v1.3.2 - the cache fix that actually works

1.3.1 set the standard DONOTCACHEPAGE constant and I assumed that was enough. It was not - the live site was still serving a stored copy of the build page.

WP Fastest Cache ignores DONOTCACHEPAGE for ordinary pages. Reading its source, it honours the constant only for a 503 while Wordfence is active, for a 403, or on the Divi theme. A normal 200 is cached regardless. It has its own opt-out function which also cannot be triggered via do_action, because its handler inspects debug_backtrace for a frame with that exact name.

Verified against a real WP Fastest Cache 1.5.0 install with an A/B/A that removes and restores the fix, so the test is shown to reproduce the bug rather than just reporting a pass. A control confirms ordinary pages still cache - the exclusion is scoped to the build address only.

After updating, clear your cache once to remove any copy already saved.

v1.3.1 - never let a page cache store the build page

Fixes a caching problem found on a live site.

A page cache had frozen the build address and was serving a stored copy of the passcode screen. Two consequences: anyone who had already entered the passcode was asked for it again on every visit (PHP never ran, so the 12-hour sign-in cookie was never checked), and more seriously, whichever request happened to fill the cache decided what everyone else saw - filled from a signed-in browser it would have served the build screen publicly.

The build address now opts itself out of caching at init (DONOTCACHEPAGE, DONOTCACHEOBJECT, DONOTCACHEDB, LiteSpeed and WP Rocket hooks) plus Cache-Control: no-store. Scoped to the build address only: the home page, master page and built video pages still cache normally.

After updating, purge your cache once to clear the copy already stored.

v1.3.0 - short address with a passcode gate

Short address for the build page, e.g. yoursite.com/video-builder, so staff are not typing a 40-character URL on a phone.

A short address can be guessed, so the passcode becomes required rather than optional and is asked for before anything else renders. Someone who finds the URL sees a bare passcode box with no site name and no hint of what the page does. Correct passcode sets a signed HttpOnly cookie for 12 hours, bound to the passcode and the secret key so changing either logs everyone out. Wrong guesses capped at ten an hour per IP. The secret key is never written into the gated page.

Also fixed: the page returned HTTP 404 while rendering correctly, and the result box said "is live" when building a draft.

The long ?vpb= address is unchanged and keeps working.

v1.2.1

Passcode is now case-insensitive and space-tolerant. Installable zip attached.

v1.2.0

Adds an optional no-login build page on a secret URL. Installable zip attached.

v1.1.0

Adds optional company name in the page title. Installable zip attached.

v1.0.0

First release. Installable WordPress plugin zip attached.