Functionalities Plugin Changelog

Lesson 17 of 18 1 min read
  • JNext lesson
  • KPrevious lesson
  • FSearch lessons
  • EscClear search

This is the complete Dynamic Functionalities changelog, from the first public release to the current version 1.6.1. I keep it honest: security fixes are labeled as security fixes, and breaking changes are called out as such.

The short version of the plugin’s history: 1.0 shipped 15 modules and a modern dashboard, 1.1 made everything free and renamed the plugin for WordPress.org, 1.2 switched every module to off-by-default, and the 1.3 and 1.4 series were about WordPress 7 editor compatibility, fonts, and hardening. 1.4.8 added the tooling layer, 1.5 brought the WordPress 7 integrations, and 1.6 was the security and correctness pass.

1.6 Series

Version 1.6.1

  • Fixed: the WordPress 7 data panel no longer appears for a module that is switched off. With Redirect Manager disabled its page still rendered 2 empty tables and a working Add redirect form, and the module refuses every write while disabled, so the form could only produce an error
  • Fixed: the Performance & Cleanup settings page was headed “Miscellaneous (Bloat Control)”, which matched neither the module card you clicked nor any other name in the interface
  • Fixed: Link Management’s JSON preset filter note now matches the format every other filter note uses
  • Changed: the “WordPress 7 workspace” heading is gone; its tables already carry their own headings, and naming a section after the WordPress version labeled the implementation rather than the thing you are looking at
  • Changed: the dashboard box holding the AI opt-in is now called “AI explanations”, after the single setting it contains, instead of advertising 4 platform features that are not configurable there

Version 1.6.0

  • Security: Abilities API operations now use a permission callback per ability and reject undeclared input properties. A shared callback previously widened to edit_post whenever a request carried a post_id, so any user who could edit 1 post could toggle modules, create redirects, create tasks, and trigger scans
  • Security: redirects, the bounded 404 log, and Task Manager projects moved to a private folder with a random name under wp-content/functionalities/. Existing files migrate automatically, Apache, IIS, and directory-listing rules are written alongside them, and a Site Health check confirms over HTTP that the folder really is unreachable
  • Fixed: header and footer snippets are no longer re-filtered against the visitor’s capability at output time. Anonymous visitors were receiving mangled code, with && and comparison operators eaten, while the logged-in administrator saw the snippet work. Filtering now happens once, at save time, against the author’s capability
  • Fixed: a JSON exception preset served from a URL is fetched at most once per cache window instead of on every page load, the cache clears on settings, post, and theme changes, and the last good list is kept when a fetch fails
  • Fixed: the bulk nofollow tool pages through posts with an ID cursor and finishes on sites with more than 100 matches, instead of returning the same first batch on every run
  • Fixed: settings export no longer redacts the GA4 measurement ID as if it were custom code
  • Fixed: core icons get the same definition-ID prefixing as custom icons, so 2 gradient icons on 1 page no longer collide
  • Improved: Link Management, Block Cleanup, and Schema use the WordPress HTML API instead of DOMDocument. Attributes are edited in place, so Vue, Alpine, and mustache syntax survive untouched and the JS-framework skip guard from 1.4.3 and 1.4.4 is gone. Content that used to be skipped is now processed correctly
  • Improved: redirects run at parse_request, before WordPress queries the database for a page it is about to discard, and its own entry points are never redirected
  • Improved: redirect hits and 404 aggregates are buffered and written in batches rather than rewriting the whole JSON file under an exclusive lock on every request
  • Improved: the Content Integrity column on the posts list reads a result cached at save time instead of rendering and parsing every row on every page load
  • Improved: the SVG icon library is stored without autoloading, so full SVG markup no longer loads on every request
  • Improved: Login Security adds per-username throttling, an IP allowlist, an unlock button on the lockout log, and a warning when every recent lockout shares 1 address, which is the signature of a site behind a CDN
  • Improved: the service worker skips wp-admin, the login page, REST responses, cross-origin requests, and anything marked no-store or private, caps the runtime cache, and precaches URLs individually so 1 stale entry cannot stop it installing
  • Improved: Performance & Cleanup makes the revision limit configurable, and disabling Heartbeat applies to the frontend only unless the new admin option is also enabled, so autosave and post locking keep working
  • Improved: Prism.js is bundled with the plugin instead of being loaded from a third-party CDN
  • Improved: Content Integrity and Assumption Detection gained the filters their documentation promised, and the module documentation now lists hook names that exist. 19 documented hooks were never fired
  • Changed: tested up to WordPress 7.1

1.5 Series

Version 1.5.0

  • Added: WordPress 7 Abilities API operations for module status, privacy-safe diagnostics, assumption scans, content-integrity checks, redirect import previews, redirect creation, task creation, module toggles, and opt-in AI explanations
  • Added: DataViews and DataForm workspaces for Redirect Manager, its bounded 404 activity, and Task Manager, with searchable, sortable, filterable tables and modern creation forms, keeping the classic interfaces as fallbacks
  • Added: Command Palette actions for opening Functionalities screens and running an Assumption Detection scan
  • Added: explicitly opt-in AI explanations powered by the WordPress AI Client. Only a finding submitted by an administrator is sent to the configured provider
  • Improved: SVG Icon block upgraded to Block API v3 with WordPress core icon support, two-way core icon transforms, pattern-override-ready content attributes, block bindings, and an Icon Callout pattern
  • Fixed: Content Integrity uses the current wp.editor plugin-sidebar components on WordPress 7 while retaining the legacy fallback
  • Fixed: custom font declarations are emitted with their preloads, so first-paint typography does not shift when async theme styles arrive
  • Changed: minimum WordPress version is now 6.3, so the SVG Icon block can use Block API v3 consistently. WordPress 7-only integrations remain feature-detected

1.4 Series

Version 1.4.8

  • Added: true lazy module registry; a frontend request with every module disabled loads no feature class files, and enabling one module loads only that feature and its shared dependencies
  • Added: versioned settings export and import with dry-run difference previews, module validation, and custom code redacted from exports unless you explicitly opt in
  • Added: privacy-conscious diagnostics download covering software versions, enabled modules, writable-path status, and rewrite-rule health; task content, redirects, users, secrets, and site URLs are excluded
  • Added: redirect CSV import and export with common column aliases, all-or-nothing dry runs, and duplicate, wildcard, loop, and chain validation
  • Added: opt-in bounded 404 monitor with retention limits, row caps, path exclusions, bot and admin filtering, referrer-origin-only storage, and purge, ignore, and redirect-prefill actions
  • Added: Assumption Detection Site Health status, configurable scheduled scans, and opt-in deduplicated email summaries
  • Added: Content Integrity snapshot diffs for links, headings, H1s, and word count
  • Improved: SVG Icon block rebuilt on block metadata with lazy paginated icon loading, px/em/rem sizing, original-color and monochrome modes, accessible labels, and missing-icon recovery
  • Security: SVG sanitization now requires a real SVG root, restricts style attributes and local references, blocks external href values, and prefixes definition IDs to prevent collisions
  • Fixed: fresh PWA settings register rewrite endpoints immediately, and the offline shell returns a cacheable response so service-worker precaching completes
  • Fixed: Task Manager and Redirect Manager JSON updates now use file locking and atomic replacement, so concurrent writes can’t lose data
  • Changed: admin bootstrap split into a small router with dedicated module, portability, and Site Health controllers

Version 1.4.7

  • Added: the block editor canvas receives explicit font-family rules when “Assign fonts to body text and headings” is enabled, so the editor matches the front end even when theme.json assignment doesn’t reach the iframe
  • Fixed: custom fonts now render inside the iframed block editor; @font-face is injected through the editor styles setting, the same channel the Font Library uses
  • Fixed: variable-font weight ranges with an out-of-spec low bound like 1 900 are normalized to 100 900 instead of being silently dropped by WordPress
  • Fixed: Components CSS reaches the block editor canvas reliably in WordPress 7
  • Changed: removed the redundant admin_head font print, superseded by the editor styles channel

Version 1.4.6

  • Added: per-font unicode-range support with quick-pick presets (Latin, Latin Extended, Greek, Cyrillic, Vietnamese, Punctuation/Symbols), also emitted into theme.json
  • Security: Login Security no longer trusts X-Forwarded-For or Client-IP headers by default; they were spoofable, allowing lockouts to be evaded or weaponized. A “Trust Proxy Headers” opt-in covers CDN and reverse-proxy setups
  • Security: client IPs from proxy headers are validated with FILTER_VALIDATE_IP
  • Fixed: Block Cleanup XPath escaping, Snippets placeholder collision, Fonts admin badge and cache invalidation, Task Manager AJAX registration and card layout, Help & Support button styling under WordPress 7

Version 1.4.5

  • Added: WOFF and WOFF2 font uploads in the media library
  • Security: font uploads validated via binary magic-byte signatures

Version 1.4.4

  • Fixed: Schema and Block Cleanup now skip content with Vue or Alpine.js directives, preventing DOMDocument from corrupting JS framework templates
  • Refactored: shared Vue-safe guard trait used by all three the_content filters that parse the DOM

Version 1.4.3

  • Fixed: Link Management skips HTML containing Vue directives like v-if and @click; DOM re-parsing was corrupting reactive templates in themes like MyListing

Version 1.4.2

  • Fixed: wp_kses preserves data-*, async, defer, nomodule, id, nonce, crossorigin, and as attributes in header and footer snippets

Version 1.4.1

  • Added: opt-in “Delete all plugin data when uninstalling” checkbox on the dashboard
  • Fixed: all file writes moved to the WP_Filesystem API; removed sslverify => false from Assumption Detection loopback requests

Version 1.4.0

  • Added: Bricks Builder font integration
  • Added: PWA module prefills app details from WordPress settings and the Site Icon
  • Improved: Task Manager UI redesign with a card-based project grid

1.3 Series

Version 1.3.3

  • Improved: Snippets UI with collapsible cards, type badges, and inline label editing

Version 1.3.2

  • Added: snippets repeater, multiple independently-toggleable snippets per location
  • Removed: legacy GT Nofollow Manager references and gtnf_* filters

Version 1.3.1

  • Added: public Link_Management::process_content() helper for ACF fields and custom templates
  • Improved: Redirect Manager query-string handling, O(1) exact lookup, deferred hit counters, and redirect loop detection

Version 1.3.0

  • Added: WordPress 7 iframed editor compatibility for Fonts, SVG Icons, Content Regression, and Components
  • Tested: up to WordPress 7.0

1.2 and Earlier

Version 1.2.0

  • Changed: all 16 modules now require explicit activation; no module runs code until enabled

Version 1.1.1

  • Fixed: escaping compliance and WordPress.org packaging issues

Version 1.1.0

  • Renamed: to Dynamic Functionalities for WordPress.org
  • Changed: all features free and open source; removed licensing module and premium barriers
  • Added: Progressive Web App module

Version 1.0.0 (February 2, 2026)

  • Initial release with 15+ modules and the modern dashboard UI

Following Releases

The latest version notes always ship with the plugin and on the Functionalities product page. For what each module does today, start at the Dashboard Overview lesson or jump to the Technical Reference.