📢 cPFence: New Version Releases & Patch Notes

cPFence

Version 3.3.75 (9th July 2025)

Added

New WAF Toggles

Ability to enable or disable Layer 7 WAF protection per domain
Ability to enable or disable Bot protection per domain
New global toggles for Layer 7 WAF and bot protection – enable or disable server-wide in one click
Fully supported via CLI – run cpfence | grep WAF to explore available WAF options

This only disables auto-protection — you can still use your own custom blacklist/whitelist in this mode:

Bots:

Blacklist: nano /opt/cpfence/app/cpfwaf/userdata_bl_agents

Whitelist: nano /opt/cpfence/app/cpfwaf/userdata_wl_agents
Layer 7 WAF:

Block custom IPs via: /opt/cpfence/app/cpfwaf/userdata_bl_IPs

All editable from the WebUI > Edit Config Files as well.

Improved

Several minor fixes and overall improvements applied

cPFence

Version 3.3.76 (11th July 2025)

Improved

WP-AutoShield daily cron now respects both "on" and "off" settings for all toggle options, not just "on" values
Additional WAF optimizations applied to improve compatibility across more platforms and plugins

cPFence

Version 3.3.77 (27th July 2025)

Added

Captcha WAF
Silent, offsite bot protection is now live. Block bad bots on login pages across all domains with one click. WebUI and CLI controls included. No user interaction, no server load. Just smarter security.
Learn more about Captcha WAF →

Key Features:
- Intercepts bots offsite before they hit your server
- Seamless for real users, no interaction required
- Blocks brute-force, dictionary, and credential-stuffing attacks
- Offloads heavy logic to reduce server load
- Supports WordPress, Joomla, Laravel, and custom logins
- Apply protection to any URL you define
- Fast, accurate validation via cPFence’s load-balanced backend
WP-AutoShield
Now auto disables LiteSpeed cache on WordPress login pages to allow Captcha WAF interception
Default is on
Config setting: autoshield_disable_ls_cache_login_page
CLI commands:
- cpfence --bulk-enable-ls-cache-login-page
- cpfence --bulk-disable-ls-cache-login-page

Improved

Lots of WAF optimizations to improve compatibility with popular plugins and themes

cPFence

Version 3.3.78 (5th August 2025)

Improved

Upgraded the WAF Module to enhance application and API security
cPFence WAF is now scoring new records in WAF testing tools
Test results shown below are from Nginx and LiteSpeed Enterprise servers only:

Fixed

Resolved an issue where SMTP settings were not being saved correctly

cPFence

Version 3.3.79 (6th August 2025)

Fixed

Resolved an issue with the WAF module affecting certain setups in the previous version.

cPFence

Version 3.3.80 (15th August 2025)

Improved

Several minor fixes and improvements in the WebUI bulk tools
Improved compatibility with PHP 8.4

Fixed

Resolved a false positive issue with the latest Clientexec version

cPFence

Version 3.3.81 (16th August 2025)

Fixed

Fixed a small glitch where WordPress sites weren't showing up in the WebUI on some systems

cPFence

Version 3.3.82 (20th August 2025)

Added

Automatic Cleanup for Quarantined Files:
cPFence will now automatically clear quarantined files older than 60 days (along with their logs and stats). This helps keep your server tidy, especially if you deal with lots of infections or run busy environments

Improved

Even more WAF optimizations for better compatibility with a wide range of plugins and themes
Added new detection signatures to catch clever and hidden attack patterns that older scanners may have missed

cPFence

Version 3.3.83 (22nd August 2025)

Added

False Positive Reporting:
You can now report false positives for both WAF and Malware directly from the WebUI
Available under:
- Threat & Malware Detection > Quarantine Management > Report Malware False Positive
- WAF Management > WAF Tracking > Report WAF False Positive

Improved

Additional WAF optimizations to further improve compatibility with plugins and themes

cPFence

Version 3.3.84 (27th August 2025)

Added

Malicious Plugin Detection:
cPFence can now automatically detect plugins that attempt to hide themselves from the WordPress admin dashboard or sneak in a backdoor. When found, you’ll receive instant alerts and automated remediation will be applied
Malicious Cronjob Detection:
Attackers often add hidden cronjobs for persistence. cPFence now detects these malicious cronjobs, alerts you immediately, and takes automated remediation actions when necessary.

Improved

MonitorPro Module: Will now skip 301 status codes to prevent unnecessary “down” alerts
Clickable Blocked IPs: Top blocked IPs displayed in the WebUI are now clickable, giving you quick access to detailed information on why each IP was blocked

cPFence

Version 3.3.85 (30th August 2025)

Added

Auto SSL is now active on the cPFence WebUI control panel
Automatic IP whitelisting for new root logins – no more manual IP whitelisting, just log in to SSH as root and cPFence will auto-whitelist it for WebUI access
Works only if the Root Login Alerts option is enabled on your main control panel server
With these improvements, we recommend using direct WebUI access instead of Cloudflare tunnels to avoid timeout issues and limitations

Improved

Improved per-website license IP sync
Increased WAF compatibility with popular plugins

cPFence

Version 3.3.86 (5th September 2025)

Improved

Per-website license system and cPFence WebUI now automatically exclude soft-deleted websites
Resolved several reported false positives, further improving detection accuracy

cPFence

Version 3.3.86.2 (7th September 2025)

Improved

Updated IP ranges database to improve country detection accuracy and coverage in the IPDB module
Addressed several malware false positives reported through WebUI
Addressed several WAF false positives reported through WebUI

cPFence

Version 3.3.87 (9th September 2025)

Added

Quarantine restore in WebUI now marks entries as Restored or Quarantined
Once a file is restored, cPFence automatically updates the status and disables further restoration attempts to prevent duplication or errors

Improved

Enhanced infection log processing and smarter scan log pruning for faster performance and improved protection

cPFence

Version 3.3.88 (12th September 2025)

Added

Search by Server Name or IP Address to quickly switch between servers in the WebUI
New file search inside Edit Configuration Files page in WebUI – instantly locate any file by name

Improved

Enhanced compatibility and performance in both WAF and Malware Protection modules

cPFence

Version 3.3.88.1 (23rd September 2025)

Improved

Resolved false positives triggered by the new Node.js feature
WebUI updated to prepare for the upcoming New WordPress Bulk Tools - manage users, themes, and plugins cluster-wide, on steroids. Coming soon

cPFence

Version 3.3.89 (26th September 2025)

Added

This release introduces the most powerful bulk WordPress management tools in cPFence.
13 new tools to manage Users, Themes, and Plugins per website, per server, or cluster-wide.
Read more: New! Bulk Manage Themes, Users, Plugins, and Updates Across All Sites
- Bulk Install Theme or ZIP
- Bulk Activate Theme by Slug
- Bulk Delete Theme by Slug
- Bulk Create WP User (redesigned)
- Bulk List WP Users
- Bulk Reset All Passwords
- Bulk Reset One User Password
- Bulk Delete WP User (Reassign Content)
- Bulk Delete WP User (No Reassign)
- Bulk Disable Plugin by Slug
- Bulk Enable Plugin by Slug
- Bulk Update All WordPress Sites (Choose exactly what gets updated: core, plugins, themes, translations—or everything)
- Bulk Enable LiteSpeed Heartbeat from WebUI
Ability to control retention period for quarantined files in settings. You can modify QUARANTINE_DAYS in WebUI or config file. Default value is 60.

Improved

Per-website license IP sync improvement
Increased WAF compatibility with popular plugins
"Bulk Enable DNSSEC" tool now skips domains that already have DNSSEC enabled

Fixed

Fixed the WebUI [stream error: TypeError…] that appeared sometimes when running bulk actions on several servers
Fixed incorrect detection of CP main domain when resellers activate their whitelisted control panel feature
Fixed ApiMachine Module to be compatible with new Enhance API recently introduced by Enhance Team

« Previous Page