2.0.0

Automatic Cloudflare provisioning, SAML removed, and every finding from an independent security audit fixed. Tested up to: 6.8

Breaking: SAML support is removed. It never verified response signatures. Sites configured for SAML are switched to OIDC on upgrade, and sites that were in "Cloudflare only" mode are moved back to side-by-side login so nobody is locked out. Read "Upgrading from 1.x" in the README.

New

• The setup wizard creates the Cloudflare Access application for you from one scoped API token: account discovery, team domain, redirect URL, scopes, allow policy, credentials. The token is never stored.
• Identity-provider groups map to WordPress roles and are re-applied on every login. Email-domain restrictions are checked on every login. New accounts use the email address as the username.

Security (all pre-existing in 1.0.x)

• Primary-mode bypass via ?cfzt_callback=1; shared OIDC state (login CSRF); rate limiter trusting spoofable headers; backup codes mintable by any edit_users holder; client secret rendered into the settings page and exported; log and CSV injection.

Fixed

• Saving the Advanced form wiped role mapping, domain restrictions and redirects. Settings import double-encrypted the secret. Role mapping never matched because the groups scope was not requested. Backup codes were unreachable in primary mode. Dark-mode page unreadable.

Upgrading: install over 1.0.x as usual. The stored client secret is re-encoded automatically. Settings exports no longer include the client secret; re-enter it after importing elsewhere.

Full details in CHANGELOG.md.