This release contains three viewer changes: a bearer-token auth fallback for hosts whose cache layer strips cookies from API responses, a global rate-limit floor on auth attempts, and a path-blocklist correction.

After updating, click Reinstall Viewer on the Overview page.

Fixed

• Viewer login silently failing on hosts where the cache layer strips Set-Cookie headers from API responses. The viewer now also issues a bearer token in the JSON response body that the client sends via Authorization: Bearer on subsequent requests.
• Path-blocklist typo and two missing entries left rate-limit.db, viewer-settings.db, and rate-limit.json readable via the viewer’s get_file_content endpoint by authenticated users. Blocklist now matches the actual filenames.

Security

• Added a global rate-limit floor for viewer auth: 100+ failed attempts across all IPs in 24h triggers a 60s delay between subsequent attempts, capping rotating-IP attackers at ~1440/day. Never locks admins out — only delays.

A note on security

The standalone viewer runs outside of WordPress, so we take its security very seriously. We’re always happy to hear about any vulnerabilities or concerns you might have or find. Please report them to support+security@wpdebugtoolkit.com.