Release notes

Changelog

• Database update until 18 August 2026.
• Improved LFI filter to reduce false positives: question marks in regular text (e.g. "do???") no longer trigger the path truncation pattern.
• Show the exact date next to the relative time of the last scan.
• Fixed the relative time of the last scans being off by the site timezone offset (e.g. "1 hour ago" right after a manual scan): manual scan timestamps were stored in UTC but displayed as site-local time.
• Removed the legacy OTP unlock feature.
• Fixed fatal error when saving articles containing multi-level form fields (mb_strlen on array).
• Fixed fatal error in the second level protection when submitting forms with nested fields (stripslashes on array); arrays are now skipped as in the Pro version.
• Fixed array request fields (e.g. multi-select form fields) being overwritten with their last value after firewall inspection.
• Fixed firewall plugin translations not loading in some component views; plugin language files reorganized to the standard Joomla layout.
• Internal modernization of the firewall plugin to the modern Joomla event architecture, getting it ready for Joomla 7.
• Removed the leftover Upload scanner settings and references (the Upload scanner is a feature of the Pro version).
• Fixed the Permissions scan hanging at the first log line on hosts where the web server kills CGI/FastCGI processes that produce no output ("Timeout waiting for output"): the scan now sends periodic keep-alive output and lifts the PHP time limit.
• Fixed the Backend Protection options in the .htaccess protection view never showing the "Applied" check mark (hide backend URL, redirection and exceptions): the detection still looked for the old rule format.
• Security: hardened the firewall filter exceptions handling.
• Security: added CSRF token checks to several backend actions.
• Security: broadened the web firewall's attack coverage: request parameters are now inspected regardless of how deeply they are nested, closing a possible evasion via deeply nested array fields.
• Security: strengthened the SQL injection filter to catch additional evasion techniques.
• Removed the User-Agent/Referer inspection option: it was trivially bypassable and gave a false sense of security.
• Fixed adding an IP range with a malformed CIDR mask (e.g. a stray trailing comma) to the blacklist/whitelist (thank you very much for reporting this, PrestaMicro!): it was accepted and stored as entered, then crashed the firewall on every request while matching visitor IPs against the list.