* Fix: Prevented .htaccess from being overwritten with an empty file, auto-creation now requires explicit filter opt-in
* Fix: removed unnecessary call to install() in firewall constructor
* Fix: header_length_ok() now uses options instead of transients for caching
* Fix: user agent and 404 detection are now excluded on cron requests
* Fix: added a check to prevent a typeError in generating htaccess rules
* Improvement: reworked .htaccess handling with insert_with_markers and improved WP Rocket integration.
* Improvement: moved firewall rules to separate firewall.php with dedicated rule classes.
* Improvement: SBOM added to plugin.
* Improvement: corrected spelling, grammar, and consistency issues in plugin strings; updated geopolitical terms.
* Fix: replaced accidental Dutch word in 2FA datatable with correct English translation.
* Fix: resolved PHP 8.4 deprecation warnings while maintaining compatibility with PHP 7.4–8.4.
* Fix: whitelisted LiteSpeed Cache crawler in .htaccess to prevent redirect issues.
* Fix: corrected 2FA grace period email logic to avoid sending reminders to users with active 2FA.
* Fix: updated hosting provider name from "XXL Hosting" to "Superspace".
* Improvement: improved compatibility with plain permalinks.
* Improvement: handling of user agents in the firewall.
* Improvement: auto cleanup 404 watchlist via cron job.
* Improvement: updated links in the plugin.
* Improvement: made various improvements to CSP learning mode.
* Fix: handled a case where the user ID could be empty in 2FA.
* Fix: learn more button in vulnerability e-mail link now links to the correct page.
* Fix: fixed an issue where rsssl_user_can_manage could be undefined when downloading the system status.
* Fix: Adjusted .htaccess redirect requirements for subfolder configurations
* Fix: re-send e-mail button on the 2FA page will now show a message when the e-mail is sent.
* Fix: restored SCSS files.
* Fix: fixed an issue where the plugin kept redirecting to its settings page after activation.
* Improvement: limit login attempts will now also trigger on password reset pages.
* Improvement: updated the way other plugins are installed via the onboarding and dashboard page.
* Improvement: added notice with an option to force verify e-mail address.
* Improvement: updated minimum WordPress version to 6.6.
* Fix: Fixed the feedback when an email is resend during Two-Factor Authentication setup.
* Fix: Fixed the Single Sign on link to support custom login urls.
* Fix: Fixed an issue where the composer autoloader was loaded twice.
* New: Passkey support for Two-Factor Authentication.
* Improvement: More detailed feedback when using CLI commands.
* Improvement: On activation, detect `EXTENDIFY_PARTNER_ID` constant and run `wp rsssl activate_recommended_features`.
* Improvement: Standardize RSS onboarding hoster list to brand names.
* Improvement: "Disable user enumeration" now returns 401 Unauthorized (instead of 404 Not Found) for non-authenticated requests to the /wp/v2/users/ endpoint.
* Include SimplyBook in “onboarding” and “other plugins” sections.
* Fix: Validate CIDR ranges before bit-shifting in IP fetcher.
* Fix: Auto-allow Googlebot IPs in Firewall when blocking the United States.
* Fix: Adjust plugin initialization timing to prevent a textdomain warning.
- Improvement: Not able to use email needed functions when email is not yet verified.
- Fix: All instruction links are now correct.
- Fix: Undefined array key "m" when showing vulnerability details.
- Fix: Prevent errors when downgrading to free.
- Fix: Compatibility between 2FA and JetPack “Log in using WordPress.com account” setting