diff --git a/changelog.txt b/changelog.txt
index d046c1f..aa8b3b2 100644
--- a/changelog.txt
+++ b/changelog.txt
@@ -1,6 +1,6 @@
 *** WebDecoy Bot Detection Changelog ***
 
-= 2.2.0 - Unreleased =
+= 2.2.0 - 2026-07-19 =
 * Added: IP allowlist — IPs or CIDR ranges that bypass all detection and blocking (Settings → Blocking). Previously the check existed internally but had no way to configure it.
 * Changed: Consolidated onto a single detector path (SDK detector + WordPress-signal wrapper) across front-end, forms, and WooCommerce; removed the unused legacy forms class and a dead scheduled task. No behavior change to detection.
 * Added: Filter rules — write expression-based rules (e.g. `ip.tor or ip.abuse_score > 50`, `ip.country in ["CN","RU"] and req.path matches "^/wp-login"`) evaluated before scoring; block or throttle, with dry-run. New Settings → Rules tab with a rule builder and parse-on-save validation. Expression language is byte-for-byte compatible with @webdecoy/node.
diff --git a/readme.txt b/readme.txt
index bceaa65..dba77fd 100644
--- a/readme.txt
+++ b/readme.txt
@@ -4,7 +4,7 @@ Donate link: https://webdecoy.com
 Tags: security, bot detection, spam protection, woocommerce, firewall
 Requires at least: 5.6
 Tested up to: 6.8
-Stable tag: 2.1.0
+Stable tag: 2.2.0
 Requires PHP: 7.4
 License: GPLv2 or later
 License URI: https://www.gnu.org/licenses/gpl-2.0.html
@@ -185,6 +185,21 @@ Privacy Policy: [https://www.jsdelivr.com/terms/privacy-policy-jsdelivr-net](htt
 
 == Changelog ==
 
+= 2.2.0 =
+* Added: Tripwires — deterministic, zero-false-positive blocking of hidden honeypot paths (on by default)
+* Added: Honeytoken — auto-injected invisible decoy link armed as a tripwire (on by default)
+* Added: Filter rules — expression-based rules with an admin rule builder (ip.* / req.* fields)
+* Added: IP enrichment (VPN/proxy/Tor, geo, ASN, abuse score) powering ip.* filter fields
+* Added: wd_clearance enforcement loop — silent cookie minting + tripwire forwarding for rotation-proof device lockouts
+* Added: Stealth-browser (F1) detection — catches automation that patches native browser functions
+* Added: Deceptive tripwire responses — fake .env/wp-config/SQL/phpinfo with per-site canary credentials; canary logins flagged as critical
+* Added: WordPress-native traps — fake vulnerable-plugin paths, optional XML-RPC trap, author-enumeration canary
+* Added: WooCommerce honeytoken coupons — a hidden decoy coupon; applying it is a deterministic bot signal
+* Added: IP allowlist (Settings → Blocking)
+* Improved: Rate limiting runs as a rule — proper 429 + Retry-After + X-RateLimit-* headers, sliding-window algorithm, per-IP/route/user keying
+* Improved: Resilient violation reporting (DB spool + cron retry, no page latency)
+* Changed: Consolidated onto a single detector path; removed legacy dead code
+
 = 2.1.0 =
 * Added: JS execution verification — detects non-JS HTTP scrapers
 * Added: Challenge token meta tag for premium page serve tracking
diff --git a/webdecoy.php b/webdecoy.php
index c580624..2f159f4 100644
--- a/webdecoy.php
+++ b/webdecoy.php
@@ -3,7 +3,7 @@
  * Plugin Name: WebDecoy Bot Detection
  * Plugin URI: https://webdecoy.com/wordpress
  * Description: Protect your WordPress site from bots, spam, and carding attacks with WebDecoy's advanced threat detection.
- * Version: 2.1.0
+ * Version: 2.2.0
  * Requires at least: 5.6
  * Requires PHP: 7.4
  * Author: WebDecoy
@@ -41,7 +41,7 @@ function str_starts_with(string $haystack, string $needle): bool
 }
 
 // Plugin constants
-define('WEBDECOY_VERSION', '2.1.0');
+define('WEBDECOY_VERSION', '2.2.0');
 define('WEBDECOY_PLUGIN_FILE', __FILE__);
 define('WEBDECOY_PLUGIN_DIR', plugin_dir_path(__FILE__));
 define('WEBDECOY_PLUGIN_URL', plugin_dir_url(__FILE__));