FluentCRM 3.1.13 - Signed updates & public checksums 🔐

We are rolling out a signed updater to all the plugins, and today, we shipped that for FluentCRM Pro, and I wanted to do this before our flagship update WhatsApp messaging later this week.

Your site checks the signature before WordPress installs anything. If the package was not built by us, or a file changed in transit, the update stops and tells you why. Nothing to turn on. This is our bigger goal about making our plugins more secure than ever.

We also sent both the free and Pro plugins to Patchstack for an external review. Everything they reported back for the edge cases is fixed in this release.

Now your site checks four things before installing:

• The release is signed, and the signature verifies against a key compiled into the plugin.
• The signed package is actually FluentCRM Pro, not another product of ours replayed as an update.
• The version is not older than what you have, which closes the downgrade trick.
• The file hash matches the signed one. One byte out and the file is deleted, not installed.

Full write-up about how it works and why this is the most secure way to distribute premium plugins: https://fluentcrm.com/blog/signed-releases-and-public-checksums-for-fluentcrm-pro/

Super excited about the next release, which will include WhatsApp messaging. Stay tuned.