PBJ SEO & Security Changelog (v4.0.0): Firewall, Malware Scanning, and Two-Factor Login

PBJ SEO is our lightweight, first-party SEO plugin — a single-file replacement for heavyweight suites like Yoast or Rank Math. It outputs document titles, meta descriptions, canonical URLs, robots directives, Open Graph and Twitter Card tags, JSON-LD structured data, and sitemap <lastmod> dates, all with zero third-party dependencies. Here’s what has shipped in every version.

Version 4.0.1 — hardening the security modules

Released July 22, 2026. A robustness and security pass over the 4.0.0 modules — everything still ships off by default.

• Fail-proof database-prefix rename. A full database backup must be downloaded before the rename unlocks; it verifies wp-config.php can be rewritten before touching the database, and fully self-restores (tables and role keys) if anything fails — it can never lock you out.
• Firewall false positives fixed. Code and path rules match the URL only, so an ordinary blog comment or contact message that merely mentions code is no longer blocked.
• Login hardening. Two-factor now issues single-use recovery codes (shown once at setup) so a lost authenticator or broken mail server can’t lock you out, plus a wrong-code limit and replay protection, and a fix for a fatal on front-end logins.
• Accurate visitor IPs. The Cloudflare visitor-IP header is trusted only when the request really arrives through Cloudflare, closing a spoofing gap that could bypass the allowlist or login lockout.
• The admin sidebar is now labeled SEO & Security with a lock icon.

Version 4.0.0 — PBJ SEO becomes PBJ SEO & Security

Released July 22, 2026. Our biggest release yet: the plugin is renamed PBJ SEO & Security and gains a whole security half alongside the SEO tools you already have. Every security feature ships OFF — upgrading changes nothing until you turn something on — and nothing contacts an external service unless you enable both a master switch and the feature.

• Web Application Firewall. Inspects anonymous requests before WordPress routes them and blocks SQL injection, XSS, directory traversal, file inclusion, and PHP-injection probes. Manual IP block/allow lists, header-based country blocking, a log-only dry-run mode, and custom virtual-patch rules. Logged-in users and your own API traffic are never inspected.
• Malware scanning & remediation. Core-file integrity against the official WordPress.org checksums, a local signature sweep of plugin, theme, and upload PHP, one-click repair of modified core files, rogue-file quarantine, and Spamhaus domain-blocklist monitoring. Run on demand or schedule daily or weekly.
• Login security. Failed-login rate limiting and IP lockout, two-factor authentication (an authenticator app or an emailed code — no SMS gateway), a secret custom login URL, and password length, complexity, and expiry rules.
• Site hardening. Disable the dashboard file editor, disable XML-RPC, hide the WordPress version, and an opt-in database-prefix rename that is fully backed up and reversible.
• Auditing & monitoring. A new Logs tab with a 30-day security event log — scan findings, firewall blocks, login lockouts, and site activity — filterable by type, plus a lightweight live-traffic view and idle-session timeout.
• Private by default. The only external services any feature can contact are WordPress.org (core checksums) and Spamhaus (DNS reputation and blocklist), each disabled unless you turn on both the master switch and that feature, and each disclosed in plain language.
• Also on the SEO side: the 404 log now keeps not-found URLs for 30 days, and you can select several at once and redirect them all to one page — or dismiss them — in a single action.

Version 3.4.0 — the cache purges itself

Released July 14, 2026.

• Automatic cache purge after a Studio Sync push. When a push commits on the live site, PBJ SEO now purges its LiteSpeed edge cache automatically — no more stale pages hanging around until the cache TTL runs out. It works with every Studio Sync version, and pairs with Studio Sync 3.4.0’s new pbj_sync_after_commit hook.
• Automatic cache purge on every dashboard save. Saving any SEO tab — Options, Business, Robots & Sitemaps, Google Tools, 404s & Redirects — purges the edge cache immediately, so changed meta tags, schema, robots rules and redirects take effect right away.

Version 3.3.0 — Google Analytics and Search Console, built in

Connecting a WordPress site to Google’s free tools usually means installing yet another plugin (for the GA tag) and puzzling through a verification flow (for Search Console). 3.3.0 folds both into PBJ SEO — with instructions written for humans:

• New Google Tools tab. Plain-English, step-by-step walkthroughs for connecting your site to Google Analytics and Google Search Console, with direct links into each console. No jargon, no guessing which of Google’s five setup paths applies to you.
• GA4 without another plugin. Paste your Measurement ID (G-XXXXXXXXXX) and PBJ SEO outputs the Google tag on every page. Logged-in editors and admins are never tracked, so your own work doesn’t skew the numbers.
• Search Console verification built in. Paste Google’s HTML-tag token — or lazily paste the whole tag, both work — and the site emits the google-site-verification meta. A Bing Webmaster Tools field is included too.
• Sitemap controls on the Robots & Sitemaps tab: choose exactly what the XML sitemap includes — per-post-type toggles, category/tag archives, author archives, and an exclude-by-ID list. Defaults match WordPress core exactly, so nothing changes until you untick something.
• “Refresh sitemap now” button — rebuilds the sitemap routes, clears any cached copy, then fetches the live sitemap and reports how many URLs crawlers currently see.
• The Checklist tab now includes Google Analytics and Search Console rows, each with a Fix link straight to the new tab.

Version 3.2.0 — the Business tab: no more baked-in defaults

Until now, PBJ SEO shipped with our own business data as its defaults — our LocalBusiness name, address, and phone number, our service-page schema map, our service-area city list, even our old-URL redirect map. That was fine when the plugin only ran on pbj.tech; it’s wrong for everyone else. 3.2.0 removes every baked-in default and replaces them with a proper home for your data:

• New Business tab. Everything the plugin can say about your business is now editable at SEO → Business: name, schema.org type, phone, email, price range, image, description, full postal address, map coordinates, your service-area list (one city or county per line), and your service pages (one slug | Name | Description line each). Fill in a field and the matching output turns on — the front-page LocalBusiness node, Service nodes with your business as provider, areaServed lists, and geo meta tags. Leave a field empty and that output simply doesn’t exist.
• Developers keep full control. A new pbj_seo_business_info filter runs over the saved Business-tab values, so a site-specific mu-plugin or theme can override or extend any of it in code. The existing pbj_seo_service_schema_map and pbj_seo_redirect_map filters work exactly as before — they just start from empty maps now.
• Upgrading? If your site relied on the old defaults (that’s essentially just pbj.tech), fill in the Business tab after updating. Legacy URL redirects are best managed on the 404s & Redirects tab, which has been the redirect home since 3.0.0 anyway.

Version 3.1.0

• Added a License tab where you enter your PBJ license key to unlock automatic updates. The plugin is fully functional without a key; a key covers up to 3 sites.

Version 3.0.1

• The admin dashboard moved from Settings → PBJ SEO to its own top-level SEO item in the sidebar. No settings or behavior changed.

Version 3.0.0 — the admin dashboard

Our biggest PBJ SEO release yet, and a deliberate reversal of the plugin’s original “one small file, no dashboard” design. PBJ SEO now has a full settings screen at Settings → PBJ SEO with four tabs:

• Checklist. A page-by-page SEO audit — every published page and post is scanned for a missing meta description, an over-long or too-short title, no featured image for social sharing, a noindex flag, or thin content — with an Edit button on each. Alongside it, a site-wide checklist covers permalinks, search-engine visibility, tagline, HTTPS, logo/icon, the front-page share image, and the XML sitemap, plus a functional check that PBJ SEO’s own output is actually running and a warning if a second SEO plugin is fighting it.
• Options. Every feature — force-HTTPS, security headers, LiteSpeed edge caching, geo meta, legacy redirects, custom redirects, 404 logging, attachment redirects, feed noindex, head cleanup, and performance tweaks — is now an on/off switch with a plain-English explanation. Everything defaults on, so upgrading changes nothing until you decide it should.
• Robots & Sitemaps. See your sitemap URL and status, preview the effective robots.txt, and add your own robots rules — saved and served automatically.
• 404s & Redirects. A lightweight logger records the URLs visitors hit that don’t exist, with hit counts and referrers, and one click turns any of them into a redirect. A full 301/302 redirect manager replaces the old code-only map.

Version 2.0.0

• Merged PBJ Site Essentials. Security headers, legacy and duplicate-slug 301 redirects, geo meta tags, Service/FAQPage/LocalBusiness schema, meta URL absolutizing, performance tweaks, and the 2026 shortcode now live inside PBJ SEO; the standalone Site Essentials plugin is retired (and while it’s still active, the merged module stands down — no double output). Service/FAQ/LocalBusiness schema now ride in the main JSON-LD graph instead of separate script tags, with new pbj_seo_service_schema_map and pbj_seo_redirect_map filters.
• New: block editor “PBJ SEO” sidebar. Per-post SEO title, meta description, and noindex fields (previously only settable via WP-CLI), plus a live SEO best-practices checklist with click-to-fix actions, a site-wide checklist, and a pre-publish review panel.
• New output: attachment pages 301 to their parent post, feeds send X-Robots-Tag: noindex, follow, robots.txt gains a Sitemap: line, article published/modified-time Open Graph tags, og:image width/height/alt and twitter:image:alt, and shortlink/RSD head links are removed.
• Changed: force-HTTPS is now on by default (was opt-in). Same safety rails — it only ever redirects when the home URL itself is HTTPS.
• Fixed: LiteSpeed edge-cache headers moved to template_redirect — previously they fired before the main query, so search/404/preview pages could be cached as public.

Version 1.4.0

• LiteSpeed edge caching. Anonymous front-end pages now send X-LiteSpeed-Cache-Control: public (6-hour TTL, adjustable via the pbj_seo_cache_ttl filter) so LiteSpeed servers full-page-cache them with no separate cache plugin. Personalized requests — logged-in users, cart/checkout, comment cookies, search, 404s, previews, feeds — are marked no-cache, with a pbj_seo_cacheable filter for site-specific rules. Content changes send a full-site purge. Both headers are ignored on non-LiteSpeed servers, so there’s zero behavior change elsewhere.

Version 1.3.1

• The posts page (blog index) now honors its own meta description and featured image for the description and og:image, instead of always falling back to the site tagline and default image.

Version 1.3.0

• Added an opt-in force-HTTPS redirect (PBJ_SEO_FORCE_HTTPS constant or pbj_seo_force_https filter). 301s to the canonical HTTPS home host and collapses www in the same hop; no-op when the home URL isn’t HTTPS, under WP-CLI/cron, or behind a TLS-terminating proxy.

Version 1.2.0

• Added an Article JSON-LD node (headline, dates, author, publisher) on posts, with pbj_seo_is_article, pbj_seo_article_type, and pbj_seo_article_author filters.
• Added the pbj_seo_schema_graph filter so themes can append site-specific schema nodes, and pbj_seo_default_image for a site-wide fallback share image.
• Added <lastmod> to core XML sitemap entries and removed the WordPress version meta generator tag.

Version 1.1.0

• Added a per-post custom title override via the _pbj_seo_title post meta (front page or any singular page).

Version 1.0.0

• Initial release. Replaced Rank Math with first-party titles, meta descriptions, canonicals, robots directives, Open Graph/Twitter Cards, Organization/WebSite/WebPage/BreadcrumbList/Product schema, and image alt-text fallbacks.