### Security
- Fixed a coming soon / maintenance mode bypass that allowed any visitor to reach the site by adding an Elementor query argument or referrer to the request
- Enforced TLS certificate validation on all licensing and update requests; the previous fallback could allow a network attacker to control the update package
- Hardened every licensing payload against PHP object injection by restricting unserialization to plain data
- Replaced the shared, non-expiring password protection cookie with per-visitor random tokens that expire server side and are revoked on logout or password change
- Added brute force throttling to the password protection endpoint
- Access passwords are now stored as a hash instead of clear text, and are excluded from settings exports
- Added nonce verification and rate limiting to the public analytics tracking endpoints
- Added nonce verification to the analytics data, export, migration, and site logo admin endpoints
- Added a capability check to the license activation and deactivation handlers
- Custom template CSS/JS and SEO head markup now require the unfiltered_html capability
- Visitor IP addresses are read from REMOTE_ADDR only and are no longer taken from spoofable forwarded headers
- Analytics values are escaped before being rendered in the admin dashboard
- Geolocation lookups now use HTTPS and can be disabled with the launchguard_enable_geolocation filter
- Removed the license check fallback that treated any stored value as a valid license
### Changed
- Uninstalling now drops the analytics tables so visitor data is not left behind
- Removed the obfuscated base64 helpers in the license base class
