> This page is for Applications Protection.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.humansecurity.com/llms.txt.

# Changelog

## August 12, 2026

## Version 12.6.0

## Added

* Added MCP Protection support

## July 16, 2026

## Version 12.5.0

### Added

* Support for multiple mobile cookie versions headers (`X-PX-AUTHORIZATION-V2` with priority over `X-PX-AUTHORIZATION`)
* Added `x-px-authorization-v2`, `x-px-original-token`, and `x-px-bypass-reason` headers to `page_requested` and `block` activities

### Fixed

* Fixed `X-PX-ORIGINAL-TOKEN` header reading bug. It now correctly reads from the request header instead of an unpopulated internal context variable
* Added `request_id` field to telemetry activity
* Added `window._pxCustomOnErrorMessage` support in block page template

## April 27, 2026

## Version 12.4.2

* Send original vid from cookie on all activities under `orig_cookie_vid`

## February 11, 2026

## Version 12.4.1

* Adjusted Telemetry by risk - adjusted telemetry requested flag on `risk_api` response

## December 10, 2025

## Version 12.4.0

* Added Header Based Logger support
* Added Telemetry by Risk support
* Correct enforcer\_start\_time and risk\_start\_time on all enforcer activities

## November 18, 2025

## Version 12.3.0

* Added response custom parameters feature (`px_custom_add_response_custom_parameters` custom subroutine)

## September 16, 2025

## Version 12.2.1

* Added `px_cookie` field on block activity

## August 19, 2025

## Version 12.2.0

* Updated MAIN.vcl boilerplate

* Support for adding a data enrichment header (new `px_data_enrichment_header_name` configuration)

* Added Documentation enforcement workflow - verify that the documentation is up to date with the latest changes in the codebase

* Added mobile headers to async activities
  * `X-PX-VID-MOBILE`
  * `X-PX-UUID-MOBILE`
  * `X-PX-HID`
  * `X-PX-MOBILE-SDK-VERSION`
  * `X-PX-OS`
  * `X-PX-OS-VERSION`
  * `X-PX-DEVICE-FP`
  * `X-PX-DEVICE-MODEL`
  * `X-PX-HELLO`

* Adding redacted `px_auth_token`, `px_cookie_secret`, and `px_remote_config_auth_token` to telemetry activities

* Fixed PXDE bugs

## June 15, 2025

## Version 12.1.5

* Send default config values on Telemetry activity even if not set in enforcer config config explicitly

## June 5, 2025

## Version 12.1.4

* Added Cross Tab Session cookie support on activities
* Fixed the commented out example for the `px_custom_block_page_content` subroutine in the VCL template

## May 4, 2025

## Version 12.1.3

* Added JA4 fingerprint data on risk\_api and async activities

## April 7, 2025

## Version 12.1.2

* Fixed an issue where remote configuration list comparisons returned true for all requests when configured via remote config:
  * sensitive, monitored, and enforced routes
  * filtered routes, methods, ips, extensions, and user agents
  * graphql routes, sensitive operation names and types

## March 4, 2025

## Version 12.1.1

* Aligned remote config ID field on all activities (`px_remote_config_id` -> `remote_config_id`)
* Added remote config version field on all activities

## February 18, 2025

## Version 12.1.0

* Added npm tool for building the VCLs and manifests
* Added the `px_remote_config_id` field for all activities
* Fixed an issue in the `px_private` dictionary output manifest file where the `write_only` property was incorrectly included as `writeOnly`

## December 16, 2024

## Version 12.0.1

### Fixed

* Fixed a bug where sensitive routes ignores the risk response when receiving requests with a low-score cookie

## November 24, 2024

## Version 12.0.0

### Added

* Added default values for `px_sensitive_headers` and removed `px_sensitive_headers_enabled` header.

### Changed

* We have considerably reduced workspace usage in this version following several modifications of our memory usage and subroutine practices.
* Moved the sending of async activities to `vcl_log` subroutine instead of `vcl_deliver` subroutine.
* Removed filter on cache hit feature.
* Moved the call to the custom additional activity handler from `vcl_deliver` subroutine to `vcl_recv` subroutine.

### Fixed

* Fixed an issue with the used cookie secret where it reported `***` even when no cookie secret was used.
* Fixed a couple of bugs in the extracted cookies feature.

## October 14, 2024

## Version 11.1.5

* Fixed inaccurate `simulated_block` field when enforced routes are configured
* Changed async activity and telemetry HTTPS logging endpoints to use `collector-<app_id>.perimeterx.net` instead of `fastly-async.perimeterx.com`
* Changed async activity HTTPS logging endpoint to set max bytes at 500,000

## September 25, 2024

## Version 11.1.4

* Removed `b` param from block page to prevent header / workspace overflow caused by excessively long URLs

## September 8, 2024

## Version 11.1.3

* Reduced HUMAN workspace footprint (in terms of headers count and workspace free bytes)
* Set complex headers once, instead of multiple times during the enforcer flow
* Remove potential large size headers from px-ctx
* Adjust px-cfg header so it won't be modified after initialization

## August 20, 2024

## Version 11.1.2

* Reduced workspace footprint by moving request cookie names from `px-ctx` header to separate `px-req-cookie-names` header

_Showing the 20 most recent of 71 entries. Append `/llms.txt` to the changelog URL for the complete index._