> This page is for Applications Protection.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.humansecurity.com/llms.txt.

# Changelog

## May 12, 2026

## Version 5.5.1

### Added

* Added `orig_cookie_vid` field on all enforcer activities

## October 27, 2025

## Version 5.5.0

### Added

* Added `is_sensitive_route` field to risk api and async activities
* Added `custom_sensitive_request` feature support
* Added `request_id` field in telemetry activity

### Fixed

* Fixed a bug where cookie operation order mismatched the spec, causing expired high-score cookies to trigger block instead of risk

## September 8, 2025

## Version 5.4.1

### Internal

* Added additional updateReason RISK to Telemetry flow

## September 1, 2025

## Version 5.4.0

### Internal

* Added Documentation enforcement workflow - verify that the documentation is up to date with the latest changes in the codebase
* Telemetry By Risk Support
* Added Telemetry By Risk support

## June 4, 2025

## Version 5.3.0 -

### Internal

* Added remote config CI workflow support

## March 4, 2025

## Version 5.2.1

* Aligned remote config ID field (`px_remote_config_id` -> `remote_config_id`) and added it to all activities
* Added remote config version field on all activities

## September 30, 2024

## Version 5.2.0

* Updated GraphQL logic to match spec and added functionality:
  * Added keywords extraction, including custom extraction
  * Updated logic of operationName query operations filtering
  * Updated parsing logic of multiple operations in the same query
  * Removed empty fields from activities
* Changed order of cookie verification steps to accommodate research severity definitions
* Added hard block page response template
* Added AdditionalActivityHandler example
* Removed S2SCallReason none
* Modified check of empty risk response to not use UUID
* Modified first party captcha script fetching to always get script with params
* Changed default value of bypass monitor header to x-px-block
* Added CI support including end to end tests and fuzzing
* Added CI multi-config for default, advanced and monitor modes

## June 3, 2024

## Version 5.1.0

* Support multiple config types (active, static, remote)
* Modify telemetry activity to include all types of config
* Fixed module mode default value and refactored according to spec (monitor and active_blocking instead of true false)

## May 6, 2024

## Version 5.0.2

* Added exponential backoff mechanism for retrying remote config updates when errors occur

## April 11, 2024

## Version 5.0.1

* Added `errorType` field to error logs during failed remote config updates

## April 2, 2024

## Version 5.0.0

* **API change**: Removed `GetConfig()` function from runtime
* **API change**: Must create new `HumanSecurityEnforcer` struct by calling `NewHumanSecurityEnforcer`
* **API change**: Added `CreateDefaultHumanSecurityMiddleware` which creates a default middleware
* Added support for remote configuration feature
* Added support for header-based logger feature
* Added capability to add to module version via configuration `px_module_version`
* Update the captcha template with captcha page includes client-side first party timeout
* Configuration for first party timeout
* Changed PXHD cookie attribute (added SameSite=Lax, using Max-Age instead of Expires)
* Minor cookie bug fixes

## February 15, 2024

## Version 4.6.1

* Fixed body parsing issue

## February 11, 2024

## Version 4.6.0

* Added support for monitored and enforced routes regex
* Added support for sensitive routes regex
* Added support for filter by route regex
* Added http method to the block response query params

## December 27, 2023

## Version 4.5.1

* Fixed first party XHR and Captcha validation issue

## December 13, 2023

## Version 4.5.0

* Added risk_start_time and enforcer_start_time fields to enforcer activities
* Added blocked URL to the captcha query params

## August 20, 2023

## Version 4.4.0

* PXHD reported on async activities is taken from risk response if it exists
* Align risk and async activities fields
* Configure domain on PXHD cookie
* Update the new blocking page

## April 18, 2023

## Version 4.3.0

* Added support for filtering by user agent, HTTP method, and IP
* Added support for custom cookie header
* Added support for monitored routes
* Added support for enforced routes
* Added support for user identifiers as part of Account Defender
* Added support for CORS, including:
  * Preflight request filtering
  * Custom preflight request handling
  * Default CORS headers on block requests
  * Customized CORS block headers
* Minor fixes to align with enforcer specifications (cookie origin, activity payloads, telemetry)

## August 9, 2022

## Version 4.2.2

* Fixed pxProxy to handle empty response.
* Added some safety checks to credentials intelligence methods.

## July 25, 2022

## Version 4.2.1

* Added support for the customer to send the `response status code` from his origin, independently, for any request by decoupling the `additionalS2SActvity` from the Credentials Intelligence feature.

## June 28, 2022

## Version 4.2.0

* Added support for Graphql sensitive operations based on name and type
* Added support for customizable Graphql routes
* Added support for enabling and disabling Graphql
* Added support for sending reporting single and multiple Graphql operation names and types on all enforcer activities

_Showing the 20 most recent of 28 entries. Append `/llms.txt` to the changelog URL for the complete index._