Guard Dog
Download

Release Notes

Browse the docs Guide 28 of 29

1.9.61 — November 10, 2026

This update brings every Guard Dog email into the email customizer and adds optional templates for WordPress’s own emails. Guard Dog now requires WordPress 6.0 or later. PHP stays at 8.1.

Email Templates

  • Every Guard Dog email is customizable: The Magic Login link, the social sign-in confirmation, and the two user enumeration alerts join the email customizer. Their default wording is unchanged, but they now go out as branded HTML emails with a plain-text version, where they were plain text before. See Email Templates.
  • WordPress’s own emails, if you want them: Password reset, new account details, new user registration (to the admin), password changed and email changed can now use Guard Dog templates. Each is off by default. See WordPress’s Own Emails.
  • Other plugins come first: If another plugin, your theme or a must-use plugin changes one of those WordPress emails, Guard Dog leaves it alone and names what it found on that template’s screen. Turn a template off, or deactivate Guard Dog, and WordPress’s own email returns unchanged.

Fixes

  • Email verification used the default body: Verification emails were sent with the default body even after the template was customized; only the subject changed. Real sends now use your customized template. Sites that never saved that template see no change.
  • Raw HTML without an email provider: With no email provider configured, the verification email could arrive showing its HTML markup. Emails sent through WordPress’s own mail path now go out as HTML with a plain-text version.
  • Enumeration alerts and your provider: User enumeration alerts and reports now go through your configured Guard Dog email provider, like other Guard Dog email. Before, they always used WordPress’s default mail path.

After Updating

  1. Guard Dog 1.9.61 requires WordPress 6.0 or later. Sites on an older WordPress are not offered this update until WordPress is updated.
  2. If you ever customized the Email Verification template, review it and send yourself a real verification email. Its body now reaches users.
  3. If you use Magic Login, social sign-in confirmation or enumeration alerts, expect those emails to look different: the same words in a new design. Adjust them under Guard Dog → Appearance → Email Templates.
  4. WordPress’s own emails are unchanged unless you turn a template on.

Requirements

Guard Dog requires WordPress 6.0 or later and PHP 8.1 or later. The optional theme header/footer integration requires WordPress 6.2 or later.

1.9.60 — November 2, 2026

This update adds three social sign-in providers and closes gaps in social login, passkey checks, and email delivery. Existing sites can update without changing their PHP version; Guard Dog still supports PHP 8.1 and WordPress 5.9 or later.

Social Sign-In

  • GitHub, LinkedIn and Facebook: These providers join Google, Microsoft and Apple. Enable and configure only the providers your site needs. Guard Dog now offers sign-in only through providers that are enabled and fully configured, and refuses a sign-in if its provider is disabled before completion.
  • Two-factor authentication: Social sign-in now follows Guard Dog’s configured 2FA checks, including required setup. Previously it skipped them. The new Bypass 2FA setting is off by default and lets a site deliberately opt out for social sign-in.
  • Account safety: Social Auto-Create cannot assign roles with administrator-only capabilities. Auto-Link and Auto-Create require email confirmation when a provider cannot verify the address. This applies to Microsoft and Facebook, to LinkedIn without a verified email, and to GitHub without a verified primary email. The link works once, expires after an hour, and must be opened in the browser that started sign-in.
  • Clearer flow: Sign-in messages are consistent across the WordPress login screen, the frontend login form and user profiles. Redirects return people to their requested page after sign-in or email confirmation.

Passkeys and Privacy

  • Passkey sign-in rejects a credential whose signature counter stops advancing, or one that belongs to a different account than the username entered. Security keys without a stored user handle can sign in after the username is entered.
  • Saved social client secrets are masked in settings. Provider icons are restricted to safe SVG elements, and access tokens and other credentials are removed from social-login error logs.
  • Facebook data-deletion requests remove that account’s links, pending sign-ins and Facebook details in the activity log. Changing the Facebook App ID or resetting Guard Dog removes the old app’s Facebook data first.

Email and Reliability

  • With the global email provider override enabled, plain-text WordPress email is sent as text so line breaks and links stay readable. The From name and Reply-To address now reach supported providers. HTML messages also get a more readable plain-text alternative.
  • Database upgrades no longer start a second copy of Guard Dog and register every hook twice.
  • Bundled Guzzle HTTP libraries were updated to patched versions.

After Updating

If you use social sign-in, test a sign-in with 2FA enabled and check your Bypass 2FA and Auto-Create role settings. If you use the global email provider override, send a plain-text test message and check its formatting and Reply-To address.

1.9.59 — October 13, 2026

This update adds email sign-in, passkey cleanup, and more control over the login screen. If you have customized email templates or exported theme files, review the upgrade steps below.

New and Improved

  • Magic Login: Existing users can request a single-use email sign-in link. When enabled with its WordPress Login Screen option, an Email me a sign-in link button with an envelope icon appears on the login screen. After opening the email link, users select Continue, complete any required 2FA, and reach a page on your site. Magic Login is off by default; enable it under Guard Dog → Authentication → Magic Login. A block and shortcode can add the request form to public pages. See Magic Login.
  • Passkey cleanup: When users delete their own Guard Dog passkey, supporting browsers and password managers are asked to stop offering it. A saved entry may still need manual removal on a device or in a password manager. See Passkeys.
  • Theme headers and footers: The login screen customizer can show your theme’s header, footer, or both. These optional controls support classic and block themes and require WordPress 6.2 or later. See Login Screen Customization.
  • Login styling: Secondary buttons follow your chosen login colors, and customization continues through the two-factor step.
  • Account pages: The account security shortcode adds controls for its 2FA heading, decorative icon, and explanatory text. Passkey and session tables scroll on narrow screens instead of breaking their headers mid-word. See Frontend Account Security.

Check Customized Emails and Theme Exports

Earlier email-template saves could discard the edited body and overwrite the two-factor code email’s body. This release fixes those saves, wrong email content, and corrupted or incomplete theme exports.

  1. Open Guard Dog → Appearance → Email Templates using its Customize button. Review your customized messages, especially Two-Factor Authentication Code, re-enter any missing text, and save each template.
  2. If you exported email or access-denied templates before updating, back up hand-edited files and re-export supported overrides. Email Verification and Password Expiration use saved settings; they do not support theme export.
  3. Check delivered HTML and plain-text messages, then complete an email 2FA sign-in with a test account.

See the detailed email recovery steps. Text discarded by an earlier failed save must be entered again.

Requirements

Guard Dog requires WordPress 5.9 or later and PHP 8.1 or later. The optional theme header/footer integration requires WordPress 6.2 or later.

Documentation Home | Roadmap →