NoHackMe Defender

Changelog

1.1.6

• Added a runtime safety guard that ignores overly broad short alphabetic payload rules such as or or and, preventing normal URLs like /sailors/ from being blocked.
• Existing active short alphabetic payload rules are now automatically marked inactive in the stored rules file during default-rule synchronization.
• Removed the broad standalone or payload signature from default rules while keeping safer quoted SQL variants.
• Added a «Разблокировать всех» button to the blocked IP admin page to clear all current IP blocks at once.

1.1.5

• Split suspicious request payload patterns and suspicious URL path patterns into two separate admin sections with independent URLs and submenu entries.
• Added the Suspicious URL paths admin page for sensitive files, foreign CMS/framework fingerprints, admin panels, and service endpoints.
• Added separate temporary protection toggles for payload/body scanning and suspicious URL path scanning.
• Added per-rule Active checkboxes so individual rules can be temporarily disabled without deleting them.
• Added per-row Delete buttons for both rule lists, making it clear that unused rules can be removed directly.
• Disabled rules are preserved in the settings files and ignored by the runtime scanner until re-enabled.
• Updated default-list synchronization so disabled default rules are not re-added as active duplicates.

1.1.4

• Added raw request body and decoded JSON scanning for REST, GraphQL, and other API-style POST/PUT/PATCH/DELETE requests.
• Added request URI, query string, request parameters, and User-Agent scanning to close bypasses where suspicious paths or scanner signatures were not submitted as normal form parameters.
• Added immediate blocking for sensitive scanner paths such as .env, wp-config.php, composer.json, backup/swap/SQL dump extensions, PHP-CGI probes, and exposed debug/runtime endpoints.
• Added immediate blocking for high-confidence foreign CMS and framework scanner paths, including Drupal, Joomla, Magento, Laravel, Symfony, TYPO3, Umbraco, and Ghost fingerprints.
• Added a missing-file probe counter that blocks IPs repeatedly requesting non-existent high-risk files such as executable script variants, backups, logs, archives, or config files.
• Added new default suspicious fragments for REST batch abuse, GraphQL probes, PHP-CGI attempts, exposed configuration/debug paths, and additional SQL injection patterns.
• Existing suspicious-fragment lists now receive missing default security signatures without removing custom entries.

1.1.2

• The plugin is now distributed as a single version without a separate premium/free split.
• Added a support block with donation links to the settings page.
• Removed premium-only UI restrictions and related admin notices.

1.1.1

• Fixed deletion of blocked IPs from the middle of the list in the admin panel.
• Added IPv6 support for blocked IPs, whitelists, range matching, and admin display.
• Added buttons to update Google and Yandex crawler IP ranges from their official sources.
• Improved admin update UX: buttons now show progress and reload the page after a successful update.
• Added safer file locking for counters and ban files to reduce race conditions under concurrent requests.
• Removed unnecessary unauthenticated AJAX actions for admin-only operations.

1.1.0

• Fixed issue with the IP whitelist functionality.
• Added a page view counter for a single IP in 10 minutes to the Statistics section.
• Updated the logic of page view counters for a single IP in 1 minute and 50 minutes in the Statistics section.

1.0.0

• Initial release: Includes hacking, parsing, DoS, and password brute force protection.