Fixed "Remove WordPress version" pinning every visitor to pre-update core assets. Dropping ver from a core script or stylesheet URL leaves an address that never changes across a WordPress release, so browsers and CDNs holding it under a…
Read full notes2 changes
Fixed
Fixed "Remove WordPress version" pinning every visitor to pre-update core assets. Dropping ver from a core script or stylesheet URL leaves an address that never changes across a WordPress release, so browsers and CDNs holding it under a long max-age keep serving the old bytes indefinitely. The version is now replaced with a stable site-specific hash instead of removed, which hides the release just as well and still busts the cache on every update. Symptom on a 7.1 upgrade: the new admin bar site icon rendered at full size because the cached stylesheet predated the .site-icon rules.
Fixed the Operations cards sitting flush against the panel edge while the panel heading above them was inset, and fixed their rows sitting 40px apart against 20px columns. The grid carried no inset of its own, and each card is a panel in…
Read full notes6 changes
Fixed
Fixed the Operations cards sitting flush against the panel edge while the panel heading above them was inset, and fixed their rows sitting 40px apart against 20px columns. The grid carried no inset of its own, and each card is a panel in its own right whose 20px bottom margin stacked on the grid gap and hung a phantom band under the last row.
Fixed the API token permission list and the "Install drop-ins, purge, and sync Cloudflare on the dashboard" link hanging outside the panel inset. The link now uses the existing .gtp-inline-link treatment, matching "View release history".
Fixed .gtp-inline-link never picking up the narrow inset at the mobile breakpoint. Its override sat in a media block declared earlier in the file than the rule it was meant to override, so source order silently discarded it.
Changed
The panel inset is now a single --gtp-inset token, 24px normally and 20px under 782px, replacing 26 hard-coded values and five per-class media overrides. Because the token is redefined on .gtp-admin rather than on each block, a rule declared later in the file can no longer defeat the responsive override, which is the defect behind the mis-inset link and permission list. Adding a new block to a panel now means using the token instead of remembering to register the class in two places.
Fixed the "Other cache rules that also match this site" block rendering at three different left offsets. The heading had no rule at all, so it fell back to the browser default and hung outside the panel inset; the note carried the standard…
Read full notes5 changes
Fixed
Fixed the "Other cache rules that also match this site" block rendering at three different left offsets. The heading had no rule at all, so it fell back to the browser default and hung outside the panel inset; the note carried the standard 24px inset; and the conflict list carried none. The heading now uses .gtp-subhead, the list is inset to match its siblings, and both pick up the 20px inset at the mobile breakpoint. The default 1em heading margin stacking on top of the note's own 20px padding also left an oversized gap, which is now collapsed.
Fixed the "Or create it automatically" heading inside .gtp-operation-panel inheriting browser default type and margins. It now shares the 14px heading rule already used by the preset and database-result headings.
Changed
Admin notices are now a compact status pill instead of a full-width WordPress notice bar. When a failure carries an upstream reason, the pill gains a "Why?" disclosure that opens the detail in an anchored popover rather than pushing the page down. The popover is anchored to its own pill rather than promoted to the top layer, so it lands in the right place without depending on CSS anchor positioning, and it light-dismisses on outside click or Escape. Dismissing removes the gtp_notice query argument instead of hiding the node, so a reload cannot resurrect a notice that has already been read.
Launcher offset. Four new fields under Settings → Launcher set how far the floating button and panel sit from the bottom and side of the screen, in pixels, with separate values for desktop and mobile. The launcher was pinned 20px from the…
Read full notes2 changes
Added
Launcher offset. Four new fields under Settings → Launcher set how far the floating button and panel sit from the bottom and side of the screen, in pixels, with separate values for desktop and mobile. The launcher was pinned 20px from the edges, so on themes with their own fixed bottom bar — a mobile nav, a share row, a cookie strip — it covered the controls underneath it and there was no way to move it. Values are clamped to 0-400px, and the panel's height subtracts the bottom offset so raising the widget cannot push the panel off the top of the screen. Defaults reproduce the previous position exactly. Applied as CSS custom properties evaluated per visitor, so the desktop/mobile split stays correct behind a full-page cache.
Fatal error when the plugin update cache was cleared. clear_update_cache() is hooked on delete_site_transient_update_plugins and deleted that same transient, which fired the action again; the hook re-entered itself until PHP exhausted…
Read full notes2 changes
Fixed
Fatal error when the plugin update cache was cleared.clear_update_cache() is hooked on delete_site_transient_update_plugins and deleted that same transient, which fired the action again; the hook re-entered itself until PHP exhausted memory ("Allowed memory size exhausted"). Any code path that deletes the update_plugins site transient triggered it, including wp plugin list after a cache flush. The method now holds a re-entry guard.
Fixed Cloudflare cache rule synchronization failing outright on any site with more than one bypassed query parameter. RuleExpression::compile() emitted a separate concat("&", http.request.uri.query) per parameter, and Cloudflare…
Read full notes12 changes
Fixed
Fixed Cloudflare cache rule synchronization failing outright on any site with more than one bypassed query parameter. RuleExpression::compile() emitted a separate concat("&", http.request.uri.query) per parameter, and Cloudflare rejects an expression that calls concat more than once (error 20127), so every sync returned HTTP 400 and the managed rule silently stopped updating. Each parameter now compiles to an equivalent starts_with() plus contains pair that calls no rationed functions.
Fixed the managed rule permanently reporting drift on plans that do not support custom cache keys. A custom cache key is an Enterprise capability, so the write only lands after RuleManager strips it, but RuleCompiler::rule() kept compiling the ideal rule for comparison. Drift was measured against a shape Cloudflare can never store and no amount of syncing cleared it. Comparison now uses the shape the plan accepts, while a sync still attempts the ideal rule so an upgraded plan heals itself.
Fixed cache rule conflict detection ignoring rules that never name a hostname. A catch-all expression such as true applies to every hostname in the zone and was reported as zero conflicts.
Fixed a fatal error in the connection check on zones with no cache ruleset yet, where a WP_Error was indexed as an array.
Added
Cloudflare API failures now report the reason Cloudflare gave, including its numeric error code and any nested error chain, instead of collapsing every failure into one generic sentence. Requests that never reached Cloudflare are reported separately from requests Cloudflare rejected.
Added a Cloudflare connection check that walks integration state, edge ownership, credentials, authentication, zone lookup, and cache rule read and write in order, and names the stage that failed with the reason. The write stage rewrites the managed rule with its own current contents, so it proves the write path without changing anything.
Added an API token panel listing the exact permissions the integration needs, a Cloudflare token-creation template link, and optional automatic creation of a zone-scoped token when a Global API Key is on file. A newly minted token is exercised before it replaces working credentials, because Cloudflare reveals a token secret only once.
The rule plan panel now lists overlapping rules with their expressions and reports whether a custom cache key was applied.
Changed
A failed synchronization now still records the live rule plan, so the screen reflects current zone state instead of appearing never to have run.
Error log. Errors and warnings are recorded to a new table and shown under Alpha Chat → Logs, with level filter, expandable context, source attribution, and a clear button. Provider failures used to be invisible unless the site owner read…
Read full notes12 changes
Added
Error log. Errors and warnings are recorded to a new table and shown under Alpha Chat → Logs, with level filter, expandable context, source attribution, and a clear button. Provider failures used to be invisible unless the site owner read the PHP error log. Anything resembling a credential is stripped before an entry is stored, and entries are pruned daily to 30 days and 2000 rows.
AI conversation titles. Conversations are named from their opening exchange by the configured chat provider, replacing a truncation of the first message. Runs as a scheduled action with a 24-token budget, so it never delays or endangers a reply, and each conversation is named once. Toggle under Behavior.
Per-device launcher visibility. The floating button can be shown or hidden independently on desktop, tablet, and mobile. Applied by screen width in the browser, not by server-side user-agent detection, so it stays correct behind a full-page cache. Blocks and shortcodes are unaffected.
alpha_chat_pre_llm_provider and alpha_chat_pre_embedding_provider filters, which replace a provider before the built-in one is constructed. The existing alpha_chat_llm_provider filter can only decorate an instance that already exists, so swapping in your own provider previously still required configuring an API key for a built-in provider you were not using.
alpha_chat_log_retention_days, alpha_chat_log_max_rows and alpha_chat_thread_titled hooks.
Fixed
A conversation showed 0 messages and a bare uuid in the admin whenever a reply failed. The message count and title were only written after a successful completion, even though the visitor's message had already been stored. Both are now written when the message is stored, and the count is derived from the stored rows.
Fallback titles contained a literal … entity instead of an ellipsis.
Provider and configuration failures return HTTP 503 rather than 502. A CDN in front of the site replaces a 502 body with its own error page, so the actual reason never reached the widget or the site owner.
Database
Schema 1.6.0 adds the alpha_chat_logs table and a title_generated column on alpha_chat_threads. Applied automatically on upgrade.
Assistant replies showed raw Markdown. Models answer in Markdown, but the widget rendered the reply as plain text, so visitors saw literal bold and - bullets instead of formatting. Replies now render bold, italic, inline code, fenced…
Read full notes6 changes
Fixed
Assistant replies showed raw Markdown. Models answer in Markdown, but the widget rendered the reply as plain text, so visitors saw literal **bold** and - bullets instead of formatting. Replies now render bold, italic, inline code, fenced code blocks, links, headings, and bullet and numbered lists.
Security
The Markdown renderer builds React elements rather than an HTML string, so reply text — which is shaped by retrieved site content and curated Q&A — can never inject markup. The widget still contains no dangerouslySetInnerHTML. Links are restricted to http, https and mailto; a javascript: URL renders as plain text and every link carries rel="noopener noreferrer".
Notes
A visitor's own message is still rendered verbatim, not as Markdown.
Chat failed with every reasoning model. The stored temperature was sent on each request, and reasoning models (gpt-5*, o1*, o3*, o4*) reject any sampling value other than the default, failing the whole request with 'temperature' does not…
Read full notes4 changes
Fixed
Chat failed with every reasoning model. The stored temperature was sent on each request, and reasoning models (gpt-5*, o1*, o3*, o4*) reject any sampling value other than the default, failing the whole request with 'temperature' does not support 0.7 with this model. temperature, top_p, presence_penalty and frequency_penalty are now omitted for those models instead of being sent with a value they refuse. Conventional models such as gpt-4o are unaffected and still receive the configured values.
Added
alpha_chat_is_reasoning_model filter, for a model the bundled prefix list does not cover yet.
Security and correctness release from a full audit of the plugin. Please read the upgrade notes below if your site sits behind a proxy other than Cloudflare, or if anything calls the contact endpoint directly.
Read full notes34 changes
Security
Rate limiting no longer trusts X-Forwarded-For from arbitrary callers. The header was accepted unconditionally, so rotating it gave every request its own bucket and left provider spend effectively uncapped. Forwarding headers are now honoured only when the request actually arrives from a trusted proxy. Cloudflare's published edge ranges are trusted out of the box; anything else is declared with the ALPHA_CHAT_TRUSTED_PROXIES constant or the alpha_chat_trusted_proxies filter.
Added a site-wide chat and contact ceiling that no client-supplied identifier can partition, as a backstop on total provider spend.
POST /contact now requires a valid wp_rest nonce. It was previously open to unauthenticated callers and sent mail on every request.
Resuming a conversation now requires the caller to own it. A thread uuid alone used to be enough, and history is replayed into the prompt, so a leaked uuid exposed the earlier conversation.
The current-page context injected into the prompt is now restricted to this site. An off-site origin_url with an attacker-chosen origin_title could previously write arbitrary text into the system prompt.
Transcript CSV export now neutralises spreadsheet formula injection from visitor-authored message content.
Masked API keys are a fixed width and no longer reveal the real key length.
Fixed
A single chat message could trigger more than one paid completion. The widget retried across transports after the server had already answered, duplicating both the provider charge and the stored thread history. It now retries only when the request never reached the plugin.
Transcript CSV export returned a JSON-encoded string rather than a CSV file, so the download could not be opened as a spreadsheet. It now streams real CSV, row by row, and no longer loads the whole archive into memory.
The "Add to Alpha Chat" post row action rendered a button whose handler was never loaded, so clicking it did nothing.
Stored API keys could not be cleared from the settings screen.
A chat widget on a cached page recovers from an expired nonce instead of failing with a message that a reload could not fix.
Restoring a post from the trash returns it to the knowledge base.
delete_post no longer runs knowledge-base cleanup for revisions and autosaves.
Update checks cache failures, so an unreachable licence server no longer adds a blocking request to every admin page load.
Token counting handles CJK text, which was undercounted roughly fourfold and produced oversized chunks.
Follow-up detection no longer treats every short message as a follow-up, which was dragging the previous topic into retrieval after a clean subject change.
Uninstall cleans every site on a multisite network and unschedules its Action Scheduler jobs; network activation installs tables on every site.
Changed
Curated Q&A is now ranked against the question and capped before it enters the prompt, instead of sending every enabled entry on every message.
Settings are resolved once per request rather than rebuilt on each read.
Retrieval scans a bounded candidate set when the fulltext index returns nothing.
Errors and warnings are logged without requiring WP_DEBUG.
Outbound fetches for the FAQ importer go through wp_safe_remote_request, and the pre-flight check covers IPv6 and literal addresses.
The settings response reports whether moderation is actually active, which requires an OpenAI key regardless of the chat provider.
Added
alpha_chat_trusted_proxies, alpha_chat_trust_cloudflare, alpha_chat_rate_limit, alpha_chat_max_prompt_faqs, alpha_chat_fallback_candidates, alpha_chat_max_queued_posts and alpha_chat_should_log filters.
GET /nonce for widgets on cached pages.
Upgrade notes
Behind Cloudflare, nothing to do. Behind any other proxy or load balancer, declare it or anonymous visitors will share rate-limit buckets: define( 'ALPHA_CHAT_TRUSTED_PROXIES', '10.0.0.0/8' );
Anything posting to /alpha-chat/v1/contact must now send an X-WP-Nonce header.
ChatController::is_rate_limited() is deprecated in favour of AlphaChat\Support\RateLimiter::hit().
Public chat no longer dies with Unexpected token '<' when /wp-json/ returns HTML. The widget retries ?rest_route=/alpha-chat/v1/chat and shows a retry message instead of the fallback answer plus a parse dump.
Read full notes5 changes
Fixed
Public chat no longer dies with Unexpected token '<' when /wp-json/ returns HTML. The widget retries ?rest_route=/alpha-chat/v1/chat and shows a retry message instead of the fallback answer plus a parse dump.
Changed
Dashboard cards, queue tiles, and the activity chart are interactive. Range is 7 / 14 / 30 days.
Dashboard uses one GET /dashboard request. Queue polling only runs while jobs are active and the tab is visible.
Curated Q&A can be imported from page URLs. The plugin prefers the local post, then the WordPress REST API (/wp-json/wp/v2/pages and /posts), then HTML. It reads FAQPage JSON-LD, Rank Math / Yoast FAQ blocks, <details>, definition…
Read full notes8 changes
Added
Curated Q&A can be imported from page URLs. The plugin prefers the local post, then the WordPress REST API (/wp-json/wp/v2/pages and /posts), then HTML. It reads FAQPage JSON-LD, Rank Math / Yoast FAQ blocks, <details>, definition lists, accordion markup, and headings that end with ?.
POST /faqs/preview and POST /faqs/import (manage_options).
alpha_chat_faq_extracted and alpha_chat_page_context filters.
Changed
Public chat uses a wp_rest nonce so WordPress cookie authentication no longer returns "Cookie check failed".
Every chat request sends the current page URL and document title. Page resolution now handles fragments, www, the static front page, and path fallbacks. Retrieval prefers chunks from that post.
Settings and Q&A admin spacing is looser: larger section padding, field gaps, and a clearer import panel.
