WingPilot changelog — earlier versions

The latest versions are listed in readme.txt.

= 1.5.18 =

* The copy of WingPilot downloaded from getwppilot.com now gets its updates through WordPress like any other plugin: a new version shows under Plugins and Dashboard → Updates with its details and changes, can be updated with one click, and is installed automatically if you turn on auto-updates for it. Before, that copy never heard of a newer version. The copy from the WordPress.org directory is updated by WordPress.org, as before.

= 1.5.17 =

* WPPilot now reads each plugin's own description from your site, so when it tells you which plugin does a job (spam filtering, backups, caching) it goes by what the plugin says it does rather than guessing from its name.
* WPPilot can now tell where the title search engines show for a page comes from: your SEO plugin's own title field, or — with no SEO plugin — your site title and tagline on the homepage (and its translations under Polylang or WPML) and the page's name elsewhere. It changes the search title only in Yoast SEO's or Rank Math's own field, and never renames a page when you asked about its search title.
* When another SEO plugin (such as SEOPress or The SEO Framework) prints its own descriptions, WPPilot now says so instead of saving a meta description that would never appear.

= 1.5.16 =

* When you ask WPPilot about enquiries or leads, it can now see your Elementor Pro forms: whether each one keeps its enquiries in Elementor → Submissions or only emails them, how many it has kept, and whether Elementor recorded their notification emails as sent. Only counts are read; your visitors' details stay on your site.
* WPPilot can now tell whether your site sends email through a mail (SMTP) plugin or through WordPress's built-in mailer, which many hosts silently drop, so it can warn you before a form relies on email alone. Nothing is sent to check.

= 1.5.15 =

* WPPilot can turn comments (and, if you ask, pingbacks) on or off for the posts and pages you choose — the "Allow comments" setting WordPress keeps on each one. Each post is checked again just before it changes, anything you changed yourself in the meantime is left alone, nothing else on the post changes, and undo puts every post back.

= 1.5.14 =

* A plugin that no update channel knows about is now reported as "unknown" for updates, instead of looking as if it were already on its latest version.
* Single-file plugins such as Hello Dolly are reported under their real name (hello-dolly) instead of ".".
* The plugin list WPPilot reads now includes each plugin's author, author and plugin web addresses and Update URI header, and also lists must-use plugins and drop-ins, so WPPilot describes everything that runs on your site.

= 1.5.13 =

* WordPress 6.9 and later: WPPilot's abilities are registered under their own "WPPilot" category, as WordPress now requires. Before, WordPress refused them with a notice for each one, and on a site showing PHP notices that text could break WPPilot's reading of the site. Nothing printed while one of the plugin's REST routes runs can reach its response any more.
* Your admin email address is no longer put in the web address when you open WPPilot. It travels in the body of the plugin's request to WPPilot instead, and WPPilot proposes it only while no account owns the site.
* The WPPilot page opens promptly when WPPilot is slow or unreachable: each request waits at most 5 seconds, a backend that just failed to answer is not asked again for a minute, and the page shows the last status it received, marked as such, instead of "Connected".
* When connecting fails, you are told what to do in plain words (for example, that a security plugin or firewall is blocking /wp-json/, or that the site must be reachable from the internet) instead of an error code. The technical detail is still there, folded away, for support. Connecting, including every step, never keeps the page waiting more than about 25 seconds.
* The activity list on the WPPilot page no longer describes your own uploads or other plugins' file changes as WPPilot's work.
* Deleting the plugin now removes everything it stored, including cached status and rate-limit entries, on every site of a multisite network. Your leads, and images WPPilot copied into your media library, are kept.
* The readme now lists every external service the plugin uses, including the image hosts approved stock photographs are downloaded from and what comment moderation sends.

= 1.5.12 =

* WPPilot can tell whether Elementor Pro is active, so a form it adds to your Elementor page or template is Elementor's own form only where your site has it.
* On a site translated with Polylang or WPML, WPPilot sees the other language versions of a page, template, header or footer, and tells you when a change reaches only one of them.

= 1.5.11 =

* Right after you activate the plugin, the "Connect this site" card is the first thing on the WPPilot page; other plugins' notices now appear below it rather than above it.
* Until this site is connected (or while it is connected but not yet linked to your WPPilot account), a short notice on the Plugins screen and the Dashboard leads to the WPPilot page. Only administrators see it, and each can dismiss it for good.

= 1.5.10 =

* When a CDN or firewall in front of your site (for example a bot check from Cloudflare, StackCDN, Sucuri or your host) turns away WPPilot's request for one of your public pages, WPPilot can now ask this plugin for it instead. The plugin requests the page from your own site exactly as an anonymous visitor would — no login, no cookies — and returns its HTML, so WPPilot can still check your forms, contact links and buttons and see how the page looks. It reads only published, public pages of your own site: never wp-admin, the login page, previews, feeds or password-protected content. WPPilot never tries to solve or get around a bot check.

= 1.5.9 =

* Before WPPilot proposes a change to an Elementor template or form, it knows where that template or form appears: which content types a template's display conditions cover (with how many published and draft items), and which pages, posts or other templates embed it. The change card says it in plain words, and WPPilot writes wording that is true on every one of those pages.

= 1.5.8 =

* WPPilot can fix your site's own Elementor forms and templates, not only pages: a MetForm form (for example, a reCAPTCHA field with a placeholder key that stops every enquiry) or an Elementor template shared by many pages (for example, placeholder text in the layout every tour or product page uses). Each change is shown to you first, says when it affects every page that uses the form or template, and can be undone.
* After such a change, the plugin also clears the site-wide page cache of supported cache plugins, so every page showing that form or template is refreshed — not only the template's own address.
* WPPilot never writes the Elementor layout of code snippets, form submissions, leads or WordPress's internal records.

= 1.5.7 =

* WPPilot no longer reads a plugin or theme as up to date when WordPress's update check did not finish, or was made while a different version was installed (for example, just after an update was undone). It says the update status is unknown instead.

= 1.5.6 =

* The WPPilot page shows one connection status at a time — connected, not linked to an account yet, needs reconnecting, temporarily unreachable, or not connected — instead of several that could contradict each other.
* Reconnect finishes in one click and always tells you what happened: reconnected, or why it could not, on the WPPilot page itself.
* "Finish connecting to WPPilot" and "View Site Briefing" now work with JavaScript or pop-ups blocked: the plugin prepares the secure sign-in itself and takes you there.
* When WPPilot keeps refusing this site's activity updates, the plugin waits longer between attempts and, after three refusals in a row, stops sending and asks you to reconnect, instead of retrying every few seconds for ever. Sending resumes once you reconnect.
* Activity updates are sent after your page has already been delivered (or from a WordPress background task when the server cannot do that), so they never slow down a page for you or your visitors.

= 1.5.5 =

* WPPilot can help you clear your comment moderation queue. It reads the comments waiting for approval (an author's email address stays on your site; only its domain is read) and, when you approve the change, marks the ones you agree are spam as spam, moves them to the trash or approves them, using WordPress's own moderation functions so Akismet learns from it when active. A comment you already handled in wp-admin is left alone. Nothing is ever permanently deleted, and the change can be undone, putting every comment back where it was.

= 1.5.4 =

* When WPPilot moves your site's images, links and menu items off a temporary or staging address onto your live address, it now also rebuilds Elementor's generated styles and the Google Fonts Elementor stores on your site, so they too load from your live address instead of the old one.

= 1.5.3 =

* WPPilot can remove a form that is no longer on any page, when you approve it. Before removing one, the plugin checks every page, post, template and widget for the form and refuses if it is still used anywhere or has received a message in the last 30 days. Messages the form already received stay under **WPPilot → Leads**, and the removal can be undone.

= 1.5.2 =

* Pages with a WPPilot meta description no longer also carry your theme's own description (Hello Elementor printed a second one from the page excerpt). Search engines now see one description per page.

= 1.5.1 =

* Site activity reaches WPPilot reliably again. The plugin now renews its sign-in to WPPilot each day; before, once that sign-in lapsed, activity from your site was turned away and the activity feed went quiet.

= 1.5.0 =

* Contact and quote forms that work. Ask WPPilot for a page with a form and the form now actually sends: each message is emailed to the address you choose and also saved under **WPPilot → Leads** in wp-admin, so a message is never lost even if your site's email fails. Forms take on your theme's fonts, colours and button style, and work on cached pages.
* Spam protection without puzzles for your visitors: a hidden trap field, a minimum time to fill in the form, and a limit on how often one visitor can send it.
* On sites built with Elementor, WPPilot can now create a new page as a real Elementor page that you can open and edit in Elementor, keeping your site's header and footer.
* Leads are kept on your site. They are not sent to the WPPilot service, and they stay in wp-admin even if you delete the plugin; only the form settings are removed.

= 1.4.9 =

* A meta description you approve in WPPilot now appears on your page when no SEO plugin is active. Before, it was saved but not shown to search engines. With Yoast SEO, Rank Math or All in One SEO active, that plugin still shows it, as before.

= 1.4.8 =

* Security scans work on hosts whose firewall blocks server paths in web addresses. The scan's progress marker no longer contains your server's folder layout, so the second page of the file list is no longer refused.
* Other plugins' notices now appear above the WPPilot settings card instead of inside it.
* Read-only: this release adds no new way to change your site.

= 1.4.7 =

* Security scans no longer miss files. The list of files the scan checks is sent in pages, and one file at the boundary of every page was being left out; every file is now listed. If a file is deleted while the list is being read, the scan now knows and starts the list again instead of treating a partial list as complete.
* Read-only: this release adds no new way to change your site.

= 1.4.6 =

* WPPilot can now see every theme installed on your site, not only the active one — with whether it is active, whether your active theme depends on it, and whether an update is waiting. Asked which themes are safe to remove, it can answer from your site instead of a rule of thumb.
* Read-only: this release adds no new way to change your site.

= 1.4.5 =

* After a menu change, WPPilot now checks whether something in front of your site is still serving the old menu, and says so. A cache your host runs outside WordPress cannot be cleared from inside it, so the honest answer is that the change is live on your site and the cached copy may last until it expires or you clear it from your hosting control panel.
* Read-only otherwise: this release adds no new way to change your site.

= 1.4.4 =

* A menu change now reaches your cached pages. A menu is on every page, so the per-page cache purge that follows a content edit could not reach it; the relabelled item showed in WordPress while visitors kept seeing the old menu for as long as the cache allowed. The plugin now announces the menu save the way the Menus screen does, and asks every cache plugin that can clear the whole site to do so.
* Read-only otherwise: this release adds no new way to change your site.

= 1.4.3 =

* Tells WPPilot which WordPress permissions it checked, not only which ones you hold. Editing a menu needs a permission the earlier check never asked about, so WPPilot believed every site lacked it and would not rename a menu item. The check now covers every permission a WPPilot change can need.
* Read-only otherwise: this release adds no new way to change your site.

= 1.4.2 =

* After WPPilot changes a page, your host's page cache now learns about it. A page-builder edit is stored as page data, which never told WordPress "this post was saved" — so a host cache (the kind your hosting company runs for you, not a plugin you installed) kept serving the old page for as long as it was allowed to. The plugin now announces the save the way the editor does, which is what those caches listen for.
* Read-only otherwise: this release adds no new way to change your site.

= 1.4.1 =

* Tells WPPilot whether a cache is actually wired into your site — the WP_CACHE setting, the advanced-cache and object-cache drop-ins, and your must-use plugins — instead of leaving it to guess from the plugin list. A cache your host installed lives outside that list, and WPPilot was advising a site with a working page cache to install one.
* Read-only: this release adds no new way to change your site.

= 1.4.0 =

* Lets WPPilot read a page the way it is actually stored. Page builders keep a page's layout in its own data rather than in the WordPress content field — Elementor, Beaver Builder, Bricks and others each in their own way — and WPPilot could only read the ones it had been specifically taught. It can now read a post's own stored data directly and work out the rest itself, so a builder or plugin it has never met is no longer a blind spot. Keys and values that look like credentials are removed on your site before anything is sent, and WPPilot is told a value was removed rather than shown a blank.
* Lets WPPilot see the facts your Site Health screen shows — PHP and database versions, memory and upload limits, caching, cron, free disk and total database size — so "why is my site slow?" can be answered from evidence instead of guessed.
* Read-only: this release adds no new way to change your site.

= 1.3.0 =

* Tells WPPilot what is out of date. Your site already knows which plugins, themes and WordPress core have updates waiting — WordPress checks for you and keeps the answer — but this plugin never sent it. WPPilot was left reasoning about staleness from a version number alone, and could tell you a theme was current while your own Updates screen showed a newer one. Each plugin and theme now reports whether an update is available and which version is offered, and "never checked" is reported as unknown rather than as up to date.
* Sends a post's publish date and author alongside what it already sent, so a question like "my posts from 2024" or "the pages Ana wrote" can be answered from the same read instead of guessed.
* Recovers when your site and your account disagree about being connected. If the backend no longer recognises this site, the screen used to keep saying "Connected" with no way to try again. It now notices the rejection and offers to reconnect. A backend that is merely unreachable is never mistaken for a revoked connection.
* Read-only: this release adds no new way to change your site.

= 1.2.1 =

* Names your plugins in your site's own language. WPPilot reads your plugin list through this plugin, and WordPress translates each plugin's name for whoever is asking — so on a German site WPPilot could report "Payment Plugins for PayPal WooCommerce" while your own Plugins screen says "Zahlungs-Plugins für PayPal WooCommerce". The list is now read in your site's language, whoever asked for it. Read-only; adds no new way to change your site.

= 1.2.0 =

* Lists your pages and posts in pages of their own, so WPPilot can see all of them. Sites with more than fifty items were reported as if the first fifty were everything, and WPPilot could tell you a page did not exist when it did. A listing now says whether more remains and where to continue from, and asks for the rest instead of assuming there is none.
* Read-only: this release adds no new way to change your site.

= 1.1.2 =

* Tells WPPilot exactly which of its endpoints this build of the plugin serves, so your account knows what it can do here instead of guessing from a version number. The report lists this plugin's own registered endpoints and nothing else — no additional site content or personal data. When something is genuinely not available on your site yet, you are told to update the plugin rather than sent to look for a security plugin that was never blocking anything.
* Corrects the 1.1.1 note below: that release did add a writable surface — the in-place text editing used for Beaver Builder and Bricks pages. Every write still goes through preview, your approval, and rollback.

= 1.1.1 =

* Reports whether a WPPilot Advanced Actions module is present on this site, so your WPPilot account can tell you truthfully what it can and cannot do here.
* Read-only and passive: this plugin does not install, download, activate or verify anything, and adds no new writable surface.

= 1.1.0 =

* Security scanning no longer sends your configuration files. File contents are now transmitted only from WordPress core, plugin, theme and must-use-plugin directories — distributed software that holds no secrets of yours. `wp-config.php`, `.htaccess`, your uploads and every data file are inspected on your own server instead, and only the finding is reported, so database credentials and security keys never leave the site. Previously these files were sent in full.
* Files whose contents stay local are still fingerprinted and still checked for injected code, so a tampered configuration file is still detected and reported.
* Private keys, certificates, database dumps, archives, `.env` and `.htpasswd` are never read for content.
* Removed the database-content scanning endpoint. It could return the values of every autoloaded WordPress option, which is where other plugins keep their own API keys, and nothing used it.
* Hardened scan path containment so a request can no longer reach outside the WordPress directory by way of a similarly named sibling directory or a symbolic link.
* Opening the WPPilot cockpit or your Briefing from wp-admin now signs you in securely and lands on the page you asked for, instead of sometimes stopping at a sign-in screen that asked you to paste your site secret.
* A WordPress administrator is no longer assumed to be the WPPilot account holder. Account access requires a WPPilot sign-in that establishes the link once; the site's admin email address is never used to guess who somebody is.
* Replaced the "Since connecting" counters, which were not measuring what they claimed. The admin screen now shows the site's real recent WPPilot activity, and says plainly when the service cannot be reached instead of reporting zero.

= 1.0.16 =

* Accepts the details block, so a page or post containing an FAQ can be saved. Previously such a draft was prepared, reviewed and approved, and then refused at the moment of writing.
* Keeps the details and summary markup intact on save, so an accordion is not quietly flattened into loose text on older WordPress versions.
* Copies images in approved content into your own media library, so a published page owns its pictures instead of linking to a third-party service for ever.
* Reports each object's registered type when content is read, so content added to a custom post type is written to the right surface.

= 1.0.15 =

* Says explicitly when a request is refused because the site no longer recognises WPPilot, so a broken connection is never confused with a permission WordPress declined for that one operation.
* Tells WPPilot the pairing has ended when the plugin is deleted, so the site is not left listed as connected.

= 1.0.14 =

* Adds a read-only theme-style endpoint so generated content can be composed in the active theme's own palette, typography and layout instead of an invented one.
* Reports which core blocks and block styles this WordPress registers, so generated content only uses blocks the editor recognises.

= 1.0.13 =

* Adds explicit publication-status support when creating prepared content.
* Reads back the created post status so unsupported plugin contracts cannot be reported as successful.

= 1.0.11 =

* Supersedes 1.0.10 with menu inspection and guarded editing endpoints for existing menu items.
* Adds menu and menu-item fingerprints so stale or structurally moved items are refused instead of edited.
* Supports relabeling existing items and repointing existing custom-link items; adding, removing, reordering, nesting, and menu assignment changes remain unsupported.
* Reads back the stored WordPress menu item after every write.

= 1.0.10 =

* Fixes Elementor reads when WordPress returns `_elementor_data` as a deserialized PHP array: arrays are re-encoded as JSON, while unsupported or unencodable values are refused instead of being string-cast to `Array`.
* Removes the 1.0.9 slash-unslashing fallback. Production diagnosis showed the live failure was the unsafe PHP array cast, not slash escaping; the earlier fallback could not repair that class of corruption.
* Applies safe postmeta conversion to the remaining metadata readers so array-valued filters or migrations cannot silently become the string `Array`.

= 1.0.9 =

* Adds explicit ordering direction and status filtering to content queries, including filtered search for drafts and other non-published content.
* Preserves each site's registered post-type labels and supports custom post types in content discovery and progress reporting.
* Added a provisional slash-escaped Elementor `_elementor_data` fallback. This was superseded in 1.0.10 after production diagnosis showed the actual failure was an unsafe PHP array cast, not slash escaping.

= 1.0.7 =

* Add post permalinks to content responses for direct page links in the app.

= 1.0.6 =
* Adds capability-detected layered cache purging after successful content writes and a one-time redirect to the WPPilot connect page after activation.

= 1.0.5 =
* Adds draft page and post creation support, capability checks and structure-aware validation for content writes, plus an automatic compatibility migration for existing connections.

= 1.0.4 =
* Content search now matches a page or post by its URL slug (not just its title), with fuzzy word matching, so naming a page by its address — or the closest thing to it — finds it.

= 1.0.3 =
* Content search now includes your unpublished work (drafts, pending, scheduled, private) so a page or post you just created is findable the moment you name it in chat.

= 1.0.2 =
* New REST endpoints for surgical, reversible builder edits: Elementor page content (`_elementor_data`) and image alt text (`_wp_attachment_image_alt`).
* All new endpoints use capability + callback-token permission checks, sanitize input and escape output — no direct file writes.

= 1.0.0 =
* Initial public release.
* Site connection with per-site cryptographic secret and JWT authentication.
* One-click "Connect to WPPilot" authorize handoff (single-use, short-lived token), with manual site-secret paste as a fallback.
* Account creation on connect: confirm or change your admin email, set a password (or use magic-link login).
* Multi-site cockpit at app.getwppilot.com — manage all your WordPress sites from one place.
* The Briefing: 60–90 second AI-generated, magazine-quality site analysis.
* Conversational actions with preview/approve/rollback: title rewrites, meta description rewrites, excerpt rewrites, body content edits (anchored find-and-replace), and post status changes.
* Page builder detection (Elementor, Divi, Beaver Builder, WPBakery, Brizy, Oxygen) with graceful refusal and manual-edit guidance.
* Watchtower monitoring with severity-tagged findings surfaced in the cockpit.
* Admin settings page with connection status, site secret display, and emergency disconnect.
* REST API endpoints for backend content access (posts, pages, metadata, status).
* Heartbeat system for ongoing site health monitoring.
* Abilities API integration (WordPress 6.9+) with graceful degradation.
* SEO plugin detection (Yoast, Rank Math, All in One SEO, SEOPress, The SEO Framework).
* Full WP.org Plugin Check compliance (0/0 errors/warnings).
