NEW Explicit user consent flow for the MU-loader install. After activation, an admin notice asks whether to install the small loader file in wp-content/mu-plugins/. Without consent the plugin runs in limited mode (filtering still works for later option queries; only the very first plugin-load pass is unaffected).
CHANGED No more silent self-healing of the MU-loader file. The file is created only on explicit click of “Install loader file” in the admin notice, and removed automatically on deactivation.
FIXED Plugin URI header now points to the WordPress.org plugin directory.
FIXED Two inline <script> blocks in the settings page extracted to a dedicated assets/admin-handlers.js enqueued via wp_enqueue_script. The frontend bar’s JSON payload now goes through wp_add_inline_script() instead of an inline <script> tag.
FIXED All $_POST / $_GET / $_SERVER super-global reads now use wp_unslash() plus an explicit sanitize_*() helper. $_SERVER[REQUEST_TIME_FLOAT] is cast through (float) before arithmetic. $_SERVER[REQUEST_URI] goes through sanitize_text_field( wp_unslash( … ) ).
FIXED All json_decode() results from POST payloads are now deep-sanitised by a new recursive sanitize_rules_array() helper before being persisted. stripslashes() replaced with wp_unslash() where applicable.
IMPROVED All uses of WP_PLUGIN_DIR / WP_CONTENT_DIR annotated with explanatory comments documenting why the WordPress-provided constants are the correct API here (no __FILE__-relative helper exists for resolving other plugins’ base paths or the must-use plugins folder at the MU-loader load stage).
1.3.7 — 2026-05-15
NEW Internationalisation: ships with full Czech, Slovak, Polish, German, French, and Spanish translations.
NEW Per-language .pot, .po, and .mo files in /languages/. Domain Path header added.
CHANGED Plugin renamed to “ALTOS” with slug altos for the WordPress.org directory.
CHANGED Self-hosted GitHub updater removed — WordPress.org handles updates from now on.
CHANGED Update Optimizer refactored to throttle HTTP requests only; it no longer hooks the update transients (cleaner separation from WordPress’s own updater).
FIXED Two stray non-English strings replaced with translatable English source strings.
FIXED Hardened output escaping across the admin UI (_e() → esc_html_e() etc.).
FIXED Replaced parse_url(), unlink(), date() and mt_rand() with their WordPress-recommended counterparts.
IMPROVED All input super-globals now go through wp_unslash() + sanitize_*.
IMPROVED Stricter phpcs:ignore documentation on the plugin’s own database queries (custom sampling_data table).
1.3.5
FIXED MU-loader self-healing — recreates a missing MU file on admin_init to prevent permanent loss after a failed activation.
FIXED Early translation loading warning on WP 6.7+ (_load_textdomain_just_in_time notice).
IMPROVED MU-plugin directory resolution consistently respects the WPMU_PLUGIN_DIR constant.
1.3.2
FIXED Self-protection in filtering: the loader can no longer block itself.
FIXED Invalid frontend rule modes safely fall back to passthrough.
IMPROVED Lower overhead in frontend/cache and auto-rules paths.
1.3.0
NEW SHA256 package integrity validation before install.
IMPROVED Frontend drawer uses a shared drawer CSS with unified visual style.
IMPROVED Frontend bar JavaScript refactor (Shadow DOM mount, per-page override UX, reset flow).
