Updated the minimum required Craft version to 5.9.12.
Updated the frontend build toolchain to Vite 8.3.4.
Fixed
Fixed a high-severity access control vulnerability.
Fixed a medium-severity access control vulnerability affecting protected URL rules.
Fixed a medium-severity access control vulnerability affecting URL aliases.
Fixed a low-severity access control vulnerability affecting regular-expression URL rules.
3.0.14 2026-10-15
Changed
Updated Craft API usage to avoid deprecated calls.
3.0.13 2026-10-07
Changed
Require Verbb Base 3.0.20 or later so shared control-panel layouts use the current asset bundle namespace. (verbb-base#3(opens new window))
3.0.12 2026-10-05
Changed
Updated the required version of verbb/base to 3.0.19.
Replaced the CodeKit stylesheet build with Vite and moved web assets to src/web.
Fixed
Fixed a high-severity access control vulnerability.
Fixed a medium-severity cross-site request forgery vulnerability affecting password-gate lockouts.
Fixed a medium-severity access control vulnerability affecting regular-expression URL rules.
Fixed a medium-severity open redirect vulnerability.
Fixed a medium-severity access control vulnerability affecting protected URL matching.
Fixed a medium-severity access control vulnerability affecting access cookies.
Fixed a low-severity access control vulnerability.
Fixed a low-severity access control vulnerability affecting denied IP addresses with access cookies.
Fixed a low-severity access control vulnerability affecting zero-prefix CIDR rules.
Fixed a low-severity sensitive data storage vulnerability.
Fixed a low-severity resource exhaustion vulnerability affecting invalid-login records.
3.0.11 2026-09-30
Changed
Route plugin settings through the plugin’s authorized settings controller.
Fixed
Fixed a high-severity access control vulnerability.
3.0.10 2026-09-23
Fixed
Fix saving one settings page resetting settings on the other pages. (#84).
3.0.9 2026-09-14
Changed
Updated documentation for clearer, more consistent guidance.
3.0.8 2026-09-13
Changed
Normalize plugin settings.
3.0.7 2026-08-29
Added
Add cookieDuration setting to control how long a visitor stays logged in for before being asked for the password again. Previously hard-coded to one hour.
Fixed
Fix enabled callback functions in config files no longer working after environment variable support was added in 3.0.6. (#83).
3.0.6 2026-06-05
Added
Add support for environment variables in password and enabled settings, including Control Panel autosuggestions.
Fixed
Fix password comparison timing vulnerability.
3.0.5 2025-11-29
Changed
Ensure rendering templates set a no-cache header for Craft Cloud.
3.0.3 2025-05-01
Fixed
Fix normalization of multi-line settings like URLs and IPs.
3.0.2 2025-02-05
Fixed
Fix layout in Craft 5.6 and match new front-end login theme.
3.0.1 2024-07-21
Added
Allow enabled to be set using a callback function in config files.
Changed
Update English translations.
Fixed
Fix multi-site protected/unprotected URLs not being honoured.
Fix an error when trying to determine multi-site plugin settings for installs where no primary site exists yet.