49 changes this release. 20 new features. 9 improvements. 17 bug fixes. 4 security updates.
Classic Monks v2.5.0 is about the two moments every site owner dreads: an update that breaks the site, and a login form that bots won’t leave alone. This release adds a maintenance mode and coming soon page, rollback for plugins and themes (premium ones included), a password policy, required two-factor login by role, and login CAPTCHA. Client sites get tighter too. You can now hide the Plugins menu, the Users menu, or any admin page per role.
Most of these used to be a separate plugin each. Now they are switches inside the plugin you already run. If you only turn on one thing from this release, I’d make it Rollback. It’s the one you’ll be glad you set up before you needed it.
Tested up to
- WordPress Version: 7.1.3
- WooCommerce Version: 11.2.1
- Bricks Builder Version: 2.4.3
Before you update
One change needs action from you. Staging Protection no longer uses a shared default access code. Every site now gets its own random code, so any link you sent out with the old default code stops working. After updating, open Staging Protection, copy the new link and send it to your clients again.
Two smaller notes. Quick Post Nav is now called Quick Nav, so look for the new name. Your existing Assets Manager rules move to the new rules system on their own.
Maintenance Mode and Coming Soon
Every agency has had the “why is the site broken?” call in the middle of a redesign. Maintenance Mode puts a proper “be right back” or “coming soon” page in front of visitors while you work, under Security → Maintenance Mode.
- Three ready-made designs, or your own page: Pick a template and set your own heading, message and color, or show any page you built yourself.
- The right people still see the real site: You, your admins and any roles you choose skip the maintenance page. A private link lets clients in to review without an account.
- Rankings stay safe: Search engines are told the site is only down for a while, so a week of maintenance doesn’t cost you your positions.
If you only need to keep a staging copy private, Staging Protection is still the better fit, and it got a big security upgrade in this release (more below). For a password wall in front of the whole site, see Site-Wide Password.
Plugin and Theme Rollback
An update breaks the checkout at 11pm. Until now the fix was digging out an old zip, or installing yet another plugin just to downgrade. Rollback puts the fix on the Plugins screen.
- One click back to a working version: Click Rollback on the Plugins screen, or in a theme’s details. Plugins and themes from WordPress.org can go back to any recent version.
- Premium and uploaded plugins too: Their old versions aren’t public, so Classic Monks saves a copy right before each update and keeps the last 5.
- Stop the update nag: Freeze a rolled-back plugin or theme so it doesn’t keep asking to update to the version that broke things.
- A record of every rollback: Each one is listed under Logs → Rollbacks, so you know what changed and when.
Turn it on under Core → Plugins. It pairs well with Find Outdated Plugins, which flags abandoned plugins before they become the problem, and with the Advanced Plugin Manager.
Login Security: Password Policy, Required 2FA and CAPTCHA
Most WordPress break-ins don’t start with a clever exploit. They start with a weak password on an editor account, or a bot hammering the login form. This group closes those doors.
- Password Policy: Set a minimum length and require capital letters, small letters, numbers or symbols. The rules apply everywhere a password is set: sign-up, profile pages, password resets and WooCommerce.
- Required Two-Factor Login by Role: Make two-factor login a must for the roles you pick, such as admins and editors. People get a few days to set it up, then they’re sent to the setup page or blocked until they do. You can’t lock yourself out by accident. Users can set it up from the front end through a shortcode or a tab in their WooCommerce account, and the Users list shows who has it on. Setup works with the existing authenticator app (TOTP) and email code methods.
- Login CAPTCHA: Stop bots on your login, sign-up and WooCommerce checkout forms with Cloudflare Turnstile or Google reCAPTCHA v3. Each form can use its own keys, and nothing changes until you add them, so switching it on can’t lock anyone out. If you’d rather skip third-party services, Math CAPTCHA is still there.
- One-Click Login Links: Login code emails can now carry a button that signs the person straight in, so nobody has to copy a code. Each link works once and expires with the code. It’s off until you turn it on. Login, password reset and two-factor emails also get a cleaner look.
Login codes got harder to abuse as well. They are only emailed to addresses that have an account, and each visitor can only request a limited number. That stops strangers from using your form to spam people, and stops bots from running up your email or SMS bill. If you use OTP login and registration, this protection is on for you after the update.
Client-Safe Admin: Hide Pages, Plugins and Users
Handing a client an admin account shouldn’t mean handing them the power to deactivate the plugin holding their site together. Three new controls fix that.
- Hide Admin Pages by Role: In the Role Manager, choose which admin pages a role shouldn’t see. The pages vanish from that role’s menu, and opening one by URL sends the user back. This works even with the Admin Menu Manager off.
- Disable Plugin Pages: Hide the Plugins menu so clients can’t install, activate, update, delete or edit plugins. The Classic Monks Plugin Manager keeps working for you.
- Disable User Pages: Hide the Users menu so clients can’t view, add or delete users.
- Quick Nav Admin Menu and Search: Quick Nav (formerly Quick Post Nav) can now show the whole WordPress admin menu in the toolbar, filtered to what each user is allowed to open. One search box finds posts, links and admin pages.
Combined with White Label, this is most of what agencies need to run client sites without a separate admin-lockdown plugin.
Menus and Publishing
Two small jobs that used to need their own plugins, plus a cleanup of menu visibility.
- Duplicate Menus: A Duplicate Menu button on Appearance → Menus copies a menu with all its items in one click. The copy stays off your site until you assign it a location.
- Publish Missed Scheduled Posts: Scheduled posts sometimes get stuck on “Missed schedule” when nobody visits the site at the right moment, because WordPress only runs its scheduler on a page visit. Classic Monks now spots these posts and publishes them for you.
- Menu Item Visibility Settings: The “who sees this menu item” panel in Conditional Menu Items now has a short summary, a Show/Hide switch, one-click condition removal, a condition search box, a condition count on each item and an unsaved-changes warning.
The menu visibility fixes matter if you’ve used it before. New and reordered condition groups now save properly, items inside a hidden parent stay hidden, visitors no longer see a menu meant for someone else, and rules for category and tag pages work.
Assets Manager and Code Manager Targeting
The Assets Manager now uses the same targeting as the Code Manager, so where a script loads and where a snippet runs are set the same way.
- Assets Manager Rules: Choose exactly where scripts, styles and plugins load. Target one page, certain posts, products or categories, page types like the shop or search results, or a web address. Each rule has its own on/off switch so you can test safely, and a new Customized tab lists every rule in one place.
- Code Manager: Pick Several Items at Once: Choose several posts, products or categories in one condition, or pick “All” options like every product page. The snippets list now shows where each snippet runs without opening it.
Classic Feedback: Find Out Why
A thumbs-down tells you a page has a problem. It doesn’t tell you what the problem is. Classic Feedback now asks.
- Feedback Follow-Up Questions: After someone votes, ask them why. They pick from reasons you write and can leave a comment. The top reasons and latest comments show in your post list.
- Feedback Logs: A new Feedback tab under Logs ranks pages by how helpful they are and which need work first. Click a page to read its votes, reasons and comments, or export everything as CSV.
Bricks Builder
- Ken Burns Effect for Bricks: Give section, container, block and div backgrounds a slow zoom-and-pan, previewed live in the builder. Classic Slideshow gets a matching transition. Visitors who turn off motion on their device don’t see it.
- Classic Table Data from an API: Classic Table can load its rows from an outside data source. Cells support dynamic data and formatted text, and sorting works on formatted cells.
Several Bricks fixes ship too. The “You Save” element updates when a shopper picks a product option, Classic Table no longer throws errors, Stacked Images shows dynamic-data images with the right alt text, and the Image Compare handle shadow now shows on the front end. The full element list lives in the Bricks elements overview.
Email, Media and Logs
- Email Cc, Bcc and Reply-To: These now work with every email provider, not only SMTP. Duplicate addresses are removed first, so providers like SendGrid stop rejecting the email. Set providers up in SMTP settings.
- Email providers back online: Amazon SES sends again and its connection test shows the real result. ToSend, Elastic Email, ZeptoMail and Pepipost changed how they work, and Classic Monks has caught up. Addresses written like “Jane <[email protected]>” are no longer dropped by any provider.
- Collapsible Folder Sidebar: Shrink the Folder Manager sidebar to give the media library more room. If a folder is open while it’s shrunk, the button shows which one, so you always know the library is filtered. Arrow keys, Enter and Space now work in the folder tree.
- Replaced images show the new picture: After a media replace, visitors see the new image right away, and swapping a large image for a smaller one no longer breaks it.
- Image Converter keeps large-image details: The Image Converter no longer strips details from large images, creates extra copies or leaves old thumbnails behind, and your quality setting now applies.
- Broken Link Checker sees what visitors see: Links are checked on the rendered page, so links inside page builders, templates, widgets and menus get caught. Log summary cards now link straight to the problem page.
Security Hardening
- Stronger Staging Protection: The shared default code is gone. Each site gets its own random code, and the browser remembers it after first use so it doesn’t stay in the link. Protection now covers the parts of the site that apps and bots use, plus sign-ups and comments. Protected pages are never cached, and visitors can’t fake their IP to get past it. Remember to resend your access link.
- Login code abuse protection: Codes go only to existing accounts, with a per-visitor request limit.
- License key hidden: The License page no longer shows any part of your key, and older saved copies are now stored securely.
- Safe plugin search: Plugin descriptions from WordPress.org are displayed safely, so hidden code in them can’t run in your dashboard.
