Compatibility: Minimum required PHP version is now correctly declared as 8.2 — the plugin’s code already required it, but the previous declaration of 7.4 allowed activation on servers where the plugin could not run. WordPress now blocks installation on older PHP instead.
Fixed: Loading the plugin on a PHP version older than 8.2 (for example via WP-CLI using a different PHP binary) now shows an admin notice instead of causing a fatal error.
3.2.2
Security: Debug log file now uses an unpredictable filename and stronger server access rules (adds Apache 2.4 Require all denied), preventing direct download on hosts that ignore .htaccess.
Security: Password-protected posts are no longer embedded for semantic search and can no longer appear in search candidates; embeddings are purged when a post is unpublished, trashed, or password-protected.
Security: Hardened admin-screen error tooltips and upgrade links against markup injection; relay error messages are sanitized on receipt.
Security: Reverting a suggestion now re-checks per-post edit permission, matching all other actions.
Fixed: Cold-cache semantic search no longer generates the same embedding twice; index statistics are cached briefly to reduce load.
3.2.1
Fixed: Plugin incorrectly showed as the free version with an upgrade prompt after activating a Pro license, since it was configured to expect a separate downloadable Pro package that doesn’t exist. Pro now unlocks in place, no separate download needed.
Updated: Bundled Freemius SDK to 2.13.2 (from 2.13.0) — includes a license-sync cron race-condition fix, multisite opt-in fix, PHP 8.5 compatibility, and hardened direct file-access checks.
3.1.9
Fixed: Premium license status was never recognized after upgrading — the plugin checked a code-package flag instead of the actual license, so paying customers kept seeing free-plan quota limits and upgrade prompts. License status now unlocks correctly as soon as it syncs, no reinstall needed.
3.1.8
Compatibility: Tested up to WordPress 7.0.
Security: Suggestions list filter, search, and sort parameters now require a verified nonce before being read; filter, sort, and pagination links carry the nonce automatically.
Security: Added an explicit capability check to the Suggestions admin page.
Security: Status filter links are now escaped at output with wp_kses().
Removed: Deprecated OpenRouter client class — the plugin only communicates with the Arcio relay.
Removed: Unused Gemini API endpoint constant.
Removed: set_time_limit() calls from AJAX handlers.
Improved: Admin page scripts moved to dedicated .js files loaded via wp_enqueue_script() — no output buffering.
Removed: Temporary fatal-error debug instrumentation from AJAX handlers — errors now route through the standard plugin logger.
Updated: Bulk-operation confirmation dialogs and admin copy now reflect managed AI plan quotas instead of legacy token/cost estimates.
Clarified: External services disclosure now accurately states that Google Gemini is reached via the Arcio relay, never directly from the plugin.
3.1.7
Fixed: Converted line endings from CRLF to LF to resolve strict plugin header parsing issues.
3.1.6
Fixed: Formatted plugin header to comply with strict WordPress parsing rules.
3.1.5
Fixed: Updated Terms of Service and Privacy Policy links to comply with WordPress directory guidelines.
3.1.4
Security: Implemented strict nonce verification across all AJAX actions to prevent CSRF attacks.
Security: Improved sanitization and validation for API relay payload signatures.
Improved: Refactored admin UI to use strictly enqueued external stylesheets and scripts, eliminating all inline styles.
Improved: Ensured zero-error compatibility under strict WP_DEBUG environments for official repository standards.
3.1.2
Migrated all AI processing to Arcio’s managed relay — users no longer need an OpenRouter API key or any third-party AI account.
Added: HMAC-signed authentication for relay requests using Freemius install credentials.
Added: Server-side quota enforcement to prevent client-side bypass.
Improved: Connection status caching reduces redundant relay pings.
Removed: OpenRouter API key field, model selection UI, and related settings.
Updated: Plan structure now uses graduated monthly analysis quotas (Free 10 / Starter 100 / Growth 500 / Pro 1,000 / Scale 5,000).
2.1.2
Improved: Replaced wp_cache_flush() with targeted cache clear to avoid nuking Redis/Memcached on license changes.
Improved: Freemius reset endpoint now restricted to dev mode only (WP_FS__DEV_MODE).
Added: Freemius lifecycle hooks for license activation, deactivation, premium activation, and free reactivation.
Added: Tabs navigation for Freemius Account/Pricing pages to reduce admin menu clutter.
Added: Custom opt-in connect screen message explaining data collection.
Added: Arcio-specific deactivation survey reasons for better feedback.
2.1.1
Fixed: Freemius license checks referenced wrong function name (arc_fs vs arcio_fs), causing Pro users to be treated as free.
Fixed: CSRF vulnerability on Freemius reset endpoint — now requires nonce verification.
Fixed: Race condition in monthly quota counter — uses atomic DB increment.
Added: Freemius license/plan change hooks to clear cached premium status on upgrade/downgrade.
Added: Stale monthly usage counter cleanup on license change.
Added: Fallback upgrade URL when Freemius SDK is unavailable.
Improved: Premium status check is now cached per-request to reduce redundant SDK calls.
2.0.0
Current stable release.
1.6.0
Fixed: All suggestion action buttons (Approve, Reject, Apply, Revert, Delete) were non-functional due to a CSS class mismatch between PHP and JavaScript.
Fixed: Buttons did not update their state after a successful action.
Fixed: “Apply Link” returned an “Invalid action type” error.
Fixed: “Load Models” only populated the main model dropdown, not the indexing model dropdown.
1.5.0
Fixed: Settings never saved due to mismatched form field names between JavaScript and PHP. All settings now save correctly.
1.4.0
Fixed: Indexing errors now display a helpful tooltip instead of failing silently.
Fixed: Clear error message when no model or API key is configured before indexing.
Added: Public API key accessor for pre-flight validation checks.
1.3.0
Removed legacy WP-Cron batch indexing system in favor of synchronous AJAX-based indexing.
