Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)

9.8.4 – 2026-10-26

Security: On multisite, only network admins can now deactivate the plugin network-wide.

9.8.3 – 2026-09-15

Security: Fixed a remaining 2FA bypass in XML-RPC authentication.

Security: Fixed an issue where unauthenticated visitors could bloat the database via the 404 interceptor. Thanks to Naoki Kawahigashi via WPScan for reporting.

Fixed: A possible error when processing plugins that were no longer available in Other Plugins.

Changed: Removed SimplyBook.me from onboarding and Other Plugins.

Changed: Standardized punctuation in task and notice messages.

9.8.2 – 2026-09-14

Security: Users required to use 2FA could extend their own grace period.

Fixed: 2FA onboarding after logging in through WooCommerce.

Fixed: The firewall could reference advanced-headers.php when the file did not exist.

Fixed: Possible fatal errors caused by invalid data in public CSP and 2FA requests.

9.8.1 – 2026-09-01

Security: Prevented unexpected deletion of the login nonce.

Security: Prevented a bug that incorrectly changed the 2FA status from active to open.

Security: Prevent XML-RPC logins without 2FA for users with 2FA configured.

9.8.0 – 2026-08-25

Fixed: Other plugin installation now retrieves the download link correctly.

Fixed: PHP 8.5 compatibility issues.

Fixed: The 2FA grace period was not always handled correctly.

Changed: REST API checks are faster and run only when needed.

Changed: Tested up to WordPress 7.1.

9.7.0 – 2026-07-29

Fixed: Alignment of the