Added: WordPress 7 Abilities API operations for module status, privacy-safe diagnostics, assumption scans, content-integrity checks, redirect import previews, redirect creation, task creation, module toggles, and opt-in AI explanations.
Added: DataViews and DataForm workspaces for Redirect Manager, its bounded 404 activity, and Task Manager with searchable, sortable, filterable tables and modern creation forms while retaining the classic interfaces as fallbacks.
Added: Command Palette actions for opening Functionalities screens and running an Assumption Detection scan.
Added: Explicitly opt-in AI explanations powered by the WordPress AI Client. Only a finding submitted by an administrator is sent to the configured provider.
Improved: SVG Icon block upgraded to Block API v3 with WordPress Core Icon source support, two-way Core Icon transforms, pattern-override-ready content attributes, block bindings, and an Icon Callout pattern.
Fixed: Content Integrity now uses the current wp.editor plugin-sidebar components on WordPress 7 while retaining the legacy fallback.
Fixed: Custom font declarations are emitted with their preloads so first-paint typography does not shift when async theme styles arrive.
Changed: Minimum WordPress version is now 6.3 so the SVG Icon block can use Block API v3 consistently. WordPress 7-only integrations remain feature-detected.
1.4.8
Improved: SVG Icon block now uses block metadata, lazy paginated icon loading, native block supports, px/em/rem sizing, original-color and monochrome modes, accessible labels, missing-icon recovery, and keyboard-friendly selection.
Security: SVG sanitization now requires a real SVG root, restricts styles and local references, blocks external href values, and prefixes definition IDs to prevent collisions.
Fixed: Fresh PWA settings now register rewrite endpoints immediately, and the offline application shell returns a cacheable success response so service-worker precaching can complete.
Added: True lazy module registry. A frontend request with all modules disabled loads no feature class files; enabling one module loads only that feature and shared dependencies.
Added: Versioned settings export/import with dry-run differences, module validation, default custom-code redaction, and an explicit code opt-in.
Added: Privacy-conscious diagnostics download with software versions, enabled modules, writable-path status, and rewrite-rule health. Task content, redirects, users, secrets, and site URLs are excluded.
Added: Redirect CSV import/export with common column aliases, all-or-nothing dry runs, and duplicate, wildcard, loop, and chain validation.
Added: Opt-in bounded 404 monitor with retention, row caps, path exclusions, bot/admin/API filtering, referrer-origin-only storage, purge, ignore, and redirect-prefill actions.
Added: Assumption Detection Site Health status, configurable scheduled scans, stale/failed scan distinction, and opt-in deduplicated email summaries.
Added: Content Integrity snapshot differences for links, headings, H1s, and word count, plus bounded audit metadata for baseline actions.
Added: Pull-request CI across PHP 7.4 through 8.5, WordPress Coding Standards, PHPUnit coverage, JavaScript/shell checks, version consistency, and distribution assertions.
Changed: Admin bootstrap is now a small router with dedicated module, portability, and Site Health controllers.
Fixed: Task Manager and Redirect Manager JSON updates now use locking, verified same-directory temporary files, and atomic replacement to prevent lost concurrent writes.
Fixed: Invalid JSON and storage failures preserve the last known file and surface an actionable admin error instead of silently appearing empty.
Fixed: SVG Icons is disabled on fresh installs, matching the explicit-activation policy used by every module.
1.4.7
Added: When “Assign fonts to body text and headings” is enabled, the block editor canvas now receives explicit .editor-styles-wrapper font-family rules (the assigned family plus a system-font fallback) for body and headings, so the editor matches the front end even when the theme.json typography assignment doesn’t reach the iframe.
Fixed: Custom fonts now render inside the block editor canvas. The editor is an iframe (WP 6.3+/7.x) that ignores src-less inline styles, so @font-face is now injected through the editor styles setting — the same channel the Font Library and add_editor_style() use.
Fixed: Variable-font weight ranges with an out-of-spec low bound (e.g. 1 900) are normalized to 100 900. WordPress was silently dropping these faces — and their entry in the editor font picker — when validating theme.json.
Fixed: Components module CSS now reaches the block editor canvas reliably via the editor styles setting. The previous inline fallback could not cross into the WP 7 iframe when the generated CSS file was unavailable.
Changed: Removed the redundant admin_head font print. It reached only the parent admin document, never the editor iframe, and is superseded by the editor styles channel.
Housekeeping: Documented a single source-of-truth matrix for the font-loading paths and removed stale per-file @version docblocks that had drifted from the plugin version.
1.4.6
Added: Character range (unicode-range) support per font in the Fonts module — limit which characters trigger a font download for faster page loads
Added: Quick-pick presets in the admin UI for common subsets (Latin, Latin Extended, Greek, Cyrillic, Vietnamese, Punctuation/Symbols)
Added: unicode-range is also emitted into the theme.json fontFace data layer so it propagates to the block editor
Security: Login Security no longer trusts X-Forwarded-For / Client-IP headers by default — these were spoofable on direct connections, allowing IP-based lockouts to be evaded or weaponized. Sites behind a trusted reverse proxy or CDN can opt in via the new “Trust Proxy Headers” setting.
Security: Login Security now validates client IPs through FILTER_VALIDATE_IP when proxy headers are in use, dropping malformed values rather than hashing them into transient keys.
Fixed: Block Cleanup XPath query now safely escapes class names via a proper XPath 1.0 string-literal builder (addcslashes was the wrong escape function and silently failed on classes containing quotes).
Fixed: Snippets kses_with_styles() placeholder collision — <style> extraction now uses a per-call random token so a snippet body containing the literal placeholder string can no longer corrupt the output.
Fixed: Fonts module admin badge now reflects the Style field (free-text input) instead of looking for a <select> that doesn’t exist.
Fixed: Fonts module options static cache is invalidated automatically on update_option_functionalities_fonts, preventing stale font lists when the option is updated mid-request.
Fixed: Task Manager AJAX handlers (Export, Delete, etc.) now register whenever in admin, so existing projects remain manageable even when the module is toggled off.
Fixed: Task Manager card layout — widget badge now sits above the action row, so Open/Export/Delete align consistently across cards.
Fixed: Help & Support buttons now have higher CSS specificity to defeat WP 7.0’s button reset.
1.4.5
Added: WOFF and WOFF2 font file uploads now supported in the WordPress media library
Security: Font uploads validated via binary magic-byte signatures to prevent malicious file uploads
1.4.4
Fixed: Schema module filter_article() now skips content with Vue/Alpine.js directives — prevents DOMDocument from corrupting JS framework templates
Fixed: Block Cleanup module filter_content_cleanup() now skips content with JS framework directives
Refactored: Extracted Vue-safe DOMDocument guard into shared Has_Dom_Parser trait used by Link Management, Schema, and Block Cleanup
All three the_content filters that use DOMDocument (priorities 12, 14, 999) are now protected against JS framework corruption
1.4.3
Fixed: Link Management process_content() now skips HTML containing Vue.js directives (v-cloak, v-if, v-show, :class, @click, {{ }})
Fixed: DOMDocument re-parsing was corrupting Vue/React template syntax in themes like MyListing, causing explore pages to flash and disappear
Improved: Early-exit check prevents unnecessary DOM parsing on content with JavaScript framework directives
1.4.2
Fixed: wp_kses now preserves data-* attributes on <script>, <style>, and <link> tags in Header & Footer snippets
Fixed: async, defer, nomodule, id, nonce, crossorigin, and as attributes no longer stripped from snippet tags for non-admin users
Fixed: Unified allowed-tags list between snippet output and save sanitization to prevent attribute drift
Fixed: README.md version was outdated (still showed 1.4.0)
1.4.1
Added: Opt-in “Delete all plugin data when uninstalling” checkbox on the dashboard — removes all options, post metadata, transients, and files on uninstall
Fixed: Replaced all direct file_put_contents calls with WP_Filesystem API across Task Manager, Redirect Manager, and JSON file creation
Fixed: Extracted duplicate CSS sanitization into a shared trait used by Components and Fonts modules
Fixed: Removed sslverify => false from loopback HTTP requests in Assumption Detection
Fixed: Disabled debug console logging in SVG Icons editor script
Fixed: Removed dead code in admin UI script
1.4.0
Added: Bricks Builder font integration — custom fonts appear in Bricks typography picker and load inside the builder canvas
Added: PWA module prefills app name, short name, description, and icons from WordPress Settings and Site Icon
