Tool Kits 2.7.32 — Automatic SEO/GEO & Lightweight Health Center (Pre-release)

Tool Kits 2.7.32 — Automatic SEO/GEO & Lightweight Health Center

This is a pre-release. The stable release remains v2.7.30.

Deployment requirement

This package inherits signed license verification from v2.7.31. Deploy the matching NexaMonitor signing API and its matching key before installation. Production readiness of that deployment has not been verified in this release. Licensed features will not activate against the previous unsigned server. The package contains public verification keys only; no private signing key is included. See LICENSE_SECURITY.md for provisioning and rollout order.

The optional PHP2Shell collector badge additionally needs the updated NexaMonitor collector controller, ToolkitsPhpSecurity support class, and collector view. Older collectors can continue accepting the heartbeat without showing this badge. No database migration is required. This plugin release does not deploy server changes or update PHP itself.

Changes

• Move the Tool Kits SEO/GEO panel to the editor sidebar, including existing editors with a saved bottom-panel order.
• Remove manual Related Content, References / Sources, and Schema Type inputs. Derive references from existing source metadata and editorial external links, related content from shared taxonomies, and schema types from the content type. Preserve legacy saved values without applying their overrides. Remove manual global schema mapping.
• Refine the Health Center score, status cards, metric panels, empty state and narrow-column layout. Show at most three priority actions, critical findings first, linked to the detailed saved checks.
• Add a local version-based PHP2Shell assessment to manual Health Center and Vulnerability scans. Vendor/prerelease builds require vendor verification; unknown branches and CLI data cannot establish web patch status. This is not an exploitation test or compromise scan.
• Request a new manual scan after 24 hours or tracked environment changes. Existing reports remain available. Runtime, WordPress/Tool Kits versions, theme/plugin lifecycle changes and selected configuration values are tracked locally; external server/proxy/file changes are not exhaustively detected.
• Show four-stage manual progress, busy state and distinct completion/error messages. Bound the client to one start and four scan steps, without automatic retry or polling.
• Attach a small saved PHP assessment to the existing heartbeat. The collector prevents stale or CLI results from displaying as a patched web runtime.

Load and behavior

These additions create no new cron jobs, automatic scans, file crawls, exploit probes, CVE API lookups or network requests. Opening Health Center reads the saved report and small local configuration values. Heartbeat reuses the saved web assessment. Existing manual Health Center homepage/profile requests and existing manual Vulnerability Scanner update checks are unchanged.

Upgrade notes

• Run one new manual Health Center scan to populate the web PHP assessment and configuration fingerprint. Legacy reports request a new scan and are not treated as fresh.
• The schema selection becomes automatic even where a legacy manual override exists. References and related links are omitted where real supporting content cannot be found.
• Review all affected PHP runtimes and update PHP through the hosting provider or administrator. A version assessment does not prove that a host was never compromised or that every worker has been restarted.

Assets: tool-kits.zip and SHA256SUMS.

Validation

• 54/54 plugin regression cases pass on PHP 7.4 and PHP 8.4, including runtime assessment, freshness, bounded manual scanning, automatic SEO/GEO and signed licensing checks.
• 112 PHP files pass syntax checks on both runtimes.
• Two targeted NexaMonitor tests pass with 13 assertions for assessment display, stale/CLI handling, optional heartbeat persistence, backward compatibility and invalid-status rejection.
• Browser preview verifies saved/stale/empty widget states and narrow-column layout without horizontal overflow inside the widget and metric panels.
• Release metadata, ZIP structure, exact packaged-source bytes, public-key inclusion, absence of private keys/environment files and SHA-256 manifest verified.