v0.13.0 — Security scans & hardening

Adds two new commands used by the Plugsent dashboard's Security section:

• security.scan — read-only facts: WP_DEBUG, SSL/siteurl scheme, XML-RPC state, DISALLOW_FILE_EDIT, blog_public, inactive plugin/theme counts, and the current hardening state.
• security.harden — enables/disables six persisted protections: hide WordPress version, block user enumeration, mask login errors, disable the file editor, send security headers (X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy), disable XML-RPC. State is stored in the plugsent_hardening option and re-applied on every request.

Advertises security.scan and security.harden capabilities so the dashboard gates the new UI per site.

Install: upload plugsent-connector-0.13.0.zip via Plugins → Add New → Upload, replacing the existing connector. Requires connector 0.12.0+ already paired; pairing data is untouched.

v0.10.0 — reliable magic login on cached sites

Fixes the admin login failing with 'link has expired' on sites running Redis/Memcached object caches: login tokens were stored as expiring transients, which external object caches may evict before use. Tokens are now stored in the database (option row, autoload off) and verified timing-safely.

v0.9.1 — friendlier login token lifetime

Admin login tokens now live for 5 minutes (was 2), so slow WP-Cron hosts and quick page visits don't run out the clock.

v0.9.0 — the real admin login release

Implements the admin.login capability for real: the 0.7.0/0.8.0 releases advertised it but the dispatch branch was silently missing (sites correctly replied unsupported_command).

• Single-use, 120-second magic login into wp-admin for the paired admin user
• Token delivered only through the signed command channel

Required for the dashboard's Admin button to work.

v0.8.0 — instant command pickup + version reporting

The connector now long-polls the server (opt-in wait parameter), so dashboard actions reach the site in seconds. Also reports its own connector version to the dashboard.

Recommended for all sites — pairs with the platform's new live progress features.

v0.7.0 — one-click admin login from Plugsent

New admin.login command: the dashboard can generate a single-use, 120-second magic login into this site's wp-admin for the paired admin user. Security: random 64-hex token, single-use, delivered only through the signed command channel.

v0.5.0 — single connection string pairing

Pairing is now ONE paste: the dashboard gives you a single connection string (server + credential combined), and the connector parses it. No separate server URL field. Both pairing codes (PLSG-) and API keys (plsk_) work.

v0.4.1 — pair with your site's API key

The pairing field now accepts the site's stable API key from the Plugsent dashboard (top-right 'API Key' on any site page) — no more rushing a 15-minute one-time code. Pairing codes keep working as before.

v0.4.0 — live step-by-step batch updates

Command results are reported one by one as they finish, so the Plugsent dashboard shows live step-by-step progress during batch updates (waiting → updating → updated), paired with the platform's new progress panel and 'Update all' button.

v0.3.1 — update results verified by version

Fixes false-positive update results: theme updates that hit an 'up to date' early-return (cache refresh race during batch updates) were reported as successful. Results are now verified by comparing the installed version before and after.