We are signing our plugin updates now, starting with FluentSupport Pro

FluentSupport Pro 2.3.2 is out. Normal maintenance mostly, but there is one change I wanted to talk about properly instead of burying it in a changelog line.

Updates are now signed

Until now, when your site updated FluentSupport Pro, it just downloaded the file and trusted it. No way to check it was really ours. That is how almost all commercial WordPress plugins still work.

Not anymore.

So now every release we publish gets signed with a key that lives offline. Not on our licensing servers. Not in our build pipeline. Not on the CDN. Your site checks that signature before WordPress downloads anything, and it checks four things:

• The signature is really ours
• The package is FluentSupport Pro and not some other plugin swapped in
• The file hash matches what we signed

Any check fails, the update stops. Nothing gets installed.

So even if someone took over our update infrastructure tomorrow, they could not produce an update your site would accept. There is nothing there to steal.

Nothing to configure. It is on by default.

This is going across all our premium plugins

We also publish per-file checksums for every release, so you can verify the files sitting on your server match what we shipped: https://checksums.wpmanageninja.com/

Also in 2.3.2

• WordPress 7.1 compatibility
• More security hardening from our ongoing audits
• Updated Gemini model list in AI Model Setup
• Fixed a missing FluentBoards documentation link

Next week, we are going to have a cool feature update release. 🙌