1.4.3

[1.4.3] - 2026-05-25

Changed

• WordPress 7.0 compatibility — Tested and confirmed compatible with WordPress 7.0. Bumped Tested up to header to 7.0. No code changes required; the plugin uses no APIs affected by 7.0's dev notes (no block registration, no the_author_posts_link / get_the_author_link calls, no Abilities or Sync providers).
• Anthropic model dropdown — Now displays the dated snapshot IDs returned by Anthropic's API (e.g. claude-sonnet-4-5-20250929) instead of the short aliases. Previously saved aliases are preserved as valid options in the dropdown.

Added

• Dynamic Anthropic model list — The "Refresh Models" button on the AI Configuration settings page now calls Anthropic's /v1/models endpoint when the active provider is Anthropic, replacing the previous static "pre-configured" message. The fetched list is cached per-provider in riviantrackr_anthropic_models_cache with the same 7-day TTL as the OpenAI cache. The original hardcoded curated list is retained as a fallback when the API is unreachable or no key is set.
• Per-provider "Last updated" timestamp — The timestamp shown below the Refresh Models button now reflects whichever provider's cache is active (OpenAI or Anthropic).

1.4.1

Added

• Minified CSS and JS assets — All frontend and admin stylesheets and scripts now ship with pre-built .min.css / .min.js versions generated by clean-css and terser. Production sites load the minified files by default (~35% smaller), while developers can load the unminified originals by setting SCRIPT_DEBUG to true in wp-config.php.

1.4.0

Added

• RivianTrackr Design System — Introduced CSS custom properties (--rtg-*) across both frontend and admin stylesheets, creating a centralized, token-based design system sourced from the RivianTrackr branding guide.
• Dark theme tokens (frontend) — riviantrackr.css now defines :root variables for accent (#fba919), backgrounds (#121e2b, #0f1a26), text (#e5e7eb), border (#374151), star rating colors, border radii, and font stacks. All component styles reference these tokens.
• Light theme tokens (admin) — riviantrackr-admin.css now defines :root variables for action colors (#0071e3), success/error/warning/info states, text hierarchy, backgrounds, border radii, shadows, and font stacks. All admin component styles reference these tokens.
• Brand gradient on provider badge — The AI provider badge mark now uses the full RivianTrackr signature gradient (12-color sweep) instead of the previous green-to-blue gradient.
• prefers-reduced-motion support — Both frontend and admin stylesheets now disable all transitions and animations when the user has reduced motion enabled, improving accessibility.

Changed

• Accent color updated — Frontend accent changed from green (#22c55e) to brand gold (#fba919) for spinner, source links, hover states, and focus rings.
• Default border color updated — Changed from #94a3b8 to #374151 across PHP defaults, admin form placeholders, and generated CSS to match the dark theme design system.
• Widget border-radius — Updated from 10px to 12px to match --rtg-radius-card token.
• Plugin author — Updated to "RivianTrackr".

1.3.5

Added

• "Hide zero-result queries" filter on Analytics dashboard — A toggle button at the top of the Analytics page that filters zero-result entries out of all views (overview stats, daily stats, top queries, top errors, and recent events). Non-destructive — data stays in the database and reappears when the filter is toggled off. Uses the existing indexed results_count column so there is no performance cost. Useful for seeing clean analytics without spam, while preserving the ability to analyze content gaps when needed.
• Sticky filter preference — The "Hide zero-result queries" toggle now remembers your choice via WordPress user meta. Once enabled, the filter stays active across page loads, navigation, and browser sessions — no need to re-enable it every time you visit Analytics. Each admin user's preference is stored independently.

Fixed

• Automatic cleanup of old off-topic log entries on upgrade — All junk queries logged before the off-topic filter existed are now automatically purged from the riviantrackr_logs and riviantrackr_feedback tables the first time an admin loads a page after upgrading. Uses a stored riviantrackr_version option to ensure it runs exactly once.
• "Scan & Remove Spam" button now also purges off-topic queries — The existing spam purge in Settings previously only checked for spam patterns and SQL injection. It now also applies the off-topic relevance filter, so clicking the button removes old entries like "scrub daddy" or "costco credit card" that aren't spam per se but don't match any configured relevance keywords.
• Session cache hit endpoint now filters off-topic queries — The /log-session-hit endpoint (rest_log_session_cache_hit()) had no off-topic check, allowing junk queries to be logged to analytics via this path. A bot could POST directly to the endpoint, or the frontend JS could log a cached error response. The endpoint now applies is_off_topic_query() and silently drops matching queries.
• Off-topic errors now cached in browser — The frontend JS previously only cached no_results errors in sessionStorage. Off-topic errors were not cached, so navigating back to the same off-topic search page would re-fire the REST endpoint every time. Off-topic errors are now cached alongside no-results, preventing repeat requests.
• Cached off-topic responses skip session cache hit logging — When serving a cached off-topic error from sessionStorage, the JS no longer calls logSessionCacheHit(), preventing the junk query from reaching the /log-session-hit endpoint.

1.3.3

Fixed

• Off-topic queries no longer logged to analytics — The off-topic filter in rest_get_summary() was calling log_search_event() before returning the error response, which meant every junk query like "scrub daddy" or "costco credit card" still ended up in the analytics database even though it was correctly blocked from reaching the AI API. The log call has been removed so off-topic queries are silently dropped — they never appear in analytics, never consume database space, and never clutter the admin dashboard.

1.3.2

Fixed

• Server-side no-results logging now validates input — The log_no_results_search() method (hooked on template_redirect) previously logged every zero-result search query directly to the database with no validation. Bots could pollute analytics simply by requesting /?s=junk without ever executing JavaScript, completely bypassing all REST endpoint protections (bot detection, spam filtering, off-topic checks, rate limiting). The method now applies bot detection via is_likely_bot(), input validation via validate_search_query() (covers SQL injection, spam patterns, blocklist, length limits), and is_off_topic_query() before logging — matching the same checks enforced on the REST API summary endpoint.

1.3.1

Added

• Relevance Keywords (off-topic filter) — New admin setting that lets you define the topics your site covers (e.g. "rivian, r1t, r1s, ev, electric vehicle"). Search queries that don't match any keyword are rejected early with a friendly message, preventing completely unrelated searches (e.g. "costco credit card", "msi monitor amazon portugal") from cluttering analytics and wasting server resources. Comma or newline separated, case-insensitive. Leave empty to allow all queries (backwards compatible).
• RIVIANTRACKR_ERROR_OFF_TOPIC error code — New error code returned when a query is blocked by the relevance filter, enabling frontend-specific handling.
• InputValidator::is_off_topic_query() method — Checks queries against configured relevance keywords using both substring and exact word matching.
• 12 unit tests for off-topic detection covering keyword matching, case insensitivity, comma/newline separators, empty configuration, and various junk query patterns.

1.3.0

Added

• Progressive IP penalties — Repeat rate-limit offenders now face escalating bans instead of a simple 60-second reset. 2nd strike within 10 minutes triggers a 5-minute ban, 3rd within 30 minutes triggers a 30-minute ban, and 4th+ within 1 hour triggers a 24-hour ban. Strike history tracked via WordPress transients.
• Mandatory JS challenge token — New "Require JavaScript Challenge" setting (enabled by default) makes the bt/bts bot challenge token mandatory on the summary endpoint. Previously, bots could bypass the check by omitting the token parameters entirely.
• Honeypot field — A hidden input field is rendered in the search summary widget. Legitimate JavaScript-driven requests send it empty; bots that auto-fill form fields are instantly rejected with a 403.
• Duplicate query throttling — The same search query from the same IP is blocked for 5 minutes to prevent bots from repeatedly hammering the AI API with identical requests. Legitimate users are unaffected since the frontend session cache already handles repeat queries.
• RateLimiter unit tests — 27 new PHPUnit tests covering progressive IP bans, duplicate query detection, bot token validation, IP rate limiting, log rate limiting, and client IP resolution.

1.2.0

Added

• PHP namespaces — All extracted classes are namespaced under RivianTrackr\AISearchSummary with a PSR-4 style autoloader (includes/class-autoloader.php). This prevents class name collisions and aligns with modern PHP standards.
• PHPUnit test suite — 87 unit tests covering SQL injection detection, spam filtering, custom CSS sanitization, text truncation, API content parsing, cache key generation, reasoning model detection, prompt building, and autoloader resolution. Tests run without a full WordPress environment using lightweight function stubs.

Changed

• Architecture: Monolithic file split into focused classes — The 6,300-line main plugin file has been refactored into five dedicated component classes:
  • includes/class-api-handler.php — OpenAI and Anthropic API communication, prompt construction, retry logic with exponential backoff, response normalization, and content parsing.
  • includes/class-cache-manager.php — Server-side transient caching, namespace-based invalidation, cache key generation, and OpenAI model list caching.
  • includes/class-rate-limiter.php — IP-based rate limiting with atomic locking, global AI call rate limiting, bot detection heuristics, JS challenge token validation, and client IP resolution.
  • includes/class-analytics.php — Search event logging, user feedback recording, log purging, feedback statistics, success rate calculation, and trending keyword queries.
  • includes/class-input-validator.php — Search query validation, SQL injection pattern detection, spam/scanner probe filtering, custom CSS sanitization (XSS prevention), and smart text truncation.
• Main plugin file delegates to components — All extracted logic in the main RivianTrackr_AI_Search_Summary class now delegates to the namespaced component classes. Hooks, admin UI rendering, and WordPress integration remain in the main class.

1.1.0.3

Improved

• AI prompts: Site-aware branding — System prompts for both OpenAI and Anthropic now instruct the AI to identify as the site's built-in search assistant rather than a generic external AI. Responses naturally attribute information to the site's coverage (e.g. "Based on RivianTrackr's reporting…") and use the site name in fallback messages, making summaries feel native to the platform.