Dragon Login Security

A quiet pointer to the Pro add-on: an Upgrade to Pro link on the Plugins screen, a one-line note at the foot of the plugin's screens, and a single dismissible notice once the plugin has done its job. Nothing in the free plugin is locked or changed, and all three disappear when Pro is active.

• New dragonloginsecurity_lockout action fires when an address is locked out.

Backup codes and authenticator codes can no longer be replayed by two sign-ins at once, and failed saves are reported as errors instead of success.

What's fixed in 1.0.10

• IP-list import confirms what it stored. Importing allow/deny lists from Limit Login Attempts or Wordfence read the counts from memory, so a failed database write still showed "Import finished: N addresses added" while the lists were unchanged. The import now re-reads the saved lists and shows an error if they were not stored.
• Settings saves are verified. The settings screen showed "Settings saved" regardless of whether the write succeeded. A failed save now shows an error and tells you the previous settings are still in effect.
• The "delete data on uninstall" preference is verified too. Changing only that checkbox left the rest of the settings identical, so a failed write to the preference was still reported as "Settings saved". It is now checked separately and a partial save says so.
• Passkey sign-in fails closed if the counter cannot be recorded. The stored signature counter is what detects a cloned security key on the next sign-in. If that counter could not be written, the sign-in was still accepted; it is now rejected so you can simply try again.
• Authenticator codes cannot be accepted twice. The replay guard that stops a captured code from being reused was not checked for a failed write. A code whose guard cannot be recorded is now rejected.
• The authenticator replay guard cannot be wound back. Two sign-ins verifying codes from adjacent 30-second windows could finish in either order, and the older one would overwrite the guard with its own lower value, leaving the newer code replayable. The guard now only ever moves forward.
• Backup codes are single-use even under write errors. A backup code is only accepted once its removal is stored. Generating or confirming backup codes now reports a failed save instead of handing you codes that would not work.
• A backup code cannot be brought back by two sign-ins at once. Each sign-in used to write the whole remaining code list back from the copy it had read, so two people (or two tabs) signing in at the same moment each restored the code the other had just used, leaving a used code valid. Consuming a code is now a single atomic step that retries against the current list, so a used code stays used.
• Enrolment reports real outcomes. Adding a passkey or enabling an authenticator app now shows an error if the credential could not be saved, instead of "Passkey added" or "Authenticator app enabled".
• Activation retries a failed table creation, and tells you when it fails. The schema version is stamped only after both plugin tables are confirmed to exist. If they cannot be created (typically a database user without the CREATE privilege), administrators see a notice naming the missing tables; retries are throttled to once every 10 minutes, and deactivating and reactivating the plugin always retries immediately.
• A missing table is now repaired from wp-admin, not only on reactivation. An earlier version could record the schema as up to date even when a table had not been created. Because that recorded version did not change in this release, those sites would have skipped the new check forever. The tables are now confirmed to exist before the recorded version is trusted, and the check runs in wp-admin rather than only on activation, so a table lost at any point (a dropped table, a restore from a partial backup) is recreated the next time an administrator opens a page. This matters here because without the lockouts table, failed sign-ins stop being recorded at all.
• The old-option migration keeps its source until confirmed. The one-time move of settings from the pre-1.0.2 option name no longer deletes the old copy before the new one is verified.

No settings, data or behaviour changes otherwise.

Passkeys now switch off cleanly, with a clear admin notice, if the bundled WebAuthn library is ever missing from your install - no more errors.

= 1.0.9 =

• Resilience: if the bundled WebAuthn library is missing from the install, passkeys are switched off cleanly (enrolment and sign-in buttons hidden, a clear admin notice on the settings screen) instead of causing an error. Authenticator apps and backup codes are unaffected.
• Documentation: added an External services section and a bundled-libraries note to the readme.

Important security fix: closes a way to bypass brute-force lockouts behind a proxy or CDN.

= 1.0.8 =

• Security: the client IP is now resolved safely behind a reverse proxy/CDN (configurable trusted proxies), closing a bypass where a spoofed X-Forwarded-For header could dodge login lockouts or lock out other IPs.
• Hardening: authenticated encryption for stored secrets (TOTP seeds, backup codes).

Tested and verified on WordPress 7.1.

• Compatibility: tested up to WordPress 7.1.

Turning off your authenticator app and regenerating backup codes now ask for confirmation and say exactly what will happen first.

One-click imports, privacy-tools integration, and data that survives uninstall.

This release adds one-click import of allow/deny IP lists from Limit Login Attempts (Reloaded) and Wordfence, integrates WordPress's privacy tools (personal-data export and erasure for a user's two-factor material and lockout history), and stops uninstall deleting your data unless you opt in first.

A cleaner, consistent look: the Dragon design system arrives.

This release brings Dragon Core's design system to every screen: a consistent header with the Dragon mark, cleaner tables, and unified status colours across the whole plugin family. Purely visual — everything behaves exactly as before.