1.3.0

This release adds an Allowed URLs setting with wildcard support, groups the more advanced options under their own section, and fixes several long-standing admin-page-access and translation issues.

🚀 Added

• Allowed URLs — A new textarea on the Dashboard Access settings page where you can paste any URLs that should skip the dashboard redirect, one per line. Useful for letting customers reach a specific admin page (like a payment confirmation or a TrustedLogin secret-share screen) without giving them the rest of the dashboard.
• Wildcards in Allowed URLs — Use * inside a query value to match a group of pages at once. For example, ?page=tl-* lets through tl-secrets, tl-config, and any other page slug that starts with tl-.
• Also block AJAX — A new checkbox in the Advanced section to extend the dashboard restriction to admin-ajax.php requests too. Most sites should leave this off; turn it on only if you know your AJAX endpoints rely on this plugin to keep them gated.
• Advanced section — The settings page now has two clear groups: the everyday Dashboard Access Controls at the top, and an Advanced section below for AJAX blocking and the Allowed URLs list. Easier to scan, less intimidating for new users.

✨ Improved

• The settings page now validates the capability values you save. A typo, empty value, or unknown capability can no longer be saved and silently disable the dashboard restriction.
• The disallowed-user redirect uses WordPress's safer wp_safe_redirect(). Your configured redirect URL still works, including external destinations — but accidental redirects to other hosts are now blocked.
• When you add an admin.php?page=… entry to the allow-list, the plugin now confirms the page is actually registered by another plugin before letting visitors through.

🐛 Fixed

• admin-post.php is now reachable as the 1.2.2 release notes promised. It had been quietly blocked despite the documentation saying it should be exempt.
• Two-step admin flows on allow-listed pages — like Wordfence Login Security's 2FA OTP step — no longer get rejected just because the request carries extra query parameters.
• Translations from translate.wordpress.org will now actually load on your site. The plugin's text domain didn't match the WordPress.org slug, so community-submitted translations (including zh_TW) were silently being dropped. Thanks to Alex Lion (阿力獅) (@alexclassroom) for surfacing this and contributing the fix.
• A handful of strings that weren't translatable before — most notably the screen-reader hint on the Login Message link — are now translatable.
• The uninstall script only runs when WordPress is actually uninstalling the plugin, not on stray requests to its file.

💻 Developer Updates

• Text domain renamed from remove_dashboard_access to remove-dashboard-access-for-non-admins to match the WordPress.org slug. If you maintain custom .po/.mo files in /languages/, rename them to use the new domain.
• New rda_strict_ajax filter mirrors the "Also block AJAX" setting for code-level control on a per-site basis.
• The existing rda_allowlist filter still works; entries now support * wildcards inside query values.
• New unit test suite using @wordpress/scripts + wp-env + PHPUnit. Run locally with npm test.