Release notes
What changed, version by version
These are the releases of the WP Safer agent — the plugin installed on the WordPress sites you manage. Your sites update to it from the panel, or on their own if you let them.
Current agent version: 1.4.2
-
- A file integrity scan no longer lists a whole plugin or theme file by file when the package on disk is not the release it claims to be. That folder is now reported as one line, with the number of files behind it; files that genuinely do not belong are still listed one by one.
- Files the hosting itself creates — PHP's own error_log wherever it appears, cPanel's .ftpquota — and compiled template caches under uploads no longer fill the report. A file standing on its own is still reported, however short it is.
- Compiled translation files that WordPress 6.5 and later write into a plugin's own languages folder are recognised instead of being reported as unexpected.
-
- A scan no longer gives up because of a single folder the hosting will not let it read. That entry is skipped, the rest of the site is scanned as usual, and the report says how many entries could not be inspected — a folder nobody looked at is not a clean one.
- A scan that keeps failing in the same place now stops after a few attempts and reports what actually went wrong, instead of retrying for minutes and ending with a limit message.
-
- Deleting a theme from your dashboard now really removes it from the site. The request used to fail on its first step on most sites, and the dashboard read that failure as a success.
- A delete request can no longer be aimed at the themes directory itself, or at the active theme and the parent theme it builds on.
-
- The estimated backup size in your dashboard now measures the files the backup actually collects. Old archives left on the site, caches, log files and node_modules folders used to count towards a figure describing a backup none of them ever entered.
-
- The agent is published under the name Safepilot and installs into a directory of that name, matching the identity it carries. A site can only ever hold one copy of it.
-
- If a site ends up with two copies of the agent, the first one loaded runs and the other makes itself inert instead of competing with it. The admin screen says which directory is redundant, and both copies share the same site key, so the site stays connected either way.
-
- The IP allow-list firewall for the WordPress admin area is managed per site from the panel: single addresses (IPv4 and IPv6), CIDR ranges, wildcards such as 192.168.1.* and ranges such as 1.2.3.10-50. Anything the list cannot read is reported back instead of being dropped in silence.
- admin-ajax.php and admin-post.php are left alone by default — a site's own front end uses them too — and a request whose address cannot be determined is let through rather than locking anyone out.
Updates arrive on their own
The panel installs a new agent version on your sites when you ask it to, or automatically if you turn that on. Nothing here needs an FTP client.