Champlin Pre-Flight Audit

گزارش تغییرات

1.0.7

• Plugin review compliance. Managed-host detection no longer assumes a hardcoded server filesystem layout — Plesk is now detected from the DOCUMENT_ROOT/SERVER_SOFTWARE environment signals and the control-panel install directory instead of matching ABSPATH against a fixed vhost path. No functional change: the same hosts are detected, and detection stays open_basedir-safe. Contributors list corrected to the plugin’s WordPress.org account. The legacy-migration success notice now signals via a transient set by the nonce-verified migrate action instead of a URL parameter, resolving the Plugin Check nonce-verification warnings (and making the notice reliably display).

1.0.6

• WordPress.org submission readiness. All Plugin Check ERRORs and most WARNINGs resolved: short PHP tags converted, direct filesystem operations refactored to use WP_Filesystem, $_POST/$_SERVER inputs unslashed before sanitization, readme tags trimmed to 5, build script now excludes hidden files. No functional changes — same audit, same autofixes, same snapshot safety net. Ready for the WP.org plugin directory review.

1.0.5

• Distribution improvements. The self-hosted GitHub variant gained automated release delivery; the WordPress.org distribution uses WordPress.org’s native plugin-update channel.

1.0.4

• Fix: Plesk detection now works under open_basedir restrictions. v1.0.2’s is_dir(/usr/local/psa) check silently failed when the vhost’s open_basedir excluded /usr/local/psa/. New detection uses ABSPATH (/var/www/vhosts/...), DOCUMENT_ROOT, and SERVER_SOFTWARE signals — all open_basedir-safe.
• Grading curve relief during major-release week. Within 14 days of a WordPress major release, plugins and themes still tested against the immediately-prior major (6.9 when current is 7.0) are downgraded from WARN to INFO and excluded from the score. Vendors typically catch up within this window; penalizing every site on day one was unfair. Auto-expires 14 days after the release date.
• Accept-as-known-risk override mechanism. Each warn/fail finding now has an “Accept as known risk” link. Click to acknowledge — the finding still appears in the report (with an “Accepted risk” tag) but is excluded from the readiness score calculation. Real enterprise audit pattern, fully reversible via “Un-accept” button.

1.0.3

• Fix: Re-run audit spinner appearing on page load and never stopping. The v1.0.1 spinner icon used the HTML hidden attribute to start hidden, but the plugin’s .wp7rc-btn__icon class set display: inline-block which silently overrode [hidden]. The spin animation then ran constantly. Added an explicit [hidden] CSS override so the spinner stays hidden until the button is clicked.

1.0.2

• Fix: Custom-code scan no longer false-positives on common vendor plugins. The previous scope included Advanced Custom Fields, WPGraphQL, Two-Factor, page builders, and other widely-installed plugins that ship their own WordPress 7.0 compatibility updates. Flagging their internal code as if it were user-owned created noise. The vendor-skip list now covers 30+ common plugin slugs across page builders, SEO, ACF, GraphQL/headless, security, cache, forms, translation, and backup.
• Fix: Backup-plugin check now detects managed-host snapshot systems. Previously warned even on Plesk / WP Engine / Kinsta / Pantheon / Pressable / SiteGround / Flywheel / GoDaddy Managed WordPress / cPanel / DreamHost installs where host-level backups are the standard. The check now detects 10 managed-host platforms and reports PASS with “host-level snapshots assumed” instead.

1.0.1

• Fix: OPcache detection no longer false-positives on hardened hosts. The previous check used function_exists('opcache_get_status'), which returns false on Plesk / CloudLinux / managed-WP servers that disable opcache_get_status via disable_functions for security. The new check uses extension_loaded('Zend OPcache') as the primary signal, falling back to detailed memory stats only if the introspection function is available. OPcache now correctly reports PASS on Plesk and CloudLinux hosts.
• UX: Re-run audit button now uses a proper event listener (was inline onclick which felt unresponsive when the audit state was unchanged), with a spinning ↻ icon during reload.
• UX: “Apply N available fixes” button replaced with a positive “All available fixes applied” green pill when there are no fixes left, instead of just disappearing.
• UX: “Apply all” dialog now shows a clear bullet list of what will change.
• UX: Fix-results report panel appears below the action buttons after Apply-all, listing every fix’s outcome with its full error message inline. No more aggregate “N applied · M failed” without context.
• Discoverability: All outbound links to champlinenterprises.com now carry UTM parameters for attribution. “No telemetry” promise unchanged — UTMs are appended to URLs only, no data sent from your server.
• Discoverability: Tasteful “Star on GitHub” band added to the dashboard footer. Self-reported install signal; fully opt-in.
• Docs: Added README.md, SECURITY.md, CONTRIBUTING.md to the GitHub repo for community standards.

1.0.0

• Initial release.
• 30+ automated checks across 9 categories (server, database, WP core, plugins, themes, custom code, headless, multisite, security).
• Premium visual dashboard with animated readiness-score donut and color-coded findings.
• Print-friendly stylesheet — browser print dialog produces a clean PDF report.
• Autofix support for 4 common issues — each fix is one click, idempotent, and reversible:
  • Disable major auto-updates during the WordPress 7.0 launch window
  • Lock down in-admin file editing (drops a mu-plugin defining DISALLOW_FILE_EDIT)
  • Update all plugins to their latest stable releases (uses WordPress core’s own Plugin_Upgrader)
  • Install and activate the official Two-Factor plugin from WordPress.org