PublishRank 2.9.71

PublishRank 2.9.71 — opt-in News feed

Release contents

• Adds an opt-in PublishRank → News screen that reads the public Netlify JSON announcements feed only after an administrator enables it.
• Displays validated announcement content with summaries, optional same-host HTTPS images and links, expandable details, and publication dates.
• Adds nonce- and capability-protected enable, refresh, and disable actions. Disabling removes both local feed caches.
• Bounds remote requests, validates the feed schema and status, sanitizes and escapes rendered values, ignores popup/HTML instructions, and supports a limited stale-cache fallback.
• Adds privacy-policy disclosure, WordPress.org external-service documentation, and a dedicated News feed operations guide.
• Synchronizes plugin header, runtime version, stable tag, and regression fixture to 2.9.71.

Validation

All 32 standalone PHP regression scripts passed. Recursive PHP syntax checks passed, JavaScript syntax checks passed, git diff --check passed, and the Composer PHPCS command exited successfully with 0 errors. It reports 177 warnings across 50 files; these are non-blocking and remain a visible backlog. The new News screen file itself passes the project PHPCS ruleset without warnings.

The live endpoint returned HTTP 200 with application/json; its 23,730-byte payload parsed as schema 1.0 with an active feed, a one-hour TTL, 10 announcements, eight active non-example items, and unique announcement IDs. The two supplied text copies are incomplete and invalid JSON at line 447, so they were not treated as production feed payloads; the live endpoint itself validated successfully.

The WordPress.org submission archive was built as dist/PublishRank-v2.9.71.zip. It contains 195 files under one publishrank/ directory and excludes repository metadata, development tools, tests, and documentation.

Manual interaction gap

A live staging WordPress dashboard was not available for browser testing. The score-card drag script and touch-action: none styling are present and the script is enqueued on supported post editor screens, but mouse, pen, and touch movement have not been verified in a browser. The new News actions submit to the registered admin-post.php handler with a nonce and capability check; the earlier general admin-screen buttons have not been validated interactively. Test these behaviors on a clean staging site before production rollout.

PublishRank 2.9.70

PublishRank 2.9.70 — coding-standard error remediation

Summary

This maintenance release follows the 2.9.69 review-correction release. It applies project-wide PHP coding-standard corrections and updates brittle source-text regression checks so they tolerate whitespace changes while continuing to assert the same plugin limits and behavior. The optional Netlify Identity Publisher Account linking added on the concurrently updated main branch is preserved in this release; the coding-standard pass itself adds no new feature.

Corrections

• Applied WordPress-Core/WordPress-Extra corrections across the PHP source tree, including translator context, output escaping, SQL preparation, control-flow formatting, and PHP style findings.
• Preserved the current optional Netlify Identity account-linking implementation from the concurrently updated main branch and corrected its PHP coding-standard issues. Its live provider flow was not authenticated in this validation.
• Added the repository-owned phpcs.xml.dist ruleset, scoped to PHP and compatible with the project’s PSR-4 class-file naming.
• Made warning-only PHPCS results non-blocking for the Composer exit status. PHPCS still prints and counts warnings; the rule does not suppress or erase them. The remaining warning backlog is reported below.
• Refreshed four source-level regression checks to use whitespace-tolerant patterns for IndexNow history, schema type selection, and sitemap size constants.
• Kept the editor score-card mouse/touch movement and admin-screen action changes from earlier releases; this release does not claim those interactions were verified in a live dashboard.

Validation performed

• composer run phpcs: 0 errors. The current ruleset reports 177 warnings across 50 files; warnings remain visible but no longer make an error-free run return a failing exit status.
• All 31 standalone PHP tests passed.
• PHP syntax lint passed across production and test PHP, the plugin bootstrap, and uninstall.php.
• node --check passed for all JavaScript assets.
• git diff --check passed.
• The WordPress.org-style ZIP is built separately by tools/build_plugin_zip.py; the archive is checked for a single publishrank/ root and omission of repository metadata, tests, development tools, dependencies, and developer documentation. The validated archive contains 193 files under one publishrank/ directory.

Remaining gaps

• The 168 PHPCS warnings are not fixed in this patch. They are advisory/non-blocking only; they remain in the PHPCS output and should be triaged in a follow-up.
• The temporary WordPress staging login did not complete, so editor score-card dragging and admin screen buttons have not been verified interactively. Perform manual checks on a clean WordPress installation with the supported editor, theme, and plugin combinations before relying on those UI interactions in production.

PublishRank 2.9.69

PublishRank 2.9.69 — review corrections and release validation

Purpose

This maintenance release follows the automated WordPress.org review of 2.9.68. It focuses on the reported translation, escaping, placeholder-order, and distribution-package findings. It does not change the plugin’s feature set or replace a live WordPress installation test.

Corrections

• Added translator notes for dynamic values throughout the affected admin, SEO, sitemap, and indexing messages. Replaced the conditional Search Console translation call with two literal gettext strings.
• Ordered the multiple substitutions in the weekly audit subject, integrity warning, and sitemap-audit messages, and clarified each placeholder’s meaning.
• Escaped the Search Console connection label, schema labels, verification-form action URLs, verification token attributes, author names, and generated status-pill markup at their output contexts. Sanitized the WordPress nonce-field HTML in the image-optimizer form; the front-end provenance markup remains a fixed, internally escaped HTML fragment.
• Added tools/build_plugin_zip.py. It derives the package version from the plugin header and creates one publishrank/ top-level directory while omitting dotfiles, .git, .github, test fixtures, Composer development files, tools, vendor/, and old dist/ archives. Documentation and runtime assets remain in the package.
• Removed the unused brain/context ^3.0 development requirement (no project reference uses it) and configured the PHPCS standards installer explicitly. The repository’s standalone PHP checks are not PHPUnit tests; Composer now exposes the actual smoke test as composer smoke rather than pointing at a missing PHPUnit configuration file.

Validation performed

• PHP parser lint over production and test PHP sources, plus the plugin bootstrap and uninstall script.
• WordPress-Core internationalization and output-escaping sniffs over production PHP: 0 errors and 0 warnings after the fixes.
• Targeted standalone checks passed for smoke, site verification, sitemap audit, sitemap limits/sharding, JSON-LD escaping, and several other feature modules.
• The 2.9.69 release ZIP contains 222 files in a single publishrank/ root. Archive checks confirmed the absence of hidden files, .git, .github, tests, tools, Composer metadata, and the development vendor/ tree. Bundled frontend libraries and their licenses remain included.

Known gaps — not represented as passing checks

The repository has historical regression scripts whose assertions no longer describe the current 2.9.68/2.9.69 source. Running every tests/*.php script currently fails in these seven files:

1. tests/analytics.php — expects the Search Console analytics page and implementation to be removed, a 30-day cap, and old help copy; the current plugin has a Search Console page and its own current reporting behavior.
2. tests/dashboard_redirects.php — pins version 2.9.48 and previous dashboard artwork/copy.
3. tests/dashboard_schema_sitemap_fixes.php — asserts previous welcome-heading styling and revoked schema-panel behavior.
4. tests/liveblog_schema.php — contains a legacy schema-value expectation that differs from the current schema allow-list.
5. tests/llms_txt.php — asserts retired source-attribution controls and opt-in behavior.
6. tests/release_2_9_45.php — hard-codes an old release version.
7. tests/schema_editor_coverage.php — expects retired schema options and old dashboard editor links.

These failures predate the present security/translation corrections; their stale assertions should be reviewed and refreshed in a separate test-maintenance pass. Test files are excluded from the installable release archive, but remain in the source repository. Consequently this release does not claim that the entire historical test directory passes.

The broad repository command composer phpcs is also still non-clean: it reports 8,191 errors and 2,013 warnings across 134 files under the full WordPress-Core/WordPress-Extra ruleset. The scanner-focused i18n and output-escaping checks above are clean; full-project coding-standard remediation remains open. A before-patch full-ruleset baseline was not captured, so this report does not attribute those aggregate findings to particular commits.

No clean WordPress staging site or browser session was available for end-to-end interaction testing. The earlier reports about editor buttons and card movement therefore still require a manual installation check on the supported WordPress/editor/theme/plugin combinations. Static source checks cannot prove that every screen button works in a live dashboard.

PublishRank 2.9.68

Changes

• Enable the editor SEO score card drag behavior by enqueueing its existing interaction script on supported post-editor screens for mouse, pen, and touch.
• Align the plugin header, runtime version, readme stable tag, and changelog at 2.9.68.
• Replace raw admin-toolbar style output with a local stylesheet enqueued through WordPress.
• Restrict Local SEO helper output to an explicit HTML allowlist.
• Add extensive development, troubleshooting, security, testing, and release documentation.

Validation notes

JavaScript syntax, version consistency, selected static checks, whitespace, and ZIP integrity were checked. PHP lint, WordPress Plugin Check/PHPCS, and live WordPress UI and role testing remain outstanding. A GitHub release does not submit or guarantee approval by WordPress.org.

PublishRank 2.9.63

PublishRank 2.9.63

Robustness audit and fixes

• Verified there is only one PublishRank custom-admin implementation and one module registration. The existing feature was not duplicated, but its previous behavior had recovery and lockout edge cases.
• Password recovery now remains available for lostpassword, retrievepassword, rp, resetpass, checkemail, confirmation, recovery-mode, post-password and registration actions.
• Any already-authenticated WordPress user can continue using normal WordPress admin routing after the short entry gate expires; WordPress capabilities still control what that user can do.
• Direct 404 responses now send no-cache headers so a CDN or reverse proxy cannot cache an unauthenticated /wp-admin/ response and serve it to an authorized browser.
• The native /wp-admin/*.php path remains unchanged for authorized users. Only unauthenticated direct probes are rejected.
• AJAX, admin-post, uploads, script/style loading, REST and cron exceptions remain intact.

Verified overlap

The audit found no second custom-admin gate in PublishRank. The separate Supabase module is an optional gate for PublishRank screens only; it does not replace or duplicate the native WordPress login/admin gate. Traffic Guard explicitly excludes /wp-admin, /wp-login.php, REST and cron paths, so it does not compete with this feature.

PublishRank 2.9.62

PublishRank 2.9.62

• Added a highlighted NEW Admin access protection dropdown in PublishRank Settings.
• Publishers can enable a unique private entry slug or disable the protection without deleting the saved slug.
• Direct unauthenticated /wp-admin/ and /wp-admin/next-admin-slug requests now return 404 before WordPress can redirect bots to the login form.
• Direct unauthenticated /wp-login.php login requests return 404, while password-recovery actions remain available so publishers cannot be locked out.
• The private entry link establishes a short-lived HttpOnly gate, after which WordPress continues using normal /wp-admin/*.php routes for the authorized browser.
• Active administrators remain allowed after the short gate expires, and AJAX, REST, cron, admin-post and upload service paths remain protected from accidental breakage.
• WordPress-generated login links now use the private entry URL, and the setting is included in PublishRank settings export/import.
• Added explicit guidance that hiding the entry point is defense-in-depth, not a replacement for strong passwords, two-factor authentication, updates or a WAF.

WordPress guidance reviewed

• WordPress hardening guidance warns that security through obscurity is not a primary security strategy and recommends updates, least privilege, strong account practices and firewall controls: https://developer.wordpress.org/advanced-administration/security/hardening/
• WordPress documents admin_init as running for admin screens as well as admin-ajax.php and admin-post.php, so those service paths are explicitly preserved: https://developer.wordpress.org/reference/hooks/admin_init/
• WordPress documents login_url as the filter for generated login URLs, which PublishRank uses for the private entry link: https://developer.wordpress.org/reference/hooks/login_url/
• WordPress documents login_init as the login-form initialization hook, which PublishRank uses for the native-login 404 gate and recovery exceptions: https://developer.wordpress.org/reference/hooks/login_init/
• WordPress requires safe redirects to be followed by exit, which the private-entry redirect follows: https://developer.wordpress.org/reference/functions/wp_safe_redirect/

PublishRank 2.9.61

PublishRank 2.9.61

• Updated the live SEO score ring to behave like a progress indicator.
• The filled ring uses a red-to-blue-to-green gradient: red at the beginning, blue through the middle, and green at the end.
• Added rounded progress ends and kept the score number green on the white card.

PublishRank 2.9.60

PublishRank 2.9.60

• Made the editor SEO score card draggable with both mouse and touch/pointer input, constrained it to the viewport, and remembered its position in the current browser.
• Added editable Search title and Meta description controls directly to the live search preview.
• Added Rank Math-style %focus_keyword% and %%focus_keyword%% variables, plus %focuskw% aliases, which resolve to the post Focus Keyword in previews and frontend metadata.
• Added one-click Insert %focus_keyword% controls for both title and description.
• Live preview changes remain unsaved until the normal WordPress post save, while the preview uses the unsaved values immediately.

PublishRank 2.9.59

PublishRank 2.9.59

• Fixed the editor SEO score number contrast: it is now a bold accessible green on the white score card background.
• Added protected custom administrator access with direct /wp-admin/ and /wp-login.php gating when configured, while preserving AJAX, REST, cron, admin-post and recovery-safe integrations.
• Added Web Story editor support using standards-compliant Article structured data, portrait poster fields and optional story publisher logo fallback.
• Normalized schema publisher identity references so Organization/Person, WebSite, WebPage, article and media entities use one shared @id rather than conflicting inline publication values.

PublishRank 2.9.58 — WordPress.org review fixes

WordPress.org review-fix release. The plugin version remains 2.9.58.

• Hardened escaping, settings validation, SQL preparation, file handling, and admin request nonce/capability checks.
• Corrected the sitemap stylesheet asset reference and translation placeholder context.
• Public source provenance, head attribution comment, and footer attribution are explicit opt-ins, disabled by default; older always-on defaults are migrated off.
• Updated regression coverage and review documentation.

Validation: 31/31 standalone regression scripts passed; PHP lint passed for 151 PHP files; git diff --check passed. The installable ZIP was checked for archive integrity, expected publishrank/ layout, and exclusion of development tests.