WordPress News
Sucuri Security 2.7.4 Released
What’s new in Sucuri Security 2.7.4
Released: 2026-07-07
Active installations: 600,000
Tested up to WordPress 7.0.2
Changelog
- Improve the Two-Factor Authentication page to load the users list in pages, so it stays fast and reliable on sites with hundreds or thousands of users (for example, WooCommerce stores).
- Add a search box to the Two-Factor Authentication page to quickly find users by username, email, or display name.
- Strengthen input validation, access checks, and output escaping.
- Add a one-click “Disable XML-RPC” option to the Hardening page to close a common brute-force and pingback-based DDoS attack vector, with a warning if an active plugin (e.g. Jetpack) depends on XML-RPC.
- Fix a fatal error on PHP 8 when the API returns the “messages” field as a string instead of an array.
Previous releases
2.7.3
- Refactor AJAX handler to an explicit dispatch map for improved security and efficiency.
- Improve 2FA section with more UI clarity.
- Make light-mode default when no preference is defined. Correct inverted dark/light mode icons.
- Fix i18n regression in 2FA status and setup templates.
- Fix duplicate CSS property declarations.
2.7.2
- Fix salt bug in the wp-config file.