Hide WP Surface 0.2.2

Prevents external login plugins from sending successful OIDC logins back to an already-consumed callback URL.

Hide WP Surface 0.2.1

Fixes admin CSS and JavaScript loading through a verified wp-admin alias and keeps external login providers on the verified login alias.

Hide WP Surface 0.2.0

This security update disables markers created by older releases. After updating, replace the generated server block and verify the login and path aliases again from the standard wp-admin path. The runtime GitHub updater and Nginx FastCGI compatibility mode were removed.

== Changelog ==

• Bound activation and probe markers to the exact configuration hash so an old verified marker cannot enable changed paths or login settings.
• Disabled active aliases before saving path changes and made every login alias require its own verified marker.
• Authenticated the original-path server handoff, removed unauthenticated internal flags, disabled their caching, and separated internal capabilities by login, admin, content, and includes purpose.
• Matched normalized Nginx URIs and added verification for percent-encoded and duplicate-slash original-path bypasses.
• Removed the direct Nginx FastCGI compatibility blocks so aliases re-enter canonical locations and retain origin access controls.
• Removed unsigned runtime GitHub update installation, third-party updater code, stored GitHub credentials, and outbound update telemetry.
• Removed whole-response HTML buffering to avoid response-sized memory amplification.
• Expire authentication cookies from old admin alias paths and clean their tracked paths during uninstall.
• Hardened marker and recovery files against symlink writes, modernized Apache deny rules, and made verification-probe cleanup fail closed.
• Registered the unauthenticated AJAX route probe only while a matching one-time verification probe exists.
• Pinned every third-party GitHub Actions step to a full commit SHA.

Hide WP Surface 0.1.29

• Made generated Nginx aliases follow the activation and probe markers so disabling path aliases stops the aliases as well as original-path blocking.
• Generated login aliases only when custom login is enabled and made Apache and Nginx login aliases honor the emergency recovery file.
• Migrated installations without a saved alias token to one persistent token instead of generating a different default during each settings read.
• Corrected the privacy documentation to disclose GitHub release checks when automatic updates are enabled.
• Added a Composer lock file so release builds package a reproducible Plugin Update Checker version.

Hide WP Surface 0.1.28

• Forced a fresh GitHub release check before wp plugin update so WP-CLI does not rely on Plugin Update Checker's normal 12-hour schedule.
• Added the same forced-check API to the bundled updater fallback for installations without Composer dependencies.

Hide WP Surface 0.1.27

• Kept final HTML path rewriting enabled for administrator responses even when a page-cache plugin defines WP_CACHE.
• Restored aliased load-scripts.php and load-styles.php URLs on administrator pages while continuing to skip final rewriting for cacheable front-end responses.

Hide WP Surface 0.1.26

• Skipped final WP_HTML_Tag_Processor rewriting on cacheable GET and HEAD requests when WordPress page caching is enabled.
• Preserved final HTML rewriting for uncached requests, including POST requests and responses marked with DONOTCACHEPAGE.
• Kept URL generation filters and fingerprint cleanup active so page-cache compatibility does not disable the rest of the plugin.

Hide WP Surface 0.1.25

• Prevented custom login responses from being stored by page-cache plugins through the widely supported DONOTCACHEPAGE signal and no-cache response headers.
• Requested an optimization bypass through the conventional DONOTMINIFY signal without depending on cache-plugin-specific hooks.
• Kept cache exclusions scoped to the configured login alias so normal front-end pages remain cacheable.

Hide WP Surface 0.1.24

• Normalized server-rewritten login aliases to the native wp-login.php request context before login rendering and OIDC plugins run.
• Fixed Authorizer compatibility so /login is not mistaken for an embedded login form return URL, avoiding the redundant post-OIDC redirect back to the login page.
• Kept OAuth2/OIDC callback query parameters intact while removing only the private alias handoff parameter.

Hide WP Surface 0.1.23

• Added Korean localization and standardized the plugin text domain as hide-wp-surface.
• Added translation catalog validation and release-time MO/PHP language file generation to CI.
• Split the settings page into accessible tabs for paths and login, server integration, fingerprint cleanup, and updates.
• Preserved the active settings tab through URL hashes and keyboard navigation while keeping all settings in one save operation.
• Replaced the hard-coded /control/admin-ajax.php guidance with the currently configured wp-admin alias path.
• Stopped tracking local IntelliJ IDEA module metadata and generated translation binaries.