Changelogs

What’s Changed

• Fixed: The WordPress 7 data panel no longer appears for a module that is switched off. On a site with Redirect Manager disabled, its page still rendered two empty tables and a working “Add redirect” form, even though the module refuses every write while disabled, so the form could only produce an error.
• Changed: The panel’s “WordPress 7 workspace” heading is gone. Its tables already carry their own headings, and naming a section after the WordPress version labelled the implementation rather than what you are looking at.
• Fixed: The Performance & Cleanup settings page was headed “Miscellaneous (Bloat Control)”, which matched neither the module card you clicked nor any other name in the interface.
• Changed: The dashboard box holding the AI opt-in is now called “AI explanations”, after the single setting it contains, instead of advertising four platform features that are not configurable there.
• Fixed: Link Management’s JSON preset filter note now matches the format used by every other filter note in the plugin.

= 1.6.0 = = 1.6.1 = Interface fixes. The WordPress 7 data panel no longer appears for modules you have switched off, where it offered a create form that could not work. Several admin headings now match the module names they belong to. No settings, data, or hooks change.

Commits

• Ship 1.6.1 (933f1be)
• Stop the WordPress 7 panel labelling itself, and hide it when the module is off (b063842)

Full Changelog: https://github.com/wpgaurav/functionalities/compare/v1.6.0…v1.6.1

What’s Changed

• Security: Abilities API operations now use a permission callback per ability and reject undeclared input properties. A shared callback previously widened to edit_post whenever the request carried a post_id, so any user who could edit one post could toggle modules, create redirects, create tasks, and trigger scans.
• Security: Redirects, the bounded 404 log, and Task Manager projects moved to a private folder with a random name under wp-content/functionalities/. Existing files are migrated automatically. Apache, IIS, and directory-listing rules are written alongside them, and a new Site Health check confirms over HTTP that the folder really is unreachable.
• Fixed: Header and footer snippets are no longer re-filtered against the visitor’s capability at output time. Anonymous visitors were receiving mangled code — && became && and comparison operators were eaten as tags — while the logged-in administrator saw the snippet work. Filtering now happens once, at save time, against the author’s capability.
• Fixed: A JSON exception preset served from a URL is fetched at most once per cache window instead of on every page load. The cache clears whenever the module settings change, a post or page is edited, or the theme changes, and the last good list is kept when a fetch fails.
• Fixed: The bulk nofollow tool pages through posts with an ID cursor and now finishes on sites with more than 100 matches. It previously returned the same first batch on every run.
• Improved: Link Management, Block Cleanup, and Schema use the WordPress HTML API instead of DOMDocument. Attributes are edited in place, so Vue, Alpine, and mustache syntax survive untouched and the JS-framework skip guard added in 1.4.3 and 1.4.4 is gone. Content that used to be skipped is now processed correctly.
• Improved: Redirect hits and 404 aggregates are buffered and written in batches rather than rewriting the whole JSON file under an exclusive lock on every request.
• Improved: Redirects run at parse_request, before WordPress queries the database for a page it is about to discard. WordPress’s own entry points are never redirected.
• Improved: The Content Integrity column on the posts list reads a result cached at save time instead of rendering and parsing every row on every page load.
• Improved: The SVG icon library is stored without autoloading, so full SVG markup no longer loads on every request.
• Improved: The service worker skips wp-admin, the login page, REST responses, cross-origin requests, and anything marked no-store or private; caps the runtime cache; and precaches URLs individually so one stale entry cannot stop it installing. The manifest now includes an id.
• Improved: Login Security adds per-username throttling, an IP allowlist, an unlock button on the lockout log, and a warning when every recent lockout shares one address, which is the signature of a site behind a CDN.
• Improved: Prism.js is bundled with the plugin instead of being loaded from a third-party CDN.
• Improved: Performance & Cleanup makes the revision limit configurable, and disabling Heartbeat now applies to the frontend only unless the new admin option is also enabled, so autosave and post locking keep working.
• Improved: Content Integrity and Assumption Detection gained the filters their documentation promised, and the module documentation now lists hook names that exist. Nineteen documented hooks were never fired.
• Fixed: Settings export no longer redacts the GA4 measurement ID as if it were custom code.
• Fixed: Core icons get the same definition-ID prefixing as custom icons, so two gradient icons on one page no longer collide.
• Fixed: Saving PWA settings flushes rewrite rules once instead of twice.
• Fixed: Disabling feeds falls back to a message only when a redirect is genuinely impossible, making the documented message filter reachable.
• Changed: The translation template is generated from the source. It was a one-string placeholder.
• Changed: src/ and docs/ are excluded from the distribution, and build.sh now uses the same exclude list as the release workflow so a local build and a tagged release cannot drift.
• Changed: Tested up to WordPress 7.1.

= 1.5.0 = = 1.6.0 = Security release. Fixes an Abilities API permission flaw that let any user who could edit a post reach administrator-only operations, moves redirect and task data into a private folder, and stops header/footer snippets being mangled for logged-out visitors. Also replaces DOMDocument with the WordPress HTML API in three content filters, so pages using Vue or Alpine are processed correctly instead of skipped. Existing settings, hooks, admin URLs, and data files are migrated automatically.

Commits

• Readme: test against WordPress 7.1, correct stale claims, link the docs site (bbcd38d)
• Fix CI: ship the Prism assets and make the POT check reproducible (c199bbd)
• Migrate legacy data even when the file modules are disabled (e1c467d)
• Ship 1.6.0: Abilities permission fix, private data storage, HTML API filters (c5cdccd)

Full Changelog: https://github.com/wpgaurav/functionalities/compare/v1.5.0…v1.6.0

What’s Changed

• Added: WordPress 7 Abilities API operations for module status, privacy-safe diagnostics, assumption scans, content-integrity checks, redirect import previews, redirect creation, task creation, module toggles, and opt-in AI explanations.
• Added: DataViews and DataForm workspaces for Redirect Manager, its bounded 404 activity, and Task Manager with searchable, sortable, filterable tables and modern creation forms while retaining the classic interfaces as fallbacks.
• Added: Command Palette actions for opening Functionalities screens and running an Assumption Detection scan.
• Added: Explicitly opt-in AI explanations powered by the WordPress AI Client. Only a finding submitted by an administrator is sent to the configured provider.
• Improved: SVG Icon block upgraded to Block API v3 with WordPress Core Icon source support, two-way Core Icon transforms, pattern-override-ready content attributes, block bindings, and an Icon Callout pattern.
• Fixed: Content Integrity now uses the current wp.editor plugin-sidebar components on WordPress 7 while retaining the legacy fallback.
• Fixed: Custom font declarations are emitted with their preloads so first-paint typography does not shift when async theme styles arrive.
• Changed: Minimum WordPress version is now 6.3 so the SVG Icon block can use Block API v3 consistently. WordPress 7-only integrations remain feature-detected.

Commits

• Add WordPress 7 integrations for 1.5.0 (1abacd5)
• Fix custom font layout shifts (87d507f)

Full Changelog: https://github.com/wpgaurav/functionalities/compare/v1.4.8…v1.5.0

What’s Changed

• Improved: SVG Icon block now uses block metadata, lazy paginated icon loading, native block supports, px/em/rem sizing, original-color and monochrome modes, accessible labels, missing-icon recovery, and keyboard-friendly selection.
• Security: SVG sanitization now requires a real SVG root, restricts styles and local references, blocks external href values, and prefixes definition IDs to prevent collisions.
• Fixed: Fresh PWA settings now register rewrite endpoints immediately, and the offline application shell returns a cacheable success response so service-worker precaching can complete.
• Added: True lazy module registry. A frontend request with all modules disabled loads no feature class files; enabling one module loads only that feature and shared dependencies.
• Added: Versioned settings export/import with dry-run differences, module validation, default custom-code redaction, and an explicit code opt-in.
• Added: Privacy-conscious diagnostics download with software versions, enabled modules, writable-path status, and rewrite-rule health. Task content, redirects, users, secrets, and site URLs are excluded.
• Added: Redirect CSV import/export with common column aliases, all-or-nothing dry runs, and duplicate, wildcard, loop, and chain validation.
• Added: Opt-in bounded 404 monitor with retention, row caps, path exclusions, bot/admin/API filtering, referrer-origin-only storage, purge, ignore, and redirect-prefill actions.
• Added: Assumption Detection Site Health status, configurable scheduled scans, stale/failed scan distinction, and opt-in deduplicated email summaries.
• Added: Content Integrity snapshot differences for links, headings, H1s, and word count, plus bounded audit metadata for baseline actions.
• Added: Pull-request CI across PHP 7.4 through 8.5, WordPress Coding Standards, PHPUnit coverage, JavaScript/shell checks, version consistency, and distribution assertions.
• Changed: Admin bootstrap is now a small router with dedicated module, portability, and Site Health controllers.
• Fixed: Task Manager and Redirect Manager JSON updates now use locking, verified same-directory temporary files, and atomic replacement to prevent lost concurrent writes.
• Fixed: Invalid JSON and storage failures preserve the last known file and surface an actionable admin error instead of silently appearing empty.
• Fixed: SVG Icons is disabled on fresh installs, matching the explicit-activation policy used by every module.

= 1.4.7 = = 1.4.8 = Adds the upgraded SVG Icon block, safe settings portability, CSV redirects, an opt-in 404 monitor, native Site Health signals, true lazy module loading, atomic file storage, and pull-request quality gates. Existing option names, block names, shortcode syntax, admin URLs, hooks, and JSON formats remain compatible.

Commits

• Improve SVG Icon block for 1.4.8 (9b797b8)
• Fix PWA offline precaching on fresh installs (#49) (7ec31cc)
• Ship Dynamic Functionalities 1.4.8 (#48) (85cc110)

Full Changelog: https://github.com/wpgaurav/functionalities/compare/v1.4.7…v1.4.8

What’s Changed

• Added: When “Assign fonts to body text and headings” is enabled, the block editor canvas now receives explicit .editor-styles-wrapper font-family rules (the assigned family plus a system-font fallback) for body and headings, so the editor matches the front end even when the theme.json typography assignment doesn’t reach the iframe.
• Fixed: Custom fonts now render inside the block editor canvas. The editor is an iframe (WP 6.3+/7.x) that ignores src-less inline styles, so @font-face is now injected through the editor styles setting — the same channel the Font Library and add_editor_style() use.
• Fixed: Variable-font weight ranges with an out-of-spec low bound (e.g. 1 900) are normalized to 100 900. WordPress was silently dropping these faces — and their entry in the editor font picker — when validating theme.json.
• Fixed: Components module CSS now reaches the block editor canvas reliably via the editor styles setting. The previous inline fallback could not cross into the WP 7 iframe when the generated CSS file was unavailable.
• Changed: Removed the redundant admin_head font print. It reached only the parent admin document, never the editor iframe, and is superseded by the editor styles channel.
• Housekeeping: Documented a single source-of-truth matrix for the font-loading paths and removed stale per-file @version docblocks that had drifted from the plugin version.

Commits

• v1.4.7: block-editor font fixes, weight normalization & housekeeping (468f285)

Full Changelog: https://github.com/wpgaurav/functionalities/compare/v1.4.6…v1.4.7

What’s Changed

• Added: Character range (unicode-range) support per font in the Fonts module — limit which characters trigger a font download for faster page loads
• Added: Quick-pick presets in the admin UI for common subsets (Latin, Latin Extended, Greek, Cyrillic, Vietnamese, Punctuation/Symbols)
• Added: unicode-range is also emitted into the theme.json fontFace data layer so it propagates to the block editor
• Security: Login Security no longer trusts X-Forwarded-For / Client-IP headers by default — these were spoofable on direct connections, allowing IP-based lockouts to be evaded or weaponized. Sites behind a trusted reverse proxy or CDN can opt in via the new “Trust Proxy Headers” setting.
• Security: Login Security now validates client IPs through FILTER_VALIDATE_IP when proxy headers are in use, dropping malformed values rather than hashing them into transient keys.
• Fixed: Block Cleanup XPath query now safely escapes class names via a proper XPath 1.0 string-literal builder (addcslashes was the wrong escape function and silently failed on classes containing quotes).
• Fixed: Snippets kses_with_styles() placeholder collision — <style> extraction now uses a per-call random token so a snippet body containing the literal placeholder string can no longer corrupt the output.
• Fixed: Fonts module admin badge now reflects the Style field (free-text input) instead of looking for a <select> that doesn’t exist.
• Fixed: Fonts module options static cache is invalidated automatically on update_option_functionalities_fonts, preventing stale font lists when the option is updated mid-request.
• Fixed: Task Manager AJAX handlers (Export, Delete, etc.) now register whenever in admin, so existing projects remain manageable even when the module is toggled off.
• Fixed: Task Manager card layout — widget badge now sits above the action row, so Open/Export/Delete align consistently across cards.
• Fixed: Help & Support buttons now have higher CSS specificity to defeat WP 7.0’s button reset.

Commits

• v1.4.6: unicode-range fonts, security & correctness fixes (00223a7)

Full Changelog: https://github.com/wpgaurav/functionalities/compare/v1.4.5…v1.4.6

What’s Changed

• Added: WOFF and WOFF2 font file uploads now supported in the WordPress media library
• Security: Font uploads validated via binary magic-byte signatures to prevent malicious file uploads

= 1.4.4 = = 1.4.5 = Enables WOFF/WOFF2 font uploads in the media library with magic-byte validation for security.

Commits

• v1.4.5: allow WOFF/WOFF2 font uploads in WordPress media library (7e66ba1)
• fix: suppress PHPCS warnings for uninstall meta_key query and dynamic hook name (d6ca5fb)

Full Changelog: https://github.com/wpgaurav/functionalities/compare/v1.4.4…v1.4.5

What’s Changed

• Fixed: Schema module filter_article() now skips content with Vue/Alpine.js directives — prevents DOMDocument from corrupting JS framework templates
• Fixed: Block Cleanup module filter_content_cleanup() now skips content with JS framework directives
• Refactored: Extracted Vue-safe DOMDocument guard into shared Has_Dom_Parser trait used by Link Management, Schema, and Block Cleanup
• All three the_content filters that use DOMDocument (priorities 12, 14, 999) are now protected against JS framework corruption

= 1.4.3 = = 1.4.4 = Extends Vue/Alpine.js protection to Schema and Block Cleanup modules. All DOMDocument-based content filters now skip JS framework content.

Commits

• docs: remove changelog from README.md, point to readme.txt (c28993b)
• v1.4.4: extend Vue-safe guard to Schema and Block Cleanup modules (f9b27cc)
• refactor: extract Vue-safe DOMDocument guard into shared trait (f4df469)

Full Changelog: https://github.com/wpgaurav/functionalities/compare/v1.4.3…v1.4.4

What’s Changed

• Fixed: Link Management process_content() now skips HTML containing Vue.js directives (v-cloak, v-if, v-show, :class, @click, {{ }})
• Fixed: DOMDocument re-parsing was corrupting Vue/React template syntax in themes like MyListing, causing explore pages to flash and disappear
• Improved: Early-exit check prevents unnecessary DOM parsing on content with JavaScript framework directives

= 1.4.2 = = 1.4.3 = Fixes Link Management breaking pages that use Vue.js (MyListing explore page, etc.). DOMDocument no longer corrupts Vue/React template directives.

Commits

• v1.4.3: fix Link Management breaking Vue.js pages (MyListing explore) (18ca7a3)

Full Changelog: https://github.com/wpgaurav/functionalities/compare/v1.4.2…v1.4.3

What’s Changed

• Fixed: wp_kses now preserves data-* attributes on <script>, <style>, and <link> tags in Header & Footer snippets
• Fixed: async, defer, nomodule, id, nonce, crossorigin, and as attributes no longer stripped from snippet tags for non-admin users
• Fixed: Unified allowed-tags list between snippet output and save sanitization to prevent attribute drift
• Fixed: README.md version was outdated (still showed 1.4.0)

= 1.4.1 = = 1.4.2 = Fixes data-* and other attributes being stripped from script/style/link tags in Header & Footer snippets for non-admin users.

Commits

• v1.4.2: preserve data-* and module attributes on snippet tags (c2c3da4)

Full Changelog: https://github.com/wpgaurav/functionalities/compare/v1.4.1…v1.4.2

What’s Changed

• Added: Opt-in “Delete all plugin data when uninstalling” checkbox on the dashboard — removes all options, post metadata, transients, and files on uninstall
• Fixed: Replaced all direct file_put_contents calls with WP_Filesystem API across Task Manager, Redirect Manager, and JSON file creation
• Fixed: Extracted duplicate CSS sanitization into a shared trait used by Components and Fonts modules
• Fixed: Removed sslverify => false from loopback HTTP requests in Assumption Detection
• Fixed: Disabled debug console logging in SVG Icons editor script
• Fixed: Removed dead code in admin UI script

= 1.4.0 = = 1.4.1 = Code quality and plugin review compliance: WP_Filesystem for all file writes, comprehensive uninstall cleanup (opt-in), shared CSS sanitization trait, and minor fixes.

Commits

• v1.4.1: comprehensive uninstall, WP_Filesystem, shared CSS sanitizer, cleanup (20f055f)

Full Changelog: https://github.com/wpgaurav/functionalities/compare/v1.4.0…1.4.1

What’s Changed

• Added: Bricks Builder font integration — custom fonts appear in Bricks typography picker and load inside the builder canvas
• Added: PWA module prefills app name, short name, description, and icons from WordPress Settings and Site Icon
• Improved: Task Manager UI redesign — external CSS, card-based project grid, improved modals, hover task actions, polished column view
• Improved: Task Manager consistent spacing across all sections

= 1.3.3 = = 1.4.0 = Bricks Builder font support. Task Manager redesign: cleaner card-based UI, external CSS, improved modals, hover actions on tasks, and polished column view.

Commits

• docs: mention Bricks font integration and typography assignments in readme (59b4f89)
• v1.4.0: Bricks font support, Task Manager redesign, typography assignments, PWA prefill (55d8432)

Full Changelog: https://github.com/wpgaurav/functionalities/compare/v1.3.1…v1.4.0