v1.2.1 — Connect setup UI + full-state backup + security hardening

Connect turns the headless REST bridge into a guided setup screen — plus full-state backup/restore and a round of security hardening.

Added

• Connect — a guided setup UI ("Bricks MCP" admin page): a status grid (plugin / Bricks / REST endpoints / Application Passwords), one-click Application Password creation (copy button; the plaintext is shown once via a 120s transient — never via the URL — with a revoke table), a multi-client config generator with ready-to-paste config for Claude Code, Claude Desktop, Cursor, Windsurf, Cherry Studio and Hermes (pre-filled with your site URL, username and the generated password), a connection test, and an admin-bar status chip. Purely additive — it registers an admin menu only (no REST route or auth path touched), gated behind is_admin() + the bab_admin_ui_enabled flag.
• Full-state backup & restore — capture the whole Bricks layer (pages / templates / global classes / menus) plus a curated allowlist of WordPress core settings into one downloadable file, and restore it. The backup directory is hardened (.htaccess deny + index.php + an unguessable token filename) and the dump deliberately excludes secrets / API keys.

Security

• Spoofing-resistant client IP for rate-limiting & the login lockout. Proxy-forwarded headers (X-Forwarded-For / CF-Connecting-IP / X-Real-IP) are now honored only from configured trusted proxies (bab_trusted_proxies constant / option / filter; set it to '*' to restore the legacy behavior); otherwise the real TCP peer (REMOTE_ADDR) is used. Closes a bypass where a client could forge X-Forwarded-For to rotate the throttle key and defeat the login lockout.
• Object-level authorization on page-mutating endpoints. update_page / patch_page / append_elements / clone_page / build_page / sign-code now require edit_post on the specific target page, not merely the generic edit_posts capability — a lower-privileged user can no longer overwrite arbitrary pages by ID. Reads are unchanged; administrators are unaffected.
• Allowlist-based backup restore. import_full_state writes only the same curated WordPress-core option keys the export captures (previously an infra-only denylist), so a crafted backup file can no longer set arbitrary options.
• Backup filename token widened 6 → 20 characters (the only protection on nginx, where the directory's .htaccess deny is ignored).
• Application Passwords force-enable is now opt-out-able via the BAB_FORCE_APP_PASSWORDS constant / bab_force_app_passwords filter (default unchanged).

Update: download bricks-api-bridge.zip below and update the plugin in WordPress (or wp plugin install bricks-api-bridge.zip --force). Full history in CHANGELOG.md.