What shipped, and when

Current: v1.0.4 · updated October 1, 2026

1. v1.0.4 October 1, 2026
   • Listing text updated: title, short description, tags and introduction.
   • The admin page is printed without an output buffer and the Report this error button goes through wp_kses.
   • Shared DevDome library 1.7.10: the one-time Report a bug hint is recorded through a nonce-checked request instead of on a page view, and the DevDome dashboard prints its icons through wp_kses.
2. v1.0.3
   • Removed the shared library update helper. The plugin no longer hooks the WordPress updater; updates come only from WordPress.org.

Current: v1.3.9 · updated October 1, 2026

1. v1.3.9 October 1, 2026
   • Shared DevDome library 1.7.10: shorter Connect text on the DevDome dashboard, which now lists only real problems and no longer says Not monitored; the one-time Report a bug hint is recorded through a nonce-checked request; icons are escaped on output.
   • The scanner screen is printed directly instead of being buffered, and every value is escaped where it is printed.
   • Overview: a status circle coloured by the worst open finding (red, orange, amber, green) replaces the score number; the header pills are gone.
   • Settings: a DevDome Account section says what connecting sends before anything is sent; the other Connect buttons open it.
   • Fixed: a file with two findings left the second one open after it was quarantined (“the file is no longer there”). All findings of a quarantined file now close together and reopen together on restore; a finding whose file is already gone closes.
   • Fixed: the Overview still showed findings that had just been handled on another tab.
   • Fixed: a clean result on a site without a DevDome account no longer says “1 check ran with reduced coverage”; the Scan Coverage list still names the account-only check.
   • False alarms from the first 1.3.8 sites: a real PDF whose compressed stream happens to hold “<?=” is no longer a disguised executable (PHP’s own parser proves the grammar error, the file cannot run; a real shell inside a PDF still is); an EMPTY auto_prepend_file line (SureMails writes one to switch the attack off) is no longer reported; a scheduled task inside an active plugin’s own hook namespace with no handler attached (a switched-off module) is no longer a task to review.
2. v1.3.8
   • NinjaFirewall’s own rule set (the nfw_rules option) is no longer a “critical” finding: it is a list of attack patterns, which is why it looked like one. It is now a low note that names the plugin.
   • A plugin that WordPress or your host updated while a scan was running was checked against the checksums of its previous version, so every changed file of the new release was reported as “modified”. The version is now read again from disk before the check, and once more if a difference shows up.
   • A post that embeds another WordPress post is stored by WordPress itself as a hidden, sandboxed frame; that exact markup is now recognised as the embed it is instead of a hidden iframe.
   • All In One Security’s firewall settings file under uploads (it starts with a stop-the-compiler statement, so nothing in it can run), Sucuri Scanner’s data files under uploads (an exit statement first, then data) and comment-only PHP stubs under other extensions (.stub, .php-old) are no longer reported as executable. Checked live against 25 security and firewall plugins.
   • Admin and Site Enhancements’ settings (custom CSS and footer code) and Jetpack’s sync error log are treated like the other settings that carry code by design: a low note, not a “script injection”.
   • MailPoet’s compiled email templates under uploads/mailpoet/cache (one template class per file, nothing that runs on its own) are a low “compiled template cache” note instead of dozens of high “executable upload” findings.
   • A must-use file that is a byte copy of an installed plugin’s official file (NinjaFirewall’s loader) is reported as that plugin’s loader, low, instead of a high “new must-use plugin”. An empty or comment-only placeholder a hardening plugin writes into wp-includes is a low note instead of a high “unknown core file”.
3. v1.3.7
   • A hidden iframe in a script is reported only when it loads a page from a foreign address or carries inline HTML. The invisible helper frames that jQuery blockUI, elFinder and cross-site storage libraries build (UpdraftPlus, WooCommerce, WP-Optimize, All In One WP Security, Redux, YITH and others, 31 official files) are no longer “Suspicious code patterns”.
   • The account report and the opt-in “Help improve detection” telemetry now include low and info findings (most severe first, 50 at most) and, for each finding, the names of the checks that fired, the file’s checksum and size, plus the scan’s PHP version, short-tag setting and WordPress version. Still no file contents, no addresses, no server paths. This lets DevDome reproduce a false alarm from the report alone instead of waiting for a support message.
4. v1.3.6
   • Photos, PDFs and other uploads are no longer reported as “PHP code inside the file” because of random bytes: a file is only a finding when PHP could actually compile and run it. On a real customer site 19 of 20 ordinary photos were still flagged by 1.3.5 (PHP short tags on); all 20 are now clean, and every known way of hiding PHP inside an image is still caught.
   • The same rule now covers plugin and theme images, compressed logs, archives and other data files, which were flagged as “Suspicious code patterns” for the same random bytes.
   • Elementor Pro Custom Code (_elementor_code) is treated like Elementor’s other data: a plain script there is a low note, not a high “script injection”. A script that redirects to a foreign host, decodes and runs code or loads from an unknown host stays an injection, in every known key.
   • “Report false alarms” now sends every open finding (most severe first, 50 at most) instead of refusing when only low and info findings are left; when nothing is open the message says so and what to do.
5. v1.3.5
   • Fewer false alarms, measured on real customer reports: ordinary images, PDFs, fonts and compressed logs are no longer reported as “PHP code inside the file” (1,060 real media files: 43 alarms before, 4 now), while PHP really hidden in an image is still caught, including code wrapped in comments or strings.
   • Normal plugin code no longer raises alarms for signing the current user out or for a boolean assert() check.
   • An upload folder “keep out” index.php with a closing tag (WP Migrate) is recognised. A file that only looks like one but opens a second PHP block is now reported, which the previous version missed.
   • JavaScript files that are exact copies of official WordPress files (a second WordPress install inside the site folder, backup folders) are no longer scanned as suspicious code.
   • A short-echo tag followed by a backtick shell command is detected in uploads.
   • When a file cannot be quarantined the message now says why: the file is gone, it is a link, it is a folder, or it is outside the folders the plugin may change.
   • Measured on 1,155 public PHP malware samples: detection unchanged. On 17,261 official WordPress, plugin and theme files: 177 low to high alarms before, 147 now.

Current: v1.1.5 · updated October 1, 2026

1. v1.1.5 October 1, 2026
   • Shared DevDome library 1.7.10: the DevDome dashboard prints its icons through wp_kses.
   • Listing text: new title, short description and introduction.
2. v1.1.4
   • Shared DevDome library 1.7.8: the one-time Report a bug hint is recorded through a nonce-checked request instead of on a page view.
   • Shared DevDome library 1.7.9: the DevDome dashboard lists only real problems (a feature that is off, paused or not connected is no longer an issue) and no longer says Not monitored.
   • DevDome dashboard: Analytics not connected or tracking paused are no longer listed as issues. Shorter Connect card text.
3. v1.1.3
   • Listing text updated: title, short description, tags and introduction.
   • Shared DevDome library 1.7.7: the first time you open any DevDome plugin screen, a small one-time hint points at the Report a bug button. It is shown once per user across all DevDome plugins.
4. v1.1.2
   • Bundled DevDome library 1.7.6: if you connect a DevDome account from the DevDome Tools dashboard, the Connect card now says exactly what is shared, including the list of active DevDome plugins and their versions. Sites that were already connected, and sites that never connect, send nothing new. See External services.
   • Listing text rewritten: new title, short description, tags and a restructured description. No change to how the plugin works.
5. v1.1.1
   • Updates now work when the plugin folder belongs to another system user (shared DevDome core 1.7.4): a folder installed from a root shell or by an AI agent used to fail every update; the plugin now repairs the folder ownership itself when it can, and says exactly what to run when it cannot.

Current: v1.0.9 · updated September 30, 2026

1. v1.0.9 September 30, 2026
   • Shared DevDome library 1.7.10: the one-time Report a bug hint is recorded through a nonce-checked request instead of on a page view; the DevDome dashboard lists only real problems and prints its icons through the WordPress escaping functions.
   • The plugin screen is printed directly instead of being buffered, and every value is escaped where it is printed (WordPress.org review rule).
   • Listing text updated: title, short description, tags and introduction.
2. v1.0.8
   • AI agents get setting names and role names back unchanged; the output filter no longer treats a long name as a secret.
   • Bundled DevDome library 1.7.6: if you connect a DevDome account from the DevDome Tools dashboard, the Connect card now says exactly what is shared, including the list of active DevDome plugins and their versions. Sites that were already connected, and sites that never connect, send nothing new. See External services.
3. v1.0.7
   • The notice capture always closes its own output buffer, even when another plugin leaves one open above it.
   • The bundled DevDome library loads WordPress admin files only where they are needed.
4. v1.0.6
   • Security review pass: every request handler checks capability and nonce inline before reading input, all inputs sanitised on the line they are read, output escaping tightened, the bundled DevDome library verifies nonces before any lookup, and the account connect return is bound to the user who started it.
   • Notice redaction now covers HTTP Authorization headers and any absolute server path; late-inserted notices reappear if the plugin does not answer within 8 seconds.
   • External services disclosure corrected to list every field an error report carries.
5. v1.0.5
   • Settings use plain checkboxes on the left of each option, saved with the Save Settings button, instead of toggle switches; nothing changes until you save.

Current: v1.7.5 · updated September 30, 2026

1. v1.7.5 September 30, 2026
   • Shared DevDome library 1.7.10: the DevDome dashboard icons are printed through the WordPress escaping functions (WordPress.org review rule).
   • Short description rewritten.
2. v1.7.4
   • Listing text updated: title, short description, tags and introduction.
   • Settings: the DevDome Account card, the same as in the other DevDome plugins, explains what connecting sends before you press Connect; the Overview button now leads to it.
   • Shared DevDome library 1.7.8: the one-time Report a bug hint is recorded through a nonce-checked request instead of on a page view.
   • Shared DevDome library 1.7.9: the DevDome dashboard lists only real problems (a feature that is off, paused or not connected is no longer an issue) and no longer says Not monitored.
3. v1.7.3
   • Bundled DevDome library 1.7.6: if you connect a DevDome account from the DevDome Tools dashboard, the Connect card now says exactly what is shared, including the list of active DevDome plugins and their versions. Sites that were already connected, and sites that never connect, send nothing new. See External services.
   • Listing text rewritten: new title, short description, tags and a restructured description. No change to how the plugin works.
4. v1.7.2
   • Updates now work when the plugin folder belongs to another system user (shared DevDome core 1.7.4): a folder installed from a root shell or by an AI agent used to fail every update with “Could not move the old version”, and an uploaded zip kept the old version. The plugin is copied to a web-owned folder right before WordPress replaces it, the old folder is kept hidden and recorded so the DevDome Malware Scanner recognises it, and the update goes through the hub, the Plugins screen, bulk updates, uploads and automatic updates alike.
5. v1.7.1
   • Connect fix (shared DevDome core 1.6.6): the connect claim now waits up to 30 seconds and keeps the handshake for 20 minutes so a refresh retries it, the DevDome hub shows why a connect failed with a Try again link, and the verify file is served through a query form for hosts that answer /.well-known/ before WordPress.

Current: v1.1.4 · updated September 30, 2026

1. v1.1.4 September 30, 2026
   • Duplicates: identical copies among the unused images are marked again and listed under a Duplicates pill on the Review screen and a Duplicate images tile on the Overview. The oldest copy is the suggested original; a used image is never marked.
   • Shared DevDome library 1.7.10: the DevDome dashboard icons are printed through the WordPress escaping functions (WordPress.org review rule).
   • Short description rewritten.
2. v1.1.3
   • Shared DevDome library 1.7.8: the one-time Report a bug hint is recorded through a nonce-checked request instead of on a page view.
   • Shared DevDome library 1.7.9: the DevDome dashboard lists only real problems (a feature that is off, paused or not connected is no longer an issue) and no longer says Not monitored.
   • Shorter Connect card text.
3. v1.1.2
   • Listing text updated: title, short description, tags and introduction.
   • Shared DevDome library 1.7.7: the first time you open any DevDome plugin screen, a small one-time hint points at the Report a bug button. It is shown once per user across all DevDome plugins.
4. v1.1.1
   • Bundled DevDome library 1.7.6: if you connect a DevDome account from the DevDome Tools dashboard, the Connect card now says exactly what is shared, including the list of active DevDome plugins and their versions. Sites that were already connected, and sites that never connect, send nothing new. See External services.
   • Listing text rewritten: new title, short description, tags and a restructured description. No change to how the plugin works.
5. v1.1.0
   • WordPress Abilities API: 22 abilities covering every feature (summary, scan results and filters, scans, cleanup, Recycle Bin batches, restore, permanent delete, protect, backups, settings, error log) for AI agents and MCP clients on WordPress 6.9 and newer.
   • Updates now work when the plugin folder belongs to another system user (shared DevDome core 1.7.4): folders installed from a root shell or by an AI agent no longer fail to update through the hub, the Plugins screen, bulk updates, uploads or automatic updates.

Current: v1.1.6 · updated September 30, 2026

1. v1.1.6 September 30, 2026
   • Shared DevDome library 1.7.10: the DevDome dashboard icons are printed through the WordPress escaping functions (WordPress.org review rule).
   • Short description rewritten.
2. v1.1.5
   • Shared DevDome library 1.7.9: the DevDome dashboard lists only real problems (a feature that is off, paused or not connected is no longer an issue) and no longer says Not monitored.
   • DevDome Account card: the same Connect card as in the other DevDome plugins, with what connecting sends stated before you press Connect. The Link Radar and store routing rows now point to it, and Check Now says that it needs the account.
3. v1.1.4
   • Link Radar: Copy ASINs and the per-row copy now confirm with Copied. The copy runs through the browser’s classic copy command first and the clipboard API second, so it works in every browser.
   • Link Radar: the Product column explains why a product title can be unavailable.
   • Link Radar: the Live list loads when the group was left open and the page is refreshed, and follows the count while a check runs.
   • Check Now: 10 products per step instead of 50, so the progress row moves every few seconds.
   • Link Radar: Download CSV per group exports every ASIN of that status with its store, product title and the pages it is used on.
   • Listing text updated: title, short description, tags and introduction.
   • DevDome Dashboard health: a high share of blocked bot clicks no longer counts as an issue. Blocked clicks mean Click Protection is working; the count stays on the tile.
   • Shared DevDome library 1.7.8: the first time you open any DevDome plugin screen, a small one-time hint points at the Report a bug button. It is shown once per user across all DevDome plugins and is recorded through a nonce-checked request.
4. v1.1.3
   • Link Radar: a fourth row, No Answer, lists products the status check could not classify, so every checked product is visible. The row has its own Check again button.
   • Status checks: Amazon pages that say Currently unavailable are now reported as Out of Stock (they were reported as Live).
   • Check Now runs about four times faster: 50 products per step instead of 5, and each step waits longer for the status service when many sites check at the same time.
5. v1.1.1
   • Bundled DevDome library 1.7.6: if you connect a DevDome account from the DevDome Tools dashboard, the Connect card now says exactly what is shared, including the list of active DevDome plugins and their versions. Sites that were already connected, and sites that never connect, send nothing new. See External services.
   • Listing text rewritten: new title, short description, tags and a restructured description. No change to how the plugin works.

Current: v1.5.6 · updated September 30, 2026

1. v1.5.6 September 30, 2026
   • Shared DevDome library 1.7.10: the one-time Report a bug hint is recorded through a nonce-checked request instead of on a page view; the DevDome dashboard lists only real problems and prints its icons through the WordPress escaping functions.
   • The redirect scripts and the rule list are printed through the WordPress escaping functions, with no escaping exceptions left (WordPress.org review rule). The scripts themselves are unchanged.
   • Listing text updated: title, short description, tags and introduction.
2. v1.5.5
   • New per-rule exclusions under Optional Settings, each with its own checkbox and off by default: IP addresses and CIDR ranges (IPv4 and IPv6), browser strings (User-Agent), and logged-in WordPress user roles.
   • Excluded visitors see the page as usual, are not sent to the bypass link and are counted with the skipped bots instead of visitors.
   • Browser string exclusions match any listed text, ignoring upper and lower case. IP and browser string exclusions depend on the visitor continuing to match; role exclusions apply only while logged in, and cached pages may still be served.
   • The rule settings are also available to AI agents as skip_ips, skip_user_agents and skip_roles.
   • For developers: new devdredi_pass_bind_address filter for the address a Visitor Check pass is bound to.
   • Bundled DevDome library 1.7.6: the optional Connect card now says exactly what a connected site shares, including the list of active DevDome plugins. Sites already connected send nothing new. See External services.
3. v1.5.4
   • New “Require the same IP address to continue” checkbox (Visitor Check, off by default): a JavaScript redirect to a provided or transit destination continues only from the IP address and browser that opened the page. The destination no longer appears in the page; a single-use pass does, checked on your own site. A pass that comes back from another address is not redirected and is counted with the skipped bots.
   • New “Don’t redirect outdated browsers” checkbox (off by default): desktop Chrome below version 125 (Edge is checked through its Chrome version) and Firefox below version 125, except versions 109 and 115, see the page as usual and are counted with the skipped bots.
   • New “Daily Redirect Limit” (off by default): the rule stops redirecting for the day once the limit is reached and starts again at midnight, site time. The limit is picked each day between two numbers; the same number twice is a fixed limit. Visitors over the limit stay on the page or go to the bypass link.
   • New “Also match the link’s UTM source” checkbox for Referring websites (off by default): the rule also fires for a tagged link such as ?utm_source=reddit.com, for sources that send no referrer.
   • The DevDome dashboard tile and digest now also show Bots Skipped across all rules.
   • All of these are also available to AI agents as the visitor_check, skip_old_browsers, daily_limit_enabled, daily_limit_min, daily_limit_max and referrer_utm_scan rule fields. Switching visitor_check or skip_old_browsers off needs confirm: true.
   • For developers: new devdredi_redirect_target filter and devdredi_redirected action.
   • Reworded the Known Bots texts: the switch keeps automated traffic out of your redirects and statistics.
4. v1.5.3
   • Fixed: country targeting redirected nobody. The plugin asked the DevDome geo service through a call reserved for connected accounts and always got no country back; it now uses the open lookup, so allow and block country lists work again on every site.
5. v1.5.2
   • New “Only visitors arriving from outside” checkbox under What To Redirect (every scope except Referring websites, which already works this way): the rule redirects a visitor who lands on the page from another website or with no referrer at all, and leaves a visitor who moves between pages of this site on the page. Works on cached pages through the same small footer script as Referring websites. The create-redirect and update-redirect abilities accept outside_only and get-redirect returns it.