FluentAuth 3.1: Turnstile bot protection, a PHP security warning and magic links that work in Outlook
FluentAuth 3.1 adds Cloudflare Turnstile to your signup, login and password reset forms, warns you when your server's PHP has the php2shell hole, and fixes magic links for Outlook and Hotmail users.
FluentAuth 3.1 is a focused update. It adds one new protection, one new warning and one fix that a lot of you asked about. Everything here is in the $0 plugin. Update from Plugins > Installed Plugins, or get it from the plugin page.
What is new in FluentAuth 3.1?
| New or changed in 3.1 | What it helps you do |
|---|---|
| Cloudflare Turnstile bot protection | Stop bots on your signup, login and password reset forms, and on WooCommerce’s account forms |
| PHP security warning | See at once if your server’s PHP has the php2shell hole, and which version to ask your host for |
| Magic links in Outlook and Hotmail | Sign in with one click, even when Microsoft scans the link first |
| Setup wizard | Turn on passkeys and the summary report during setup |
Bot protection with Cloudflare Turnstile
Spam signups do more harm than clutter. Each fake account makes your site send a welcome email or a verification code to an address that does not exist. Those bounces count against your domain, and over time more of your real emails land in spam.
FluentAuth 3.1 adds Cloudflare Turnstile, a free check that tells people from bots, usually without a puzzle. Find it under Settings > Bot Protection. It has three switches, so you protect only the forms you need:
- Signup forms: FluentAuth’s signup form and the WordPress registration page.
- Login and password reset: the WordPress login page and FluentAuth’s login forms.
- WooCommerce My Account: the login and signup forms on WooCommerce’s account page. Checkout is left alone on purpose, so a bot check can never cost you a sale.
A few details we took care over:
- Keys you already have. If Fluent Forms or FluentCart already has Turnstile keys, copy them in with one click. FluentAuth keeps its own copy, so removing the other plugin later does not switch your protection off.
- Keys are checked before they save. New keys are tested with Cloudflare on the settings screen, so a typo cannot quietly break your forms.
- Cloudflare being down does not lock you out. If Cloudflare cannot be reached, or your secret key was changed in the Cloudflare dashboard, forms keep working. FluentAuth refuses a form only when the bot check itself failed.
- A failed check does not count as a failed login. A visitor whose browser blocks Cloudflare is not pushed towards the login attempt limit.
- A way back in. Login protection starts switched off, and the screen warns you to update
your keys if you move to a new domain. If the check ever stops you signing in, add
define('FLUENT_AUTH_DISABLE_TURNSTILE', true);towp-config.phpand sign in as normal.
The security checklist now also points out when anyone can register on your site and the signup form has no bot protection.
On the forms you protect, your visitors’ browsers load Cloudflare’s script. Cloudflare’s Turnstile privacy addendum explains what it collects.
A warning when your server’s PHP is not safe
On 21 October, PHP released fixes for two critical bugs, nicknamed php2shell. They let an attacker take over a server without logging in, and they sit in PHP itself, below WordPress. No plugin can block them, including ours. The fix is a PHP update on your server.
What FluentAuth can do is make sure you know. From 3.1, administrators see a warning in wp-admin and at the top of the FluentAuth dashboard when the server’s PHP is older than the fixed release. The warning names the exact version to ask your host for: 8.2.35, 8.3.36, 8.4.27 or 8.5.12. On PHP 8.1 and older, it asks you to upgrade to PHP 8.2 or newer. FluentAuth itself still runs on PHP 7.3 and newer; the warning is about your server’s security, not the plugin’s requirements.
Read php2shell: the PHP security hole every WordPress site owner should fix this week for how the attack works, how to check your server, and a message you can send your host. Ubuntu servers keep their old version number when they are patched, so the article also explains what to do if the warning stays after your host says you are safe.
Magic links now work for Outlook and Hotmail users
Some of you told us that magic links failed for people with Outlook, Hotmail or Live addresses. The person clicked the link and landed on the site still logged out, while Gmail users signed in fine.
The cause was Microsoft’s link scanner. Outlook opens every link in an email before the person sees it, to check it for phishing. A magic link works once, so the scanner used it up, and the real click came too late.
In 3.1, opening the link no longer signs anyone in by itself. It shows a short page that signs the person in automatically. A scanner opens the page but never takes that last step. Real visitors notice nothing: they click the link and arrive signed in, as before. If a link really has expired or was already used, the page now says so and links to the login form, where before it failed without a word.
Setup wizard improvements
- The two-factor step now offers passkeys next to authenticator apps and email codes, on sites that can use them.
- The alerts step shows the summary report that new sites send each month, and lets you change how often it comes or turn it off.
- The last screen links to the setting that requires two-factor for chosen roles. Setup does not switch it on for you, because requiring a second step before anyone has set one up would lock people out.
Smaller changes
- Switched-on toggles now look on in dark mode.
- Clearer wording across the admin, with notes that help translators get it right.
- If you use the FluentAuth Alerts Service, scan reports now include your PHP and WordPress versions. The connect screen lists this before you connect.
Update now
FluentAuth 3.1 is available on WordPress.org. Update from your Plugins screen, then check your dashboard: if the PHP warning appears, start with the php2shell article.