iThemes Security Pro | Best #1 WordPress Security Plugin v.8.4.2

v5.3.5 - 2018-07-09
Enhancement: Add setting to customize On-Board text.
Enhancement: Require user to confirm Two-Factor email method when signing up via On-Boarding. Can be disabled by disabling the new Two-Factor Email Confirmation email in the Notification Center.
Enhancement: Add setting for customizing who is required to use two-factor when "Vulnerable User Protection" and "Vulnerable Site Protection" are enabled and who is presented the On-Board flow.
Tweak: Check if an IP is blacklisted on page load for compatibility with servers that cannot process server configuration level bans immediately.
Bug Fix: Provide better error messages in case the server for SSL support detection is non-responsive.

IThemes Security Pro v5.3.4 WordPress Plugin
5.3.4 - 2018-06-27 - Chris Jean & Timothy Jacobs
Enhancement: Add mitigation for the WordPress Attachment File Traversal and Deletion vulnerability.
Tweak: Display the subject line of the Two-Factor Email when logging in.
Tweak: Fire a WordPress action whenever settings are updated.
Bug Fix: Improved input sanitization on the logs page to prevent triggering warnings.
Bug Fix: Don't track post status transitions to the identical post status.

v5.3.3 - 2018-06-18
Security Fix: Fixed SQL injection vulnerability in the logs page. Note: Admin privileges are required to exploit this vulnerability. Thanks to Çlirim Emini, Penetration Tester at sentry.co.com, for reporting this vulnerability.
Tweak: Recommend Strong Passwords and Refuse Compromised Passwords in the Grade Report.
Bug Fix: Provide default values for enabled requirements.

v5.3.2 - 2018-06-12
Bug Fix: Accessing password requirement settings would not resolve properly in some instances.

v5.3.0 - 2018-06-07
New Feature: Integration with Have I Been Pwned to prevent users from using passwords found in data breaches.
Enhancement: Introduce Password Requirements module for managing and enforcing password requirements.
Enhancement: Continually evaluate password strength for users instead of only during registration.
Enhancement: Add basic admin debug page to help diagnosing and resolving issues. Particularly with the events.
Bug Fix: Password strength would not be evaluated if password was set using custom PHP or CLI commands.
Bug Fix: Only hide "Acknowledge Weak Password" checkbox if the user was not allowed to use a weak password.
Bug Fix: Ensure Grade Report instructions in the Security Digest is accurate when the Grade score is capped.