Security hardening. The Temporary Super Users page did not escape the user name, username and email address of the listed users. Exploitability of this is extremely unlikely. It would first require another user with adequate administrative permissions to set these fields to malicious values on a user account. The victim Super User would have to make that user account a temporary Super User without having checked that user's information. In this case, JavaScript which runs in the victim Super User's browser could be injected when they view the Temporary Super Users page. Separately, the Never block these domains feature now verifies that the host name of the visitor's IP address resolves back to that same IP address, and only matches whole domain name parts.
Never block these IPs / domains blocks malicious requests again (Pro). These options are meant to protect legitimate visitors, such as search engine crawlers, from being automatically IP-blocked when someone tricks them into visiting malicious URLs. The malicious request itself must still be blocked. There was a confusion as to what this feature should do since version 7.6.0. Now it's written in stone. Please note that while malicious requests from these IPs and domains are blocked, they are not being logged, emailed about, or counting towards an automatic IP ban. Moreover, logging in with a forbidden username no longer bans IP addresses which are in the IP Allow Lists or in Never block these IPs.
Search engine and AI crawler IP lists (Pro). Search engines and AI companies publish the IP address ranges their crawlers use. The new Crawlers tab of Configure WAF lets you use these lists to decide, separately for each crawler, whether to ignore it (default), block it, or never block it. For example, you can block AI training crawlers while still letting search engines index your site. The lists are downloaded and cached automatically, and there is a new Joomla scheduled task type to let you update them on your schedule, without relying on user traffic for the built-in refresh to eventually trigger automatically.
Removed the built-in Never block these IPs and domains entries. These lists used to ship with hard-coded crawler IP addresses and search engine domains. The IP addresses were outdated. Updating removes these built-in entries from your site, unless you gave them a description. Any entries you added yourself are kept. Use the new crawler IP lists instead.
Fixed blocked requests with "Keep a debug log file" enabled (Pro). With this option enabled, blocked requests resulted in a server error page instead of the block message. They were also neither logged nor emailed about, nor did they count towards automatic IP bans. Since the debug log file records request data, Admin Tools now also reminds you in the backend for as long as this option is enabled; please only keep it on while troubleshooting.
.htaccess Maker can let Joomla handle missing files (Pro). By default, requesting a file which no longer exists in one of the allowed frontend or backend directories results in a plain server 404 error. Joomla never sees the request, so redirects you have set up for these files (e.g. with Joomla's Redirect component, or our URL Redirections feature) do not work. Two new options let you hand these requests over to Joomla. Please keep in mind that this will send all 404s to Joomla, increasing your server load. You should evaluate what makes more sense: enabling these options, or putting manual redirection rules as .htaccess code.
Switching between Admin Tools Core and Professional. Installing Core over Professional now removes the Professional-only plugins and files. Switching editions in either direction now updates the update site right away, instead of leaving a stale one behind; on Joomla 4 the stale update site meant Joomla kept looking for updates of the edition you no longer have. Admin Tools Core no longer keeps a Download ID in its update site. These should've been built-in features in Joomla itself, and a lot of improvements were made in that area in Joomla 5 and 6, but the reality is that core Joomla handling of changing update sites is still not enough.
Quick Setup Wizard fixes (Pro). Running the Quick Setup Wizard no longer erases the Custom Rules you had entered in the .htaccess Maker, and it now fully resets the rest of the configuration as you would expect. The original design mostly concerned itself with new installations, without considering properly the use case people use it for on existing installations: reset the component, without losing the custom rules in the .htaccess Maker used to select the correct PHP version on their server. A big thank-you goes out to all users who submitted a support ticket explaining their expectation; it helped us reevaluate this feature.
Administrator Password Protection. Due to a bug, choosing crypt() password hashing used APR-1 everywhere, except on Windows servers where Apache cannot verify crypt() hashes. The intent was the exact opposite. The crypt() option is now no longer offered on Windows servers, and works as intended on all other servers. Moreover, APR-1 hashes now use an 8-character salt, the same as Apache's own htpasswd tool. Existing password protection keeps working; the longer salt is used the next time you apply the password protection. We expanded the documentation page explaining why APR-1 is used by default and why it might actually be safer than bCrypt against more sophisticated brute-force attacks.
Bug fixes. We have also fixed a number of medium and low priority bugs; please see the CHANGELOG for the full list.