iThemes Security Pro 8.5.3

Enhancement: Add super admins as a selectable role for User Groups.
Enhancement: Add reCAPTCHA to the Reset Password form.
Enhancement: Add support for resending a Two-Factor Email code.
Enhancement: Add support for resending a Passwordless Login email.
Enhancement: Allow selecting users across all sites in a network for User Groups, Security Profile cards, and User Security Check.
Enhancement: Include all super admins by default in the Security Profile card, even if they are not a member of the network's main site.
Enhancement: Display all of a user's roles in the Security Profile card.
Enhancement: When logging in with Passwordless Login, skip Two-Factor if the primary Two-Factor method is Email.
Enhancement: Force a space after each Two-Factor Backup Code to assist with copying and pasting.
Enhancement: Include the website URL in the download file for Two-Factor Backup Codes.
Enhancement: Add a warning if a WordPress Salt is set to an invalid value.
Enhancement: Allow re-entering the Two-Factor Onboard flow even after Two-Factor is setup by visiting /wp-login.php?itsec_after_interstitial=2fa-on-board directly.
Enhancement: Add a new WP CLI command for managing user Two-Factor enrollment.
Enhancement: Add a new WP CLI command for retrieving logs.
Enhancement: Include child log items in the logs list table. These are helpful for debugging issues.
Enhancement: Improve performance of the logs page on sites with large number of log items.
Tweak: Only show Lockout Bypass Magic Link for valid users.
Tweak: When logging $_SERVER, only log a snapshot of available properties.
Bug Fix: New Password Requirements for already created accounts were not enforced until the second login.
Bug Fix: User Security Check would not display in Multisite.
Bug Fix: Prevent fatal error if invalid user IDs are encountered by User Groups.
Bug Fix: Infinite loop when trying to use Application Passwords on Multisite.
Bug Fix: User Logging did not correctly capture the user id of the logged-out user on WordPress 5.3.
Bug Fix: Warnings when doing a settings import.
Deprecated: The "getlockouts", "releaselockout", and "getrecent" WP CLI commands. Use the "lockout" and "log" commands instead. They will be removed in a future release.

Tweak: Harden iThemes Sync connection flow by adding a second verification check.
Bug Fix: Prevent UnknownIdentifierException errors when modules are loaded before expected.
Bug Fix: Add additional type checks.

Bug Fix: A fatal error could occur when upgrading to User Groups if a custom role had been selected for Two-Factor or Passwordless Login that has since been deleted but the module's settings had not been updated.