1.0.45 — October 29, 2026

v1.0.45 — Emergency Recovery & Support

• Redesigned Emergency Login Recovery with clearly identifiable expandable sections.
• Added the ability to email recovery instructions to the current administrator.
• Added a downloadable emergency recovery guide for safekeeping outside WordPress.
• Included standalone recovery procedures in the plugin documentation and readme.txt.
• Separated BSM Product Support diagnostics from Hosting / Server Support recovery instructions.
• Preserved existing authentication configuration and emergency recovery options.

v1.0.44 — Security & Email Settings Improvements

• Consolidated Security settings to eliminate duplicate configuration forms.
• Improved navigation for account authentication policies.
• Reorganized Email settings to place General & Login Links first.
• Updated email authentication settings so the default sign-in method is relevant only when both magic links and verification codes are allowed.
• Improved Activity username filtering to reduce unwanted browser autofill.
• Preserved existing configuration and authentication settings.

v1.0.43 — Administration & Activity Improvements

• Corrected navigation to relocated authentication settings.
• Improved compatibility with previously bookmarked administration URLs.
• Removed redundant navigation shortcuts from the Overview dashboard.
• Added login shortcode instructions within Login Methods.
• Improved analytics tooltip sizing and readability.
• Improved Activity search fields to reduce browser autofill.
• Updated Activity timestamps to use the configured WordPress timezone.
• Improved IP-blocking controls with safer action availability and confirmation.

v1.0.42 — Analytics & Navigation

• Updated the main WordPress administration menu label to BSM Magic Login.
• Added hourly authentication activity reporting for the Today view.
• Updated analytics to respect the WordPress site timezone.
• Improved chart scaling to display whole-number event counts.
• Added tooltips positioned near the selected chart data point.
• Improved keyboard accessibility for analytics tooltips.
• Updated analytics tables and CSV exports to reflect the selected reporting period.

v1.0.41 — Dashboard & Authentication Provider Management

• Introduced an improved Overview dashboard with authentication statistics.
• Consolidated authentication analytics into the main dashboard.
• Removed the redundant Analytics submenu.
• Improved SMS provider management with a more intuitive configuration workflow.
• Organized Single Sign-On providers into individual expandable sections.
• Preserved Microsoft Entra ID configuration and authentication.
• Added clearly labeled future integration listings for Google Workspace, Okta, Google Login, and Facebook Login.
• Improved navigation between authentication settings.

v1.0.40 — Administration & Email Delivery Improvements

• Consolidated authentication administration into Overview, Activity, Login Methods, Security, Integrations, and License.
• Improved the authentication activity chart.
• Updated authentication email handling to reduce unwanted email conversation threading.
• Improved management of newly issued authentication credentials.
• Continued improvements to the setup wizard and administration experience.

v1.0.39 — Login Interface Maintenance

• Corrected a JavaScript error affecting the magic-link confirmation interface.
• Improved reliability of the login confirmation screen.

v1.0.38 – v1.0.36 — Activity & Administration

• Expanded authentication activity searching and filtering.
• Added more convenient review of authentication events.
• Improved activity pagination and administration controls.
• Continued refinements to the passwordless login interface.

v1.0.14 — Microsoft Entra ID Single Sign-On

• Added Microsoft Entra ID Single Sign-On configuration.
• Added guided setup for new or existing Microsoft Entra applications.
• Added connection validation and administrator test sign-in.
• Supported secure OpenID Connect authentication.
• Added protected storage for provider credentials.
• Added account identity binding to help prevent unauthorized account linking.
• Added an optional Microsoft Entra sign-in shortcode.
• Preserved existing passwordless authentication and emergency recovery methods.

v1.0.0 Series — Passwordless Authentication & Security

• Expanded support for passkey authentication using compatible devices and authenticators.
• Added guided initial setup and configuration.
• Improved passwordless options on the WordPress login screen.
• Added reversible login-screen takeover and emergency fallback controls.
• Expanded email verification and authentication options.
• Improved authentication activity logging and retention controls.
• Added additional protections against repeated authentication attempts.
• Improved security responses to reduce account information disclosure.
• Expanded username and email authentication support.
• Improved passkey request throttling and account protection.
• Added guided emergency recovery instructions.
• Improved administrator configuration and role-based authentication policies.

v0.9.1 – v0.9.5 — Administration & Integration Improvements

• Expanded compatibility with BSM WordPress AI Connection.
• Improved management of authentication settings and policies through authorized integrations.
• Added additional provider management and diagnostic capabilities.
• Improved provider lifecycle and credential management operations.

v0.9.0 — Security Hardening

• Strengthened passkey authentication with required user verification.
• Improved compatibility with biometric authentication, device PINs, and supported security keys.
• Added additional protections against repeated recovery-code attempts.
• Reduced account information disclosure during passkey authentication.
• Improved validation of WordPress role-based authentication policies.
• Strengthened protection of authentication requests and administrative operations.
• Improved safeguards for single-use authentication credentials.
• Preserved existing authentication history, SMS providers, passkeys, recovery codes, and security settings during upgrades.

Key Capabilities Available by v1.0.45
Passwordless Authentication

• Email magic links and six-digit verification codes.
• SMS authentication with configurable providers.
• Passkeys and supported device authentication.
• Microsoft Entra ID Single Sign-On.

Security & Access

• Configurable authentication policies and rate limits.
• WordPress role-based access controls.
• IP blocking and account protection.
• Authentication event logging.
• Emergency login recovery options.

Administration

• Centralized authentication dashboard.
• Authentication activity analytics and CSV exports.
• Provider configuration and management.
• Customizable email authentication settings.
• Guided setup and recovery documentation.
• BSM licensing and plugin update integration.

Compatibility and Upgrades

Existing authentication settings, user accounts, and stored credentials are retained during supported plugin upgrades. Administrators should maintain a working alternative login method when changing authentication settings.

Current release: v1.0.45

Social login through Google and Facebook, Google Workspace SSO, and Okta are planned for future development and are not included as functioning authentication providers in v1.0.45.

0.9.0 — October 7, 2026

Pre-1.0 Security Hardening Release

SECURITY — PASSKEY USER VERIFICATION
- WebAuthn registration now requires user verification.
- WebAuthn authentication now requires user verification.
- Authenticator responses must contain both the User Present
and User Verified flags.
- Passkey authentication requests now specify
userVerification: required.
- This strengthens passkey authentication for Face ID,
Touch ID, Windows Hello, PIN-protected authenticators,
and compatible security keys.

SECURITY — RECOVERY CODE ABUSE PROTECTION
- Added attempt tracking to passkey recovery challenges.
- Recovery challenges allow a maximum of 10 attempts.
- Challenges are invalidated after the attempt limit.
- A locked recovery challenge requires the user to restart
authentication.
- Existing five-minute challenge expiration remains enforced.

SECURITY — ACCOUNT ENUMERATION REDUCTION
- Public passkey authentication no longer distinguishes
between an unknown account and an account without
registered passkeys.
- Both conditions return the same generic
"Passkey authentication is unavailable" response.
- This reduces information exposed through the public
authentication endpoint.

SECURITY — ROLE POLICY VALIDATION
- Privileged-role configuration is now validated against
roles actually registered on the WordPress installation.
- Arbitrary or stale role slugs submitted to the settings
endpoint are discarded.
- Existing capability and nonce protection remains enforced.

SECURITY — EXISTING SINGLE-USE CONTROLS REVIEWED
- Email magic-link completion continues to use an atomic
state transition before authentication.
- SMS OTP completion continues to use an atomic
issued-to-used state transition.
- Superseded credentials remain unusable.
- WebAuthn authentication challenges remain single-use.
- Passkey registration challenges remain single-use.
- Step-up challenges remain time-limited and single-use
after successful completion.

PRE-1.0 ATTACK-SURFACE REVIEW
Reviewed the major authentication and administrative paths for:
- Capability enforcement
- Nonce verification
- Input sanitization
- Safe redirects
- SQL parameterization
- Single-use credential handling
- Authentication state transitions
- Public AJAX authentication endpoints
- Authenticated AJAX endpoints
- admin-post handlers
- Recovery flows
- WebAuthn challenge handling
- Free/Pro boundaries

UPGRADE / DATABASE
- Advanced the Magic Login schema version to 0.9.0.
- Existing installations migrate automatically.
- No destructive migration is performed.
- Existing authentication history is retained.
- Existing SMS provider configuration is retained.
- Existing passkeys are retained.
- Existing recovery codes are retained.
- Existing security policies are retained.
- Existing licensing configuration is retained.

VERSION CONSISTENCY
- Plugin header: 0.9.0
- BSMML_VERSION: 0.9.0
- WordPress readme Stable Tag: 0.9.0
- Database schema version: 0.9.0

COMPATIBILITY
- Preserves Free email magic-link authentication.
- Preserves Pro SMS authentication.
- Preserves SMS provider failover and health monitoring.
- Preserves Account Security.
- Preserves WooCommerce integration.
- Preserves signed webhooks.
- Preserves authentication analytics and CSV export.
- Preserves IP/CIDR security controls.
- Preserves WebAuthn/passkeys.
- Preserves risk-aware authentication.
- Preserves privileged-role step-up.
- Preserves emergency recovery codes.
- Preserves privacy export/erasure.
- Preserves multisite support.
- Preserves BSM licensing.
- Preserves BSM automatic updates.
- Stable installation directory remains bsm-magic-login/.

0.8.0 — October 7, 2026

Recovery & Operational Safety Release

NEW — EMERGENCY RECOVERY CODES (PRO)
- Added one-time recovery codes for passkey-protected accounts.
- Generates 10 recovery codes at a time.
- Recovery codes are displayed only once after generation.
- Codes are stored only as keyed cryptographic hashes.
- Individual codes become permanently invalid after use.
- Generating a new set invalidates the previous set.
- Users can explicitly invalidate all remaining recovery codes.

NEW — PASSKEY RECOVERY
- Recovery codes can satisfy a passkey step-up challenge when
the user's passkey is unavailable.
- Supports recovery from both risk-triggered and mandatory
privileged-role step-up challenges.
- Successful recovery establishes the authenticated WordPress
session only after the original authentication stage succeeded.
- Recovery-code authentication is recorded in the security log.

NEW — MY LOGIN SECURITY CONTROLS
- Added Recovery Codes management to the existing
[bsm_magic_login_security] interface.
- Displays the number of unused recovery codes.
- Allows authenticated Pro users to generate replacement codes.
- Allows users to invalidate their recovery codes.
- Newly generated plaintext recovery codes are intentionally
shown only once.

NEW — SECURITY HEALTH
Added:

Magic Login > Security Health

Operational diagnostics now check:
- HTTPS availability
- WordPress cron configuration
- OpenSSL availability
- WordPress authentication/security salts
- Required Magic Login database tables
- Privileged-user strong-auth recovery readiness

NEW — LOCKOUT PREVENTION
- Mandatory privileged-role passkey step-up cannot be enabled
for the administrator's own role unless that administrator
already has:
- a registered passkey, or
- valid recovery codes.
- This prevents an administrator from enabling a policy that
immediately removes their own viable authentication path.

NEW — PRIVILEGED ACCOUNT READINESS
- Security Health evaluates users covered by mandatory
privileged-role step-up.
- Administrators are warned when a privileged user has neither
a registered passkey nor recovery codes.
- Configuration warnings do not silently alter authentication
policy or user credentials.

RECOVERY DESIGN
- Recovery codes do not replace normal authentication.
- A recovery code is used only as the strong-authentication
recovery stage after the primary email/SMS authentication
requirement has been satisfied.
- Recovery codes cannot be retrieved in plaintext after their
initial generation.
- Lost recovery codes must be replaced with a newly generated set.

EXISTING EMERGENCY CONTROLS
The wp-config.php recovery controls remain available:

define('BSMML_DISABLE_ALL', true);
define('BSMML_DISABLE_EMAIL', true);
define('BSMML_DISABLE_SMS', true);

These remain independent of the WordPress administration UI.

DATABASE / UPGRADE
- Advanced the Magic Login schema version to 0.8.0.
- Existing installations migrate automatically.
- No destructive database migration is performed.
- Existing authentication history is retained.
- Existing passkeys are retained.
- Existing SMS providers and credentials are retained.
- Existing phone verification is retained.
- Existing licensing and update configuration is retained.

VERSION CONSISTENCY
- Plugin header updated to 0.8.0.
- BSMML_VERSION updated to 0.8.0.
- WordPress readme Stable Tag updated to 0.8.0.
- Database schema version updated to 0.8.0.

COMPATIBILITY
- Preserves Free email magic-link authentication.
- Preserves Pro SMS authentication.
- Preserves provider health and intelligent failover.
- Preserves Account Security.
- Preserves WooCommerce integration.
- Preserves signed webhooks.
- Preserves analytics and CSV export.
- Preserves IP/CIDR security controls.
- Preserves WebAuthn/passkeys.
- Preserves risk-aware authentication.
- Preserves privacy export/erasure.
- Preserves multisite support.
- Preserves BSM licensing.
- Preserves BSM automatic updates.
- Stable plugin directory remains bsm-magic-login/.

0.7.0 — October 7, 2026

Hardening & Privacy Release

NEW — VERSIONED DATABASE MIGRATIONS
- Added an independent Magic Login database schema version.
- Database migrations now run automatically when required.
- Schema updates no longer depend solely on plugin activation.
- Existing installations are upgraded safely in place.
- Database schema version is visible in Data & Privacy.

NEW — WORDPRESS MULTISITE SUPPORT
- Added network-activation handling.
- Network activation provisions Magic Login tables and settings
independently for each existing site.
- Newly created multisite sites are automatically provisioned.
- Site-specific WordPress table prefixes are respected.
- Existing single-site behavior remains unchanged.

NEW — WORDPRESS PRIVACY EXPORT
- Integrated with Tools > Export Personal Data.
- Magic Login authentication history associated with an email
address can be included in a WordPress privacy export.
- Exported authentication information can include:
- Timestamp
- IP address
- User agent
- Authentication event
- Result
- Reason
- Member Magic Login profile information is included where
applicable:
- Mobile number
- Mobile verification status
- Number of registered passkeys

NEW — WORDPRESS PRIVACY ERASURE
- Integrated with Tools > Erase Personal Data.
- Removes outstanding Magic Login credential records associated
with the user.
- Removes SMS authentication records associated with the user.
- Removes stored mobile authentication information.
- Removes phone-verification state.
- Removes registered passkey credentials.
- Retained security/audit events are anonymized rather than
silently destroying historical security evidence.
- Anonymization removes:
- WordPress user association
- Username
- Original email address
- Original IP address
- User agent

NEW — DATA & PRIVACY ADMINISTRATION
Added:

Magic Login > Data & Privacy

The screen provides:
- Current database/schema version
- Privacy-tool information
- Explicit uninstall-data policy
- Destructive uninstall control

NEW — SAFE UNINSTALL POLICY
- Deactivation never deletes Magic Login data.
- Plugin deletion preserves data by default.
- Administrators can explicitly enable:
"Permanently delete Magic Login data when the plugin is deleted"
- The destructive option is OFF by default.

When destructive uninstall is explicitly enabled, deletion removes:
- Magic Login request tables
- Authentication audit tables
- IP block tables
- SMS provider tables
- SMS authentication-code tables
- Magic Login settings
- SMS settings
- Account Security settings
- Integration settings
- Strong Authentication settings
- Data/privacy settings
- Database version metadata
- Licensing data
- Magic Login user metadata
- Mobile authentication information
- Passkey credentials
- Magic Login administrator capability

NEW — ACCESSIBILITY HARDENING
- Added explicit keyboard focus treatment to front-end
authentication controls.
- Added minimum interactive control target sizing.
- Preserved status-region behavior for passkey interactions.
- Existing semantic labels and form controls remain intact.

UPGRADE SAFETY
- Existing authentication history is retained.
- Existing provider credentials are retained.
- Existing license configuration is retained.
- Existing passkeys are retained.
- Existing mobile verification is retained.
- Existing security settings are retained.
- Existing Free/Pro entitlements are retained.
- No destructive migration is performed during upgrade.
- Installing v0.7.0 does not enable destructive uninstall.

COMPATIBILITY
- Preserves Free email magic-link authentication.
- Preserves Pro SMS OTP authentication.
- Preserves multiple SMS providers.
- Preserves intelligent provider failover and health monitoring.
- Preserves Account Security.
- Preserves role-based authentication policies.
- Preserves WooCommerce integration.
- Preserves signed webhooks.
- Preserves authentication analytics and CSV export.
- Preserves IP/CIDR security controls.
- Preserves WebAuthn/passkeys.
- Preserves risk-aware authentication.
- Preserves privileged-role step-up authentication.
- Preserves BSM licensing.
- Preserves BSM automatic updates.
- Stable installation directory remains bsm-magic-login/.

0.6.0 — October 7, 2026

Strong Authentication Release

NEW — PASSKEY / WEBAUTHN AUTHENTICATION (PRO)
- Added WebAuthn passkey authentication.
- Users can register passkeys from My Login Security.
- Supports platform authenticators such as:
- Face ID
- Touch ID
- Windows Hello
- Device passkey managers
- Compatible hardware security keys
- Added standalone passkey login shortcode:
[bsm_magic_login_passkey]
- Passkeys can be individually removed by the user.
- Tracks passkey creation and last-use information.
- Passkey private keys never leave the user's authenticator.
- BSM Magic Login stores only the credential information required
to verify authentication.

SECURITY — WEBAUTHN VERIFICATION
- Cryptographically verifies WebAuthn ES256 signatures.
- Validates WebAuthn challenge values.
- Validates site origin.
- Validates relying-party ID hashes.
- Requires the WebAuthn User Present flag.
- Validates authenticator signature counters when supplied.
- Registration challenges expire automatically.
- Authentication challenges expire automatically.
- WebAuthn credentials are scoped to the WordPress site's hostname.

NEW — PASSKEY MANAGEMENT
- Added passkey registration to My Login Security.
- Users may register multiple passkeys.
- Passkeys can be individually named.
- Users can remove individual credentials without affecting
their other authentication methods.
- Passkey registration requires an already authenticated session.

NEW — RISK-AWARE AUTHENTICATION (PRO)
- Added authentication risk scoring.
- Risk signals currently include:
- Previously unseen IP address
- Previously unseen browser/user-agent signature
- Recent failed authentication activity
- Membership in a configured privileged WordPress role
- Risk scores range from 0–100.
- Administrators can configure the threshold at which
step-up authentication is required.
- Default step-up threshold is 60.

NEW — HIGH-RISK STEP-UP AUTHENTICATION
- Email and SMS authentication can optionally require a
registered passkey when the calculated authentication
risk exceeds the configured threshold.
- The normal email magic link or SMS OTP is validated first.
- WordPress does not establish the authenticated session yet.
- The user must then successfully complete the passkey challenge.
- Only after the second authentication factor succeeds is
the WordPress session established.
- Step-up challenges expire after five minutes.

This creates a genuine two-stage flow:

Email Magic Link + Passkey

or

SMS OTP + Passkey

NEW — PRIVILEGED ROLE PROTECTION
- Administrators can select WordPress roles that should receive
additional risk weighting.
- Optional policy can always require passkey step-up for
selected privileged roles.
- Administrator is selected as the default privileged role.
- The policy remains opt-in so existing sites are not locked
out during upgrade.

NEW — STRONG AUTHENTICATION SETTINGS
Added:

Magic Login > Strong Authentication

Administrators can configure:
- Passkey authentication
- Risk-aware step-up authentication
- Risk threshold
- Mandatory step-up for privileged roles
- Which WordPress roles are considered privileged

NEW — SECURITY AUDIT EVENTS
Added authentication events for:
- Passkey registered
- Passkey removed
- Passkey login
- Step-up authentication required
- Step-up authentication completed

Risk-triggered events record the calculated score and
applicable risk reasons without recording authentication secrets.

UPGRADE SAFETY
- Passkey authentication is Pro functionality.
- Passkeys are enabled for registration/login after upgrade.
- Risk-based mandatory step-up is NOT automatically enabled.
- Mandatory privileged-role step-up is NOT automatically enabled.
- Existing administrators therefore cannot accidentally lock
themselves out simply by installing v0.6.0.
- Administrators should register at least one working passkey
before enabling mandatory step-up policies.

COMPATIBILITY
- Preserves Free email magic-link authentication.
- Preserves Pro SMS authentication.
- Preserves SMS provider health and intelligent failover.
- Preserves Account Security.
- Preserves WooCommerce integration.
- Preserves signed webhooks.
- Preserves authentication analytics and CSV export.
- Preserves IP/CIDR security controls.
- Preserves BSM licensing.
- Preserves BSM automatic updates.
- Preserves existing authentication history and settings.

REQUIREMENTS
- WebAuthn/passkeys require a secure HTTPS origin.
- Browser and device must support WebAuthn.
- localhost remains subject to the browser's normal WebAuthn
development exception.

0.5.0 — October 7, 2026

SMS Infrastructure Release

NEW — SMS PROVIDER HEALTH
- Added operational health tracking for every configured SMS provider.
- Provider health states include Unknown, Healthy, Degraded, and Unhealthy.
- Tracks consecutive provider failures.
- Tracks last successful delivery.
- Tracks last provider failure.
- Retains the most recent provider failure diagnostic.
- Successful provider communication resets consecutive failure state.

NEW — INTELLIGENT PROVIDER FAILOVER
- Added configurable automatic SMS provider failover.
- The configured default provider remains the primary provider.
- Additional enabled providers can serve as fallback connections.
- Administrators can configure the maximum number of fallback providers.
- Healthy providers are preferred when selecting fallback connections.

FAILOVER SAFETY
- Failover occurs only for failures that indicate the SMS provider or
transport infrastructure may be unavailable.
- Eligible failures include:
- Network/transport failures
- Connection timeouts
- HTTP 408 responses
- HTTP 429 provider rate limiting
- HTTP 5xx provider/server failures
- Recipient, credential, configuration, and ordinary client-side failures
do not automatically cascade to another provider.
- This prevents one authentication request from unnecessarily generating
multiple billable SMS messages.

NEW — PROVIDER DIAGNOSTICS
- SMS Providers now displays provider health.
- Displays consecutive failure count.
- Displays the last successful provider communication.
- Displays the last provider failure when no successful send is available.
- Existing provider test results remain available.
- Provider tests now also update provider health information.

NEW — DELIVERY ATTRIBUTION
- Authentication requests record the provider that actually accepted
the SMS message.
- When failover succeeds, the SMS authentication record is updated to
reference the successful fallback provider.
- Provider message IDs continue to be retained when supplied by the provider.
- Historical authentication records remain intact.

NEW — SMS SETTINGS
- Added Enable Provider Failover setting.
- Added Maximum Fallback Providers setting.
- Failover can be disabled without removing secondary provider connections.

SUPPORTED PROVIDERS
- Plivo
- Twilio
- Telnyx
- AWS SNS
- Bird / MessageBird

COMPATIBILITY
- Preserves the stable bsm-magic-login/ installation directory.
- Preserves Free email magic-link authentication.
- Preserves Pro SMS OTP authentication.
- Preserves multiple provider connections.
- Preserves v0.3.0 Account Security functionality.
- Preserves v0.4.0 WooCommerce, webhook, analytics, CSV export,
and email-customization functionality.
- Preserves BSM licensing.
- Preserves BSM automatic updates.
- Existing provider credentials and historical activity are retained.

0.4.0 — October 6, 2026

NEW — WOOCOMMERCE INTEGRATION (PRO)
- Added passwordless authentication to WooCommerce login forms.
- Added optional passwordless authentication during checkout for signed-out customers.
- Added My Login Security integration to the WooCommerce My Account dashboard.
- WooCommerce integration uses the existing Magic Login authentication engine rather than creating a separate authentication path.
- WooCommerce integration can be enabled or disabled independently.

NEW — SIGNED WEBHOOKS (PRO)
- Added outbound authentication webhooks.
- Administrators can configure a webhook endpoint.
- Administrators can select which authentication events are delivered.
- Added HMAC-SHA256 payload signing.
- Signature is delivered through the X-BSMML-Signature header.
- Added administrator-controlled signing secret.
- Leaving the secret field blank preserves an existing secret.
- A signing secret is automatically generated when necessary.
- Added Send Test Webhook functionality.

Supported webhook event classes include:
- request
- email
- click
- login
- expiration
- invalid_token
- sms_request
- sms_send
- sms_code
- sms_login

NEW — AUTHENTICATION INTEGRATION API
- Added the canonical bsmml_auth_event WordPress action.
- Email and SMS authentication events now publish through the common integration hook.
- Provides a stable integration point for future BSM and third-party integrations.

NEW — AUTHENTICATION ANALYTICS (PRO)
- Added Analytics administration screen.
- Added Today, 7-day, and 30-day reporting windows.
- Reports authentication events grouped by event type and result.
- Uses existing authentication audit data rather than maintaining a duplicate analytics dataset.

NEW — CSV EXPORT (PRO)
- Added CSV export of authentication activity.
- Exports:
- UTC timestamp
- Username
- Email
- IP address
- Event type
- Result
- Reason
- Export requires Magic Login administrative permissions and active Pro entitlement.
- Export requests are nonce protected.

ENHANCED — EMAIL CUSTOMIZATION
- Expanded email magic-link template controls.
- Added configurable authentication button text.
- Added configurable email footer.
- Added configurable From name.
- Added configurable Reply-To address.
- Existing configurable subject and introductory copy remain supported.
- Existing {minutes} expiration placeholder remains supported.
- Email customization remains part of the core email Magic Login functionality rather than being artificially Pro-gated.

SECURITY
- Webhook payloads are cryptographically signed using HMAC-SHA256.
- Webhook signing secrets are never transmitted in webhook payloads.
- Webhook destinations are validated before being stored.
- Webhook delivery does not block the authentication request while waiting for a remote service.
- Analytics and exports require Magic Login administrative capabilities.
- Existing token, OTP, rate-limit, role-policy, IP/CIDR, and account-revocation protections remain intact.

COMPATIBILITY
- Preserves BSM Magic Login Free email authentication.
- Preserves BSM Magic Login Pro SMS authentication.
- Preserves multiple SMS provider connections.
- Preserves Account Security functionality introduced in v0.3.0.
- Preserves WordPress login integration.
- Preserves BSM License Manager integration.
- Preserves BSM automatic-update integration.
- Preserves existing audit history and security controls.

0.3.0 — October 6, 2026

Account Security Release

NEW — MEMBER SECURITY CENTER
- Added [bsm_magic_login_security] shortcode.
- Provides a front-end "My Login Security" interface for authenticated users.
- Displays the member's authentication email.
- Displays mobile-number verification status for Pro users.
- Allows members to manage their verified mobile authentication number.
- Allows members to revoke outstanding Magic Login credentials.
- Allows members to terminate their WordPress login sessions.

NEW — SELF-SERVICE PHONE VERIFICATION (PRO)
- Members can enter or change their mobile number from the security interface.
- New or changed numbers become unverified before they can be used for SMS login.
- Sends a randomized six-digit verification code through the configured SMS provider.
- Verification codes expire after five minutes.
- Maximum of five verification attempts per verification request.
- Verification codes are stored as keyed hashes rather than plaintext.
- Successful verification records the verification timestamp.
- Phone numbers continue to use E.164 normalization.

NEW — ACCOUNT REVOCATION
- Added emergency credential revocation for individual users.
- Revocation invalidates outstanding email magic links.
- Revocation invalidates outstanding SMS login codes.
- Revocation invalidates outstanding phone-verification requests.
- Administrators can terminate all WordPress sessions for the affected user.
- Members can revoke their own outstanding credentials and sessions from the security interface.

NEW — ADMIN USER SECURITY CONTROLS
- Added Magic Login Security controls to WordPress user profiles.
- Authorized administrators can revoke a user's outstanding passwordless credentials.
- Authorized administrators can terminate all WordPress sessions for a user.
- Includes confirmation before destructive revocation.

NEW — GLOBAL AUTHENTICATION CONTROLS
- Added independent Email Magic Login enable/disable control.
- Added independent SMS Login enable/disable control.
- Added global passwordless authentication policy management.

NEW — EMERGENCY RECOVERY CONTROLS
Magic Login can now be disabled outside WordPress admin through wp-config.php.

Supported emergency constants:

define('BSMML_DISABLE_ALL', true);
define('BSMML_DISABLE_EMAIL', true);
define('BSMML_DISABLE_SMS', true);

These controls override the database configuration, providing an administrator recovery mechanism even when the WordPress Magic Login settings interface cannot be used.

NEW — ROLE-BASED AUTHENTICATION POLICIES (PRO)
Each WordPress role can independently allow:

- Email + SMS
- Email only
- SMS only
- Passwordless authentication disabled

Policies are enforced when authentication credentials are requested rather than functioning only as UI restrictions.

NEW — WORDPRESS LOGIN SCREEN INTEGRATION
- Added optional passwordless authentication controls to wp-login.php.
- Administrators can enable or disable the integration.
- Existing WordPress password authentication remains available.
- Passwordless authentication does not forcibly replace WordPress passwords.

SECURITY
- Changed mobile numbers require verification before member-controlled SMS authentication can use them.
- Emergency configuration constants take precedence over WordPress database settings.
- Account revocation invalidates outstanding credentials before destroying sessions.
- Phone verification codes are never stored in plaintext.
- Existing single-use magic-link and SMS OTP protections remain intact.

COMPATIBILITY
- Preserves BSM Magic Login Free email authentication.
- Preserves existing SMS providers and provider configurations.
- Preserves existing activity history.
- Preserves IP/CIDR security controls.
- Preserves BSM License Manager integration.
- Preserves the v0.2.2 BSM automatic-update infrastructure.
- Existing WordPress password login remains enabled by default.

NEW SHORTCODE
[bsm_magic_login_security]

Existing shortcode remains:
[bsm_magic_login]

0.2.1 — September 27, 2026

LICENSING
- Added BSM Strategy standardized licensing client.
- Added License as the final Magic Login admin submenu.
- Added Free and Pro edition handling.
- Added license activation and license replacement.
- Added Validate Now.
- Added license deactivation/removal.
- Added stable installation ID.
- Added activation ID support.
- Added BSM Magic Login product-slug identification.
- Added license package, status and expiration display.
- Added last-successful-validation tracking.
- Added BSM License API diagnostics.
- Separates API/transport failures from authoritative license states.
- Revoked, invalid and suspended licenses disable Pro immediately.
- Supports the BSM post-expiration Pro allowance.
- Supports the BSM validation-outage grace lifecycle.

FREE / PRO
- Added authoritative Free vs Pro feature matrix to License.
- Free retains complete email magic-link authentication.
- Pro adds SMS OTP authentication.
- Pro includes Plivo, Twilio, Telnyx, AWS SNS and Bird.
- Pro includes SMS provider connection management.
- Pro includes advanced IP/CIDR blocking and abuse controls.
- Actual feature gating now matches the displayed Free/Pro matrix.

ADMIN
- License is consistently named "License".
- License is positioned as the final plugin submenu.
- Added License API Diagnostics section.
- Diagnostics do not expose license credentials or activation IDs.