3.11.0

Groundwork only — nothing changes for anyone in this release.

A way round a block neither host can lift

Some stores are refused by security software sitting in front of our service, which judges callers by the reputation of their hosting address. When that address is shared with other websites, a store can be refused for things it had no part in.

That situation has no fix at either end. Our host cannot make an exception for one address on a shared server, and a store cannot mend the reputation of an address it shares with strangers.

The plugin can now be pointed at a different way of reaching us, which needs nobody's permission.

When it is used

Only after both ordinary routes have been answered with a browser check. A store connecting normally makes exactly one request, as it always has, and waits for nothing.

No alternate address is set in this release, so nothing changes yet. A single site can be pointed at one by adding TCGIANT_SYNC_RELAY_FALLBACK to its wp-config.php, which is how it gets tested on the store that needs it.

The connection test reports on that route too, when one is configured.

One thing worth being plain about

Whatever stands on that alternate route can read the eBay credentials passing through it, because encryption ends there before being re-established to us. That is a genuine widening of who is trusted with your account details, and it is exactly why this is a last resort rather than the ordinary path — it is reached only when the direct routes have already failed, and never otherwise.

Connections over plain, unencrypted addresses are refused outright.