Commits
Plugin Hardening: Real Sessions, Brute Force, and Anti-Replay
Five security fixes to the maintenance plugin: WooCommerce sessions that are no longer deleted while active, xmlrpc included in the lockout, hardening that verifies what it claims, anti-replay signatures, and latency that does not bog down the listing.
A day of hardening the maintenance plugin: five battlefronts across the same security file and its neighbors, with everything under test.
Sessions that breathe
WooCommerce session deletion had no WHERE clause: it was wiping active carts along with the old ones. Now it filters by session_expiry using UTC_TIMESTAMP() and only removes what has already expired.
xmlrpc counts too
The brute-force lockout covered wp-login but not xmlrpc: dictionary attacks filled the failure counter without ever triggering the lockout. Now both entry points count toward the same lockout.
Honest hardening
The PHP execution block in uploads wrote the .htaccess and considered the job done. If the write failed, the panel displayed protection that did not exist. Now the plugin checks that the block is still on disk and, if it cannot write it, says so: an error response, the option set to 'no', and the hardening status active only when it can be verified.
Anti-replay for real
HMAC-signed mutations could be replayed unchanged: the signature was always valid. Now every mutation signature that has already been used is remembered for five minutes, and the replay is rejected. GET requests are not stored, so the portal's repeated checks are not broken.
Latency
The plugins list marked the check as complete even when the update failed, and the panel went three hours without data. Now it marks it only after succeeding and retries on the next listing run. The audit's malware scan is delayed by about five minutes to avoid hammering every tab opening.
Status: the plugin does its job without ever claiming anything it has not been able to verify.