=== BulletProof Security === Contributors: AITpro Donate link: http://www.ait-pro.com/aitpro-blog/331/bulletproof-security-plugin-support/bulletproof-security-donations-page/ Tags: virus, antivirus, attack, bulletproof, security, secure, htaccess, chmod, maintenance, plugin, private, privacy, protection, permissions, 503, base64, injection, code, encode, script, attack, hack, hackers, block, blocked, prevent, prevention, RFI, XSS, CRLF, CSRF, SQL Injection, vulnerability, website security, WordPress security, security log, logging, HTTP log, error log, login security, login, log, users, login alerts, lock, brute force, authenticate, authentication, firewall, User ID, Author ID, Username, enumeration, Bot, spam, spammers Requires at least: 3.0 Tested up to: 3.8 Stable tag: .49.8 WordPress Website Security Protection. Website security protection against: XSS, RFI, CRLF, CSRF, Base64, Code Injection and SQL Injection hacking... == Description == = htaccess Core Website Security (Firewalls) = WordPress Website Security Protection: BulletProof Security protects your WordPress website against XSS, RFI, CRLF, CSRF, Base64, Code Injection and SQL Injection... hacking attempts. One-click .htaccess WordPress security protection. Protects wp-config.php, bb-config.php, php.ini, php5.ini, install.php and readme.html with .htaccess security protection. Security Logging. HTTP Error Logging. Login Security/Login Monitoring: Log All Account Logins or Log Only Account Lockouts. Website Maintenance Mode (HTTP 503). Additional website security checks: DB errors off, file and folder permissions check... System Info: PHP, MySQL, OS, Server, Memory Usage, IP, SAPI, DNS, Max Upload... Built-in .htaccess file Editor. = Login Security & Monitoring Website Security = Login Security & Login Monitoring: Log All User Account Logins or Log Only User Account Lockouts (see Screenshot). Brute Force Login Security Protection. Email alerting options allow you to choose 5 different email alerting options: Choose to have email alerts sent when a User Account is locked out, An Administrator Logs in, An Administrator Logs in and when a User Account is locked out, Any User logs in and when a User Account is locked out or Do Not Send Email Alerts. Choose Standard WP Error Messages or Generic Error Messages for Login Security Stealth Mode. Choose to Enable or Disable Login Password Reset capability for Login Security Stealth Mode. See BulletProof Security Login Security & Monitoring Features for additional features and options. = Why is .htaccess Website Security So Much Better Than Any Other Type of Website Security? = The answer is very simple - .htaccess files (distributed configuration files) are processed first before any other code on your website. In other words, hackers malicious scripts are stopped by BulletProof Security .htaccess files/Firewalls before those scripts even have a chance to reach the php coding in WordPress. BulletProof Security uses .htaccess website security files, which are specific to Apache Linux Servers. Please read the FAQ page for Server compatibility questions. = Security Log File Automation - Automatically Zipped, Emailed and Replaced = Security Log files are automatically zipped, emailed and replaced with a new blank Security Log file when the log file reaches the maximum file size setting that you choose. By Default BulletProof Security sets this DB option to zip, email and replace the Security Log file when it reaches 500KB. The Security Log file is checked once per hour with a WordPress Cron. The optimum recommended file size setting is 500KB. = BulletProof Security Fast and Simple with No Manual Configuration Required = The BulletProof Security WordPress Security plugin is designed to be a fast, simple and one click security plugin to add .htaccess website security protection for your WordPress website. Activate .htaccess website security and .htaccess website under maintenance modes from within your WordPress Dashboard - no FTP required. The BulletProof Security WordPress plugin is a one click security solution that creates, copies, renames, moves or writes to the provided BulletProof Security .htaccess master files. BulletProof Security protects both your Root website folder and wp-admin folder with .htaccess website security protection, as well as providing additional website security protection. BulletProof Security allows you to add .htaccess website security protection from within the WordPress Dashboard so that you do not have to access your website via FTP or your Web Host Control Panel in order to add website security protection for your WordPress site. BulletProof Security Modes: Root .htaccess security protection, wp-admin .htaccess security protection, Deny All .htaccess self protection, WordPress default .htaccess mode and .htaccess Maintenance Mode (503 Website Under Maintenance). In BulletProof Security Mode your WordPress website is protected from XSS, RFI, CRLF, CSRF, Base64, Code Injection and SQL Injection hacking attempts. = BulletProof Security Maintenance Mode = BulletProof Security Maintenance Mode allows you to create your custom website under maintenance page within BulletProof Security and activate Maintenance Mode to put your website in maintenance mode. Maintenance Mode allows website developers or website owners to access and work on a website while a 503 Website Under Maintenance page is displayed to all other visitors to the website. Allow access to your WordPress Dashboard for only yourself or add additional IP addresses to allow mulitple IP addresses access to your WP Dashboard while in maintenance mode. = BulletProof Security Additional Website Security Protection = WordPress is already very secure, but every website, no matter what type of platform it is built on should have additional website security measures in place as a standard. BulletProof Security provides that additional website security protection that every website should have. = Translations = * Lithuanian by Vincent G from Host1Free.com * Filipino/Tagalog by pointen.dk * Russian by EyeFinity * If you would like to translate the BPS plugin to your language see this BPS Plugin Language Translation Tutorial. Please include a link to your website so that we can add it here. Thank you. * Tip: If you use the Google Chrome Browser you can right mouse click in plugin pages and then click on Translate to... To translate plugin text into your Language. = BulletProof Security Bonus Custom Code = * Brute Force Login Protection .htaccess code * Speed Boost Cache .htaccess code * HotLink Protection .htaccess code - Google, Yahoo, Bing safe * Author ID / Username Bot Probe Protection Code = BulletProof Security htaccess Core (Firewalls, etc.) Features = * Root Folder BulletProof Mode/Firewall * wp-admin Folder BulletProof Mode/Firewall * Built-in .htaccess File Editor & File Manager * Built-in .htaccess Backup and Restore * One-click .htaccess website security protection from within the WP Dashboard * .htaccess security protection against XSS, RFI, CRLF, CSRF, Base64, Code Injection and SQL Injection.......... hacking attempts * TimThumb Vulnerability/Exploit .htaccess security protection (Firewall) * .htaccess Lock / Unlock (404 Read-Only) * .htaccess AutoLock On or Off * Security / HTTP Error Logging - Log 400, 403 and 404 Errors * Security Log: Add / Remove User Agents/Bots to Ignore/Not Log or Allow/Log * Security Log: Turn On / Turn Off / Delete Log * Security Log Automation: Automatically zipped, emailed and replaced based on file size * Automatic .htaccess file updating on BPS upgrade installation * New .htaccess security filters automatically added during upgrade * WP Dashboard Alerts / WP Dashboard Dismiss Notices * Anti Comment Spam .htaccess code - works together with Akismet or other Spam plugins to keep Comment Spam at a minimum * Anti Comment Spambot .htaccess code - Forbid Empty Referrer Spambots * Author ID / User ID / Username Bot Probe Protection * Custom Code feature: Add, Edit, Modify, Save additional Bonus or personal custom .htaccess code * WordPress readme.html and /wp-admin/install.php protected with .htaccess security protection * wp-config.php and bb-config.php files protected with .htaccess security protection * php.ini and php5.ini files protected with .htaccess security protection * WordPress database errors turned off - Verification and function insurance * WordPress version is not displayed / not shown - WordPress version is removed * WP Generator Meta Tag filtered - not displayed / not shown * WP DB default admin username / account check * System Info: PHP, MySQL, OS, Server, Memory Usage, IP, SAPI, WP Filesystem API Method, DNS, Max Upload, Zend Engine Version, Zend Guard/Optimizer, ionCube Loader, Suhosin, APC, eAccelerator, XCache, Varnish, cURL, Memcache and Memcached * Security Status Page - Displays website security status information * File and Folder Permission Checking - CGI / DSO - SAPI check / display * Help & FAQ page - links to BPS Guide and other detailed Help & Info pages * Extensive Read Me! jQuery Dialog Help buttons throughout the BulletProof Security plugin pages * Website Developer Maintenance Mode (503 website open to Developer / Site Owner ONLY) * Log in / out of your website while in Maintenance Mode * Customizable 503 Website Under Maintenance page * HUD Success / Error message display * i18n Language Translation coding = BulletProof Security Login Security & Monitoring Features = * Brute Force Login Security Protection * Log All User Account Logins or Log Only User Account Lockouts * Logged DB Fields: User ID, Username, Display Name, Email, Role, Login Time, Lockout Expires, IP Address, Hostname, Request URI * Email Alerting Options: User Account is locked out, An Administrator Logs in, An Administrator Logs in and when a User Account is locked out, Any User logs in and when a User Account is locked out, Do Not Send Email Alerts * Login Security Additional Options: Max Login Attempts, Automatic Lockout Time, Manual Lockout Time, Max DB Rows To Show, Turn On/Turn Off * Login Security Stealth Mode: Standard WP Error Messages or Generic Error Messages. * Login Security Stealth Mode: Enable or Disable Login Password Reset capability and links. * Dynamic DB Form: Lock, Unlock, Delete * Enhanced Search: Allows you to search all of the Login Security database rows/Fields * Stand-alone Unlock Form bpsunlock.php: Unlock User Accounts without having to be logged into the WP Dashboard * Please click the Login Security Blue Read Me help button for full descriptions of all features and options. == Installation == 1. Install, activate plugin, click AutoMagic buttons, Activate BulletProof Modes, choose Login Security options and turn On Login Security. 2. Download Installation: 3. Download the bulletproof-security.zip file to your computer and unzip it. 4. Upload the bulletproof-security folder (including all files within) to your /wp-content/plugins folder. 5. Activate plugin, click AutoMagic buttons, Activate BulletProof Modes, choose Login Security options and turn On Login Security. 6. Enjoy! == Frequently Asked Questions == = How does the BulletProof Security Plugin htaccess Core (Firewalls) work? = The BulletProof Security Plugin allows you to instantly create and activate .htaccess website security with one click (ok maybe a few clicks) for your website without having to know anything about .htaccess files. The Master .htaccess files are pre-made and BPS writes .htaccess code that is customized for your website. There is nothing to figure out or to configure. Click the AutoMagic buttons (creates customized Master .htaccess files) and Activate BulletProof Modes (copies the customized Master .htaccess files to your root and wp-admin folders). BPS has built-in Backup and Restore and an .htaccess File Editor for full manual editing control as well. BulletProof Website Security fast and simple. Enjoy! = How does BulletProof Security Plugin Login Security & Monitoring work? = BulletProof Security Login Security & Monitoring allows you to choose whether you want to Log All User Account Logins or Log Only User Account Lockouts. The Dynamic DB Logging Form has 3 checkbox options: Lock, Unlock or Delete database rows. The Login Security database table is hooked into the WordPress Users database table, but they are 2 completely separate database tables. If you lock a User Account then BPS Pro will enforce that lock on that User Account and the User will not be able to log in. If you unlock a User Account then the User will be able to login. Deleting database rows in the Login Security database table does NOT delete the User Account from the WordPress Users database table. When you delete a User Account it is pretty much the same thing as unlocking a User Account. To delete actual User Accounts you would go to the WordPress Users page and delete that User Account. = What do I do if my User Account is locked out? = A stand alone Login Security Unlock User Account Form has been created that allows you to Unlock locked User Accounts outside of your WordPress Dashboard. To use this stand alone script download it from this BulletProof Security Pro plugin folder - /wp-content/plugins/bulletproof-security/admin/htaccess/bpsunlock.php and then upload it to your website root folder. Then type in the path to the bpsunlock.php file in your Browser. Example: http://www.example.com/bpsunlock.php. The stand alone script displays step by step instructions on how to use it. = Do I need to understand .htaccess code in order to use the BulletProof Security Plugin htaccess Core? = No, The .htaccess file creation is automated in BulletProof Security. Everything is automatically done for you. You do not need to know or understand anything about .htaccess website security files in order to use the BulletProof Security plugin. Extensive help information can be found in the Blue Read Me help buttons in BPS. = What do I do if I cannot log back into my website due to an htaccess file problem? = If you accidentally activated BulletProof Modes without first clicking the AutoMagic buttons or if you put your website in Maintenance Mode and your IP address has been changed by your ISP and you cannot log back into your website then you will need to use FTP or your Web Host Control Panel File Manager and delete the .htaccess file that BPS created in your website root folder. BPS website security is done purely with .htaccess website security and nothing else is modified on your website. So simply deleting the .htaccess file in your website root folder removes BPS website security and will allow you to log back in, use the AutoMagic buttons and activate BulletProof Mode again to protect your website again. = Will BulletProof Security cause my website to run slower? = No, BulletProof Security will not cause a website to run slower. BulletProof Security is website performance optimized and uses very little/low website resources and very little Server memory. If you would like to check your plugins to check how much website resource and Server memory each of your plugins is using install the P3 (Plugin Performance Profiler) plugin. Both W3 Total Cache and WP Super Cache use .htaccess code to speed up your website. = Can BulletProof Security speed up my website and make it run faster? = Yes, BulletProof security can speed up your website and make it run faster if you use the Speed Boost Cache Bonus Code and add it to BPS Custom Code. See the BulletProof Security Bonus Custom Code section on the BulletProof Security plugin Description page for a link to the Speed Boost Cache Bonus Code. = BPS Alert! Your site does not appear to be protected by BulletProof Security. What does the Alert mean? = When upgrading/updating the BulletProof Security plugin you may see this WP Dashboard Alert. BPS Alert! Your site does not appear to be protected by BulletProof Security. There are 2 very common issues/problems that can cause this. The cPanel HotLink Protection Tool issue or the WordPress flush_rewrite_rules function issue. Click this link Common BPS Issues Note: Any custom htaccess code or modifications that you have made to your htaccess files will not be altered, modified or changed during the auto-update. Activating BulletProof Modes again after upgrading BPS is no longer necessary. = Where can I find BulletProof Security additional troubleshooting steps & support? = Please see the BulletProof Security Forum. = BulletProof Security Server Compatibilty = * Compatible with Apache CGI configured Servers * Compatible with Apache DSO configured Servers (May require CHOWN Ownership change or file/folder permission changes) * DSO Help Info * Compatible with Nginx frontend Server with Apache backend Server * Compatible with LiteSpeed Servers * Compatible with Windows IIS Servers - Windows Hosting - See IMPORTANT NOTES below. * If your IIS Server has ISAPI_Rewrite installed then you CAN use .htaccess files / BulletProof Modes. * IMPORTANT NOTES: If you have an IIS Server you may or may not be able to use .htaccess files and can only use Login Security & Monitoring. If your IIS Server is using the URL Rewrite Module then you can probably use .htaccess files / BulletProof Modes. If you activate BulletProof Modes and your website crashes then FTP to your website and delete the root .htaccess file and the wp-admin .htaccess file. You will not be able to use .htaccess files on your Server/website and can only use Login Security and the other features in BPS. = Additional BulletProof Security Server Compatibilty Info = BulletProof Security uses .htaccess website security files, which are specific to Apache Linux Servers. BPS is compatible with Apache Linux Servers, LiteSpeed Servers, Nginx Servers (if the Nginx Server is the frontend Server and Apache Linux Server is the backend Server). If you do not know what type of Server you have you can check your Server Type and Operating System on the BPS System Info page. You can install BulletProof Security if you have a Windows IIS hosted website to use the additional features in BPS, but may or may not be able to Activate BulletProof Modes depending on what your IIS Server does and does not have installed / configured. Please see this WordPress Codex Permalinks without mod_rewrite for additional information regarding IIS Servers and also the Helicon Tech website for additional information regarding ISAPI_Rewrite. = Does BulletProof Security Work on ALL Nginx Servers / Server Configurations? = If you are using both Apache and Nginx together and Nginx is the frontend webserver and Apache is the backend Server used to process PHP then BulletProof Security will work on this type of combined Server Configuration. If you are only using Nginx then an .htaccess file will not work. Nginx has its own rewrite module - HttpRewriteModule and the mod_rewrite equivalent of an .htaccess file has similar, but different coding and is added to an Nginx Server config file. Note: If you are not familiar with Nginx, then it should be noted that Nginx does not have a PHP module like Apache's mod_php, instead you either need to build PHP with FPM (ie: php-fpm/fastcgi), or you need to pass the request to something that can handle PHP. = Are there any known issues or conflicts with other WordPress Plugins or Themes? = Occasionally issues or conflicts do occur with other plugins, but they are always quickly resolved. BPS is compatible with all other Plugins and Themes. An .htaccess bypass / skip rule is all that is required to allow a plugin or theme to do something that is blocked by BPS. Please check the BulletProof Security Plugin Compatibility Testing and Fixes page for the latest plugin bypass / skip rules. All new plugin skip / bypass rules are now being posted in the BulletProof Security Forum. = I am seeing Security Log entries in my BulletProof Security Log. What do they mean? = Your Security Log will log 400, 403 and 404 (requires copying the BPS 404 logging code to your Theme's 404.php Template) Errors. The Security Log logs 400 and 403 HTTP Response Status Codes by default. You can also log 404 HTTP Response Status Codes by opening this BPS 404 Template file - /bulletproof-security/404.php and copying the logging code into your Theme's 404 Template file. When you open the BPS Pro 404.php file you will see simple instructions on how to add the 404 logging code to your Theme's 404 Template file. = HTTP Response Status Codes = * 400 Bad Request - The request could not be understood by the server due to malformed syntax. * 403 Forbidden - The Server understood the request, but is refusing to fulfill it. * 404 Not Found - The server has not found anything matching the Request-URI / URL. No indication is given to whether the condition is temporary or permanent. = What is the difference between BulletProof Security free and BulletProof Security Pro? = = BulletProof Security = * .htaccess Website Security Protection (Firewalls) * Security Logging * HTTP Error Logging * Login Security & Monitoring = BulletProof Security Pro Feature Highlights = * 1 Click Setup Wizard - Setup takes less than 1 minute * AutoRestore - Automatic File Restore * Quarantine - Automatic File Quarantine * Real-time IDPS File Monitor (ARQ IDPS) * Plugin Firewall (true IP Based Firewall) * JTC Anti-Spam / Anti-Hacker * Uploads Folder Anti-Exploit Guard (UAEG) * .htaccess Website Security (Firewalls) * Custom php.ini Website Security * Login Security & Monitoring w/Dashboard Alerting / Status Display & additional options/features * F-Lock - Read Only File Locking * Security Logging * HTTP Error Logging * PHP Error Logging * AutoRestore/Quarantine Logging * Displayed Alerts / Email Alerts * Versatile Set of Pro-Tools... * Base64 Decoder / Encoder... * View All BulletProof Security Pro Feature Details = Is BulletProof Security Network / Multisite Compatible? = Yes. BulletProof Security contains AutoMagic buttons for Network / Multisite websites. Both sub-directory and sub-domain Master .htaccess code is written / created for your specific Network / Multisite site based on your WordPress version. The BulletProof Security plugin can be Network Activated or you can allow BulletProof Security to be activated individually on each Network / Multisite subsite or of course you can choose not to Network Activate BulletProof Security or allow the BPS plugin on subsites. Only Login Security and System Info menus are available on subsites. Super Admins will see BPS Dashboard Alerts and other Status displays on the Primary Site only. Administrators can activate or deactivate BulletProof Security on subsites if you allow this on your Network / Multisite website. The BPS Primary Site Menus will display all BPS menus. All other BulletProof Security features are not available on subsites since Network/Multisite subsites are virtual and do not have separate website files of their own. All of the other standard BulletProof Security features work sitewide and affect all other virtual subsites with the exception of Login Security which works individually for each specific website - Primary or virtual subsites and therefore should only be available to and controlled by the Super Admin with Network Admin capabilities for the Network/Multisite website. BulletProof Security also works with Network / Multisite Domain Mapping. = Is BulletProof Security BuddyPress Compatible? = Yes. BulletProof Security works with all BuddyPress site types. = Is BulletProof Security Compatible with subdomain websites and subdirectory websites? = Yes, BulletProof Security works on all types of WordPress installations including "Giving WordPress Its Own Directory" websites. = Is BulletProof Security automatically setup already? = Yes and No. You must be using a WordPress Custom Permalink structure for BPS to work correctly (every WordPress site should be anyway). If you are not using a custom Permalink structure then you will get a warning message that Custom Permalinks need to be enabled when you access the BulletProof Security Options page. BulletProof Security includes AutoMagic Master .htaccess file creation so that only one click is required to automatically create your Master .htaccess security files for your website, which you then Activate - BulletProof Mode. BulletProof Security also offers full manual control of editing the .htaccess files using the built-in File Editor. BulletProof Security is designed with everyone in mind: regular folks, Designers, Developers and Coders. BulletProof Security is designed to work with every type of WordPress installation: Single websites, subfolder websites, subdomain websites, "Giving WordPress its Own Directory" websites, Network / Multisite subdirectory websites and Network / Multisite subdomain websites. BulletProof Security will automatically create the correct Master .htaccess files for your website when you click the AutoMagic buttons. If you prefer to do everything manually then you would edit your .htaccess using the built-in .htaccess File Editor instead of using Automagic to automatically create your .htaccess files. = Can I add my own .htaccess code to the BulletProof Security .htaccess files? = Yes. Of course. The secure.htaccess and wpadmin-secure.htaccess Master .htaccess files already contain .htaccess security code that protects your website against XSS, RFI, CRLF, CSRF, Base64, Code Injection and SQL Injection hacking attempts. Add any additional security filters or other .htaccess code to your Master .htaccess files or your currently active .htaccess files using the built-in .htaccess File Editor. The BulletProof Security Master .htaccess files contain help info and additional options within the .htaccess files themselves. htaccess files can do a lot of neat things besides just providing website security protection. As of version .46.9 you can now also add any custom code to the Custom Code feature. Your custom .htaccess code will be saved to your WP DB permanently until you delete it. Please view the Read Me Help button in Custom Code for specific details. = Does the BulletProof Security Plugin create or write the .htaccess files? = Yes, BulletProof Security creates customized .htaccess website security files with AutoMagic. BulletProof Security also offers full manual control of editing both the BPS Master .htaccess files and your currently active .htaccess files using the built-in .htaccess File Editor. The BPS Master .htaccess files have already been pre-made. When you click the AutoMagic buttons your .htaccess Master files are created with specific code for your specific website with the correct RewriteRule and RewriteBase automatically added to your .htaccess files. You can add additional code to the master .htaccess files, edit the .htaccess files or create completely new .htaccess master files from within the WordPress Dashboard using the built-in BPS File Editor - no FTP required - no Web Host Control Panel required. BPS could also just be used simply as an online .htaccess file editor and manager. AutoMagic is great, but having both AutoMagic and full manual editing control makes BulletProof Security a very versatile website security protection tool. = Does BulletProof Security work with Git distributed version control system? = Yes, BulletProof Security works with Git, but does require some additional set up steps. Please see this thread for the setup steps Git distributed version control system setup steps == Screenshots == 1. BulletProof Security - Security Modes page 2. BulletProof Security - Security Log page 3. BulletProof Security - System Info page 4. BulletProof Security - htaccess File Editor page 5. BulletProof Security - Login Security and Monitoring page == Changelog == = .49.8 = * Custom Code Code Correction: ENT_QUOTES flag added to Custom Code AutoMagic variables to convert Single Quote HTML entities stored in the DB back to characters during AutoMagic File writing. * Enjoy! = .49.7 = * Network / Multisite Plugin Network Activation or Single subsite Plugin Activation: As of BulletProof Security .49.7, the BPS plugin can be Network Activated or you can allow the BPS plugin to be activated individually on each Network / Multisite subsite or of course you can choose not to Network Activate BPS or allow the BPS plugin on subsites. * New AutoMagic WP 3.5+ Network / Multisite .htaccess code: BPS AutoMagic buttons automatically write the correct Network / Multisite root .htaccess code for your site based on your WordPress version. * Network / Multisite New Feature Notice: BPS can now be Network Activated on Multisite: This Network / Multisite New Feature Dismiss Notice displays on Network / Multisite only to alert Network / Multisite site owners about the new Network Activation capability in BPS. * CSS Visual Style Changes for WP 3.8+ MP6 & Pre 3.8 WP Versions: WordPress 3.8 is using the new MP6 GUI. A BPS 3.8 CSS stylesheet has been created to visually display things correctly in WordPress 3.8. BPS will automatically load the correct CSS stylesheet for your WordPress version. CSS visual enhancements were also created for pre WordPress 3.8 versions. * See the BPS Whats New page for more details * Enjoy! = .49.6 = * Bonus Code Dismiss Notice Added: Author ID / User ID / Username BOT Probe Protection Code: Protects against hacker Bot Probes looking for WordPress author enumeration (a numbered list of Author ID's / User ID's) to exploit. Generates a standard WordPress 404 Error instead of displaying Author ID's / User ID's / Usernames. * Root .htaccess File code modifications/changes: 
OLD: RedirectMatch 403 /\..*$
NEW: RedirectMatch 403 \.(htaccess|htpasswd|errordocs|logs)$

BPS Query String Exploits Code Changes
OLD: RewriteCond %{QUERY_STRING} (\.\./|\.\.) [OR]
NEW: RewriteCond %{QUERY_STRING} (\.\./|%2e%2e%2f|%2e%2e/|\.\.%2f|%2e\.%2f|%2e\./|\.%2e%2f|\.%2e/) [NC,OR]

OLD: RewriteCond %{QUERY_STRING} (\./|\../|\.../)+(motd|etc|bin) [NC,OR]
NEW: RewriteCond %{QUERY_STRING} (\.{1,}/)+(motd|etc|bin) [NC,OR]

OLD: RewriteCond %{QUERY_STRING} [a-zA-Z0-9_]=http:// [OR]
NEW: RewriteCond %{QUERY_STRING} [a-zA-Z0-9_]=http:// [NC,OR]

OLD: RewriteCond %{QUERY_STRING} [a-zA-Z0-9_]=(\.\.//?)+ [OR]
NEW: RewriteCond %{QUERY_STRING} [a-zA-Z0-9_]=(\.\.//?)+ [NC,OR]
* See the BPS Whats New page for more details * Enjoy! = .49.5 = * Reverting: Brute Force Login Protection code is now optional/Bonus Code again * BPS will not automatically add this code as standard code in the root .htaccess file * The Brute Force Login Protection Custom Code text box will remain for folks who can use this code on their websites. * See the BPS Whats New page for more details * Enjoy! = .49.4 = * Code Mod to Brute Force Login Protection code to allow for the widest possible range of compatibility * This affected a small number of folks * MOD: RewriteCond %{HTTP_USER_AGENT} ^(|-?)$ [NC,OR] to RewriteCond %{HTTP_USER_AGENT} ^$ [OR] * Enjoy! = .49.3 = * New Feature - Security Log zip, email and delete/replace option: Security Log files are automatically zipped, emailed and replaced with a new blank security log file when they reach the maximum file size setting on the Security Log page. During the BPS upgrade this is automatically set to zip and email log files when they reach 500KB in size. * Structural/Menu Changes: The Security Log & System Info tab pages have been moved out of htaccess Core and now have their own separate pages/menu links. * New standard root .htaccess code added: Server Protocol HTTP/1.0 and blank User Agent htaccess BRUTE FORCE LOGIN PAGE PROTECTION code is now standard .htaccess code in the BPS root .htaccess file. * New BPS Custom Code Text box added: A new Custom Code Text box has been added: CUSTOM CODE BRUTE FORCE LOGIN PAGE PROTECTION. * Check Headers Tool added to the System Info page: This tool Allows you to check your website Headers or another website's Headers remotely. * New System Info page check - Public IP/X-Forwarded-For check: If you are using CloudFlare on your website then you will see Proxy X-Forwarded-For IP Address: instead of Public ISP IP / Your Computer IP Address: displayed to you. This additional check is for troubleshooting issues with CloudFlare, CDN, Proxy or VPN. * PHP mysqli_get_client_info function additional check Additional function checking code has been added in cases where the mysqli_get_client_info function is not available on a Host Server. * Enjoy! = .49.2 = * Dismiss Notice text corrections: S-Monitor page text changed to Security Status page * W3TC & WPSC Alerts text corrections: Edit/Upload/Download page text changed to htaccess File Editor page * Several BPS functions renamed for uniqueness/no-conflict assurance * PHP 5.5.x Deprecated function replacement file options.php: mysql_get_client_info replaced with mysqli_get_client_info * PHP 5.5.x Deprecated function replacements file bpsunlock.php: New code using MySQLi instead of MySQL * Enjoy! = .49.1 = * Backup folder path correction on Backup & Restore page * WP Filesystem API Method will display the WordPress Filesystem Method in use. For DSO Server troubleshooting additional fields will be displayed if the Script Owner and File Owner ID's do not match. * Custom Code help text changes * Custom Code additional error checking * htaccess auto-writing additions * Additional root htaccess file placeholders/markers added * New Dashboard Dismiss Notices: Sucuri 1-click Hardening, Broken Link Checker, phpini handler, Speed Boost Custom Code, Custom Permalinks check * Dashboard Alerts are now only displayed to Administrators. Editors, Authors, etc will no longer see Alerts * The htaccess Core Edit/Upload/Download tab page has been renamed to htaccess File Editor. * The File Upload & Download features have been removed from the new htaccess File Editor page since these features/options are obsolete. * Visual Enhancements: AutoMagic font size increased, etc. * Enjoy! = .49 = * Security Vulnerability/Bug Fix/Patch: HTML rendered in Security Log file via Logged Header Fields * Special Thanks go to Jacek Sowinski via Secunia SVCRP for discovering this vulnerability. * Solution/Fix: Security Log logged Header Fields are now HTML escaped * Enjoy! = .48.9 = * 2 New Login Security Options Added: * Error Messages: Choose to display Standard WP Login Error Messages or Generic Error Messages. * Password Reset: Enable or Disable Login Password Reset capability. This option also includes additionl Stealth Mode capabilities. Please read the Blue Read Me help button on the BPS Login Security page for a full description and additional help information. * Login Security Bug Fix/Code Correction: Using the /wp-login.php URL no longer generates an initial login error. * New Dismiss Notice - Brute Force Login Protection Code: At some point the Brute Force Login Protection code will be standard in BPS .htaccess files. For now a dismiss notice has been added with a link to the Brute Force Login Protection code. * Additional error checking & Overall Code Improvements: Really too many things to list so in general BPS .48.9 is more streamlined, has better/additional error checking and overall code improvements throughout BPS. * Enjoy! = .48.8 = * Code / Help Text Corrections * Corrected Help Text typos in Custom Code. Code Correction for the Network/Multisite menus / pluggable.php issue * Enjoy! = .48.7 = * Auto-update now displays ONLY - The BPS Automatic htaccess File Update Completed Successfully! * The old Dashboard Alert has caused a lot of confusion so it is now history * Enjoy! = .48.6 = * Custom Code Additions: Custom Code now includes additional Text Areas/Text Boxes for every possible section of code in the Root and wp-admin .htaccess files * A jQuery Accordian has been added to Custom Code to ensure that the correct Custom Code Text Areas/Text Boxes are being used, better functionality and visual enhancement. * Windows IIS check/dismiss notice. Displays a dismissable alert for folks who have Windows IIS Servers that allow .htaccess rewriting or have ISAPI_Rewrite installed which allows/converts .htaccess rewriting. * Reset / Recheck Dismiss Notices added to Security Status page * Lots of other improvements * Enjoy! = .48.5 = * Bug fix: Conditional wrap added to /includes/login-security.php * Enjoy! = .48.4 = * Login Security & Monitoring * Log All User Account Logins or Log Only User Account Lockouts * Logged DB Fields: User ID, Username, Display Name, Email, Role, Login Time, Lockout Expires, IP Address, Hostname, Request URI * Email Alerting Options: User Account is locked out, An Administrator Logs in, An Administrator Logs in and when a User Account is locked out, Any User logs in when a User Account is locked out, Do Not Send Email Alerts * Login Security Additional Options: Max Login Attempts, Automatic Lockout Time, Manual Lockout Time, Max DB Rows To Show, Turn On/Turn Off * Dynamic DB Form: Lock, Unlock, Delete * Enhanced Search: Allows you to search all of the Login Security database rows/Fields * Stand-alone Unlock Form bpsunlock.php: Unlock User Accounts without having to be logged into the WP Dashboard * Please click the Login Security Blue Read Me help button for full descriptions of all features and options. * Enjoy! = .48.3 = * jQuery Code changes for the new jQuery version in WordPress 3.6 * Enjoy! = .48.2 = * Bug fix: Turn On/Off Error logging pattern match correction to include all possible scenarios * Bug fix: ErrorDocument 401 default added/removed on Turn Error Logging On/Off * Enjoy! = .48.1 = * Security Log - Add / Remove User Agents/Bots to Ignore/Not Log or Allow/Log * New htaccess code - ErrorDocument 401 default * General Coding Improvements & Enhancements * Enjoy! = .48 = * facebook externalhit_uatext.php script/error log fix * 400, 403 and 404 Error Logging templates modified * General Coding Improvements & Enhancements * Enjoy! = .47.9 = * Security Logging / HTTP Error Logging On / Off buttons added * Turn Security Logging / HTTP Error Logging On or Off on the Security Log page * Russian Translation by EyeFinity * General Coding Improvements & Enhancements * Enjoy! = .47.8 = * Security Logging / HTTP Error Logging - Log 400, 403 and 404 Errors * Security Logging / HTTP Error Logging Dashboard Alert - log file size * IMPORTANT: NEW root .htacess file code automatically created/modified on upgrade * Additional System Info Check Added: cURL Extension * General Coding Improvements & Enhancements * Enjoy! = .47.7 = * IMPORTANT UPDATE: .htaccess FILE UPDATE FOR WordPress 3.5 * 3.5 BUG FIX: visual and text editor display blank boxes * Problem: Square Bracket filters are blocking the visual and text editor * Solution: Square Brackets are automatically removed from .htaccess files/filters on upgrade to .47.7 * Enjoy! = .47.6 = * BPS Master htaccess Folder Deny All .htaccess security protection automated * BPS Backup Folder Deny All .htaccess security protection automated * Turn On AutoLock / Turn Off AutoLock options/buttons added * General Coding Improvements & Enhancements * Visual Improvements/Enhancements * Enjoy! = .47.5 = * General Coding Improvements & Enhancements: * WordPress 3.5 pre-release coding added * Visual Improvements/Enhancements * jQuery coding Improvements/Enhancements * .htaccess code Additions and Improvements * Anti-Comment Spam .htaccess coding added * DNS Host Name Check for htaccess file auto-lock * Screenshot image files moved to the assets folder to reduce plugin size = speedier upgrades * Enjoy! = .47.4 = * Improved and Extended Automatic htaccess File Upgrading * No need to reactivate BulletProof Modes when upgrading * Automatic updating from .46.9 to the current version of BPS * Additional System Info Checks Added: * Zend Engine Version, Zend Guard/Optimizer, ionCube Loader, Suhosin, APC, eAccelerator, XCache, Varnish, Memcache and Memcached * System Info Checks: check if extensions are installed, loaded, enabled or disabled * Additional Memory Limit Checks: WordPress Admin Memory Limit, WordPress Base Memory Limit and PHP Actual Configuration Memory Limit * Enjoy! = .47.3 = * .47.2 Automatic .htaccess file updating on upgrade installation added * No need to reactivate BulletProof Modes when upgrading * .47.2 New htaccess security filter added automatically during upgrade * .47.3 New htaccess security filter added automatically during upgrade * .47.3 Deny All protection automatically activated for BPS Master /htaccess folder * WP Dashboard Alerts - Root and wp-admin htaccess file checks * Enjoy! = .47.2 = * Automatic .htaccess file updating on upgrade installation * No need to reactivate BulletProof Modes when upgrading * New htaccess security filter added automatically during upgrade * WP Dashboard Alerts - Root and wp-admin htaccess file checks * Lithuanian Language Translation by Vincent G from Host1Free.com * Enjoy! = .47.1 = * A very minor coding mistake - A superglobal did not have html entities escaped * No reported problems or issues * Sincere thanks to SiNA Rabbani for discovering this coding mistake * Sincere thanks to Jon and Mark from WordPress.org as well for assistance = .47 = * View the Whats New page in BPS for the latest changes to BPS * No changes have been made to either the Root or wp-admin .htaccess files * i18n Language Translation Coding Added * Language Translation Tutorial link added to the Whats New page in BPS * Coding improvements / enhancements * Enjoy! = .46.9 = * Significant changes to both the Root and wp-admin .htaccess files Create new Master .htaccess files with AutoMagic and activate all BulletProof Modes. * NEW Custom Code feature added to BPS * Coding improvements / enhancements * Enjoy! = .46.8 = * New TimThumb .htaccess code allows internal image requests but Forbids RFI hacking attempts * BPS is no longer Forbidding TimThumb thumbnailer scripts by default * DNS Name Server check on System Info page * Coding improvements / enhancements * WP Rating and Download Stats added to BPS * CSS nick nacks * Enjoy! = .46.7 = * New jQuery Dialog Read Me Help buttons have been created to replace the old Hover ToolTips * WP_CONTENT_DIR replaces ABSPATH path for sites that have moved wp-content to another location * .htaccess Return Carriage filter modified * .htaccess Slash-Jack filter modified * Several new pop up confirm messages have been added throughout BPS for forms that perform critical operations * Several new SAPI types have been added to CGI and DSO checking * AutoMagic for Network / Multisite sub domain sites is no longer writing the wp-admin forbid coding * Link to Sucuri Malware Website Scanner added * BPS is Forbidding Thumbnailer Scripts by Default * To enable Thumbnailer Scritps see root .htaccess file * Enjoy! = .46.6 = * Cookie filter removed from BPS QUERY STRING EXPLOITS * Explicit "exec" and "execute" filter removed from BPS QUERY STRING EXPLOITS * non-GPL Javascript Countdown Timer removed * BPS is Forbidding Thumbnailer Scripts by Default * To enable Thumbnailer Scritps see root .htaccess file * Enjoy! = .46.5 = * Massive amount of new security filters * Complete restructuring of how .htaccess Rewriting is processed to work with WP * Network / Multisite AutoMagic buttons added * Network / Multisite code added for Super Admins - display BPS menus to Super Admins only * New System Info information added * File permission checking and recommendations for CGI or DSO - SAPI detection * File Lock / Unlock buttons - Read Only root .htaccess - CGI / DSO SAPI detection * Help info updated * Updated Whats New * Lots of other stuff * Enjoy! = .46.4 = * Network / Multisite detect with additional help info * chmod 0644 added to copy function for default, secure and wp-admin htaccess files * Fixed CSS display issues for WP versions 3.2+ * Replaced PP donate link with BPS Pro Upgrade link * Replaced BPS Pro Modules page with BPS Pro Features page * Security Status print output instead of var_dump * Help info updated * Other CSS changes * Updated Whats New = .46.3 = * BPS Security Top Level Menu added * Whats New page was added - Read the new Whats New page for details about the latest changes to BPS * BPS Master htaccess file changes * Maintenance Mode page changes - Form settings saved to the WP DB * HUD, W3TC and WPSC - Heads Up Display checks / messages changes / additions * wp-admin htaccess file removal added * My Notes page was added = .46.2 = * Additional new .htaccess security coding and modifications added to the BPS master .htaccess files * New plugin conflict permanent fixes added to the secure.htaccess Master file * BulletProof Security is now fully AutoMagic and still offers full manual control = .46.1 = * Additional new .htaccess coding and modifications added to the BPS master .htaccess files * New plugin conflict permanent fixes added to the secure.htaccess Master file * Maintenance Mode is AutoMagic - Completed the Maintenance Mode page ...finally * Create the Maintenance Mode Under Maintenance page from within the Dashboard * Preview your Website Under Maintenance page from within the Dashboard * New System Information Displayed - WordPress Installation Folder, WordPress Installation Type and * WP Permalink Structure Checks and displayed info * Heads Up Display (HUD) created * Improved Error and Warning messages * Major Core code improvements * nick nack core code fixes and improvements * New Help and FAQ links - new help pages created on AIT-pro = .46 = * New File Uploader code written - no longer using Uploadify code * New File Downloader code written - no longer using Zubrag code * File Uploader is AutoMagic - no setup required * File Downloader is one-click - no setup required * Major overhaul of the core BPS coding * !!! Special Thanks to Jon Cave!!! * for finding a CSRF security vulnerability in BPS .45.9 * that has now been eliminated in BPS .46 with new coding * And also excellent coding advice to improve BPS even more * and making the entire WordPress Community a safer and better place * New permanent plugin conflict fixes added to master .htaccess files = .45.9 = * !!!Critical Update!!! * Security Patch Release = .45.8 = * Permanent Backup and Restore options added - permanent online backup and restore * Permanent Backup and Restore for all .htaccess files * Permanent Backup and Restore for File Uploader and File Downloader setup settings * Additional new .htaccess coding and modifications added to the BPS master .htaccess files * New plugin conflict permanent fixes added to the secure.htaccess Master file * WordPress readme.html and /wp-admin/install.php are now protected by BulletProof Security * Improved Success / Error messaging - more detailed success / error messages displayed * New Help and FAQ links added - New detailed Help and Info pages created = .45.7 = * Additional .htaccess coding filters added to the BPS master .htaccess files * File Editor added - Edit the BPS .htaccess files from within the WP Dashboard * File Uploader added - Upload files from within the WP Dashboard * File Downloader added - Download files from within the WP Dashboard * Deny All BulletProof Security Modes added for the /htaccess folder and /backup folder * Nick Nacks, etc. = .45.6 = * !!!CRITICAL UPDATE!!! * New SQL Injection hacking method blocked - New code added to master .htaccess files * This update protects against this latest new SQL Injection hacking method * Installing BPS does not activate the new BPS .45.6 .htaccess files * After installation please activate the BPS .45.6 BulletProof modes * Please download your current htaccess files first before activating BPS .45.6 Security Modes = .45.5 = * The SVN DB problem for BPS was fixed by some awesome person at WP! * WP ROCKS!!! BPS .45.5 will install successfully now. ;) * Bug fixes: W3 Total Cache, Simple Facebook Connect, Ozh' Admin Drop Down Menu, ComicPress * Permanent coding fixes incorporated into master htaccess files to replace workarounds * Additional mission critical PHP Info checks added * Php.ini and php5.ini files are now protected by BulletProof Security * Updated BPS help files - AITpro.com site help files pending * nick nacks here and there = .45.4 = * SVN DB Corruption - unable to use this version - will not download - will not install * Bug fixes: W3 Total Cache, Simple Facebook Connect, Ozh' Admin Drop Down Menu, ComicPress * Permanent coding fixes incorporated into master htaccess files to replace workarounds * Additional mission critical PHP Info checks added * Php.ini and php5.ini files are now protected by BulletProof Security * Updated BPS help files - AITpro.com site help files pending * nick nacks here and there = .45.3 = * More Query String Exploit Filters added to BPS Master .htaccess files * Options -Indexes added to BPS Master .htaccess files at user requests * Added IP address display to maintenance mode javascript countdown timer display * No need to click Update Permalinks anymore for Maintenance Mode - RewriteRule override added = .45.2 = * New Apache Directives for PHP5 added to the .htaccess master files * Maintenance mode master .htaccess code modified - RewriteCond to load new background png * Maintenance Mode log in / log out issue fixed - Log in / out of your Dashboard in Maintenance Mode * Website Under Maintenance coding modifcations and visual design enhancements * Background Graphic for Website Under Maintenance page created and added in the installation * Minor cosmetic nicks nacks fixed here and there * Help files and hover tool tips help info updated * Tested on WordPress 3.1-alpha - no issues or problems = .45.1 = * Bug fix for version check of BPS .htaccess master file * Bug fix for wp-config.php check based on BPS .htaccess version * Fix - BPS plugin uninstall issue fixed * Fix - BPS Widget configuration issue fixed * Completely recoded with WordPress 3.0 coding enhancements and improvements * Completely new sophisticated visual design and look * jQuery UI Tabbed Menu with CSS Hover Menu Buttons - see screenshot * New Messaging Display System added * ,htaccess code added to master files to .htaccess protect wp-config.php * WordPress DB error on / off checking and verification status display * WordPress version is not displayed - remove_action('wp_head', 'wp_generator'); * WP generator meta tag removed - remove_action('wp_head', 'wp_generator'); * Administrator username “admin” check * System information page displays PHP, MySQL, Server Info, etc. - see screenshot * Security Status page added - see screenshot * Help & FAQ page added * BPS Pro Modules page added - BPS Pro Modules are installed separately * New BPS .45.1 Guide created @ AIT-pro.com = .45 = * Completely recoded with WordPress 3.0 coding enhancements and improvements * Completely new sophisticated visual design and look * jQuery UI Tabbed Menu with CSS Hover Menu Buttons - see screenshot * New Messaging Display System added * ,htaccess code added to master files to .htaccess protect wp-config.php * WordPress DB error on / off checking and verification status display * WordPress version is not displayed - remove_action('wp_head', 'wp_generator'); * WP generator meta tag removed - remove_action('wp_head', 'wp_generator'); * Administrator username "admin" check * System information page displays PHP, MySQL, Server Info, etc. - see screenshot * Security Status page added - see screenshot * Help & FAQ page added * BPS Pro Modules page added - BPS Pro Modules are installed separately * New BPS .45.1 Guide created @ AIT-pro.com = .44.1 = * If you are upgrading from .44 to .44.1 download the /htaccess folder first * before upgrading and upload it back to the back to the BulletProof plugin folder * after you have upgraded to .44.1. * Added Backup form function - backs up users original existing htaccess files * Added Restore form function - restores users original existing htaccess files * Backup folder added for backed up original htaccess files * Removed links from all ToolTips except for the top Read Me! hover ToolTip = .44 = * First version release of BulletProof Security * Extensive Read Me! help hover ToolTips added to the BulletProof plugin page * Visual and coding Enhancements made to the BulletProof Maintenance page * Function check_perm redeclare conflict fixed == Upgrade Notice == = .49.8 = * Custom Code Code Correction: ENT_QUOTES flag added to Custom Code AutoMagic variables to convert Single Quote HTML entities stored in the DB back to characters during AutoMagic File writing. * Enjoy! = .49.7 = * Network / Multisite Plugin Network Activation or Single subsite Plugin Activation: As of BulletProof Security .49.7, the BPS plugin can be Network Activated or you can allow the BPS plugin to be activated individually on each Network / Multisite subsite or of course you can choose not to Network Activate BPS or allow the BPS plugin on subsites. * New AutoMagic WP 3.5+ Network / Multisite .htaccess code: BPS AutoMagic buttons automatically write the correct Network / Multisite root .htaccess code for your site based on your WordPress version. * Network / Multisite New Feature Notice: BPS can now be Network Activated on Multisite: This Network / Multisite New Feature Dismiss Notice displays on Network / Multisite only to alert Network / Multisite site owners about the new Network Activation capability in BPS. * CSS Visual Style Changes for WP 3.8+ MP6 & Pre 3.8 WP Versions: WordPress 3.8 is using the new MP6 GUI. A BPS 3.8 CSS stylesheet has been created to visually display things correctly in WordPress 3.8. BPS will automatically load the correct CSS stylesheet for your WordPress version. CSS visual enhancements were also created for pre WordPress 3.8 versions. * See the BPS Whats New page for more details * Enjoy! == Help Info == Extensive Help Info can be found on the AIT-pro.com website and within the BulletProof Security pages themselves. Click on the blue Read Me Help buttons to get Help Info about the particular section or page of the BulletProof Security plugin that you are in. The Help and FAQ page contains links to Help pages that will load in a new browser tab so that you are not redirected away from your WordPress Dashboard. What's New in .49.8 = .49.8 = * Custom Code Code Correction: ENT_QUOTES flag added to Custom Code AutoMagic variables to convert Single Quote HTML entities stored in the DB back to characters during AutoMagic File writing. * Enjoy! = .49.7 = * Network / Multisite Plugin Network Activation or Single subsite Plugin Activation: * As of BulletProof Security .49.7, the BPS plugin can be Network Activated or you can allow the BPS plugin to be activated individually on each Network / Multisite subsite or of course you can choose not to Network Activate BPS or allow the BPS plugin on subsites. Super Admins will see BPS Dashboard Alerts and other Status displays on the Primary Site only. Administrators can activate or deactivate BPS on subsites if you allow this on your Network / Multisite website. * Primary Network / Multisite Site Menus: The BPS Primary Site Menus will display all BPS menus. All other BulletProof Security features are not available on subsites since Network/Multisite subsites are virtual and do not have separate website files of their own. All of the other standard BulletProof Security features work sitewide and affect all other virtual subsites with the exception of Login Security which works individually for each specific website - Primary or virtual subsites and therefore should only be available to and controlled by the Super Admin with Network Admin capabilities for the Network/Multisite website. * Login Security and System Info menus / pages are available on Network / Multisite subsites to Super Admins and Administrators: * Login Security has all the same functionality on Network/Multisite subsites with these exceptions: Login Security email alerting is not available for subsites. * System Info has all the same functionality on Network/Multisite subsites with these exceptions: MySQL Database information is not displayed on subsites. * New AutoMagic WP 3.5+ Network / Multisite .htaccess code: BPS AutoMagic buttons automatically write the correct Network / Multisite root .htaccess code for your site based on your WordPress version. * Network / Multisite New Feature Notice: BPS can now be Network Activated on Multisite: This Network / Multisite New Feature Dismiss Notice displays on Network / Multisite only to alert Network / Multisite site owners about the new Network Activation capability in BPS. * CSS Visual Style Changes for WP 3.8+ MP6 & Pre 3.8 WP Versions: * WordPress 3.8 is using the new MP6 GUI. A BPS 3.8 CSS stylesheet has been created to visually display things correctly in WordPress 3.8. BPS will automatically load the correct CSS stylesheet for your WordPress version. CSS visual enhancements were also created for pre WordPress 3.8 versions. * See the BPS Whats New page for more details * Enjoy!