ITX UserOps — User Management, Login Activity, Sessions & Audit Log

Dnevnik promjena

2.7.2

• Fixed: with a two-factor plugin that asks for its code during sign-in (XO Security is one), every administrator sign-in was reported as “Administrator signed in without the login form”. Those plugins take over the sign-in on WordPress’s wp_login step and end the request with their code form before this plugin heard the sign-in. It now hears every sign-in first, and a login cookie withdrawn again in the same request — as those plugins do before asking for the code — is not counted.

2.7.1

• Fixed: on a site behind Cloudflare or another firewall, a page the firewall sent in place of the plugin’s data was reported as “Code injected into the site’s pages”, with a banner saying the site may be compromised. Part of that page’s own script read as data, and the rest looked injected. A web page that answers instead of WordPress is no longer read as data or reported as an attack, and the screen now says who answered — “Cloudflare blocked this request before it reached WordPress”, for example.

2.7.0

• New: signs of a break-in that hides from wp-admin. Written from a real case: a site running this plugin was held for weeks by attackers whose plugins hid themselves from the Plugins screen, whose administrators were hidden from the Users screen, and whose script was printed in front of every page. Each of those is now checked for, on the site itself:
• An administrator who exists in the database but is hidden from the Users screen. The plugin reads the accounts straight from the database and compares them with what WordPress lists; a difference means code on the site is hiding someone.
• An administrator created by code running on the server with nobody signed in — by a scheduled task, an ordinary request, or a file inside wp-content that loads WordPress itself (the shape of a backdoor). The file is named in the log. One made from WP-CLI is noted as a warning.
• A plugin hidden from the Plugins screen, or one that is running while the Plugins screen calls it inactive. Management tools that hide on purpose (MainWP Child, ManageWP Worker, InfiniteWP, iThemes Sync) are left alone while they update from WordPress.org.
• A plugin, must-use plugin or drop-in that appeared without being installed through WordPress — by FTP, a file manager or a backdoor — and a folder in wp-content/plugins that is not a plugin at all.
• Code printed in front of the site’s pages or its REST responses. The plugin’s screens now read past it and keep working, show what was added in a red banner, and record it; once a day the site also checks its own front page and REST index.
• An administrator signed in without the login form — a login cookie issued with no sign-in, so no password, two-factor or lockout was checked. Critical when a file inside wp-content did it. Changing your own password, View-as, and the User Switching plugin are recognised.
• A file inside wp-content that starts WordPress by itself when its address is requested — how backdoor endpoints run. For the first week after install these are learned quietly (some plugins have one); after that a new one is reported, then at most once a day while it keeps being used. A file in uploads, in a folder that is not a plugin, or in a hidden plugin is reported even in the first week. Mark a file you recognise as expected from its entry in the activity log.
• New: plugin installs, updates and deletions are logged, with where each plugin gets its updates (WordPress.org, a vendor, or nowhere).
• New: alerts that may not arrive. When an email from UserOps (an alert, a sign-in code) cannot be sent, that is logged — once an hour at most — and the WordPress Dashboard says so. The plugin also works out how this site sends mail (an SMTP plugin, a mail service, or the server’s own PHP mail — including FluentSMTP installed with no connection set up), and the Dashboard says plainly when security email goes out over PHP mail with no phone connected to carry alerts instead.
• New: a Critical level in the activity log, above Warning, for signs of a break-in only. Critical events are emailed to the site’s admin address and sent to connected phones as “Signs of a break-in”, and they are listed on the WordPress Dashboard until dealt with. Each one says what happened and what to do.
• The admin-bar online counter keeps updating on a site that injects code in front of REST responses.
• Fixed: times shown to the second in the activity and email logs read “5:19 pm:03” on sites using a 12-hour clock (WordPress’s default). They now read “5:19:03 pm”.
• Fixed: on the 30-day sign-in chart in a person’s profile, the last two dates were printed on top of each other.
• Fixed: in the email log, “Handed off — reported by another plugin” ran into the next column instead of wrapping.
• What these checks cannot see: code that loads before this plugin (a must-use plugin, or a db.php drop-in) can hide from any check made inside WordPress, and a file that never loads WordPress is invisible to it. A new must-use plugin or drop-in is reported when it appears.

2.6.1

• Released alongside ITX UserOps Premium 3.6.1, so the two stay in step. Everything new since 2.4.0 is listed under 2.6.0 below.

2.6.0

• New: the mobile app is free. ITX UserOps → Mobile app shows what it does, connects a phone in three steps — scan a code drawn on this screen, approve the phone on your site, allow notifications — and lists the phones connected. Before you start, it checks HTTPS, application passwords, whether your server passes the app’s sign-in on, and whether it can send notifications. The app shows who is online, sign-ins, recent activity and people, and lets you disable or re-enable an account, sign someone out everywhere, or send a password reset.
• New: four alerts on connected phones, each switchable per phone — an administrator account is created, someone is made an administrator, sign-ins fail in a burst, or an account is disabled or re-enabled by someone else.
• New: the Overview is a dashboard — who is online now, the last 20 things that happened (filter by sign-ins, account changes or warnings), and fourteen days of sign-ins, each loading on its own.
• New: what needs an administrator now reaches the WordPress Dashboard — a notice at the top for anything urgent (until it is dealt with, or hidden until something new happens) and a list at the top of the UserOps dashboard widget — as well as the Overview.
• New: every change to the plugin’s settings is written to the activity log as one entry per save — what changed, from what to what, and from where (a screen, WP-CLI, a scheduled task, the mobile app or an API key). Secrets are never written; their entries say “changed”.
• Security: the Settings screen and its settings, and viewing the site as another user, now ask whether you may manage the site and that account — not only whether you can open the UserOps console. That matters wherever another plugin or role gives the console to someone who is not an administrator.
• Security: on multisite, a site’s own administrator can no longer change or remove a super admin’s role on that site.
• Security: a connected phone’s notifications can no longer be moved to another account’s device by someone who learns its push address.
• Fixed: an old link to the Login log (a bookmark, an email) now keeps its filters, and the Overview’s login tiles open the log already filtered.
• Fixed: plugin upgrades no longer log invalid database statements; a comment inside a table definition was being read as a column.
• Fixed: a plugin upgrade no longer re-applies the type of every column in the plugin’s tables — up to 191 database statements on MariaDB, or on WordPress before 6.9. It now changes only what the new version changes.
• Fixed: an IP range written with a malformed prefix length (10.0.0.0/nope) now matches nothing, instead of every address.
• Fixed: on servers without mbstring, a stored email body cut at the size limit could end in half a character.
• Exported files are named for the plugin: itx-userops-users-….csv, itx-userops-activity-….csv.
• The Mobile app screen keeps its margin on the right, and its list of phones scrolls on a phone instead of spilling out of the card.
• External services: connecting a phone to the mobile app uses app.itxuserops.com (in the phone’s browser) and, once the phone allows notifications, the browser maker’s Web Push service. Nothing is contacted until you connect a phone. See External services.

2.5.0

• New: Settings → PHP in uploads. One switch stops PHP files in wp-content/uploads from being run by visiting their address — the way a backdoor dropped there is used. Files are not removed, and plugins that keep PHP in uploads (WPML’s template cache, a theme’s saved settings) are not affected, because they load it from inside WordPress. On Apache and LiteSpeed the rule is written to uploads/.htaccess, next to whatever else is there, and then proved by requesting a harmless test file; the screen says whether the server actually obeys it. On nginx the screen shows the rule to give your host. Uninstalling removes the rule.

2.4.1

• Fixed: 2.4.0 did not actually keep the Bing Webmaster Tools and IndexNow bundles off the plugin’s screens. Both plugins give WordPress their file addresses in a roundabout form (“admin/../static”), and 2.4.0 compared the addresses as written instead of as the browser requests them. No other change.

2.4.0

• New: role templates. “New role” now offers a starting point as well as a blank role — Site Manager (runs the site day to day without plugins, themes, code or settings), Content Reviewer (edits anyone’s drafts, cannot publish or delete), Support Agent (helps customers and subscribers with their accounts) and, where the plugin is installed, SEO Manager (Rank Math or Yoast) and Order Handler (WooCommerce). A template only sets where a role starts; it is an ordinary role afterwards.
• Security: nobody but an administrator can now edit, delete or change the role of an account with more access than their own, or hand out a role with more access than their own. WordPress lets anyone holding edit_users edit any account, administrators included — harmless while only administrators hold it, an account takeover the moment a role editor gives it to anyone else. This also narrows delegated administrators in the same way.
• WooCommerce no longer sends people whose work is in wp-admin but not in posts — order handlers, support staff, the read-only plugins list — to My Account.
• Fixed: on sites running LiteSpeed Cache with “Cache REST API” and “Cache Logged-in Users” switched on, the role list kept showing an old copy for up to half an hour — a new role was created but never appeared, and each further click created another “Custom role 1”. The plugin’s screens now tell LiteSpeed not to cache them.
• Fixed: two roles can no longer end up with the same name; a repeated name is numbered.
• Faster screens where Bing Webmaster Tools or IndexNow is installed: both load their whole app on every admin page, re-downloaded on every visit, and the plugin’s own screens no longer carry it.

2.3.1

• Fixed: “View” on the Plugins & themes row of the role grid is now genuinely read-only. It used to grant the ability to switch the site’s active theme and to edit menus, widgets and the Customizer, and it showed no plugins at all. WordPress has no read-only capability for plugins or themes, so View now grants this plugin’s own and opens a new read-only Plugins & themes screen: every plugin and theme, its version, whether it is active, and whether an update is waiting — with nothing on it that changes anything.
• New: an Appearance row in the role grid for menus, widgets and the Customizer, so giving an editor the menus no longer means giving them the theme.
• On upgrade, roles the grid had put on the old View are corrected to the read-only one, and administrators are told which roles changed. Roles arranged any other way — including one that was also given activate_plugins by hand — are left exactly as they are.

2.2.2

• Fixed: “Duplicate Administrator” was refused with “You cannot grant access you do not have yourself” on most sites. WordPress switches some of the administrator’s capabilities off at run time (file editing when DISALLOW_FILE_EDIT is set, the Links manager, unfiltered uploads), and WooCommerce stores per-item ones, and the role editor read all of those as not held. Capabilities your own role grants can now be copied. No other change.

2.2.1

• Fixed: 2.2.0 as published was missing two files, and sites that updated to it stopped loading with a “Class not found” error for the DNS Toolbox integration. This release contains them. No other change.

2.2.0

• Changed: the console is reorganised into sections that match the job rather than the feature list. Overview, People, Access, Activity, Settings. Nothing has been removed and nothing has moved out of reach — the Login Log, Activity Log and Email Log are now tabs of Activity, and the role editor is a tab of Access.
• Changed: the dashboard is split in two. Overview answers “is anything wrong” and every figure on it is a link into the exact filtered list that explains it; People is the account directory and everything you do to one person. Previously the same screen tried to be both, and clicking a summary figure filtered a table further down the page rather than taking you anywhere.
• Every page now says in one line what it answers, because this is a console people open weeks apart and a bare noun heading is decoded from scratch every time.
• Every tab has its own address. Links into the console — from a bookmark, from documentation, or from an alert — open the exact tab they name, and the address bar follows the tab you are on so you can copy what you are looking at.
• Old bookmarks keep working: every retired page address resolves to the tab that now holds what it used to show.

2.1.0

• New: DNS Toolbox integration. When the DNS Toolbox connector (dnstoolbox.app) is on the site, the console’s site card shows a “Users & logins” summary from this plugin — users, administrators, who is online, sign-ins and failed sign-ins over a day and a week, the last event — and merges the activity log into the site’s timeline, with IP addresses anonymised and no user agents. Premium adds two-factor coverage and the posture score. Nothing new is exposed: the connector asks in-process through one filter (dntc_companions), on its own signed request, and this plugin never sends anything anywhere.

2.0.0

• New: WordPress 7.1 support. The minimum WordPress version is now 6.6 — every release from 6.6 to 7.1 is exercised by the test suite on each change, so “tested up to” is measured rather than asserted.
• New: saved segments. A filter set you use often can be named and kept — “Dormant admins”, “Never signed in” — and reopened from a row of buttons above the table. A segment saves the QUESTION rather than a list of people, so whoever matches next month appears in it without anyone touching it. Segments are shared with everyone who can open the console, and they record who created them.
• New: view a customer’s site as they see it. A time-boxed, read-only session — fifteen minutes, and while it runs nothing can be bought, submitted or changed, so it cannot be used to act on somebody’s behalf by accident. A banner on every page names who is viewing and whose account it is, with a one-click exit. You can only ever view “downward”: an account holding administrator capabilities cannot be viewed as at all. Every session, and every ending, is written to the tamper-evident activity log with who, whom and for how long.
• Changed: the dashboard is reorganised. The twelve filter controls that wrapped onto three lines are now one toolbar attached to the table, with the less-reached filters behind a “More filters” button that shows how many of them are active — so a filter you cannot see can never be quietly in force. What you are filtering by is spelled out as removable chips beneath it, alongside your saved views.
• Changed: the ten summary figures are one strip instead of ten boxes, and the three panels below them are shorter. Same numbers, same click-to-filter behaviour, about a third of the height — the user list now starts above the fold on a laptop.
• New: “Last activity” can be sorted. Accounts that have never been seen stay in the list, sorted to the end, rather than disappearing from it.
• Sortable columns now show a faint arrow at rest, so it is possible to tell which headings can be clicked without clicking them. Reported by an administrator who read the unsorted columns as unsortable — which, with no marking, was the reasonable reading.
• Changed: the console works on a phone. Every wide table now scrolls inside its own card instead of forcing the whole page sideways, headers and filters stack rather than wrap into a wall, and touch targets are sized for a thumb. The breakpoint is WordPress’s own 782px, so the console folds at the same width the surrounding admin does.
• Fixed: the Role and Status filters drew two borders on top of each other on mobile, because the field inside the control was being given the same outline as the control around it.
• Changed: on a store, the Purchases / Spent / Last order filters moved into “More filters” with the rest of the less-reached ones, and now count towards the number on that button.
• Fixed: the Email Log wrote a PHP notice on every unfiltered page load, because the query was prepared with no values to substitute.

1.9.1

The first update on WordPress.org since 1.0.0, condensing the development releases in between. What is new compared to 1.0.0:

• New: Roles. WordPress permissions described the way people think about them — a grid of areas (Posts, Pages, Media, Comments, Users, Site settings, Plugins & themes) against levels (None, View, Contribute, Manage) instead of sixty raw checkboxes. Custom post types get their own row automatically.
• Roles is draft-first: every edit collects into a draft, a bar counts the changes, and nothing touches the live role until you press Publish. Leaving with a draft open prompts you like any unsaved form.
• Alongside the grid: a Plain English view of the role as toggleable statements, side-by-side role comparison with differences highlighted, people management (add someone to a role, move people out, reassign between roles), create/duplicate/rename/delete, and “Restore WordPress defaults” for the five built-in roles.
• Capabilities the grid does not manage are never touched — if WooCommerce or a membership plugin added something to a role, saving leaves it byte-for-byte. A role the grid cannot describe reads “Custom” and shows the exact difference instead of quietly rewriting it on save.
• Role guardrails are enforced on the server, not merely hidden in the screen: you cannot grant access you do not hold yourself, change your own role, or demote the last administrator. The administrator role is visible but not editable. Activation changes nothing until you choose to change it.
• New: an Email Log. Every message WordPress hands to the mail server is recorded — recipient, subject, timing, and what the server said back. Nothing is labelled “Delivered” or “Sent”, because your site cannot observe either: the good state is “Handed off”, failures carry the server’s error, and results another plugin merely claimed are shown as reported rather than observed.
• You choose which kinds of mail are logged; account mail and the plugin’s own mail are on by default, high-volume kinds are off. Message contents are not stored unless you switch it on — and when you do, password reset links, one-time codes and application passwords are stripped before anything is written, so the log cannot become a way in. Stored contents can be deleted again in one click.
• New: client IP detection behind Cloudflare, a load balancer or another reverse proxy (Cloudflare’s ranges are built in). Forwarding headers are only trusted when the request genuinely arrives from a configured range, so they cannot be forged.
• New: the activity log is tamper-evident. Each entry is chained to the one before it, so database-level tampering — an edited dump, SQL injection, a rogue database user — is detectable, and legitimate retention deletion records itself so it is never mistaken for interference.
• New: the activity log records which door a sign-in attempt came through — the login form, XML-RPC, the REST API or WP-CLI — shown as “Signed in via” in the event details.
• New: each user’s profile panel gains an Emails tab beside Overview, Sessions and Activity; log rows on every screen open a keyboard-accessible side panel; every dashboard overview tile drills into its matching filtered view.
• Fixed: repeat login lockouts now double in length as intended — the record the escalation counted from was being deleted the moment a lock expired, so an attacker could simply wait out the shortest lockout and go again.
• Fixed: changing roles from the bulk actions bar, which failed on every site, and bulk-action failures that closed the toolbar without saying why.
• Performance: the online-users counter, dashboard counts and activity-log totals are cached instead of recomputed on every admin page load, session cleanup and IP searches are indexed, and the dashboard no longer counts every user account per visit.
• Database schema upgrades from version 1 to 6 run automatically on update; every step is additive and existing entries stay readable.

The full release-by-release history is at https://itxuserops.com/changelog/

1.0.0

• Initial release: unified user dashboard, enable/disable accounts, device-grouped session management, activity & login audit log, profile drawer, bulk actions with CSV export, admin-bar online counter, user-overview dashboard widget, and native Users-screen integration.