Compliance pass following the WordPress.org manual review.
Determine file/directory locations through the WordPress API instead of internal constants: the audit payload now reports the public content URL via content_url(), and other plugins’ on-disk size is measured by deriving the plugins root from plugin_dir_path() on the main file rather than WP_PLUGIN_DIR.
Disk-free-space probing no longer falls back to an absolute server path: if wp_upload_dir() cannot be resolved the probe is skipped.
Database backups are now stored as a protected ZIP archive (database.zip) only. The raw SQL is streamed to a temporary file (wp_tempnam()), added to the ZIP, and deleted immediately in both success and failure paths — a loose database.sql is never left on disk. ZIP support is required; there is no loose-SQL fallback.
Removed the literal ABSPATH token from user-facing error messages.
2.0.3
Restored the automatic “disable file editor” fix using a runtime-only define. When enabled, DISALLOW_FILE_EDIT is set with define() on every request from the plugin bootstrap — wp-config.php is never modified, no file is written to disk and an existing definition is never overridden.
WP_DEBUG remains detection-only with a manual recommendation; it is never changed automatically.
2.0.2
Compliance pass following the WordPress.org manual review.
Replaced all plugin cURL calls with the WordPress HTTP API (wp_remote_get).
The plugin no longer edits wp-config.php automatically. The WP_DEBUG and file-editor fixes now return a manual recommendation telling the administrator exactly which line to add; the audit still detects the issue.
Pre-modify file backups (e.g. .htaccess, robots.txt) are now stored inside ZIP archives in the protected uploads backup directory — no loose .bak or config files are ever written.
Stopped exposing absolute server paths (ABSPATH, WP_CONTENT_DIR, document root) in the audit payload and error messages.
Added the UNIFYCA_PLUGIN_URL constant and tidied file/directory location handling; writable storage always uses wp_upload_dir().
2.0.1
WordPress.org compliance pass following directory pre-review.
Removed the external public-IP lookup (api.ipify.org). Local audits now make no outbound requests to any external service; the server IP is resolved locally only.
Removed the connector self-update mechanism. The plugin now relies exclusively on the WordPress.org update infrastructure and no longer writes the update_plugins site transient.
Hardened backup storage: backups are stored under wp-content/uploads/unifyca-backups/ (via wp_upload_dir()), always protected with an index.php and a deny-all .htaccess. Core backups are written as a single ZIP archive — the plugin never leaves loose, web-accessible PHP files (e.g. wp-config.php, wp-settings.php) in the backup directory.
Replaced every __return_true REST permission callback with dedicated callbacks that verify the connection state, the HMAC signature (timestamp freshness + shared-secret), and, for backup downloads, the short-lived signed token.
Documented all external services and updated the Privacy section.
2.0.0
New wp-admin dashboard. Replaces the previous connector-only settings page with a full website-health audit experience.
Local audits run without a Unifyca account. The plugin can be used standalone.
New score system (overall + per-category) with consistent severity colours.
Issue cards include human explanations, “why it matters” and recommended actions.
New Unifyca_Audit_Engine class. Single source of truth for all audit checks.
New Unifyca_Alert_Catalog class. Translates raw audit data into UI-friendly issue cards.
New Unifyca_Score class. Pure score-calculation layer.
