Horse Tools 1.3.45

• Fixed: the table of contents title leaked into other posts' excerpts. The the_content filter that adds the TOC guarded against archives and feeds with is_singular()/in_the_loop()/is_main_query(), but those only describe the page's main query, not which post is actually being filtered. A "related posts" block or card list on a singular page runs its own query and calls the_post() on that without changing the main query's flags, so the guard still passed — and the TOC title got prepended to that other post's content before WordPress trimmed it down to an excerpt, leaving the title text stuck to the front of the summary ("Mục lục …"). The guard now also checks that the post being filtered is the one actually being viewed.
  Translations:
• Arabic, German, Spanish, French, Indonesian, Japanese, Portuguese (Brazil) and Russian brought to full coverage — 811 strings each, added since the plugin's original translation baseline (two-factor authentication, the lightbox, the table builder, FAQ schema, PHP snippets, the WooCommerce Telegram integration, mail-deliverability diagnostics, and more). Hindi and Thai are in progress.

---

Install: download horse-tools-1.3.45.zip below, then Plugins → Add New → Upload Plugin.

Horse Tools 1.3.44

• Fixed: a reCAPTCHA key in the wrong box locked people out of their own site, and nothing said so. A v2 key and a v3 key are indistinguishable by eye. Put a v2 key in the box with the dropdown on V3 and Google refuses to load the widget; the hidden token is never filled; the server rejects the empty token; and the generic-error setting turns all of that into "Login failed". The person at the keyboard sees a wrong password on a password that is right, with the word reCAPTCHA appearing nowhere.
• The login form now says when reCAPTCHA failed to load, above the fields, before anything is typed. The old code called into grecaptcha without checking it existed, so a failed load threw a script error and the form went on looking normal.
• The reCAPTCHA error is no longer replaced by the generic "Login failed". Naming reCAPTCHA reveals nothing about which accounts exist, which is the only thing that masking is for.
• New: "Test these keys against Google" on the Google tab. It checks the keys currently in the boxes, not the saved ones, and tells you which of the two is wrong — v2 key in the v3 slot, secret and site key swapped, or an empty secret meaning reCAPTCHA is protecting nothing. A transport failure is reported as "could not tell" rather than as a bad key.
• Fixed: deferring JavaScript could break WordPress's own scripts. Scripts carrying inline code are skipped, and skipped scripts run before deferred ones — so anything they depend on must not be deferred either. It wasn't, and on the login screen clipboard and dom-ready were deferred while user-profile and a11y, which need them, were not. The whole dependency chain is now walked, not just one level.
• Found by reading a site that could not be logged into, rather than from the report — the report said "wrong password", which was the one thing it was not.

---

Install: download horse-tools-1.3.44.zip below, then Plugins → Add New → Upload Plugin.

Horse Tools 1.3.43

• Fixed: the login security question rejected correct Vietnamese answers. The answer was compared with strtolower(), which only lowercases the 26 English letters. It turns "Bé" into "bé" but leaves "Đào", "Ánh", "Út" and "Ơn" exactly as they were — so an owner who saved "Đào" and typed "đào" was refused, every time, with an answer that was right. Accented capitals are precisely where nicknames and names begin, so the commonest kind of answer was the one that could not work.
• And you were never told which field was wrong. With user-enumeration protection on, every login error is replaced by a generic "Login failed" so the screen cannot reveal whether an account exists. A failed security question reveals no such thing — the message is identical whether or not the account exists — so it now comes through intact, and says specifically whether the answer was wrong or the box was left empty. Reported from a site where a correct password read as a wrong one for exactly this reason. It is the second time this masking has swallowed a message it should not have; the first was the 2FA screen in 1.3.5.
• Two more ways a right answer used to be a wrong one: a double space between words, and the two legal encodings of the same Vietnamese letter (composed "ắ" versus "ă" plus a separate accent — identical on screen, different bytes, and which one you get depends on the keyboard). Both are now handled. Unicode normalisation needs the intl extension; without it the rest still applies.
• Diacritics still count. "dao" is not "đào" — nothing here makes the answer easier to guess.

---

Install: download horse-tools-1.3.43.zip below, then Plugins → Add New → Upload Plugin.

Horse Tools 1.3.42

• Choosing an email service now switches the Email module on. Found by opening the new screen on a live site rather than trusting it: every SMTP setting filled in correctly and the module's own on/off switch stayed off, which is a configuration that looks complete and cannot send a thing — the exact failure this screen was built to prevent.
• The line explaining that your existing settings already look like a particular service now disappears once you pick one, instead of sitting above help that contradicts it.

---

Install: download horse-tools-1.3.42.zip below, then Plugins → Add New → Upload Plugin.

Horse Tools 1.3.41

• Pick your email service and the SMTP settings fill themselves in. The form asked eight questions. Seven of them have exactly one right answer once you know which service you are using, and the eighth is a password — so it now asks which service, and answers the seven itself. Gmail and Google Workspace, Brevo, Resend, SendGrid, Mailgun, Zoho, Microsoft 365 and Yandex.
• It says what the password is called and where to find it, per service, because "app password" and "SMTP key" and "API key" are three different things in three different places, and a site owner who has never sent mail through a relay has no way to know which one this box wants.
• Two services want a fixed account name — Resend wants the literal word resend, SendGrid wants apikey — and people quite reasonably type their email address there instead, then read "the password is wrong" and change the password. The screen now says so before that happens.
• Signing in as one address and sending as another is now caught and explained. It is the commonest way to end up with settings that connect perfectly and mail that never lands: the service accepts the login, then refuses or quietly drops the message, and from your side those look identical to nothing happening. Only stated for the services that actually have the rule, and only when both addresses are filled in.
• If your domain already receives mail through one of the listed services, the screen names the entry to choose — sending through the service that already handles your mail is the one most likely to work first time.
• A site that filled the eight fields in by hand years ago is not asked to start again: the service is recognised from the server name and its notes apply as they stand.
• The three provider logos that used to sit above the form are gone. They filled in three of the fields, silently, for three services, and said nothing about the two that decide whether the mail actually arrives.

---

Install: download horse-tools-1.3.41.zip below, then Plugins → Add New → Upload Plugin.

Horse Tools 1.3.40

• The mail checks no longer draw conclusions from an address the site does not really send from. Sites behind a proxy, a load balancer or a container runtime see 127.0.0.1 or a 10.x where the public address should be, and judging either the sender policy or the reverse name against that answers a question about a machine which does not exist on the internet.
• It mattered more than it sounds. The sender-policy check could evaluate a private address against a record ending in "reject everything else" and print a confident accusation that happened to be right for the wrong reason — and would have been wrong the first time it met a host whose real address was authorised. It now says it cannot tell, which every screen already knows how to show.
• The Email screen states the address mail leaves by, and the name that address carries. Half the checks on that screen are about it, and when it is unknown they are skipped — which is a different thing from passing, and now reads as one.

---

Install: download horse-tools-1.3.40.zip below, then Plugins → Add New → Upload Plugin.

Horse Tools 1.3.39

• Horse Tools now checks whether your server's address has a name. Gmail and Yahoo both expect the address a message arrives from to resolve back to something, and Yahoo refuses outright when it does not — which from your side looks exactly like the message vanishing, because the refusal happens at the far end and the bounce goes somewhere you never read.
• A plain VPS often has no such name, because nobody set one and nothing else needs it. The site owner cannot see it, and has no way to connect "no reverse DNS" to "the customer says the order email never came".
• Only the unambiguous case is reported: no name at all. Whether an existing name is a good one has enough grey in it to produce false alarms, and this screen does not raise those.
• This is what was actually wrong on the two sites it was written for — and the release before this one guessed differently. Port 25 turned out to be open; the addresses simply had no names. The check added in 1.3.38 stays, because it is right about the case it describes, but it was not this case.

---

Install: download horse-tools-1.3.39.zip below, then Plugins → Add New → Upload Plugin.

Horse Tools 1.3.38

• Horse Tools now checks whether your server can reach any other mail server at all — the question nobody asks, and the answer that explains most vanished email. WordPress hands each message to a local mail program, that program accepts it (which is why every screen says "sent"), and then finds outbound port 25 closed. DigitalOcean, Google Cloud and many others close it by default so their machines cannot be used for spam. The message waits in a queue nobody reads, and no bounce arrives, because a bounce would have to leave by the same door.
• This is reported first, above everything else, because no DNS record can change it. A site in this state can spend weeks adjusting SPF while every message goes on sitting in a queue.
• Diagnosed from two sites on one server with opposite DNS — one publishing a hard-fail SPF, the other publishing none at all — both reporting mail sent and neither delivering anything. Different DNS, identical outcome, so the DNS was not the cause. The earlier releases' focus on SPF was right about what those records say and wrong about why the mail was disappearing.
• The check is a bare TCP connect to a well-known mail exchanger, held for half a day. Nothing is sent and no message is involved; it asks only whether the door opens. It is skipped entirely when the site already sends through an SMTP service, because those use a different port.

---

Install: download horse-tools-1.3.38.zip below, then Plugins → Add New → Upload Plugin.

Horse Tools 1.3.37

• If you have already paired Telegram for two-factor recovery, security messages now go there — no extra setup. Asking for a chat ID was asking a question the plugin had already answered. A site with the bot token filled in and an administrator paired has a working bot, a known chat and a proven route; the alert code reported "no Telegram" anyway and pushed everything into email, because it only knew to look at the WooCommerce order chat field.
• Found on a live site whose owner said the bot had been set up ages ago. They were right — token present, bot reachable, chat on file since the day they turned on two-factor recovery. The gap was mine.
• The screen names where the chat came from, so a site that never typed one anywhere is told why it is suddenly receiving Telegram messages. A dedicated field still wins, then the order chat, then the paired one.

---

Install: download horse-tools-1.3.37.zip below, then Plugins → Add New → Upload Plugin.

Horse Tools 1.3.36

• The check-in message now falls back to the other channel — and says so, loudly. If Telegram will not send, the message goes by email instead, with a line at the top naming the channel that failed and repeating the reason it gave. A quiet fallback is the classic mistake: Telegram breaks, email carries everything without comment, and a year later you believe you have two channels when you have had one since March — and find out when the second one goes too. The delivery is not the news; the failure is.
• Arriving by the backup route is therefore recorded as a fault, not a success. It shows on the health card and in the "not protected" list until the main channel works again.
• Domains you approved a long time ago are now brought back for a second look. A domain can go bad without anything on your site changing: it expires, somebody else buys it, and a link approved in 2019 points at whatever they sell now. Nothing here moved, so nothing here noticed.
• That nudge is filtered so it cannot become a wall. A site that approved 686 domains in one click would otherwise get all 686 back a year later, which is not a review. Only domains that are both over a year old and linked from one or two posts are raised — a domain you link from two hundred posts is one whose going bad you would hear about from a customer within the week; a domain reached once, from an article nobody has opened since 2019, is the one that can change hands in silence.
• "Checked — still fine" only resets the clock. It never changes what is approved.

---

Install: download horse-tools-1.3.36.zip below, then Plugins → Add New → Upload Plugin.