The malware scan gains eighteen checks written against real backdoors, and eight\nexisting checks stop reporting honest code. If your provider's hub had refused an\nupdate as infected, it will go through after this.<\/p>","1.22.2":"
Nothing on your site changes. This release exists to correct what the plugin's\nown listing says about it, which had fallen behind several releases.<\/p>","1.22.1":"
Fixes backups of sites larger than 4 GB, which failed while verifying the\nfinished archive. If you have such a site, run a backup after updating.<\/p>","1.22.0":"
A restore that cannot finish no longer leaves your site half-restored, and a\nrestore that ran into trouble now says so instead of reporting success. Nothing\nyou had set up changes; no action needed.<\/p>","1.21.0":"
The activity log now records the updates your provider installs on this site,\nand three other things it was missing. Nothing else changes; no action needed.<\/p>","1.20.0":"
A plugin that appears on your site without WordPress.org publishing it now\nstarts a malware scan by itself, within seconds, instead of waiting for the next\nscheduled one. Nothing is blocked or deleted; no action needed.<\/p>","1.19.0":"
Adds German, server-configuration checks, email delivery monitoring and a\ncancel button for a stuck scan, and stops a slow update on shared hosting being\nkilled part-way. Nothing you had set up changes; no action needed.<\/p>","1.18.0":"
The malware scan now recognises backdoors that arrive dressed as an ordinary\nplugin, not just obfuscated webshells. Nothing you had set up changes; no action\nneeded.<\/p>","1.17.1":"
Fixes false "a WordPress core file is missing" and "no longer matches the\nofficial release" findings on the readme and licence files a non-English\nWordPress installs under a translated name.<\/p>","1.16.0":"
The support card on your dashboard can now show your provider's telephone\nnumber, if they have set one in their hub. Nothing you had set up changes; no\naction needed.<\/p>","1.15.0":"
The malware scan now counts the plugins on disk itself instead of taking\nWordPress' word for what is installed, so a plugin that has hidden itself from\nthe plugin list is reported — and checked against WordPress.org like every\nother one. Must-use plugins are now listed too: they run on every request and\nthe admin gives you no way to switch one off, so the scan reports what is there.\nNothing you had set up changes; no action needed.<\/p>","1.14.0":"
Adds a "Request help" button to the dashboard support card, and lets your hub\nfind and clear the files old backups, restores and migrations left behind.\nNothing you had set up changes; no action needed.<\/p>","1.13.7":"
Identical to 1.13.5 and 1.13.6 in behaviour. Nothing on your site changes.<\/p>","1.13.6":"
Identical to 1.13.5 in behaviour. It exists so the plugin directory's listing\nand its screenshots describe the same version; nothing on your site changes.<\/p>","1.13.5":"
Corrections to the Bulwarden screen rebuilt in 1.13.4. Nothing changes in how\nthe plugin works; no action needed.<\/p>","1.13.4":"
The Bulwarden screen has been rebuilt around what you actually came to it for.\nNothing you had set up changes; no action needed.<\/p>","1.13.3":"
Bulwarden moves out of the Settings submenu into its own entry in the WordPress\nadmin menu. Nothing else changes; no action needed.<\/p>","1.13.2":"
Fixes a false "a WordPress core file no longer matches the official release"\nfinding on Fixes a false "a plugin file no longer matches the version published on\nWordPress.org" finding on plugins WordPress.org publishes more than one copy of.<\/p>","1.13.0":" Your hub can now see and finish an update that changed this site's files but\nnever completed — a pending database upgrade or a leftover maintenance\nlock. Restores can also put back only the database, leaving files untouched.<\/p>","1.11.0":" Must be installed alongside the matching hub update: the two sign requests to\neach other and the signing form changed on both sides at once.<\/p>","1.9.0":" Stored data moved to a new prefix and there is no automatic migration —\nre-pair the site with your hub after updating, and re-enter the backup\npassphrase. Existing backups still need the old passphrase to decrypt.<\/p>"},"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3661811,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3661811,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3661811,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3661811,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.13.7","1.14.0","1.15.0","1.16.0","1.17.0","1.17.1","1.18.0","1.19.0","1.22.2","1.23.0","1.25.0","1.26.0","1.27.0","1.27.1","1.27.2","1.27.3","1.28.0","1.28.2","1.29.1"],"block_files":[],"assets_screenshots":{"screenshot-1.png":{"filename":"screenshot-1.png","revision":3693044,"resolution":"1","location":"assets","locale":"","width":2080,"height":628},"screenshot-2.png":{"filename":"screenshot-2.png","revision":3661811,"resolution":"2","location":"assets","locale":"","width":1120,"height":1468},"screenshot-3.png":{"filename":"screenshot-3.png","revision":3693044,"resolution":"3","location":"assets","locale":"","width":2080,"height":2560},"screenshot-4.png":{"filename":"screenshot-4.png","revision":3661811,"resolution":"4","location":"assets","locale":"","width":2080,"height":1308},"screenshot-5.png":{"filename":"screenshot-5.png","revision":3661811,"resolution":"5","location":"assets","locale":"","width":2080,"height":1150},"screenshot-6.png":{"filename":"screenshot-6.png","revision":3693044,"resolution":"6","location":"assets","locale":"","width":1120,"height":778}},"screenshots":{"1":"The Bulwarden screen at a glance: whether the site is connected, whether\nbackups are encrypted, when the last backup and scan ran, and how current\nthe scanner's signature list is.","2":"Connecting the site: the connect string you paste into your hub, and the\nAPI credentials behind it.","3":"Backups: a run in progress showing the phase it has reached, its log and a\ncancel button, above the encryption passphrase and the folders left out of\nthe archive.","4":"The malware scan: what the last one found, grouped by kind, and how much of\nthe site could be checked against the files WordPress.org published.","5":"The activity log: an append-only record of credential changes, backups,\nrestores, scans and repairs, including the ones the hub triggered.","6":"The dashboard support card — who maintains this site, how to reach\nthem, and the Request help<\/em> button that files a ticket with them directly."}},"plugin_section":[262246],"plugin_tags":[151,732,1184,5603,600],"plugin_category":[52,54],"plugin_contributors":[277095],"plugin_business_model":[],"class_list":["post-355276","plugin","type-plugin","status-publish","hentry","plugin_section-dashboard-widgets","plugin_tags-backup","plugin_tags-maintenance","plugin_tags-malware","plugin_tags-monitoring","plugin_tags-security","plugin_category-performance","plugin_category-security-and-spam-protection","plugin_contributors-bulwarden","plugin_committers-bulwarden"],"banners":{"banner":"https:\/\/ps.w.org\/bulwarden\/assets\/banner-772x250.png?rev=3661811","banner_2x":"https:\/\/ps.w.org\/bulwarden\/assets\/banner-1544x500.png?rev=3661811","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/bulwarden\/assets\/icon-128x128.png?rev=3661811","icon_2x":"https:\/\/ps.w.org\/bulwarden\/assets\/icon-256x256.png?rev=3661811","generated":false},"screenshots":[{"src":"https:\/\/ps.w.org\/bulwarden\/assets\/screenshot-1.png?rev=3693044","caption":"The Bulwarden screen at a glance: whether the site is connected, whether\nbackups are encrypted, when the last backup and scan ran, and how current\nthe scanner's signature list is."},{"src":"https:\/\/ps.w.org\/bulwarden\/assets\/screenshot-2.png?rev=3661811","caption":"Connecting the site: the connect string you paste into your hub, and the\nAPI credentials behind it."},{"src":"https:\/\/ps.w.org\/bulwarden\/assets\/screenshot-3.png?rev=3693044","caption":"Backups: a run in progress showing the phase it has reached, its log and a\ncancel button, above the encryption passphrase and the folders left out of\nthe archive."},{"src":"https:\/\/ps.w.org\/bulwarden\/assets\/screenshot-4.png?rev=3661811","caption":"The malware scan: what the last one found, grouped by kind, and how much of\nthe site could be checked against the files WordPress.org published."},{"src":"https:\/\/ps.w.org\/bulwarden\/assets\/screenshot-5.png?rev=3661811","caption":"The activity log: an append-only record of credential changes, backups,\nrestores, scans and repairs, including the ones the hub triggered."},{"src":"https:\/\/ps.w.org\/bulwarden\/assets\/screenshot-6.png?rev=3693044","caption":"The dashboard support card — who maintains this site, how to reach\nthem, and the Request help<\/em> button that files a ticket with them directly."}],"raw_content":"\n Bulwarden is the site agent<\/strong>, installed on each managed WordPress site. It\nexposes a signed REST API ( It is built for the person who is responsible for a site they did not build:\nan agency looking after forty of them, or an owner who wants one place that\nanswers \"is this thing all right?\" without logging into it.<\/p>\n\n On activation the plugin provisions an API key + secret. Copy the connect\nstring<\/strong> from the Bulwarden<\/strong> entry in the WordPress admin menu and paste\nit into the hub's \"Connect a site\" form. Your provider's support details are\nthen pushed to the site automatically by the hub and appear on the dashboard.<\/p>\n\n Hub \u2192 client requests are authenticated with the per-site API key and an\nHMAC-SHA256 signature over the method, route, timestamp, a single-use nonce and\nthe body. The nonce is what makes a signature good exactly once: it is recorded\nwhen the request arrives and refused if it comes back, so a captured request\ncannot be replayed. Timestamps outside a 5-minute window are rejected outright,\nwhich is also how long a nonce has to be remembered for. The secret never\ntravels on the wire \u2014 it lives only in this plugin and in the hub webapp.<\/p>\n\n Bulwarden is a client agent: on its own it sends data nowhere. Pairing this\nsite with a hub (yours, or your maintenance provider's) is an explicit,\nopt-in action \u2014 you choose when to copy the connect string from the Bulwarden\nscreen in the WordPress admin menu and hand it to that hub. Nothing is\ntransmitted before that.<\/p>\n\n Once paired, data only moves in these cases:<\/p>\n\n Independently of any hub pairing, this plugin verifies WordPress core and\nwordpress.org-hosted plugin files by comparing local file hashes against the\npublic checksum APIs at Bulwarden does not call home on activation, does not collect analytics, and\nstores data on no server this site hasn't been explicitly connected to. The\nhub itself is a separate service outside this plugin's control; consult your\nprovider for how it handles the data described above.<\/p>\n\n This plugin connects to the services below. Nothing here runs on activation.<\/p>\n\n Bulwarden is the site-side agent for a hub<\/strong> \u2014 the management application an\nagency or site owner runs to watch and maintain a fleet of WordPress sites. The\nhub is a separate product and is not part of this plugin.<\/p>\n\n The default hosted hub is operated by Bulwarden at https:\/\/bulwarden.net\/ \u2014\nterms of use: https:\/\/bulwarden.net\/terms\/ , privacy policy:\nhttps:\/\/bulwarden.net\/privacy\/ . A hub can also be self-hosted, or run by the\nmaintenance provider you buy from, in which case this plugin talks to that\nprovider's server instead and their terms and privacy policy apply.<\/p>\n\n No connection to any hub exists until you make one.<\/strong> You pair a site by\ncopying the connect string from the Bulwarden screen in the WordPress admin\nmenu and pasting it into the hub; before that the plugin contacts no hub at\nall, and it never discovers or chooses one on its own. Once paired, data moves only in these cases:<\/p>\n\n Every one of those requests is authenticated with this site's own API key and\nan HMAC-SHA256 signature; the shared secret never travels over the wire.<\/p>\n\n The malware scan verifies WordPress core and wordpress.org-hosted plugins\nagainst their published checksums, using WordPress.org's own public APIs at\n https:\/\/api.wordpress.org\/core\/checksums\/1.0\/ and\n https:\/\/downloads.wordpress.org\/plugin-checksums\/. This happens whenever a\nscan runs, whether or not the site is paired with a hub.<\/p>\n\n These requests identify only the release being looked up: the WordPress version\nand locale, and each installed plugin's slug and version. No file contents,\nhashes, site URL or user data are sent \u2014 the reference checksums are returned\nand compared locally.<\/p>\n\n These are WordPress.org services, covered by the WordPress.org privacy policy:\nhttps:\/\/wordpress.org\/about\/privacy\/<\/p>\n\n\n Bulwarden is one half of a pair: this plugin runs on the site, and a hub<\/strong>\nruns somewhere else and manages it. Installing the plugin on its own does\nnothing until you pair it with a hub.<\/p>\n\n Yes, for anything beyond installing it. The hub is separate software: use the\nhosted one, run your own, or use the one your maintenance provider runs. Until\nthe site is paired, this plugin contacts nothing and does nothing.<\/p>\n\n Updates install like any other plugin. Your credentials, passphrase and settings\nsurvive an update; nothing needs re-pairing.<\/p>\n\n\n No. Before you pair it with a hub it contacts nothing at all, and it never\ndiscovers or chooses a hub by itself. After pairing, data moves only for the\nthings listed under Privacy below — health checks, backups, malware scan\nfindings — and only to the hub you paired with.<\/p><\/dd>\n No, provided you set a passphrase. The archive is encrypted on this server<\/strong>\nwith a key derived from your passphrase, and only the ciphertext is uploaded.\nThe passphrase is never transmitted, so a hub holds bytes it cannot decrypt.\nThe same property is why nobody can recover a lost passphrase for you.<\/p><\/dd>\n The site stops answering its hub, which the hub will notice and report as the\nagent going unreachable. Deleting the plugin removes its settings, its audit-log\ntable and its working directories (see Yes. Everything the plugin puts on screen — the settings page, the support\ncard on the dashboard, every status message and every scan finding — is\ntranslated, and WordPress picks it up from your site's own language setting with\nnothing to configure. Both German locales are covered: Deutsch<\/em> and Deutsch\n(Sie)<\/em>. The wording is formal throughout, because these screens are read by the\nowner of the site rather than by the agency that maintains it.<\/p><\/dd>\n The plugin runs per site. A network-wide database upgrade is reported but not\nperformed — core's own network upgrade screen walks every site in the\nnetwork, and that is where it belongs.<\/p><\/dd>\n The file-integrity check compares every core and WordPress.org-hosted file\nagainst the checksums WordPress.org published for that exact release. A caching\nor optimisation plugin that rewrites a stylesheet produces the same mismatch a\nbackdoor does, which is why \"this file no longer matches what was published\" is\nreported as a fact rather than a verdict, and why non-executable files are\nwarnings rather than critical findings. Your hub can show you the actual diff.<\/p><\/dd>\n Nothing on page loads: there is no front-end code path. Backups and malware\nscans are real work and run in the background across WordPress cron ticks, to a\ntime budget, so they do not block visitors. Health checks are answered on demand\nwhen the hub asks.<\/p><\/dd>\n PHP 7.4 or newer and WordPress 6.0 or newer. Backups additionally need the\n sodium extension (encryption) and either wp-includes\/version.php<\/code> — raised on any site whose display\nlanguage differs from the WordPress package it was installed from.<\/p>","1.13.1":"jgm\/v1<\/code>) that a Bulwarden hub<\/strong> calls to read\nhealth and security data, run checks and trigger updates. The hub is a separate\napplication \u2014 it is not part of this plugin \u2014 and this plugin talks to no hub\nat all until you pair it with one<\/strong>. On its own it sends nothing anywhere.<\/p>\n\nWhat it reports<\/h4>\n\n
\n
.maintenance<\/code> lock from an updater that died\nmid-copy. Both are reported, and both can be finished from the hub by running\nexactly what WordPress itself would have run.<\/li>\nmail()<\/code>, an SMTP\nserver, or the plugin that configured one. No part of any message is stored:\nnot the recipient, not the subject, not the body.<\/li>\n<\/ul>\n\nWhat it finds<\/h4>\n\n
\n
.htaccess<\/code>, php.ini<\/code> and .user.ini<\/code> are\nthe one part of a WordPress install that changes what the server<\/em> does\nrather than what WordPress does, and nothing in wp-admin shows them. A file\nset to run before every request, a rule that makes uploaded images execute as\nPHP, a redirect that only fires for search engines: all reported, with the\nline. Nothing is ever changed for you \u2014 a good share of those directives are\nwritten deliberately by a host or a security plugin, and the point is that\nyou get to decide which.<\/li>\ndatabase.sql<\/code>\nin the web root, an installer that overwrites the site with no login. Found,\nmeasured, and removable from the hub \u2014 and the site<\/em> decides what may be\ndeleted, so a stale list can only ever be refused.<\/li>\nWhat it does<\/h4>\n\n
\n
Pairing<\/h4>\n\n
Security<\/h4>\n\n
Privacy<\/h3>\n\n
\n
.maintenance<\/code> lock file, and reports the outcome.<\/li>\n.htaccess<\/code>, php.ini<\/code> and .user.ini<\/code> files, so the hub can show\nwhat is in them and when they last changed. These are configuration, not\ncontent \u2014 no post, page, media file or user data is read.<\/li>\napi.wordpress.org<\/code> and downloads.wordpress.org<\/code>.\nThose requests carry only what identifies the release to look up \u2014 the\nWordPress version and locale, and each plugin's slug and version. No file\ncontents, hashes, URLs or user data are sent: the reference checksums come\nback and the comparison happens here, on this server.<\/p>\n\nExternal services<\/h3>\n\n
Your Bulwarden hub<\/h4>\n\n
\n
api.wordpress.org and downloads.wordpress.org<\/h4>\n\n
\n
Do I need a hub?<\/h4>\n\n
Upgrading<\/h4>\n\n
\n
Does this plugin send my site's data anywhere on its own?<\/h3><\/dt>\n
Can the hub operator read my backups?<\/h3><\/dt>\n
What happens if I deactivate or delete the plugin?<\/h3><\/dt>\n
uninstall.php<\/code>); backups already stored\non a hub are unaffected.<\/p><\/dd>\nIs the plugin available in German?<\/h3><\/dt>\n
Does it work on multisite?<\/h3><\/dt>\n
Why does the malware scan flag a file I know is fine?<\/h3><\/dt>\n
What does it do to my site's performance?<\/h3><\/dt>\n
Which PHP and WordPress versions are supported?<\/h3><\/dt>\n
zlib<\/code> or the zip<\/code> extension\n(archiving); the Settings screen tells you if either is missing.<\/p><\/dd>\n\n<\/dl>\n\n\n1.29.1<\/h4>\n\n
\n
1.29.0<\/h4>\n\n
\n
1.28.2<\/h4>\n\n
\n
1.28.1<\/h4>\n\n
\n
1.28.0<\/h4>\n\n
\n
1.27.3<\/h4>\n\n
\n
1.27.2<\/h4>\n\n
\n
http:\/\/<\/code> to\n https:\/\/ on that old domain. The restore reported success in both cases.\nThis site's addresses are now recorded before the restore starts and used as\nthe target; if they could not be recorded, the addresses are left alone and\nthe restore says so instead of guessing.<\/li>\n1.27.1<\/h4>\n\n
\n
object-cache.php<\/code>, db.php<\/code>, advanced-cache.php<\/code> and the rest of that\nfamily in wp-content<\/code>). They are loaded before any plugin and are tied to\nthe server they were written on \u2014 a cache server address, database hosts,\nabsolute paths \u2014 so a backup's copy restored onto another server took the\nwhole site down before anything could repair it. The copy already on the site\nis kept, and the restore log says which files were left alone.<\/li>\n<\/ul>\n\n1.27.0<\/h4>\n\n
\n
BULW_RESTORE_TICK_BUDGET<\/code> (seconds) shortens a restore's\nper-round budget so that a multi-round restore can be reproduced on a small\ntest site.<\/li>\n<\/ul>\n\n1.26.0<\/h4>\n\n
\n
.jpg<\/code>, .pdf<\/code> or .mp4<\/code> in the uploads folder \u2014 is reported as\na critical finding. There is no innocent reason for one, and it is exactly how\nsuch a file is kept out of sight.<\/li>\nwp-admin<\/code> or wp-includes<\/code> is reported as\ncritical. WordPress itself ships none, in any language.<\/li>\n1.25.1<\/h4>\n\n
\n
1.25.0<\/h4>\n\n
\n
1.24.1<\/h4>\n\n
\n
1.24.0<\/h4>\n\n
\n
1.23.0<\/h4>\n\n
\n
wp-cron.php<\/code>, take a\nrole from the request, or unpack code fetched from a server nobody published.\nEach check pairs the dangerous action with the thing that makes it\nillegitimate, so an honest plugin doing the same work is not reported.<\/li>\n1.22.2<\/h4>\n\n
\n
1.22.1<\/h4>\n\n
\n
zip<\/code> extension that check cannot run, so an affected backup may\nhave been stored instead of failing — those cannot be restored, and should be\nreplaced with a fresh backup after updating.<\/li>\n<\/ul>\n\n1.22.0<\/h4>\n\n