This release focuses on two areas that matter when something goes wrong: preserving a valid plugin configuration and detecting more forms of obfuscated JavaScript in incoming requests. It also improves compatibility with hosting environments that do not provide the mysqlnd database driver.
Automatic backup and recovery for plugin settings
WP Cerber now keeps a last-known-valid backup of its settings.
The backup is refreshed after successful settings updates, imports, plugin upgrades, and daily maintenance. An invalid configuration cannot replace the existing valid backup.
If the settings stored in the WordPress database become corrupted or unreadable, WP Cerber attempts to restore the last valid configuration automatically. This helps preserve firewall rules, notifications, and other plugin settings instead of immediately falling back to defaults.
The recovery process is reported through the issue monitor:
- A successful recovery produces a dismissible warning that explains what happened and what should be reviewed.
- A failed recovery produces a critical issue with diagnostic information and practical guidance.
- Duplicate or contradictory recovery notices are prevented.
This also fixes a PHP 8 scenario where corrupted settings could trigger a fatal TypeError during plugin initialization and take the website down.
Traffic Inspector detects more obfuscated JavaScript
We made several changes to the Traffic Inspector detector that screens public request fields for obfuscated JavaScript.
The detector now handles more escape formats, including Unicode escapes, and inspects code reconstructed from String.fromCharCode() calls more thoroughly. It also recognizes payloads that use wrapped integer values, unsupported tokens, or JavaScript comments to interfere with decoding.
These changes close several practical bypasses while keeping the detector deliberately conservative. Partial expressions and ambiguous input remain outside the detection scope where supporting them would create an unreasonable false-positive risk.
The release also fixes a regression that prevented some strings composed entirely of \xNN hex escapes from being decoded correctly.
Better compatibility with hosts without mysqlnd
Some hosting environments provide the PHP mysqli extension without the mysqlnd driver. On those systems, database operations that relied on fetch_all() could cause a fatal error.
WP Cerber now detects whether that method is available. When it is not, the plugin uses a compatible row-by-row fallback instead.
The plugin remains functional, although the fallback may be slower. A new advisory in the System Readiness widget explains the condition and recommends enabling mysqlnd for full compatibility and better performance.