WBAMS 1.11.0: safer by default, and sections from add-ons

v1.11.0October 9, 2026

Add-ons can offer their own page-builder sections, the web server's protective rules now ship with WBAMS, and wrong sign-ins and password-reset emails are limited.

Highlights

• Page-builder sections from add-ons, listed under their own heading in the Section Library.
• Protective .htaccess rules and security headers in every fresh install.
• Limits on wrong client sign-ins and on password-reset emails.
• A stricter session cookie and a new session id at every sign-in.
• Old knowledgebase addresses redirect permanently to the readable ones.

Changes

• Added An active add-on can offer its own sections by adding a cms-sections.json to its folder.
• Changed Folder listing off; package files, dot-files, dumps, logs and backups refused; storage/ and code folders refused; security headers with HSTS on HTTPS.
• Changed After 5 wrong attempts for one account or 20 from one address in 15 minutes, sign-in is refused until the 15 minutes pass. Reset emails: 3 per address and 10 per visitor in 15 minutes.
• Fixed Website pages can be indexed again; sitemap.xml lists each page once and includes the knowledgebase and published updates.
• Fixed Long pages on phones that mobile Safari reloaded and gave up on.
• Fixed A product group can be created and edited again; Duplicate a Product copies the type's own settings.