> This page is for Applications Protection.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.humansecurity.com/llms.txt.

# Changelog

## June 18, 2026

## Version 8.7.0

* Use `undici` as the HTTP client instead of `Phin`, which is no longer maintained.
* Added `undici` HTTP client implementation
* Added `risk_rtt` field to activities in case of S2S timeout
* Support for JWT key names that contain dots (such as URLs) when extracting the user id and additional fields
* Custom block on error message configuration support
* Pass request object to response custom parameters custom function
* MCP Protection support
* Send original vid from cookie on all activities under orig\_cookie\_vid
* Added Hard Block Support

## March 4, 2026

## Version 8.6.0

* Changed response headers being set as arrays instead of strings

## November 25, 2025

## Version 8.5.0

* Added support for `custom_proxy` feature (`px_proxy_url` configuration)

## November 3, 2025

## Version 8.4.1

* Added support for the `custom_sensitive_request` feature,  which enables using a custom function to identify sensitive routes
* Added `is_sensitive_route` field in activities

## March 6, 2025

## Version 8.3.0

* Added support for running the Enforcer as a standalone Node.js process without requiring a code bundle.
* Added `remote_config_id` field to risk and async activities
* Added `remote_config_id` and `remote_config_version` fields to telemetry activity
* `DefaultGraphQLParser` modified to extract `operationName` and variables even when the query is not present
* Specifying token version (v2 or v3) with `px_token_version` always for consistency in telemetry activities
* Fixed issue where telemetry would fail for array of cookie strings
* Fixed issue where `UrlImpl` constructor would throw an error for `@` character in the path or search params
* CD process fix

## September 23, 2024

## Version 8.2.1

* Decode the request URL, send it on the enforcer activities URL field, and use it for all enforcer processing.

## September 5, 2024

## Version 8.2.0

* Added `px_token_version` configuration to support both v2 and v3 (default is v3)
* GraphQL query keyword extraction via string/regex (`px_graphql_keywords`) and custom function (`px_extract_graphql_keywords`)
* Support for cookie secret rotation
* Configuration `px_sensitive_graphql_operation_names` expanded to include regular expressions and applies to extracted GraphQL keywords as well
* Telemetry activity includes redacted sensitive configuration fields
* Default value for `px_bypass_monitor_header` changed from an empty string to "x-px-block"
* Modify telemetry activity to include all types of config
* Updated the captcha template
* Using raw URL instead of parsed URL in block page captcha script query parameter
* Converted fields `login_successful_reporting_method`, `sent_through` of `CredentialEndpointConfiguration` to optional
* Fixed issue where unvalidated `_pxvid` value was added to the captcha page
* Fixed issue where regular expressions occasionally failed on calls to `test()` due to global flag

## February 21, 2024

## Version 8.1.0

* Added base64-encoded request HTTP method to captcha script query parameters on block pages
* JSON parsing issue with generated package.json for CommonJS library build fixed
* Issue with mix-ups in header-based logs fixed
* Issue where block activities may contain `http_status_code` field fixed

## January 18, 2024

## Version 8.0.1

* Issue with duplicate sending of batched activities fixed
* Memory issue with header-based logger fixed

## January 10, 2024

## Version 8.0.0

* Refactor to base on JS Core library
* Maintains support for:
  * Additional activity handler
  * Advanced blocking response
  * Block activity
  * Block page captcha
  * Block page rate limit
  * Bypass monitor header
  * Client IP extraction
  * Cookie v3
  * CORS support
  * Credentials intelligence
  * CSS ref
  * Custom cookie header
  * Custom first-party endpoints
  * Custom logo
  * Custom parameters
  * Enforced routes
  * Filter by extension
  * Filter by HTTP method
  * Filter by IP
  * Filter by route
  * Filter by user agent
  * First party
  * GraphQL support
  * Header-based logger
  * Hype sale challenge
  * JS ref
  * Logger
  * Mobile support
  * Module enable
  * Module mode
  * Monitored routes
  * Page requested activity
  * PXDE
  * PXHD
  * Risk API
  * Sensitive headers
  * Sensitive routes
  * Telemetry command
  * URL decode reserved characters
  * User identifiers
  * VID extraction

## December 21, 2023

## Version 7.9.0

### Added

* Support for header-based logger
* Added `risk_start_time` and `enforcer_start_time` fields to enforcer activities
* Added `failOnEmptyBody` flag for `callServer` to specify whether a request should fail if it has no body

### Changed

* Updated the configuration of PX first-party requests to include additional support

## May 16, 2023

## Version 7.8.0

### Added

* Custom cookie header is processed in addition to (not instead of) default cookie header
* Custom cookie header default value has been set to x-human-cookies
* Added HUMANHD from risk response to the async activities

## March 28, 2023

## Version 7.7.1

### Added

* Support for handling GraphQL requests with empty query field
* Support custom is sensitive request via function

## Version 7.7.0

### Added

* Support for handling graphQL requests with empty query field
* Support custom is sensitive request via function

## January 26, 2023

## Version 7.6.0

### Added

* Support for CORS preflight requests and CORS headers in block responses

## Version 7.5.0

### Added

* Support User Identifiers: CTS and JWT.

## January 15, 2023

## Version 7.4.0

### Added

* using perimeterx node core 3.7.0

## June 30, 2022

## Version 7.3.2

### Fixed

* pxhd cookie is now set with SameSite=Lax

## May 18, 2022

## Version 7.3.1

### Added

* Update block page to support error handling for mobile.

## May 2, 2022

## Version 7.3.0

### Added

* Support for credentials intelligence v2 hashing protocol added and set as default

## April 11, 2022

## Version 7.2.0

### Added

* New block page implementation
* Support for dynamic cookie signing with IP (requires PXHD)
* Send PX cookie over risk\_api on sensitive routes

## March 10, 2022

## Version 7.1.1

### Added

* Send PX cookie over risk\_api on sensitive routes

_Showing the 20 most recent of 58 entries. Append `/llms.txt` to the changelog URL for the complete index._