PublishRank 2.9.73

PublishRank 2.9.73 — lossless image optimization

Summary

This maintenance release losslessly recompresses four larger images shipped with PublishRank. Existing filenames, formats, dimensions, color modes, decoded pixels, transparency, animation frame count, timing, and looping are preserved.

Image changes

• assets/images/publishrank-banner-publisher.png: 1,363,475 → 1,264,399 bytes (99,076 bytes saved).
• assets/images/social-share-1200x630.png: 154,943 → 146,849 bytes (8,094 bytes saved).
• assets/icon-128x128.gif: 149,331 → 142,617 bytes (6,714 bytes saved).
• assets/icon-256x256.gif: 405,103 → 384,011 bytes (21,092 bytes saved).

Across all 20 shipped PNG/GIF files, raw image bytes decreased from 4,083,704 to 3,948,728: 134,976 bytes saved (3.31%). The two GIFs retain 24 frames, the original 80 ms per-frame timing, and infinite looping. The other 16 PNGs already had no smaller encoding under lossless PNG recompression, so they were left byte-for-byte unchanged.

The bundled runtime directory assets/vendor/fontawesome-free-7.3.1 contains CSS and font files, not images. Composer’s development-only vendor/ directory has two PHPUnit report SVG icons totaling 538 bytes; they were left unchanged as tiny third-party files and are excluded from the WordPress submission ZIP.

Validation

All 32 standalone PHP regression tests passed. PHP lint passed for production, bootstrap, and test files; node --check passed for JavaScript assets; and git diff --check passed. Composer PHPCS reported 0 errors and 177 existing warnings.

The four recompressed files were compared against their original tracked copies: PNG dimensions, modes, ICC/transparency metadata, and decoded pixel bytes match; GIF dimensions, frame count, loop, per-frame duration, and every composited RGBA frame match. No image was resized, cropped, recolored, converted to another format, or replaced with a remote asset.

The WordPress.org ZIP is generated by tools/build_plugin_zip.py; it excludes Composer development dependencies and test/docs/tooling files.

PublishRank 2.9.72

PublishRank 2.9.72 — GitHub News source and activation consent

Summary

This release changes the optional News feed to the official announcements.json file in the PublishRank website repository, adds an activation-time consent dialog, improves external-service disclosures, and renders the top-level WordPress sidebar icon as a solid-white masked silhouette.

Changes

• Fetches the raw JSON corresponding to the official GitHub source file from raw.githubusercontent.com. The raw endpoint currently serves text/plain; charset=utf-8; the reader accepts that media type as well as JSON media types and still parses/validates the JSON schema before use.
• Adds a branded modal on first activation when News is not already enabled. Enable live News is the only choice that permits a feed request; No thanks records an opt-out, and Not now/Escape dismisses without connecting. The prompt is shown to an administrator with manage_options, remains pending until a choice is made, and links to the official source and service privacy policies.
• Keeps the feed disabled by default, requests nothing on activation itself, preserves any prior enabled preference, and stores the modal decision locally. The existing News screen remains available for later opt-in.
• Discloses GitHub Raw server-IP/request metadata and the distinct Netlify image/link traffic in the activation prompt, News consent screen, suggested WordPress privacy-policy text, this guide, and readme.txt.
• Uses versioned cache keys for the provider change and clears the legacy Netlify-feed cache when News is declined or disabled.
• Applies a local alpha mask to the sidebar icon, filled with #fff, because WordPress renders the add_menu_page() icon URL as a background image rather than an <img> element.

Validation performed

• All 32 standalone PHP regression tests passed, including no request before consent, activation prompt state, the exact GitHub Raw endpoint, text/plain and application/json responses, schema validation, caching, stale fallback, item filtering, and URL allowlisting.
• PHP syntax lint passed across production and test PHP, publishrank.php, and uninstall.php.
• node --check passed for all shipped/source JavaScript assets.
• composer run phpcs: 0 errors. 177 warnings remain visible across the existing project and remain non-blocking.
• The official raw endpoint returned HTTP 200, text/plain; charset=utf-8, and a 23,730-byte valid schema 1.0 active feed; it contained 10 announcements, including 8 active non-example entries at validation time.
• dist/PublishRank-v2.9.72.zip was verified to contain 198 files under one publishrank/ directory, including the activation modal assets, and excluding repository metadata, tests, developer tools, local dependencies, and documentation.
• git diff --check passed.

Manual interaction gap

No live WordPress staging dashboard was available in this task. The activation hook, protected form actions, modal keyboard handling, local styling, and CSS alpha-mask rule were statically reviewed and covered where applicable by regression/syntax checks, but the activation popup has not been clicked through in a browser and the rendered sidebar icon has not been visually checked in a live WordPress admin theme. Verify first-activation prompt display, Enable/No thanks/Not now/Escape behavior, no request after decline/dismiss, and the sidebar icon on a clean staging site before production deployment.

PublishRank 2.9.71

PublishRank 2.9.71 — opt-in News feed

Release contents

• Adds an opt-in PublishRank → News screen that reads the public Netlify JSON announcements feed only after an administrator enables it.
• Displays validated announcement content with summaries, optional same-host HTTPS images and links, expandable details, and publication dates.
• Adds nonce- and capability-protected enable, refresh, and disable actions. Disabling removes both local feed caches.
• Bounds remote requests, validates the feed schema and status, sanitizes and escapes rendered values, ignores popup/HTML instructions, and supports a limited stale-cache fallback.
• Adds privacy-policy disclosure, WordPress.org external-service documentation, and a dedicated News feed operations guide.
• Synchronizes plugin header, runtime version, stable tag, and regression fixture to 2.9.71.

Validation

All 32 standalone PHP regression scripts passed. Recursive PHP syntax checks passed, JavaScript syntax checks passed, git diff --check passed, and the Composer PHPCS command exited successfully with 0 errors. It reports 177 warnings across 50 files; these are non-blocking and remain a visible backlog. The new News screen file itself passes the project PHPCS ruleset without warnings.

The live endpoint returned HTTP 200 with application/json; its 23,730-byte payload parsed as schema 1.0 with an active feed, a one-hour TTL, 10 announcements, eight active non-example items, and unique announcement IDs. The two supplied text copies are incomplete and invalid JSON at line 447, so they were not treated as production feed payloads; the live endpoint itself validated successfully.

The WordPress.org submission archive was built as dist/PublishRank-v2.9.71.zip. It contains 195 files under one publishrank/ directory and excludes repository metadata, development tools, tests, and documentation.

Manual interaction gap

A live staging WordPress dashboard was not available for browser testing. The score-card drag script and touch-action: none styling are present and the script is enqueued on supported post editor screens, but mouse, pen, and touch movement have not been verified in a browser. The new News actions submit to the registered admin-post.php handler with a nonce and capability check; the earlier general admin-screen buttons have not been validated interactively. Test these behaviors on a clean staging site before production rollout.

PublishRank 2.9.70

PublishRank 2.9.70 — coding-standard error remediation

Summary

This maintenance release follows the 2.9.69 review-correction release. It applies project-wide PHP coding-standard corrections and updates brittle source-text regression checks so they tolerate whitespace changes while continuing to assert the same plugin limits and behavior. The optional Netlify Identity Publisher Account linking added on the concurrently updated main branch is preserved in this release; the coding-standard pass itself adds no new feature.

Corrections

• Applied WordPress-Core/WordPress-Extra corrections across the PHP source tree, including translator context, output escaping, SQL preparation, control-flow formatting, and PHP style findings.
• Preserved the current optional Netlify Identity account-linking implementation from the concurrently updated main branch and corrected its PHP coding-standard issues. Its live provider flow was not authenticated in this validation.
• Added the repository-owned phpcs.xml.dist ruleset, scoped to PHP and compatible with the project’s PSR-4 class-file naming.
• Made warning-only PHPCS results non-blocking for the Composer exit status. PHPCS still prints and counts warnings; the rule does not suppress or erase them. The remaining warning backlog is reported below.
• Refreshed four source-level regression checks to use whitespace-tolerant patterns for IndexNow history, schema type selection, and sitemap size constants.
• Kept the editor score-card mouse/touch movement and admin-screen action changes from earlier releases; this release does not claim those interactions were verified in a live dashboard.

Validation performed

• composer run phpcs: 0 errors. The current ruleset reports 177 warnings across 50 files; warnings remain visible but no longer make an error-free run return a failing exit status.
• All 31 standalone PHP tests passed.
• PHP syntax lint passed across production and test PHP, the plugin bootstrap, and uninstall.php.
• node --check passed for all JavaScript assets.
• git diff --check passed.
• The WordPress.org-style ZIP is built separately by tools/build_plugin_zip.py; the archive is checked for a single publishrank/ root and omission of repository metadata, tests, development tools, dependencies, and developer documentation. The validated archive contains 193 files under one publishrank/ directory.

Remaining gaps

• The 168 PHPCS warnings are not fixed in this patch. They are advisory/non-blocking only; they remain in the PHPCS output and should be triaged in a follow-up.
• The temporary WordPress staging login did not complete, so editor score-card dragging and admin screen buttons have not been verified interactively. Perform manual checks on a clean WordPress installation with the supported editor, theme, and plugin combinations before relying on those UI interactions in production.

PublishRank 2.9.69

PublishRank 2.9.69 — review corrections and release validation

Purpose

This maintenance release follows the automated WordPress.org review of 2.9.68. It focuses on the reported translation, escaping, placeholder-order, and distribution-package findings. It does not change the plugin’s feature set or replace a live WordPress installation test.

Corrections

• Added translator notes for dynamic values throughout the affected admin, SEO, sitemap, and indexing messages. Replaced the conditional Search Console translation call with two literal gettext strings.
• Ordered the multiple substitutions in the weekly audit subject, integrity warning, and sitemap-audit messages, and clarified each placeholder’s meaning.
• Escaped the Search Console connection label, schema labels, verification-form action URLs, verification token attributes, author names, and generated status-pill markup at their output contexts. Sanitized the WordPress nonce-field HTML in the image-optimizer form; the front-end provenance markup remains a fixed, internally escaped HTML fragment.
• Added tools/build_plugin_zip.py. It derives the package version from the plugin header and creates one publishrank/ top-level directory while omitting dotfiles, .git, .github, test fixtures, Composer development files, tools, vendor/, and old dist/ archives. Documentation and runtime assets remain in the package.
• Removed the unused brain/context ^3.0 development requirement (no project reference uses it) and configured the PHPCS standards installer explicitly. The repository’s standalone PHP checks are not PHPUnit tests; Composer now exposes the actual smoke test as composer smoke rather than pointing at a missing PHPUnit configuration file.

Validation performed

• PHP parser lint over production and test PHP sources, plus the plugin bootstrap and uninstall script.
• WordPress-Core internationalization and output-escaping sniffs over production PHP: 0 errors and 0 warnings after the fixes.
• Targeted standalone checks passed for smoke, site verification, sitemap audit, sitemap limits/sharding, JSON-LD escaping, and several other feature modules.
• The 2.9.69 release ZIP contains 222 files in a single publishrank/ root. Archive checks confirmed the absence of hidden files, .git, .github, tests, tools, Composer metadata, and the development vendor/ tree. Bundled frontend libraries and their licenses remain included.

Known gaps — not represented as passing checks

The repository has historical regression scripts whose assertions no longer describe the current 2.9.68/2.9.69 source. Running every tests/*.php script currently fails in these seven files:

1. tests/analytics.php — expects the Search Console analytics page and implementation to be removed, a 30-day cap, and old help copy; the current plugin has a Search Console page and its own current reporting behavior.
2. tests/dashboard_redirects.php — pins version 2.9.48 and previous dashboard artwork/copy.
3. tests/dashboard_schema_sitemap_fixes.php — asserts previous welcome-heading styling and revoked schema-panel behavior.
4. tests/liveblog_schema.php — contains a legacy schema-value expectation that differs from the current schema allow-list.
5. tests/llms_txt.php — asserts retired source-attribution controls and opt-in behavior.
6. tests/release_2_9_45.php — hard-codes an old release version.
7. tests/schema_editor_coverage.php — expects retired schema options and old dashboard editor links.

These failures predate the present security/translation corrections; their stale assertions should be reviewed and refreshed in a separate test-maintenance pass. Test files are excluded from the installable release archive, but remain in the source repository. Consequently this release does not claim that the entire historical test directory passes.

The broad repository command composer phpcs is also still non-clean: it reports 8,191 errors and 2,013 warnings across 134 files under the full WordPress-Core/WordPress-Extra ruleset. The scanner-focused i18n and output-escaping checks above are clean; full-project coding-standard remediation remains open. A before-patch full-ruleset baseline was not captured, so this report does not attribute those aggregate findings to particular commits.

No clean WordPress staging site or browser session was available for end-to-end interaction testing. The earlier reports about editor buttons and card movement therefore still require a manual installation check on the supported WordPress/editor/theme/plugin combinations. Static source checks cannot prove that every screen button works in a live dashboard.

PublishRank 2.9.68

Changes

• Enable the editor SEO score card drag behavior by enqueueing its existing interaction script on supported post-editor screens for mouse, pen, and touch.
• Align the plugin header, runtime version, readme stable tag, and changelog at 2.9.68.
• Replace raw admin-toolbar style output with a local stylesheet enqueued through WordPress.
• Restrict Local SEO helper output to an explicit HTML allowlist.
• Add extensive development, troubleshooting, security, testing, and release documentation.

Validation notes

JavaScript syntax, version consistency, selected static checks, whitespace, and ZIP integrity were checked. PHP lint, WordPress Plugin Check/PHPCS, and live WordPress UI and role testing remain outstanding. A GitHub release does not submit or guarantee approval by WordPress.org.

PublishRank 2.9.63

PublishRank 2.9.63

Robustness audit and fixes

• Verified there is only one PublishRank custom-admin implementation and one module registration. The existing feature was not duplicated, but its previous behavior had recovery and lockout edge cases.
• Password recovery now remains available for lostpassword, retrievepassword, rp, resetpass, checkemail, confirmation, recovery-mode, post-password and registration actions.
• Any already-authenticated WordPress user can continue using normal WordPress admin routing after the short entry gate expires; WordPress capabilities still control what that user can do.
• Direct 404 responses now send no-cache headers so a CDN or reverse proxy cannot cache an unauthenticated /wp-admin/ response and serve it to an authorized browser.
• The native /wp-admin/*.php path remains unchanged for authorized users. Only unauthenticated direct probes are rejected.
• AJAX, admin-post, uploads, script/style loading, REST and cron exceptions remain intact.

Verified overlap

The audit found no second custom-admin gate in PublishRank. The separate Supabase module is an optional gate for PublishRank screens only; it does not replace or duplicate the native WordPress login/admin gate. Traffic Guard explicitly excludes /wp-admin, /wp-login.php, REST and cron paths, so it does not compete with this feature.

PublishRank 2.9.62

PublishRank 2.9.62

• Added a highlighted NEW Admin access protection dropdown in PublishRank Settings.
• Publishers can enable a unique private entry slug or disable the protection without deleting the saved slug.
• Direct unauthenticated /wp-admin/ and /wp-admin/next-admin-slug requests now return 404 before WordPress can redirect bots to the login form.
• Direct unauthenticated /wp-login.php login requests return 404, while password-recovery actions remain available so publishers cannot be locked out.
• The private entry link establishes a short-lived HttpOnly gate, after which WordPress continues using normal /wp-admin/*.php routes for the authorized browser.
• Active administrators remain allowed after the short gate expires, and AJAX, REST, cron, admin-post and upload service paths remain protected from accidental breakage.
• WordPress-generated login links now use the private entry URL, and the setting is included in PublishRank settings export/import.
• Added explicit guidance that hiding the entry point is defense-in-depth, not a replacement for strong passwords, two-factor authentication, updates or a WAF.

WordPress guidance reviewed

• WordPress hardening guidance warns that security through obscurity is not a primary security strategy and recommends updates, least privilege, strong account practices and firewall controls: https://developer.wordpress.org/advanced-administration/security/hardening/
• WordPress documents admin_init as running for admin screens as well as admin-ajax.php and admin-post.php, so those service paths are explicitly preserved: https://developer.wordpress.org/reference/hooks/admin_init/
• WordPress documents login_url as the filter for generated login URLs, which PublishRank uses for the private entry link: https://developer.wordpress.org/reference/hooks/login_url/
• WordPress documents login_init as the login-form initialization hook, which PublishRank uses for the native-login 404 gate and recovery exceptions: https://developer.wordpress.org/reference/hooks/login_init/
• WordPress requires safe redirects to be followed by exit, which the private-entry redirect follows: https://developer.wordpress.org/reference/functions/wp_safe_redirect/

PublishRank 2.9.61

PublishRank 2.9.61

• Updated the live SEO score ring to behave like a progress indicator.
• The filled ring uses a red-to-blue-to-green gradient: red at the beginning, blue through the middle, and green at the end.
• Added rounded progress ends and kept the score number green on the white card.

PublishRank 2.9.60

PublishRank 2.9.60

• Made the editor SEO score card draggable with both mouse and touch/pointer input, constrained it to the viewport, and remembered its position in the current browser.
• Added editable Search title and Meta description controls directly to the live search preview.
• Added Rank Math-style %focus_keyword% and %%focus_keyword%% variables, plus %focuskw% aliases, which resolve to the post Focus Keyword in previews and frontend metadata.
• Added one-click Insert %focus_keyword% controls for both title and description.
• Live preview changes remain unsaved until the normal WordPress post save, while the preview uses the unsaved values immediately.