v1.11.3

Add Create Form Page button for existing/imported Gravity Forms; bump…

v1.11.2

Build Image Optimization backup in batches so large libraries don't t…

v1.11.0

Image Optimization

This release adds an Image Optimization card under Settings › CDG Core › Performance. It's off by default, so updating changes nothing until you turn it on.

What's new

• Three modes. Convert to WebP, compress the original JPG/PNG in place, or both. A Compression Level (1–100, default 80) applies to both. When both are on, the WebP is made first, so it never comes from a recompressed file.
• Resize large uploads. An optional max width (default 2400px) scales big uploads down proportionally and never enlarges. It replaces WordPress's own -scaled copy. A PNG only slightly over the limit is left alone if resizing would make the file bigger.
• WebP on the front end. Image URLs switch to .webp wherever the file exists. This covers , srcset, lazy-load data-* attributes, and CSS backgrounds. Download links, social meta tags and JSON-LD keep the original URLs. It's skipped in the admin, REST, the Customizer preview and the Divi builder. It works with or without month- and year-based upload folders.
• Tools for existing images. Each has a read-only Preview (dry run) that reports what it would do and changes nothing.
• Bulk convert or compress your Media Library.
• Back up your originals as a zip.
• Replace originals with WebP: rewrites image links across all post types, Divi layouts, options, custom fields and term fields, switches the images to native WebP, and deletes the originals.
• Free up space: deletes WordPress's leftover pre-scaled and pre-rotated originals, but only when nothing still links to them.
• Restore from backup undoes steps 3 and 4.
• WP-CLI. wp cdg webp convert|replace|restore|status.
• Divi. Handles Divi 5 block JSON, Divi 4 shortcodes, Library and Theme Builder layouts, and options such as the logo. Replace and
• Restore clear Divi's static CSS cache.

Safety rails

Replace and bulk compress refuse to run unless a backup exists that is under 24 hours old and newer than your latest upload.
Backups are kept 7–90 days (default 30) and have randomized file names.
Anything that isn't safe to touch is skipped, not guessed at.

Also in this release

SVG uploads now save their width and height, which stops WordPress logging "undefined array key" warnings on REST uploads.
A new Image Optimization section in the Guide tab.
The repo's .gitignore now excludes non-production files, and admin/style-guide.html is no longer tracked.

Before you use it

Server setup. SpinupWP runs nginx, which ignores the .htaccess that protects the backup folder. Add a rule to block it:

location ^~ /wp-content/uploads/cdg-webp-backups/ {
    deny all;
}

Save it as /sites//nginx/deny-cdg-backups.conf, then run sudo nginx -t && sudo service nginx reload.

Page cache. Purge your page cache after Replace or Restore. Cached pages keep the old image URLs until you do.
What compression does. Compressing in place removes embedded metadata such as camera data. Photos with unusual colour profiles can shift slightly in colour.
Not tested. Gravity Forms and ACF image fields, real Theme Builder templates in a live editing session, and very large libraries (I tested about 100 images). Try Replace on a staging copy of a large site first.

v1.10.2

updates style sidebar issue

v1.10.1

updated permission rules and groups

v1.10.0

restructure admin and plugin visibility rules

1.9.15

fixed php scripting error in code snippet

v1.9.14

• Documentation tab: the Articles and Categories list rows now use the same 16px 20px padding as setting rows elsewhere in Settings, instead of sitting flush against the card edges.
• Documentation viewer: cards now carry 32px of padding on all sides, with the shared card header/body padding zeroed inside the viewer so the spacing stays exactly 32px.

1.9.13

Documentation moved out of Tools into its own Settings tab

The Documentation post type and its taxonomy no longer register a menu entry at all. Article and category management now live in a new Documentation tab in CDG Core Settings:

• Articles — the 50 most recently edited articles with status, categories, and last-modified date, plus View/Edit actions and an Add New button
• Categories — every category with its article count, linking out to the standard term editor
• The documentation settings (enable toggle, dashboard widgets, widget style, docs per widget) moved here from the Features tab

The viewer intentionally stays at Tools → Documentation — it's a reading surface for the whole site rather than an editing one. It was relabeled from "View" now that the list screen it sat beneath is gone, and both it and the category archive are restyled in the CDG Core design system instead of raw WordPress admin markup.

Fixes

• Code Snippet titles and descriptions gained a backslash before every apostrophe on each save. WordPress magic-quotes $_POST, and sanitize_text_field() doesn't strip slashes — only wp_unslash() does. The snippet code field already handled this; the two text fields didn't, so slashes compounded indefinitely. Fixed the same omission in custom menu link titles, the Post rename labels, sidebar entry and submenu renames, the admin footer text, and Custom Admin CSS (where it was mangling backslashes and quotes in stylesheets).

  Note: this stops new slashes accumulating but doesn't clean values already saved — affected titles need to be re-typed once.

• Fixed the dashboard widgets' "view article" links, which pointed at admin.php?page=cdg-view-doc. The viewer is parented to tools.php, so admin.php can't resolve it.

• Tools → Autoloaded Options no longer reports "failed" when toggling an option that's already in the requested state.

Security

• The "Restrict to Administrators" toggle for SVG, font, and Lottie uploads could be bypassed. The upload_mimes filter checked capabilities correctly, but the paired wp_check_filetype_and_ext filter did not — it stamped a valid extension/MIME pair onto any matching file regardless of who was uploading, which is all wp_handle_upload() needs to accept it. Both filters now share one capability check.

• The SVG sanitizer passed LIBXML_NOENT, which despite its name enables entity substitution — opting into the behavior behind XXE and billion-laughs expansion. Removed, and SVGs carrying a DOCTYPE are now rejected outright. Event-handler attributes are stripped by on* prefix rather than a fixed list, which had been missing onmouseenter, onwheel, and onpointerdown among others.

• The Documentation viewer now checks read_post before rendering, so drafts and private articles aren't readable by anyone who can guess a post ID.

1.9.12

• Fixed the Documentation Categories link, still missing from Tools after 1.9.11's fix. That fix set the taxonomy's own show_in_menu to 'tools.php', but WordPress core never actually reads that value in this configuration: the only place a taxonomy's show_in_menu gets turned into a submenu link is a loop in wp-admin/menu.php that runs solely for post types with their own top-level menu (show_in_menu === true, checked strictly) — and post types nested under an existing menu (like Documentation under Tools) skip that loop entirely. Unlike post types, which get a dedicated fallback (_add_post_type_submenus() in wp-includes/post.php) for exactly this nested case, taxonomies have no such fallback in core. Categories is now added the same way View Documentation already is: a manual add_submenu_page( 'tools.php', ... ) call pointed at the real edit-tags.php screen.