WP Ghost Update packs july 2026

WP Ghost

= 9.0.09 (08 July 2026) =

New - Force 2FA Setup: require selected user roles to set up Two-Factor Authentication before they can access the dashboard, with a guided setup screen shown right after login
Fix - WP-CLI commands no longer emit a PHP 8.5 Undefined array key hostname warning

= 9.0.08 (01 July 2026) =

Fix - Temporary Login page no longer triggers a fatal error when opened for a user that was deleted or expired
Fix - Two-Factor email setup and Magic Login no longer emit PHP warnings when the requested user no longer exists

= 9.0.07 (29 June 2026) =

New - Frontend Check now also verifies the theme's CSS and JS files load, catching a broken layout on pages that still return 200
New - Detects when CSS/JS/font files load through WordPress instead of the server config, falls back to safe paths and warns you on the settings page
Improvement - Redesigned the Frontend Check results into clear, uniform rows that stay readable with long URLs

= 9.0.06 (02 June 2026) =

Fix - Some sites could show a blank page when source code optimization was enabled; the header/tag find & replace is now fail-safe and never blanks the output on a regex error
Fix - Prefetch/speculation rules cleanup now removes the wp-admin and wp-*.php entries without leaving the rules JSON invalid
Security - Fixed unauthenticated Open Redirect via the redirect_to parameter on the custom logout URL.

Discussion