WP Panel v1.6.0 Officially Released: Detect WordPress Intrusions Sooner

WP Panel v1.6.0 is officially released.

This version focuses onWordPress site securityand delivers a concentrated update: new lightweight anomaly monitoring, file integrity baselines, SQL injection request protection, a new site toggle to „disable WordPress application passwords,“ and improvements to temporary maintenance windows, persistent IPv6 bans, and log retention policies.

A significant portion of these capabilities comes from a real incident we recently handled: a cross-border jewelry independent site that had long been neglected was compromised, and it wasn't discovered until the site went down and customers started asking—tens of thousands of spam posts had been injected into the database, a database backdoor was buried on the homepage, and the web access logs had long exceeded their retention period, making it impossible to trace the initial entry point.

A site „being accessible“ and „not being compromised“ are two different things.The problem v1.6.0 aims to solve is very specific: enable long-neglected sites to receive signals in the early stages of an intrusion, rather than only realizing it months later when the site goes down.

Why „post-incident investigation“ is so difficult

This type of intrusion targeting neglected sites is usually not a single takedown, but staged persistence planting:

• Malicious plugins: appear normal on the surface but actually provide a remote posting interface and can even create administrator accounts themselves;
• Disguised plugins: copies itself intomu-plugins, hides itself in the backend, and cannot be completely removed by the ordinary „deactivate plugin“ action;
• Database triggers: when the homepage is edited, hidden spam content is automatically reinserted, so it disappears in the backend but reappears on the frontend;
• Application passwords: used for automatic posting via the REST API, and logging out of the browser session cannot stop it.

Combined with log expiration, modified files, and „publish dates“ forged to months earlier, by the time the problem is discovered, the conditions for tracing back are often already lost.

What security capabilities are new in v1.6.0

Account and credential monitoring

• Alerts when administrator accounts are added, demoted, or promoted;
• Inventory, addition, first use, source IP changes, and revocation of application passwords are all logged.

This was the most critical and most easily overlooked part of the last incident: as long as an attacker obtains one application password, they can post automatically over the long term.

Content and settings monitoring

• Alerts when posts and pages are published in bulk, modified in bulk, deleted, or unpublished;
• Homepage change notifications are merged: two adjacent modifications less than 6 hours apart are grouped into the same notification, and the next change after 6 hours of quiet triggers a new notification;
• It also prompts when open registration or the default role is changed.

Database Persistent Object Monitoring

• Samples triggers, events, stored procedures, and functions in the database;
• Specifically covers database-layer backdoors such as „content deleted but coming back“.

File integrity baseline

• On sites with file locks enabled and healthy status, monitors changes to core, plugin, theme, MU plugin, drop-in, and other code files using an off-site SHA-256 baseline;
• After normal maintenance windows or panel-controlled updates are completed, the new baseline is accepted; only abnormal changes enter security events.

SQL injection request protection

• Conservative protection: identifies high-confidence attack structures only at the URL layer and rejects them before the request enters PHP;
• Repeated triggers from trusted sources are temporarily banned by independent rules;
• Ordinary search requests will not be mistakenly blocked. It is not a complete WAF and does not inspect POST/JSON request bodies.

Disable WordPress application passwords

• Adds a site-level switch. New sites are disabled by default, reducing the possibility of legacy remote credentials being used to write content;
• Existing sites remain allowed after upgrade to avoid interrupting mobile apps, automatic publishing, and third-party REST integrations.

Other supporting improvements

• Adds a recoverable temporary maintenance window: briefly unlock in the WordPress backend with a maintenance password, automatically relock on schedule, and relocking must truly restore permissions to be considered successful;
• Completes IPv6 persistent banning, and the current ban status simultaneously checks IPv4, IPv6, Fail2ban, and the Nginx execution layer;
• Raw logs for new sites are retained for 14 days by default, and WordPress security events are retained for 90 days;
• Fixes the issue where WordPress debug mode did not fully take effect;
• Security setting saves are changed to a unified transaction to prevent concurrent requests from overwriting new configuration with old configuration.

FAQ

With these monitors enabled, will my site be immune to intrusions?

No. No security product can guarantee that you will not be compromised. v1.6.0 solves „earlier detection“, not „absolute defense“.

Will monitoring automatically delete malicious posts, users, or plugins?

No. Anomaly monitoring only alerts and preserves evidence; it does not automatically modify data. Destructive operations such as deletion and isolation are always executed after your confirmation.

Will SQL injection protection mistakenly block legitimate traffic?

It only handles high-confidence attack structures at the URL layer; ordinary searches, core REST searches, and low-confidence signals will not be blocked. It does not inspect POST/JSON request bodies and cannot replace the application's own parameterized queries.

Can file integrity baselines detect malicious content in the database?

No. It covers files, but cannot cover „pure database writes“, such as posting through a legitimate REST API. Database-layer anomalies must be discovered through database object monitoring and content monitoring.

Once the initial baseline is established, does that mean the site is clean?

No. The initial baseline only means „recording the current file state.“ If malicious files or unknown credentials already existed before the baseline was established, manual review is still required.

Will existing sites have application passwords forcibly disabled after upgrading?

No. Only newly created sites have it disabled by default; existing sites remain allowed after upgrade.

Putting these capabilities back into this real incident

It should be noted: these monitoring capabilities at the time of the incidenthad not yet been deployed. If the capabilities of v1.6.0 were placed on the timeline at that time, it would roughly look like this:

Attack action	Signal that v1.6.0 would generate
Quietly create an application password	Credential addition record
Malicious plugin written to disk, new administrator added	Administrator change alert + file integrity change alert
Implant database trigger	Database object sampling alert
Publish tens of thousands of posts in a short period	Abnormal content publishing volume alert

These aresignals, notconvictions. They do not by themselves prove that the site was compromised, but they are enough to let you intervene at the right point in time, rather than months later.

Applicable boundaries and considerations

• This version does not guarantee that a website will not be compromised; it only shortens the time from „being compromised“ to „being discovered“;
• File integrity baselines, temporary maintenance windows, and code change alerts only apply tofile lock enabledWordPress sites; sites without file lock enabled will not receive code baseline monitoring;
• SQL protection only handles high-confidence structures at the URL layer, does not inspect request bodies, and does not mean the site has a vulnerability;
• Anomaly monitoring requires properly configured notification channels and someone to respond; otherwise alerts are just a record in the panel;
• The integrity of commercial and self-developed plugins still lacks a unified trusted verification source, so it is recommended to use them together with regular backups.

Upgrade and compatibility

• v1.6.0 includes a database upgrade and can be upgraded continuously from v1.5.14 without manually modifying the database;
• After the upgrade, SQL injection request protection is enabled by default. If your business uses special query structures, it is recommended to check access logs after upgrading and disable it in „Security Settings“ if necessary;
• Existing websites will not automatically disable application passwords. After upgrading, it is recommended to proactively review the administrator list and application password list to confirm there are no entries you did not create;
• The companion plugin has been upgraded to 1.1.28, the settings page now uses a unified security status layout, and includes built-in English and Simplified Chinese;
• The upgrade will not modify the existing website's files, database, SSL certificates, or Nginx/PHP configuration.

Summary

WP Panel v1.6.0 does not promise „it will never be hacked“; instead, it fills the most lacking link for long-term unmaintained sites:Timely detection and evidence preservation。

• Accounts, credentials, content, settings, database objects, and code files—abnormal behavior in multiple places can be traced;
• Monitoring only alerts; it does not touch your data for you;
• From „only discovering it when it can“t be opened„ to “receiving an alert as soon as something is abnormal.„

For operations personnel who have a batch of sites and cannot possibly stare at the backend every day, this is a version worth upgrading to. Not using WP Panel yet? If you have a batch of long-running WordPress sites, it is recommended to first enable anomaly monitoring on a non-core site, observe for a period of time, and then gradually roll it out to all production environments.

Upgrade now

WP Panel v1.6.0 has been officially released: Viewv1.6.0 release page。

After upgrading, you can find the above new capabilities in „Website Details → WordPress Optimization,“ „Security Settings,“ and „Security Defense.“