v0.10.0

v0.10.0 - July 10, 2026

The surfaces release. One nav item per job, with every capable plugin layered in behind it: Forms (now including Contact Form 7 via Flamingo or CFDB7), Email Log, Activity Log, Snippets, Redirects and Backups (UpdraftPlus and Disembark) are first-class Minn views with a provider switcher, and the sidebar reorganizes into Workspace, Tools and Manage. Around them: admin notices extracted into a safe digest (with background actions and Hide), one-click Update everything, Clear site cache across a dozen providers, find & replace in the editor, a Spam settings page, Site Kit traffic, and Integrations diagnostics so a misdeclared surface explains itself.

Added

• Spam settings page: Settings gains a Spam section showing who filters comment spam and what happens to it. Active providers (Akismet, Antispam Bee, CleanTalk bundled; others via the minn_admin_spam_providers filter) each get a card with configured state, all-time blocked count, a few safe toggles and a link to their full screen. The page also carries the spam-queue count with a jump to the Comments spam tab (or a plain explanation when commenting is disabled) and core's Disallowed Comment Keys blocklist, editable in place.
• Integrations diagnostics: the System page gains an Integrations card: a live registry of every surface, editor panel, design source, cache purger, page builder and hook listener, each attributed to the plugin that registered it, with descriptor problems flagged (unknown keys, missing routes, columns without keys). A malformed integration used to fail silently in the app; now it explains itself, and the copy report carries the section for tickets.
• Open design-library seam: any block plugin can now put its template library in Minn's slash menu and block picker by answering the new minn_admin_design_sources filter; the picker groups each library under its own name. The bundled Stackable, Kadence and GenerateBlocks adapters register through the same filter, and the two-endpoint route contract is documented in docs/for-plugin-authors.md.
• Security activity log (Wordfence): Wordfence joins the Activity Log family with a login-security view: every sign-in and failed attempt, with usernames and decoded IPs, filterable by success/failure and searchable. Firewall and scans stay in wp-admin. New docs/plugin-support.md maps everything Minn covers.
• Add theme opens with popular themes: the Add theme dialog now preloads the WordPress.org popular directory instead of a blank search box, so there's always something to pick.
• Backups surface (UpdraftPlus): a read-only Backups view lists every backup set (components, size, where it's stored, when), a Backups health check on the System page answers "is my site backed up?" at a glance (pass under 36 hours, warn under 8 days, fail beyond or on errors), and ⌘K gains Back up site now, which starts a backup through UpdraftPlus's own background machinery and never runs it in-request. Restores stay in wp-admin.
• AIOSEO and SEOPress in the SEO panel: the editor's SEO panel (title, meta description, focus keyword) now covers All in One SEO and SEOPress alongside Yoast and Rank Math. AIOSEO stores in its own table rather than postmeta, so Minn reads and writes through AIOSEO's own model; additional keyphrases are preserved and clearing a field removes it cleanly. The first active SEO plugin wins, in install-base order.
• Site Kit traffic: sites running Google Analytics through Site Kit get the real Overview traffic chart with no dedicated analytics plugin. Reports flow through Site Kit's own REST module as the current user, so Google auth, dashboard sharing and API quotas stay Site Kit's job. A purpose-installed analytics plugin still answers first; Site Kit fills in when none is active, with results cached for 15 minutes.
• Email Log family: FluentSMTP, WP Mail SMTP and Post SMTP join Gravity SMTP under one Email Log nav item with a provider switcher. FluentSMTP and Post SMTP show the full send log (subject, recipients, sent/failed, message body) and FluentSMTP supports one-click Resend; WP Mail SMTP (free) surfaces its debug events, which is where that plugin records delivery failures. All read-only database shims: serialized recipient blobs are mined with regexes, never unserialized, and each plugin's local-versus-UTC timestamp convention is normalized so relative times read true.
• Clear site cache: one ⌘K command purges every cache layer the site runs. Bundled providers: Kinsta (page, CDN, object cache and OPcache via the hosting mu-plugin), LiteSpeed Cache, WP Super Cache, W3 Total Cache, WP Rocket, WP Fastest Cache, SiteGround Optimizer, Autoptimize, WP-Optimize, Cache Enabler, Hummingbird and Elementor's generated CSS. Each layer purges in its own isolated request, so one broken cache plugin never blocks the rest; third parties can add providers with the minn_admin_cache_purgers filter.
• Duplicate: the content row menu can duplicate any post or page as a new draft. Content, excerpt, taxonomy terms and meta (builder data, featured image, SEO fields) ride along, and an Open action in the toast jumps straight into the copy.
• Update everything: the notification panel's Updates tab pins a single button that runs every pending plugin, theme and WordPress core update in one click (core goes last, with poll-verified completion), shows each step while it works, then reports what changed.
• Core updates, front and center: a pending WordPress update now shows a banner on the Overview page and an amber chip in the topbar on every screen (alongside the existing Extensions banner, notification item and a new System health check). Updating polls for completion, so a connection dropped while core files are replaced can no longer report a false failure; the poll also finishes a missed database migration. When WordPress updates itself (minor releases do), a notification says so instead of the update nag silently vanishing.
• Theme updates surface: pending theme updates light the Extensions dot and appear in notifications; clicking one lands on the Themes tab.
• Admin-notice digest: notices other plugins print in wp-admin now land in Minn's notification panel under a new Notices tab. Minn triggers a background dashboard pageload as the current user, renders each registered notice callback in an isolated buffer, and extracts structured data only (severity, plain text, action links, owning plugin via Reflection). No third-party HTML, CSS or JavaScript ever reaches Minn.
• Notice actions run in the background: a notice's own links render as buttons on the row. Allow, dismiss and opt-in style links (the ones that reload the page they rendered on) run without leaving Minn, the plugin's own security nonce reaches its handler untouched, and the digest refreshes so an actioned notice disappears on the spot; external links open in a new tab.
• Hide any notice: every row on the Notices tab gets a Hide button (with Undo) that clears the notice from Minn's digest. Some plugins wire their notice dismissal to their own admin-ajax JavaScript, which no extraction can replay; Hide covers those and anything else you are done seeing. A hidden notice stays hidden across re-captures until its text changes, and hiding is per-user in Minn only: wp-admin is untouched.
• Find & replace in the editor: ⌘⇧F opens a find bar over the post (also in ⌘K); plain ⌘F stays the browser's native find. Matching works the way a writer expects: case-insensitive with an Aa toggle, matches cross bold, italic and code boundaries but never cross blocks, and protected block islands are left alone. Enter and ⇧Enter step through highlighted matches, Replace and Replace-all rewrite through the editor's native input path so ⌘Z steps back one change at a time, and Esc closes with the current match selected.
• Disembark in the Backups family: sites using the Disembark connector get a Backups view that tells the truth about a pull-based tool: a status card with the last scan, database size and working files on disk, the exact disembark connect command as a click-to-copy box (also in ⌘K as Copy Disembark backup command, fetched on demand so the site token never rides a pageload), scan sessions with per-session delete, workspace cleanup, and token regeneration. Minn never claims backup freshness for Disembark; the site cannot know a pull completed.
• Surface status cards: adapters (bundled or third-party) can now declare a status route on any surface and get a card above the list: server-built stat rows, an optional copy-to-clipboard command box, and action buttons with confirm and refresh semantics. The Disembark adapter is the reference; the shape is documented in docs/for-plugin-authors.md.
• Contact Form 7 joins the Forms family: the biggest form plugin in the ecosystem, through both of its popular storage plugins. With Flamingo (CF7's own companion), messages render as contact cards with per-form tabs, spam and unspam run through Flamingo's own handlers (Akismet reporting rides along), trash stays restorable in Flamingo, and CF7 forms list in the Manage view with shortcodes and message counts. With CFDB7, entries are read from its serialized rows without ever running unserialize (a byte-length scanner walks the data instead, so hostile content cannot execute), opening a message marks it read like CFDB7's own screen, and delete is honest about being permanent. Form building stays in CF7's editor, one click away.
• Snippets surface: Code Snippets, WPCode and FluentSnippets list, toggle, create and edit from Minn. One Snippets nav item with a topbar provider switcher when more than one is active.
• Forms family: Fluent Forms and Elementor Pro join Gravity Forms under one Forms nav item. Entry details use a contact-style card (name, email, message body, quiet meta) instead of a raw field dump. ←/→ still steps entries on the page.
• Redirects edit: Safe Redirect Manager and Simple 301 Redirects support in-place edit (not list-only). Redirect adapters collapse to one Redirects nav item with a provider switcher.
• Activity Log family: WP Activity Log, Aryo, Stream and Simple History collapse to one Activity Log nav item. Event detail uses the same card language as form entries (who, event message, short context, meta chips) with open-in-log and Simple History action links where available.
• Users context menu: right-click (or ⋯) a user for View, Copy email, Send password reset, Send email (styled HTML from the site), Sign out sessions, Edit in wp-admin, and Delete with a reassign autocomplete. REST: users/{id}/reset-password and users/{id}/email.
• Buttons live island: slash Buttons inserts a multi-row CTA editor (label, URL, new tab, outline, add/remove). Nested core/button markup stays Gutenberg-valid; non-edited attrs (e.g. colors) are preserved.
• Interactive Details island: expand/collapse, type the summary and body in the card (no free top-level <details> that traps the caret).
• Shortcode island field: type [shortcode …] in the island; no browser prompt.
• Pullquote as editable prose; slash insert for Spacer, File and Shortcode (Basics always lists them, including on classic-mode posts; insert promotes to blocks mode).
• Add plugin categories: SEO, Forms, Ecommerce, Security, Backup, Analytics, Cache, Email/SMTP, Redirects, Dev tools, Spam, Blocks. Each chip runs a plain WordPress.org search so the directory ranks popular options.
• Admin bar "Edit in Minn Admin": on a singular front-end view you can edit, the bar node retargets to that post/page in the Minn editor; elsewhere it stays Minn Admin → the app home.

Improved

• Sidebar in three groups: the navigation now separates the act-on-it set (Workspace: Overview, Content, Media, Comments, Orders, Forms) from site plumbing (Tools: Email Log, Activity Log, Snippets, Redirects, Backups, and any future surface family by default), and Extensions joins Manage. Group labels collapse and expand with the choice remembered, every row keeps its icon, and third-party surfaces can claim Workspace with a group descriptor key when they are genuinely inbox-shaped; everything else lands in Tools so the prime real estate stays curated.
• Plugin toggle refresh: activating or deactivating a plugin re-polls surfaces, builders and editor insertables so the sidebar and slash menu match live state without a hard reload.
• Comments nav: hidden when comments are disabled site-wide; detection uses support / REST mechanisms rather than a single plugin slug.
• History card: labels when a version was superseded; hides the live-post mirror; refreshes after save; site-timezone dates no longer skew.
• Activity detail chrome: drops the redundant "Open in log" meta chip (footer open-in-provider remains).
• User email template: site-branded only (no Minn Admin header/footer credit).

Fixed

• Spam page tracks plugin toggles: activating or deactivating a spam plugin from Extensions now refreshes Settings → Spam in the same session; the cached settings data used to survive the toggle until a hard reload.
• wrapperText fields no longer double-render: a block-form wrapperText pattern and the generic text-run pass both offered the same string, so the labeled field appeared alongside a duplicate "Text" run and the two edits raced. The labeled field now wins; overlapping runs are suppressed.
• Sidebar scrolls on short screens: the navigation list scrolls when the window is short; the logo, search and your account stay pinned.
• Details no longer breaks the editor: free contenteditable <details> trapped the caret and blocked typing after insert; Details is an island with trailing affordance and Remove + undo.
• Basics list completeness: Spacer, File, Shortcode (and Embed/Gallery) always appear in Browse all / Basics even on classic content.
• ⌘Z restores removed islands: while the "Block removed" toast is up, ⌘Z / Ctrl+Z runs the same restore as the Undo button (island deletes are outside Blink's undo stack).
• New → Post/Page from the editor: URL changed to /editor/pages but the open post stayed on screen. Route change now compares editor type + id and rebuilds a blank document.
• Relative times ("in 4h" on EDT): bare UTC timestamps (Code Snippets modified, Stream/WSAL/Aryo, GF entry dates, Redirection last hit, Simple History date_gmt) were parsed as site-local. normalizeTimeInput honors utc / *_gmt; adapters emit Z or set column utc: true. Site-local WP REST dates unchanged.
• Otter Product Review / classic blocks no longer preview as giant stars: Otter only registers front-end style.css handles when has_block() runs on a real post, so island do_blocks never loaded them. The Otter adapter now registers those styles from the submitted markup (and returns their URLs) so review stars, pros/cons, and the rest layout at real size.
• Otter Maps preview is no longer an empty shell: the Leaflet block is a JS-only empty div (and Otter can emit invalid height:400pxpx). Previews now use OpenStreetMap's embed iframe (Otter's own AMP path) so the map is visible without running Leaflet in the editor.
• Slash menu on blank posts: empty editor bodies (new pages, select-all + delete) left the caret in a bare text node with no wrapping <p>, so typing / never opened the block menu. Blank bodies now seed a paragraph, and a bare text / is promoted to one on the fly.
• Block editor ↗ saves first: the inspector (and locked-mode) escape to wp-admin now persists the live document before opening, so unsaved islands no longer vanish in Gutenberg. The button reads Saving… while the request runs.
• ⌘S in shortcode (and other live-field) islands: focus in a shortcode input used to stop keydown propagation, so ⌘S never hit Minn and the browser offered "Save Page As…". Save is handled in the capture phase and commits the focused field first.
• Backspace/Delete arm-then-remove is consistent: empty shortcode fields, empty code blocks, and islands all share the same first-press red outline / second-press remove (with Undo). Empty paragraphs no longer jump over a shortcode into the previous code block.
• Featured image thumb is clickable: opens the media preview modal (full image, title/alt, Copy URL, Open, Edit image). From that context, Replace featured and Remove featured are available; saving an edited copy adopts it as the new featured image.
• Self-update reloads the app: updating Minn Admin from Extensions (single or Update all) hard-reloads the page so the version badge, boot payload, and new JS/CSS land immediately instead of leaving a stale SPA in memory.