WordPress News
Sucuri Security 2.8 Released
What’s new in Sucuri Security 2.8
Released: 2026-09-09
Active installations: 600,000
Tested up to WordPress 7.1
Requires PHP 7.4
Changelog
- Add one-time backup codes for Two-Factor Authentication. Ten codes are created when 2FA is turned on, any one of them will get you in if you lose your authenticator app, and each code stops working once it has been used. You can generate a fresh set at any time from your WordPress profile.
- Add a search box and severity, plugin, and theme filters to the Audit Logs page, so you can find a specific event without paging through the whole history. Filtering and paging now happen instantly.
- Add a one-click CSV download of the complete audit trail, ready for a compliance review, an incident timeline, or an archive before older records age out. Large histories export without slowing the site down.
- Fix an issue that left the audit trail completely empty on sites that do not run in English. Events were recorded but never shown.
- Fix audit entries being cut short or lost. Saving the WordPress Writing settings discarded the record of every other option changed in that same save, and a less-than sign in a site title or option value truncated the entry from that point on.
- Fix plugin and theme names that contain an ampersand being shown with an HTML escape code in place of the character itself, both on the page and in the export, which also stopped them from being found by search.
- Mask API keys, tokens, and salts in the audit trail. They were previously stored in plain text, and are now masked both as new events are recorded and as existing records are read back.
- Fix a case where markup returned by the Sucuri API could reach the dashboard without being escaped.
- Fix removing a file from the Hardening allowlist when its path contains characters that have a special meaning in a regular expression.
- Require PHP 7.4 and WordPress 6.0 or later, and correct the places in the plugin that still advertised PHP 5 support.
Previous releases
2.7.4
- Improve the Two-Factor Authentication page to load the users list in pages, so it stays fast and reliable on sites with hundreds or thousands of users (for example, WooCommerce stores).
- Add a search box to the Two-Factor Authentication page to quickly find users by username, email, or display name.
- Strengthen input validation, access checks, and output escaping.
- Add a one-click “Disable XML-RPC” option to the Hardening page to close a common brute-force and pingback-based DDoS attack vector, with a warning if an active plugin (e.g. Jetpack) depends on XML-RPC.
- Fix a fatal error on PHP 8 when the API returns the “messages” field as a string instead of an array.
2.7.3
- Refactor AJAX handler to an explicit dispatch map for improved security and efficiency.
- Improve 2FA section with more UI clarity.
- Make light-mode default when no preference is defined. Correct inverted dark/light mode icons.
- Fix i18n regression in 2FA status and setup templates.
- Fix duplicate CSS property declarations.