanged. Rules now reads in task order — your forms first, limit strictness next, and the account-abuse, card-testing and disposable-email cards grouped under one Fraud & abuse checks heading, with a jump bar linking each section. Activity rows tuck their review controls behind a Review button and drop the jargon: "Pause attempt limits for this visitor" instead of "Local-rate exception minutes", and "Visitor check: not needed for this decision" instead of "Provider: Not evaluated". Overview's next step, setup checklist and quick-setup card now agree on fresh installs, and the stat cards count forms rather than "actions". The Provider tab greets Automatic sites with "no keys needed" instead of key instructions. All four bundled translations cover the renamed and new strings at 100%.
1.9.1
September 30, 2026 · Requires WordPress 7.1+ and PHP 8.1+ · Tested up to WordPress 7.1.2
- Squashed Bugs in Activity Stream
1.9.0
September 30, 2026 · Requires WordPress 7.1+ and PHP 8.1+ · Tested up to WordPress 7.1.2
- Probe Runner to make sure admins are never locked out.
1.7.0
September 30, 2026 · Requires WordPress 7.1+ and PHP 8.1+ · Tested up to WordPress 7.1.2
1.6.0
September 30, 2026 · Requires WordPress 7.1+ and PHP 8.1+ · Tested up to WordPress 7.1.2
- Failed-payment adapter
- decision-time guard
1.5.0
September 30, 2026 · Requires WordPress 7.1+ and PHP 8.1+ · Tested up to WordPress 7.1.2
- the keyless provider that solves the onboarding blocker.
- A signed, action-bound render proof is printed into every protected form (classic forms work with zero JavaScript),
- a per-site-named honeypot catches bots, and a time-trap rejects submissions faster than 2 seconds. It's the fresh-install default, needs no account/keys/connection test, and is the recommended entry in the provider picker with its own no-keys setup flow.
1.4.0
September 30, 2026 · Requires WordPress 7.1+ and PHP 8.1+ · Tested up to WordPress 7.1.2
- Squashed Bugs
- Event Log
- Engine Core
1.2.1
September 29, 2026 · Requires WordPress 7.1+ and PHP 8.1+ · Tested up to WordPress 7.1.2
- Fix attack-cleanup selection for accounts with order history, including failed orders. Reviewed accounts can now be selected for reversible quarantine and restoration while keeping all accounts and orders intact. Permanent deletion remains unavailable for any account with linked order history. Unknown history checks still prevent quarantine and deletion. Clarify selection instructions and the reason deletion is unavailable.
1.2.0
September 29, 2026 · Requires WordPress 7.1+ and PHP 8.1+ · Tested up to WordPress 7.1.2
- Independent account-abuse protection checks combined generated-profile patterns and repeated identities before supported registration, checkout and order-payment processing. Observe mode is the upgrade default; choose Block matching attempts under Rules or enable the recommended setup. A passed CAPTCHA does not override an account-abuse block. New attack cleanup previews suspicious customer accounts, supports reversible quarantine and restoration, and offers separate selected-account deletion after 24 hours of quarantine. Accounts with order history or protected roles are preserved; orders are never deleted. Activity stores reason codes and boolean signals without raw profiles. Includes bounded atomic distinct-email counters, privacy-tool integration and schema-safe upgrades.
1.1.0
September 29, 2026 · Requires WordPress 7.1+ and PHP 8.1+ · Tested up to WordPress 7.1.2
- Read-only compatibility assessment for native WooCommerce registration and both checkout paths. Coverage separates detected setup, configured rules, successful observed use and recorded release tests. Captured site or protection-rule changes invalidate earlier successful-use evidence. Diagnostics include a bounded local site manifest; custom routes and unexecuted flows remain unverified. No test accounts, orders or payments are submitted by the assessment. Includes the 1.0.2 storage-warning fixes.
1.0.2
September 29, 2026 · Requires WordPress 7.1+ and PHP 8.1+ · Tested up to WordPress 7.1.2
- Fixes a warning banner that could stay on every admin page after a single failed storage operation (for example during an update or a backup restore): storage failures are now honored for 15 minutes and each new failure refreshes that window, so the warning clears itself once storage is healthy and persists only while it is genuinely broken. The banner now names its cause instead of showing one shared sentence - recovery mode, storage failure (with component and time), attack or continuity mode, provider outage, and blocked-activity bursts each get their own message. Diagnostics and wp usp status show when and where a storage operation last failed; internal error details are never exposed.
1.0.1
September 29, 2026 · Requires WordPress 7.1+ and PHP 8.1+ · Tested up to WordPress 7.1.2
- Hotfix: translator source files (.po) are no longer shipped in the release ZIP — they halved the language payload's size and could make automatic updates time out on slower hosting, leaving a partially-extracted plugin.
1.0.0
September 29, 2026 · Requires WordPress 7.1+ and PHP 8.1+ · Tested up to WordPress 7.1.2
- Contact Form 7 forms are now protected: the verification widget rides CF7's own form rendering (one challenge per form, fresh on AJAX replacement) and both the classic POST and the AJAX feedback endpoint share the wpcf7_spam gate. A new Contact forms area appears under Rules only while CF7 is active, and Coverage confirms it from real use like every other form.
0.8.0
September 28, 2026 · Requires WordPress 7.1+ and PHP 8.1+ · Tested up to WordPress 7.1.2
- A dashboard widget on the main wp-admin screen shows the last 24 hours of decisions and blocks at a glance, and an optional weekly summary email (off by default, totals only, sent by your own site) arrives at the administrator address. Neither contains visitor data.