Security Ninja PRO v5.305 Plugin
Security Ninja PRO is a comprehensive WordPress security plugin built on years of industry best practices to help protect your website from vulnerabilities and attacks. It performs over 40 security tests, including checks for brute-force exposure and known weaknesses such as the Timthumb vulnerability. The plugin scans your site for potential security holes and provides preventive measures to reduce risk. With detailed explanations and included code snippets for quick fixes, it makes strengthening your site’s security straightforward and practical.
Security Ninja PRO works through dedicated modules that continuously monitor and analyze your WordPress installation. The Core Scanner compares your core files with official master copies from WordPress.org to detect unauthorized changes, while the Malware Scanner checks themes and plugins for malicious code. An Events Logger records site activity, including failed login attempts, and the Scheduled Scanner runs automated tests without manual intervention. Together, these tools provide ongoing monitoring and proactive protection for your website.
Core Features of Security Ninja PRO Plugin
- 40+ Security Tests: Performs over 40 tests including brute-force attack checks.
- Vulnerability Detection: Scans your site for security weaknesses and holes.
- Timthumb Vulnerability Check: Detects exposure to the Timthumb vulnerability.
- Preventive Security Measures: Provides tools to help prevent attacks.
- Quick Fix Code Snippets: Includes ready-to-use code snippets for fast security improvements.
- Core Scanner Module: Compares WordPress core files with official master copies.
- Malware Scanner Module: Scans theme and plugin files for malicious code.
- Events Logger Module: Logs site events including failed login attempts.
- Scheduled Scanner Module: Runs automated security tests on a schedule.
What’s New (Changelog) in Security Ninja PRO v5.305
= v5.305 = 2026-10-11
* IMPROVED: German - The bundled translation now uses Du, the same terms throughout (Schwachstelle, Core-Scanner, Malware-Scanner, Korrekturen, Anmeldung), and the strings that were still English are translated.
* FIX: Tests - A wp-config.php moved one level above the WordPress root now scores as a pass. A file still in the root stays a warning. Thank you Robert.
* IMPROVED: Updated Freemius SDK to the latest version.
* NEW: Agent skill - SKILL.md in the plugin folder tells Cursor and Claude-style agents how to configure Security Ninja, read scan results, and work through a harden checklist. This is separate from the WordPress Abilities API. Thank you Gabe.
* IMPROVED: Vulnerability Scanner - When vulnerabilities are found, the warning is the only headline. "Vulnerability Scanner" stays when the scan is clean or still running. Collapsed Details no longer leaves an empty white bar.
* FIX: Auto Fixer - File backups are stored as .wfbkp data files again (not .php), so the Malware Scanner no longer flags our own backups. Existing .wfbkp.php backups are migrated automatically. Thank you Tom and Masahiro.
* IMPROVED: Tests - Permissions-Policy example now uses current header syntax and a shorter default that leaves fullscreen, autoplay, and encrypted media alone so embedded video keeps working. Thank you Lee.
* IMPROVED: Tests - Permissions-Policy default no longer disables payment, so Apple Pay and Google Pay checkouts keep working. Thank you Robert.
* IMPROVED: Tests - Content-Security-Policy help and Fixes examples use a WordPress-safe enforcing policy. Script limits stay an advanced step and will not pass the test while they are Report-Only. Thank you Robert.
* IMPROVED: Tests - MySQL permissions warns when the account has ALL PRIVILEGES on this site's database, and fails on global grants or GRANT OPTION. The help text lists the privileges WordPress, updates, and backups need. Thank you Robert.
* IMPROVED: Tests - Security header help cleanup: removed obsolete X-Frame-Options ALLOW-FROM, fixed CSP Apache Header set syntax, and aligned X-Content-Type-Options, X-Frame-Options, HSTS, and Referrer-Policy PHP examples with the wp_headers filter.
* IMPROVED: Fixes - Hide WP Version now also clears the generator on RSS/Atom feeds and strips matching WordPress core ?ver= from CSS/JS asset URLs. Plugin and theme cache-busting versions are left alone.
* FIX: Scheduled Scanner - Scans started through Action Scheduler's async admin-ajax runner no longer die on a Security Ninja test nonce check (403). Internal runners skip that AJAX nonce; UI AJAX still verifies it. Thank you Kevin.
* IMPROVED: Firewall - Block IP Network now uses api.wpsecurityninja.com. User-agent matches stay local and are no longer sent to the shared list. Sites with the feature on download the shared list once a day.
* IMPROVED: Firewall - Block IP Network reports are queued locally and flushed in batches (every 15 minutes or at 25 unique IPs), with a local hit count per IP.
* IMPROVED: Firewall - Early Firewall 8G blocks are reported to the Block IP Network when WordPress imports them. User-agent matches stay local.
* FIX: Firewall - Repeated failed logins are reported to the Block IP Network as repeat_failed_login, which is the type the shared list accepts.
* IMPROVED: Events Logger - Selected firewall and block events, including Early Firewall blocks and lost-password bans, are kept for 90 days. Other events still follow the retention you set.
* IMPROVED: Firewall - Country block selection stays as you set it when you press Enter in another field on the Firewall settings page.
* IMPROVED: Firewall - Request URI checks use the path only. Query parameters are checked separately, so long tokens in URLs (for example WooCommerce download links) are not mistaken for exploit paths.
Similar Plugins
