v4.14.5

Fixed

• Trashing a published post now purges the post's public URL from the Cloudflare cache, also when a trashed post with the same slug already exists.
• Failed connections to the Cloudflare API now show the reason instead of a generic "Request error", without PHP warnings.
• PHP 8.1+ deprecation notices when a request has empty or missing input.
• Activating the plugin on an unsupported WordPress version now deactivates it again with a notice.

Changed

• Requires WordPress 6.7 or newer, as the plugin now supports the five latest major WordPress versions.
• Tested up to WordPress 7.1.2.
• Improved the automated tests and CI, including tests on the five latest WordPress versions and compatibility tests with popular plugins.

Security

• Compare CSRF tokens in constant time.
• Escape output on the settings page and sanitize input to the settings page proxy.
• Only use the CF-Connecting-IP header as the visitor IP address when it holds a valid IP address.

v4.14.4

Fixed

• Guard against non-string parse_url result in pathIsNotForFeeds.

Added

• Unit tests for Hooks.php covering private helpers, purgeCacheByRelevantURLs, isEnabled methods, getPostRelatedLinks, and cache purge event handlers.
• Extract WP core class stubs into a shared test fixture and bootstrap.

Changed

• Bumped symfony/yaml from 5.4.45 to 5.4.52.
• Bumped symfony/polyfill-intl-idn from 1.37.0 to 1.38.1.

Security

• Declare least-privilege permissions on php-build, php, and stale CI workflows.

v4.14.3

= 4.14.3 - 2026-05-12 =

Fixed

• FQCN references are now correctly rewritten by update-namespaces.php during build.
• Fixed double pipes typo after ttf in htaccess.
• Recognize new cfk_/cfut_/cfat_ credential formats
• Apply settings fail-fast when using Account Owned Tokens
• Partial-failure test silently overwriting message regex assertion
• PHP 8.4 deprecation by marking $previous parameter explicitly nullable
• Now trimming apiKey and email to prevent whitespace issues on authentication.

Changed

• Replace FQCN type hints with imported aliases for LoggerInterface.

v4.14.2

What's Changed

• Release/v4.14.2 by @barrykooij in #571

Full Changelog: v4.14.1...v4.14.2

v4.14.1

What's Changed

• Fix classmap autoloading for deprecated classes in release builds by @barrykooij in #569

Full Changelog: v4.14.0...v4.14.1

v4.14.0

What's Changed

• Suppress security warning for API key in test by @wglane in #562
• Release/4.14.0 by @barrykooij in #564
• Add explicit permissions to release workflow by @barrykooij in #565
• Added backwards compatibility for deprecating of CF\ namespace in favor of Cloudflare\APO\ by @barrykooij in #566
• Changed release.yml dry-run from false to true by @barrykooij in #567

New Contributors

• @wglane made their first contribution in #562

Full Changelog: v4.13.0...v4.14.0

v4.13.0

What's Changed

• 4.13.0 by @barrykooij in #557
• fix: restored default experimental matrix value by @barrykooij in #558
• Update semgrep.yml by @hrushikeshdeshpande in #559

Full Changelog: v4.12.8...v4.13.0

v4.12.8

What's Changed

• Prevent default settings from enabling Auto Minify due to deprecation (#547)

Full Changelog: v4.12.7...v4.12.8

v4.12.7

What's Changed

• Upgrade cloudflare-plugin-frontend to v3.10.0 (#542)

Full Changelog: v4.12.6...v4.12.7

v4.12.6

What's Changed

• Upgrade cloudflare-plugin-frontend to v3.9.0 (#537)

Full Changelog: v4.12.5...v4.12.6