WordPress News
Sucuri Security 2.8.1 Released
What’s new in Sucuri Security 2.8.1
Released: 2026-10-14
Active installations: 600,000
Tested up to WordPress 7.1.3
Requires PHP 7.4
Changelog
- Fix the Last Logins date and time column showing up blank when the site’s date or time format setting is empty or invalid. The WordPress default format is used instead.
- Fix logins completed through Two-Factor Authentication not being recorded in Last Logins or reported to other plugins that watch for logins.
Previous releases
2.8
- Add one-time backup codes for Two-Factor Authentication. Ten codes are created when 2FA is turned on, any one of them will get you in if you lose your authenticator app, and each code stops working once it has been used. You can generate a fresh set at any time from your WordPress profile.
- Add a search box and severity, plugin, and theme filters to the Audit Logs page, so you can find a specific event without paging through the whole history. Filtering and paging now happen instantly.
- Add a one-click CSV download of the complete audit trail, ready for a compliance review, an incident timeline, or an archive before older records age out. Large histories export without slowing the site down.
- Fix an issue that left the audit trail completely empty on sites that do not run in English. Events were recorded but never shown.
- Fix audit entries being cut short or lost. Saving the WordPress Writing settings discarded the record of every other option changed in that same save, and a less-than sign in a site title or option value truncated the entry from that point on.
2.7.4
- Improve the Two-Factor Authentication page to load the users list in pages, so it stays fast and reliable on sites with hundreds or thousands of users (for example, WooCommerce stores).
- Add a search box to the Two-Factor Authentication page to quickly find users by username, email, or display name.
- Strengthen input validation, access checks, and output escaping.
- Add a one-click “Disable XML-RPC” option to the Hardening page to close a common brute-force and pingback-based DDoS attack vector, with a warning if an active plugin (e.g. Jetpack) depends on XML-RPC.
- Fix a fatal error on PHP 8 when the API returns the “messages” field as a string instead of an array.