What shipped, and when.

What changed on devdome.com and analytics.devdome.com. Plugin releases follow below.

1. October 8, 2026
   • Stats API docs and MCP docs now match the code: which endpoints take days only, DELETE answers 409 without purge, POST sites returns the verification file, bots takes a limit, incidents page with limit and before, the per-IP limiter is documented.
   • Stats API: /referrers keeps the x-dd-effective-window header cross-origin, /bots honours limit, /health forwards days, /incidents forwards limit and before. MCP: get_visitors takes from and to, get_bot_report takes limit.
2. October 7, 2026
   • Connect hand-off survives the email code and the email link: after signup you return to the site that started the connection.
   • Footer lists every released plugin, derived from the catalog.
3. October 2, 2026
   • Security routes and the public API hardened after an independent review: per-IP limits on key-cache misses, fail-closed cron routes, no upstream error text on public answers.
   • Country Blocker product page and docs.
4. September 30, 2026
   • Billing: an in-place upgrade charges at most once, refunds are one database transaction, a pending-payment notice is mailed when the payment provider has not answered within 15 minutes.
5. September 24, 2026
   • MCP server: every tool carries a title and read-only / destructive hints, as required by Claude connectors and the ChatGPT app review.
6. September 20, 2026
   • Dashboard Bot Protection and Threat Detection: the plugin’s on / off, pause, six rule actions and custom rules travel both ways between the dashboard and the site; the site’s own daily totals (caught by your rules, visits from bots, visits from people).
7. September 15, 2026
   • Analytics: referrals from AI assistants (ChatGPT, Perplexity, Claude and others) are classified as their own source.
8. September 5, 2026
   • MCP server published: public README, server.json and MIT licence at github.com/DevDomeFamily/devdome-mcp; listed in the official MCP Registry.

Current: v1.3.16 · updated October 22, 2026

1. v1.3.16 October 22, 2026
   • Verdict gate: a code-pattern finding on a file of an installed plugin or theme, a Composer library, a DevDome plugin, a must-use plugin your hosting platform installs, or a media, document or archive file is a review note (LOW or INFO), never a threat. A known-malware match or a strong signal (decoded payload executed, request input reaching exec or include, executable in uploads, auto-prepend directives) keeps its full severity. Seen on real sites: Gravity Forms and WPBakery code rated HIGH, a WP Engine must-use plugin rated CRITICAL, videos and backup archives flagged for a backtick.
   • A benign verdict from the DevDome cloud analysis now lowers a pattern-only finding to a review note; before it only added a line while the finding stayed HIGH (Gravity Forms common.php).
   • Trusted local baseline: a plugin, theme or must-use file an earlier scan already judged and that has not changed since is not analysed again (premium plugins, firewall plugins and hosting must-use plugins stop producing the same notes scan after scan). New, modified and first-seen files, everything outside those folders, and every file after a rules or signature update are scanned as before; the malware hash lookup still covers every file.
   • A file of a bundled default theme (Twenty Twenty-Five and the others WordPress ships) that matches the WordPress core checksum list is no longer reported as modified: the theme zip on WordPress.org is built separately from the copy WordPress installs and can differ in content.
   • An unknown PHP file inside a WordPress.org plugin folder that is identical to a file of an older release of the same plugin is reported as a leftover of an in-place update (Low review note with the release it belongs to), not as an unknown file (High). The list of releases comes from the WordPress.org plugin information API and is cached for a week.
   • The One click fix ability is annotated destructive for MCP clients, so they ask before running it. It still moves every file it touches to quarantine first.
   • A finding about a new must-use plugin, drop-in or administrator now closes itself when the file is removed or the account is deleted or demoted; it comes back if the object returns. Before, it stayed open until you clicked.
   • Shared DevDome library 1.7.17: the connect beacon’s flood guard counts an IPv6 visitor per /64 network, and the one-click install of another DevDome plugin verifies the downloaded package against the published checksum before installing.
2. v1.3.15
   • Scheduled scans no longer stall on a large backup archive or database dump that carries PHP: the check whether such a file could run as PHP now stops at the scan batch deadline, a large non-PHP file is pattern-checked in its first megabyte only and reported as partially checked, and the clock is read between the pattern passes so one batch can no longer overrun its budget by a whole megabyte.
   • The code analysis no longer slows to a crawl on a very long line full of escaped quotes (a database dump line, a serialized settings blob): one megabyte of such text took 99 seconds and now takes a fraction of a second.
   • The next scan batch is queued before the current one starts, so a worker that is cut off by a time limit no longer ends the scan; the following batch picks the scan up.
3. v1.3.14
   • A dismissible note at the top of the settings page mentions the free DevDome Analytics plugin, with a button that opens the plugin installer (or the Analytics screen when it is already active). Dismiss hides it for good.
   • Shared DevDome library 1.7.13: uninstalling the last DevDome plugin also removes the note’s dismissal, the update-repair records and the per-user “Report a bug” flag; the visitor-beacon flood guard keeps one short-lived record per address and clears its expired ones itself, and behind Cloudflare it counts per visitor instead of per Cloudflare address.
   • Nine code shapes from a real October 2026 break-in (a REST exploit that planted fake plugins, a lock360 re-infector and a fleet-wide index.php) are now recognised: function names assembled from string offsets and then called, variables named by escaped literals, a file that reads and decodes its own source, a password gate on a request key, a dispatch table built with strrev or join, errors silenced together with the time limit removed, a folder taken from the request and browsed, a remote address hidden in base64, and a visitor profile collected from the server variables and sent away. Every planted file from that incident now scores HIGH or CRITICAL; before, most scored LOW or were not reported.
   • A request-driven file write in a file under 4 KB that does not use WordPress at all counts as a dropper. A small settings editor behind a capability and nonce check keeps its ordinary score.
   • A PHP file that sits directly in the site root without being part of WordPress (the attacker’s admin.php next to wp-load.php) is reported, the same way an unknown file inside wp-admin or wp-includes is.
4. v1.3.13
   • Old plugin copies that an UpdraftPlus restore keeps under wp-content/updraft/plugins-old are checked against their own release on WordPress.org when its checksum list is available: a file with the same path and the same bytes as that release is no longer reported as suspicious code (two high and eight medium alarms on one site came from old Kadence Blocks and WP-Optimize copies, among them extension-less Composer bin files).
   • A must-use plugin file that newly appears and is identical to a file the old copy still holds from its release is a low note naming the plugin, the same as for an installed plugin (Burst Statistics places burst_rest_api_optimizer.php this way).
5. v1.3.12
   • The report dialog (Report false alarms, Send scan report) prefills your e-mail with the site admin address so we can answer; clear the field to send without one.
   • The readme now carries an Upgrade Notice, so the Plugins page of an older install says what a new version fixes.

Current: v1.0.2 · updated October 16, 2026

1. v1.0.2 October 16, 2026
   • A dismissible note at the top of the settings page mentions the free DevDome Analytics plugin, with a button that opens the plugin installer (or the Analytics screen when it is already active). Dismiss hides it for good.
   • Shared DevDome library 1.7.13: uninstalling the last DevDome plugin also removes the note’s dismissal, the update-repair records and the per-user “Report a bug” flag; the visitor-beacon flood guard keeps one short-lived record per address and clears its expired ones itself, and behind Cloudflare it counts per visitor instead of per Cloudflare address.
   • Fixed: when the plugin’s settings table is missing although the storage was stamped as current (for example after a database restore), the stamp is dropped so the next load rebuilds the tables instead of failing on every request.
2. v1.0.1
   • Changed: every markup fragment printed from a variable (the Report this error button, the severity and state badges, the proposed-value attributes) now goes through an escaping function at the point of output, and the admin page is printed directly instead of being buffered and echoed.
   • Changed: the directory listing title is the plugin name.
3. v1.0.0
   • Added: WordPress Abilities API (6.9+) with eleven abilities (status, settings, filtered events, recent activity, one user’s activity, login events with the failed-login picture, plugin / theme / core changes, events worth reviewing, update settings, run purge, repair storage), listed on the WordPress MCP Adapter; every read is recorded like a screen read and every write keeps the screen’s capability and confirmation rules.
   • Added: a request-wide database guard: a failed query inside a save, purge, repair, page render or ability ends that action with a database error and a “Report this error” button, never with “Saved.” or a calm empty screen.
   • Changed: the admin screen is the DevDome suite frame: Overview / Activity / Settings tabs that switch instantly, the plugin mark and bug-report button in the header, the Activity list as the dashboard table with the standard pager and the shared filter dropdowns, settings as label and control rows with a short hint and an info icon, and the DevDome Account connect card as the first Settings section while the site is not connected.
   • Changed: the Overview opens with a status circle (recording / failed logins above threshold / activity lost), the Settings tab saves through the suite’s sticky Save button with a pending-changes counter, result banners disappear on the next action, and the manual purge is confirmed by typing DELETE.
   • Security: reading, exporting, configuring, purging, viewing diagnostics, repairing storage and seeing full IP addresses are now seven separate, real capabilities granted to the administrator role on activation. The old devdacti_capability filter now scopes reading only.
   • Security: the storage redactor also removes quoted JSON credentials (“password”:”…”) and PEM key blocks, and every ability answer passes the same redactor, including map keys and error data, so no credential, e-mail address or server path reaches an agent.
   • Fixed: a failed dashboard count is reported as a database error instead of being cached as zero for five minutes; a personal-data export or erasure that cannot read or write the log is returned to the requester as an error, never as a completed request; every erasure statement is checked and the account’s rows stay findable for a retry until the last one.
   • Fixed: granting a role to an account that had none is recorded, and a further role added in the same request as a role change is its own event; policy changes are written in one statement (all or nothing) and the forwarded-header choice is part of the recorded policy; the failed-login picture in get-login-events is summed over the whole window; the storage schema is stamped only after both tables, every index and the unique bucket key were verified.
4. v0.1.2
   • Fixed: the account-connection shim no longer deletes DevDome Analytics’ connection stamp (it now only removes a stamp it wrote itself).
5. v0.1.1
   • Initial release: authentication, content, plugin/theme/core, user, media, comment and settings tracking; hourly failed-login aggregation; filterable log with CSV export; retention purge; IP anonymization on by default; dashboard with critical-activity feed.

Current: v1.0.5 · updated October 16, 2026

1. v1.0.5 October 16, 2026
   • A dismissible note at the top of the settings page mentions the free DevDome Analytics plugin, with a button that opens the plugin installer (or the Analytics screen when it is already active). Dismiss hides it for good.
   • Shared DevDome library 1.7.13: uninstalling the last DevDome plugin also removes the note’s dismissal, the update-repair records and the per-user “Report a bug” flag; the visitor-beacon flood guard keeps one short-lived record per address and clears its expired ones itself, and behind Cloudflare it counts per visitor instead of per Cloudflare address.
   • Shared DevDome library 1.7.12: a Cloudflare visitor address header is trusted only when the connection itself comes from a Cloudflare address, so a forged header from anywhere else is ignored.
   • Shared DevDome library 1.7.11: on a subdirectory multisite, a site mapped to its own domain is its own site and no longer shares the network’s connection.
   • The plugin now creates its tables and default settings on the next admin page load whenever they are missing, for example when the plugin files were copied into place or updated outside the plugin screen. Before, such a site showed the plugin as active while every request hit a failing database query and nothing was protected.
   • The rate-limit and request-velocity counters keep one short-lived record per visitor address and clear their expired ones themselves. They used to write a new record per address every window, which sat in the database until the daily cleanup.
   • Deleting the plugin also removes the cached update-check answer it kept in the database.
2. v1.0.4
   • The personal data exporter and eraser match exact addresses only. A row shortened by Anonymize IPs covers several visitors and is no longer included in one person’s export.
   • Database error texts shown on screen or sent with an error report also redact secrets and server paths.
   • The Outside Lookups hint states that the good-bot check still uses this server’s own DNS resolver.
3. v1.0.3
   • The plugin header now states Requires at least 6.2 and Requires PHP 7.4, so WordPress refuses to activate it on older versions (WordPress.org review).
   • The reverse-DNS check for good bots answers “unverified” instead of failing on hosts where the DNS functions are disabled.
4. v1.0.2
   • The DevDome dashboard can no longer change anything on the site. Settings go one way, from the site to the dashboard; the remote sync endpoint and every remotely applied setting (mode, on or off, pause, rules, Known Bots, blocked countries, time zone) were removed.
   • Shared DevDome library 1.7.10.
5. v1.0.1
   • Outside Lookups: one switch, off by default, for the bot list downloads and the country and network lookups. Nothing is contacted on activation.
   • The early-block must-use file and the Safe Mode flag file are no longer written; Safe Mode is a setting.
   • The Safety Link (a no-login pause URL) was removed.
   • Events, sessions and reputation records are kept 90 days on every site.
   • Chart.js 4.5.1.
   • DevDome dashboard: paused, off or watching only are no longer listed as issues.
   • Shared DevDome library 1.7.9: the DevDome dashboard lists only real problems (a feature that is off, paused or not connected is no longer an issue) and no longer says Not monitored.

Current: v1.0.5 · updated October 16, 2026

1. v1.0.5 October 16, 2026
   • A dismissible note at the top of the settings page mentions the free DevDome Analytics plugin, with a button that opens the plugin installer (or the Analytics screen when it is already active). Dismiss hides it for good.
   • Shared DevDome library 1.7.13: uninstalling the last DevDome plugin also removes the note’s dismissal, the update-repair records and the per-user “Report a bug” flag; the visitor-beacon flood guard keeps one short-lived record per address and clears its expired ones itself, and behind Cloudflare it counts per visitor instead of per Cloudflare address.
   • Shared DevDome library 1.7.12: a Cloudflare visitor address header is trusted only when the connection itself comes from a Cloudflare address, so a forged header from anywhere else is ignored.
   • Shared DevDome library 1.7.11: on a subdirectory multisite, a site mapped to its own domain is its own site and no longer shares the network’s connection.
   • Deleting the plugin also removes the cached update-check answer it kept in the database.
2. v1.0.4
   • Listing text updated: title, short description, tags and introduction.
   • The admin page is printed without an output buffer and the Report this error button goes through wp_kses.
   • Shared DevDome library 1.7.10: the one-time Report a bug hint is recorded through a nonce-checked request instead of on a page view, and the DevDome dashboard prints its icons through wp_kses.
3. v1.0.3
   • Removed the shared library update helper. The plugin no longer hooks the WordPress updater; updates come only from WordPress.org.

Current: v1.0.10 · updated October 16, 2026

1. v1.0.10 October 16, 2026
   • A dismissible note at the top of the settings page mentions the free DevDome Analytics plugin, with a button that opens the plugin installer (or the Analytics screen when it is already active). Dismiss hides it for good.
   • Shared DevDome library 1.7.13: uninstalling the last DevDome plugin also removes the note’s dismissal, the update-repair records and the per-user “Report a bug” flag; the visitor-beacon flood guard keeps one short-lived record per address and clears its expired ones itself, and behind Cloudflare it counts per visitor instead of per Cloudflare address.
   • Shared DevDome library 1.7.12: a Cloudflare visitor address header is trusted only when the connection itself comes from a Cloudflare address, so a forged header from anywhere else is ignored.
   • Shared DevDome library 1.7.11: on a subdirectory multisite, a site mapped to its own domain is its own site and no longer shares the network’s connection.
   • Deleting the plugin also removes the cached update-check answer it kept in the database.
2. v1.0.9
   • Shared DevDome library 1.7.10: the one-time Report a bug hint is recorded through a nonce-checked request instead of on a page view; the DevDome dashboard lists only real problems and prints its icons through the WordPress escaping functions.
   • The plugin screen is printed directly instead of being buffered, and every value is escaped where it is printed (WordPress.org review rule).
   • Listing text updated: title, short description, tags and introduction.
3. v1.0.8
   • AI agents get setting names and role names back unchanged; the output filter no longer treats a long name as a secret.
   • Bundled DevDome library 1.7.6: if you connect a DevDome account from the DevDome Tools dashboard, the Connect card now says exactly what is shared, including the list of active DevDome plugins and their versions. Sites that were already connected, and sites that never connect, send nothing new. See External services.
4. v1.0.7
   • The notice capture always closes its own output buffer, even when another plugin leaves one open above it.
   • The bundled DevDome library loads WordPress admin files only where they are needed.
5. v1.0.6
   • Security review pass: every request handler checks capability and nonce inline before reading input, all inputs sanitised on the line they are read, output escaping tightened, the bundled DevDome library verifies nonces before any lookup, and the account connect return is bound to the user who started it.
   • Notice redaction now covers HTTP Authorization headers and any absolute server path; late-inserted notices reappear if the plugin does not answer within 8 seconds.
   • External services disclosure corrected to list every field an error report carries.

Current: v1.7.7 · updated October 16, 2026

1. v1.7.7 October 16, 2026
   • A dismissible note at the top of the settings page mentions the free DevDome Analytics plugin, with a button that opens the plugin installer (or the Analytics screen when it is already active). Dismiss hides it for good.
   • Shared DevDome library 1.7.13: uninstalling the last DevDome plugin also removes the note’s dismissal, the update-repair records and the per-user “Report a bug” flag; the visitor-beacon flood guard keeps one short-lived record per address and clears its expired ones itself, and behind Cloudflare it counts per visitor instead of per Cloudflare address.
   • External services lists the “Report this error” button and what it sends.
   • Deleting the plugin also removes the cached update-check answer it kept in the database.
2. v1.7.6
   • Agent answers for the link list, a single link, the link export, a recheck and an address edit now mask tokens, passwords and e-mail addresses found in a stored URL, anchor, error text or redirect target, as the 404 answers already did.
   • Database guard: when a database query fails while the plugin works (a scan step, a settings save, an export, a REST call or an agent ability), the plugin now says so and changes nothing more, instead of reporting a clean result or writing over data it could not read. Settings and job state are read back after every write, so “saved” means saved.
   • Shared DevDome library 1.7.11: on a subdirectory multisite, a site mapped to its own domain now connects as its own site instead of sharing the main site’s DevDome account link.
   • Shared DevDome library 1.7.12: a Cloudflare visitor address header is trusted only when the connection itself comes from a Cloudflare address, so a forged header from anywhere else is ignored.
3. v1.7.5
   • Shared DevDome library 1.7.10: the DevDome dashboard icons are printed through the WordPress escaping functions (WordPress.org review rule).
   • Short description rewritten.
4. v1.7.4
   • Listing text updated: title, short description, tags and introduction.
   • Settings: the DevDome Account card, the same as in the other DevDome plugins, explains what connecting sends before you press Connect; the Overview button now leads to it.
   • Shared DevDome library 1.7.8: the one-time Report a bug hint is recorded through a nonce-checked request instead of on a page view.
   • Shared DevDome library 1.7.9: the DevDome dashboard lists only real problems (a feature that is off, paused or not connected is no longer an issue) and no longer says Not monitored.
5. v1.7.3
   • Bundled DevDome library 1.7.6: if you connect a DevDome account from the DevDome Tools dashboard, the Connect card now says exactly what is shared, including the list of active DevDome plugins and their versions. Sites that were already connected, and sites that never connect, send nothing new. See External services.
   • Listing text rewritten: new title, short description, tags and a restructured description. No change to how the plugin works.

Current: v1.1.6 · updated October 16, 2026

1. v1.1.6 October 16, 2026
   • A dismissible note at the top of the settings page mentions the free DevDome Analytics plugin, with a button that opens the plugin installer (or the Analytics screen when it is already active). Dismiss hides it for good.
   • Shared DevDome library 1.7.13: uninstalling the last DevDome plugin also removes the note’s dismissal, the update-repair records and the per-user “Report a bug” flag; the visitor-beacon flood guard keeps one short-lived record per address and clears its expired ones itself, and behind Cloudflare it counts per visitor instead of per Cloudflare address.
   • Deleting the plugin also removes its one-time migration marker and the cached update-check answer it kept in the database. The marker was loaded on every request after the plugin was gone.
2. v1.1.5
   • Network uninstall now clears the shared DevDome connection state on every site of the network, not only the last one visited.
   • Database guard: every action (the review screen, cleanups, restores, deletes, the admin page, the scheduled sweep, the Abilities API) now records a failed database query and refuses to write, move or delete anything after it. The screen says that a query failed instead of showing an empty library, an empty Recycle Bin or default settings, and a running job pauses with the error on it so you can resume it.
   • State options (the cancel and rollback markers, the runner key, the site token) are read back after every write; a value that did not land is treated as not saved.
   • Shared DevDome library 1.7.11: on a multisite network a site mapped to its own domain is its own site and no longer shares the network’s DevDome connection.
   • Shared DevDome library 1.7.12: a Cloudflare visitor address header is trusted only when the connection itself comes from a Cloudflare address, so a forged header from anywhere else is ignored.
3. v1.1.4
   • Duplicates: identical copies among the unused images are marked again and listed under a Duplicates pill on the Review screen and a Duplicate images tile on the Overview. The oldest copy is the suggested original; a used image is never marked.
   • Shared DevDome library 1.7.10: the DevDome dashboard icons are printed through the WordPress escaping functions (WordPress.org review rule).
   • Short description rewritten.
4. v1.1.3
   • Shared DevDome library 1.7.8: the one-time Report a bug hint is recorded through a nonce-checked request instead of on a page view.
   • Shared DevDome library 1.7.9: the DevDome dashboard lists only real problems (a feature that is off, paused or not connected is no longer an issue) and no longer says Not monitored.
   • Shorter Connect card text.
5. v1.1.2
   • Listing text updated: title, short description, tags and introduction.
   • Shared DevDome library 1.7.7: the first time you open any DevDome plugin screen, a small one-time hint points at the Report a bug button. It is shown once per user across all DevDome plugins.

Current: v1.1.7 · updated October 16, 2026

1. v1.1.7 October 16, 2026
   • A dismissible note at the top of the settings page mentions the free DevDome Analytics plugin, with a button that opens the plugin installer (or the Analytics screen when it is already active). Dismiss hides it for good.
   • Shared DevDome library 1.7.13: uninstalling the last DevDome plugin also removes the note’s dismissal, the update-repair records and the per-user “Report a bug” flag; the visitor-beacon flood guard keeps one short-lived record per address and clears its expired ones itself, and behind Cloudflare it counts per visitor instead of per Cloudflare address.
   • Shared DevDome library 1.7.12: a Cloudflare visitor address header is trusted only when the connection itself comes from a Cloudflare address, so a forged header from anywhere else is ignored.
   • Shared DevDome library 1.7.11: on a subdirectory multisite, a site mapped to its own domain is its own site and no longer shares the network’s connection.
   • External services lists the “Report this error” button and what it sends.
   • Click counting keeps its short-lived unique-visitor markers from piling up: expired markers are now removed by the plugin itself instead of waiting for the daily WordPress cleanup.
   • Deleting the plugin also removes the cached update-check answer it kept in the database.
2. v1.1.6
   • Shared DevDome library 1.7.10: the DevDome dashboard icons are printed through the WordPress escaping functions (WordPress.org review rule).
   • Short description rewritten.
3. v1.1.5
   • Shared DevDome library 1.7.9: the DevDome dashboard lists only real problems (a feature that is off, paused or not connected is no longer an issue) and no longer says Not monitored.
   • DevDome Account card: the same Connect card as in the other DevDome plugins, with what connecting sends stated before you press Connect. The Link Radar and store routing rows now point to it, and Check Now says that it needs the account.
4. v1.1.4
   • Link Radar: Copy ASINs and the per-row copy now confirm with Copied. The copy runs through the browser’s classic copy command first and the clipboard API second, so it works in every browser.
   • Link Radar: the Product column explains why a product title can be unavailable.
   • Link Radar: the Live list loads when the group was left open and the page is refreshed, and follows the count while a check runs.
   • Check Now: 10 products per step instead of 50, so the progress row moves every few seconds.
   • Link Radar: Download CSV per group exports every ASIN of that status with its store, product title and the pages it is used on.
   • Listing text updated: title, short description, tags and introduction.
   • DevDome Dashboard health: a high share of blocked bot clicks no longer counts as an issue. Blocked clicks mean Click Protection is working; the count stays on the tile.
   • Shared DevDome library 1.7.8: the first time you open any DevDome plugin screen, a small one-time hint points at the Report a bug button. It is shown once per user across all DevDome plugins and is recorded through a nonce-checked request.
5. v1.1.3
   • Link Radar: a fourth row, No Answer, lists products the status check could not classify, so every checked product is visible. The row has its own Check again button.
   • Status checks: Amazon pages that say Currently unavailable are now reported as Out of Stock (they were reported as Live).
   • Check Now runs about four times faster: 50 products per step instead of 5, and each step waits longer for the status service when many sites check at the same time.

Current: v1.5.9 · updated October 16, 2026

1. v1.5.9 October 16, 2026
   • A dismissible note at the top of the settings page mentions the free DevDome Analytics plugin, with a button that opens the plugin installer (or the Analytics screen when it is already active). Dismiss hides it for good.
   • Shared DevDome library 1.7.13: uninstalling the last DevDome plugin also removes the note’s dismissal, the update-repair records and the per-user “Report a bug” flag; the visitor-beacon flood guard keeps one short-lived record per address and clears its expired ones itself, and behind Cloudflare it counts per visitor instead of per Cloudflare address.
   • External services lists the “Report this error” button and what it sends.
   • Link rotation keeps its position for the newest 20,000 visitors of a rule and forgets the oldest, so a busy rotation rule no longer grows one database record without limit.
   • Resetting a rule’s statistics also removes that rule’s stored “Open on every Nth visitor” records, which the reset had already made unusable but left in the database for up to a year.
2. v1.5.8
   • The Selected existing URLs picker lists up to 100 pages or posts before you type (was 30, so a site with more pages could not see the ones past the cut) and says “Showing 100 of 530. Type to find more.” when there are more. Typing part of a title or address finds any page, as before.
3. v1.5.7
   • Visitor statistics and the once-per-visitor redirect count now identify a visitor by the trusted client address (behind Cloudflare or a trusted proxy) instead of the raw connection address, and the agent rule details mask secret values in the selected referrer pages like they do for sources and destinations.
   • New per-rule Hide From Search controls under Optional Settings, both off by default: a Noindex Header sent on every address the rule targets before the plugin decides who is redirected, and a Robots.txt Disallow block for the rule’s Custom URLs or Selected existing URLs in the virtual robots.txt. Also available to AI agents as search_noindex and search_disallow.
   • New per-rule Report To DevDome Analytics switch, off by default: each redirect is reported to your DevDome Analytics dashboard and a destination that is another site of your account gets an opaque ?d= token. Needs a connected DevDome account; what is sent is listed under External services. Agents: analytics_report, confirmation required to turn it on.
   • Trust forwarded IP headers now believes a forwarded header only when the connection comes from a Cloudflare address or a private or loopback reverse proxy; a direct visitor can no longer hand the plugin another address.
   • Saving a rule is all or nothing: every row is copied before the first write and put back when a write fails, so visitors never meet a half-changed running rule. Return to Default acts only on the rule the screen shows.
   • A database query that fails during an action (saving, importing, rule actions, agent abilities) now ends in an error instead of a success message, and no further write follows it. Reset Stats reports a rotation position it could not clear.
   • Import checks every value against the same choices and ranges the settings screen enforces and refuses the file otherwise. Agent exports mask credentials and secret-looking values in destination URLs and email addresses; the wp-admin Export file is unchanged. The cache purge ability reports how many caching plugins received the purge.
   • Shared DevDome library 1.7.11: on a subdirectory multisite, a site mapped to its own domain is its own site and no longer shares the network’s connection.
4. v1.5.6
   • Shared DevDome library 1.7.10: the one-time Report a bug hint is recorded through a nonce-checked request instead of on a page view; the DevDome dashboard lists only real problems and prints its icons through the WordPress escaping functions.
   • The redirect scripts and the rule list are printed through the WordPress escaping functions, with no escaping exceptions left (WordPress.org review rule). The scripts themselves are unchanged.
   • Listing text updated: title, short description, tags and introduction.
5. v1.5.5
   • New per-rule exclusions under Optional Settings, each with its own checkbox and off by default: IP addresses and CIDR ranges (IPv4 and IPv6), browser strings (User-Agent), and logged-in WordPress user roles.
   • Excluded visitors see the page as usual, are not sent to the bypass link and are counted with the skipped bots instead of visitors.
   • Browser string exclusions match any listed text, ignoring upper and lower case. IP and browser string exclusions depend on the visitor continuing to match; role exclusions apply only while logged in, and cached pages may still be served.
   • The rule settings are also available to AI agents as skip_ips, skip_user_agents and skip_roles.
   • For developers: new devdredi_pass_bind_address filter for the address a Visitor Check pass is bound to.
   • Bundled DevDome library 1.7.6: the optional Connect card now says exactly what a connected site shares, including the list of active DevDome plugins. Sites already connected send nothing new. See External services.

Current: v1.1.6 · updated October 16, 2026

1. v1.1.6 October 16, 2026
   • Shared DevDome library 1.7.13: uninstalling the last DevDome plugin also removes the note’s dismissal, the update-repair records and the per-user “Report a bug” flag; the visitor-beacon flood guard keeps one short-lived record per address and clears its expired ones itself, and behind Cloudflare it counts per visitor instead of per Cloudflare address.
   • Shared DevDome library 1.7.12: a Cloudflare visitor address header is trusted only when the connection itself comes from a Cloudflare address, so a forged header from anywhere else is ignored.
   • Shared DevDome library 1.7.11: on a subdirectory multisite, a site mapped to its own domain is its own site and no longer shares the network’s connection.
   • The outbound-click relay’s flood guard keeps one short-lived record per visitor address and clears its expired ones itself. It used to write a new record every minute per address, which sat in the database until the daily cleanup.
2. v1.1.5
   • Shared DevDome library 1.7.10: the DevDome dashboard prints its icons through wp_kses.
   • Listing text: new title, short description and introduction.
3. v1.1.4
   • Shared DevDome library 1.7.8: the one-time Report a bug hint is recorded through a nonce-checked request instead of on a page view.
   • Shared DevDome library 1.7.9: the DevDome dashboard lists only real problems (a feature that is off, paused or not connected is no longer an issue) and no longer says Not monitored.
   • DevDome dashboard: Analytics not connected or tracking paused are no longer listed as issues. Shorter Connect card text.
4. v1.1.3
   • Listing text updated: title, short description, tags and introduction.
   • Shared DevDome library 1.7.7: the first time you open any DevDome plugin screen, a small one-time hint points at the Report a bug button. It is shown once per user across all DevDome plugins.
5. v1.1.2
   • Bundled DevDome library 1.7.6: if you connect a DevDome account from the DevDome Tools dashboard, the Connect card now says exactly what is shared, including the list of active DevDome plugins and their versions. Sites that were already connected, and sites that never connect, send nothing new. See External services.
   • Listing text rewritten: new title, short description, tags and a restructured description. No change to how the plugin works.