LMN Site Monitor — Changelog (English version)

================================
Version: 2026-08-19 — v1.1.1

- FIX: the internal VERSION constant was still hardcoded to 1.0.1 after the 1.1.0 release, so the admin header badge, the About tab, and the Google Safe Browsing clientVersion field kept reporting the wrong version. Now matches the plugin header (1.1.1).

================================
Version: 2026-08-14 — v1.1.0

- COMPAT: WordPress 7.1 confirmed — reviewed the iframed post editor, client-side media processing, @wordpress/components changes, persistent toolbar, and jQuery UI 1.14.2 update; none of these affect this plugin (no editor, media, toolbar, or jQuery UI hooks used).
- NEW: SSL certificate details in the WHOIS/DNS modal — issuer, TLS protocol version (best-effort probe), and Subject Alternative Names (SANs) now shown alongside the existing SSL expiry date.

================================
Version: 2026-07-15 — v1.0.1

- COMPAT: WordPress 7.0.1 confirmed — reviewed the 7.0.1 patch file list; no changes affect admin_post, wp_ajax, admin_menu, cron, or wp_mail hooks used by this plugin.
- FIX: Uninstall cleanup — uninstall.php was leaving the lmnsimo_order option (card sort order) behind in wp_options after uninstall; now deleted along with the other plugin options.
- FIX: Uninstall cleanup — per-site malware scan schedules (lmnsimo_scan_site_cron) were not cleared on uninstall, leaving orphaned cron events; now cleared alongside lmnsimo_check_sites_cron.
- IMPROVE: Requires at least / Requires PHP added directly to the plugin file header (previously only in readme.txt), so WordPress core itself blocks activation on incompatible sites.

================================
Version: 2026-05-31 — v1.0.0

- COMPAT: WordPress 7.0 full compatibility — tested and confirmed against WP 7.0 core (Modern theme, PHPMailer 7.0.2, PHP 7.4 minimum).
- IMPROVE: CSS scoping fix — postbox header rule (h2.hndle) now scoped to .lm-scope, preventing style leakage to other dashboard widgets.
- NEW: Apache ECharts 5.6.0 + echarts-gl 2.0.8 bundled locally in /assets/ (no external CDN, GDPR-safe); Chart.js and date-fns adapter removed.
- NEW: Bar chart (2D/3D toggle) — horizontal bar chart of average response time per site; 3D mode via echarts-gl (WebGL). Toggle button in the chart header switches between 2D and 3D view.
- NEW: Line chart — global min/avg/max response time trend with filled min–max band.
- NEW: Donut chart — speed tier distribution across five ranges (< 500 ms, 500 ms–1 s, 1–2 s, 2–5 s, > 5 s).
- NEW: Activity heatmap — GitHub-style grid showing check count by hour of day and day of week.
- IMPROVE: All four charts support light and dark mode via ECharts native theming.
- IMPROVE: i18n audit — 9 new strings added to .pot and all 16 .po/.mo files (3 interface strings for 3D toggle and heatmap, 6 help tab strings).
- FIX: Double-encoding bug — &amp; in heatmap title string corrected to & to prevent esc_html_e() double-encoding.
- IMPROVE: Help tab updated — "Performance charts & statistics" section now documents all four ECharts charts with descriptions of 2D/3D toggle and activity heatmap.
- IMPROVE: Charts grid column for donut chart widened from 320px to 420px at ≥1280px breakpoint; donut center adjusted to prevent legend overlap.

================================
Version: 2026-05-16 — v0.9.4

- NEW: Site thumbnail in card view — each card shows a screenshot preview of the monitored URL using the free Automattic mshots service (no API key required). Images load lazily, are served via CDN, and are refreshed automatically. Dark mode applies a subtle brightness filter.
- NEW: Telegram Bot alerts — configure Bot Token + Chat ID in Settings → Alerts. Alerts for site down, recovery, SSL expiry and domain expiry are sent as formatted HTML messages. Independently toggleable alongside email.
- NEW: Discord Webhook alerts — configure Webhook URL in Settings → Alerts. Alerts sent as Discord embeds with color-coded severity (red/orange/green). Independently toggleable.
- SECURITY: Full secrets encryption — all sensitive credentials (SMTP password, Telegram Bot Token, Discord Webhook URL, GSB API key, URLhaus API key) are encrypted with AES-256-CBC using AUTH_KEY + SECURE_AUTH_SALT. Settings forms never return secret values to the browser. Plaintext legacy values continue working without manual migration.
- IMPROVE: i18n complete — 51 previously untranslated PHP strings added to the .pot template and fully translated across all 16 supported languages (es_ES, en_US, fr_FR, de_DE, it_IT, pt_PT, ca, gl_ES, eu, ar, uk, nl_NL, tr_TR, ko_KR, zh_CN, ja). All .po and .mo files recompiled with correct GNU gettext plural-form encoding.
- FIX: Closing the security scan modal no longer causes a flash from dark to light mode; location.reload() removed, scan results update in-place via DOM.
- FIX: Scan status label ("No incidents" / "Incidents detected") now appears on the card immediately after scanning, without requiring a manual page reload.
- FIX: Plural-form translations in .mo files were corrupted (drag-to-reorder label appearing in SSL/domain expiry day fields); all 16 .mo files recompiled with correct plural-form binary encoding.
- IMPROVE: Performance charts redesign — neon color palette for bar chart; trend chart shows filled min–max band with adaptive Y axis (no forced zero baseline); distribution chart replaced with animated Polar Area chart; neon glow effect on all chart canvases in dark mode.

================================
Version: 2026-04-29 — v0.9.3

- NEW: Animated toast notification system — success / error / warning toasts appear bottom-right, auto-dismiss 3.8 s, click to close, slide-in/out animation. Replaces silent AJAX operations.
- IMPROVE: "Force" and "Check all now" buttons change to "Checking…" and disable during server-side check, providing clear feedback.
- IMPROVE: Pin/Unpin actions now show a success toast ("Pinned to top" / "Unpinned"); AJAX errors show an error toast with automatic UI rollback.
- IMPROVE: Card reorder (drag-and-drop) now shows an "Order saved" toast when the server confirms persistence.
- IMPROVE: Site cards lift 2 px on hover with smooth shadow transition; lift suppressed during drag.
- IMPROVE: 5 new i18n strings (orderSaved, toastPinned, toastUnpinned, checkingNow, toastError); translations for 16 languages pending.
- SECURITY: SSRF protection — admin-supplied URLs (Add site form and CSV import) are validated to resolve to a public IP before being accepted. Private ranges, loopback, link-local, and reserved ranges are rejected; only http/https schemes are allowed.
- SECURITY: error_msg sanitization — body snippet stored on HTTP 4xx/5xx responses is sanitized with sanitize_text_field() after stripping HTML tags.
- NEW: Unified action bar above and below the card list — Select all checkbox, bulk actions, Apply, Check all now, Scan all, Export CSV, Import CSV. Both bars synchronized.
- NEW: Select all checkbox with indeterminate state support.
- NEW: Scan all — sequential background scan of all sites, badge rows update live, success toast on completion.
- NEW: Import CSV button triggers file picker directly (no visible file input).
- IMPROVE: 3 new i18n strings (selectAll, scanAll, scanAllDone) translated in 16 languages and compiled.

================================
Version: 2026-04-02 — v0.9.2

- FIX: URLhaus (abuse.ch) now requires an API key (Auth-Key header since 2024); added URLhaus API Key field in Settings → Security scanning. Without a key the check is skipped gracefully.
- FIX: Scan modal failed to open with "i18n is not defined" JS error — resolved by declaring i18n from cfg.i18n inside initScanModal().
- FIX: PDF security report printed blank — modal is temporarily moved to document.body before window.print() and restored afterwards.
- FIX: "Scanning…" text rendered as garbled bytes (double-encoded UTF-8) — replaced with an animated indeterminate progress bar.
- IMPROVE: Scan badge button removed from card header; scan result (shield icon + date + color-coded label) now appears as an inline row inside the card metadata block.
- FIX: "Scan" button font-size reduced to 11 px to match all other card action buttons.
- IMPROVE: Status labels "No incidents" / "Incidents detected" color-coded green/red; all 16 .po/.mo files updated.
- NEW: Help tab with 12 documented sections covering all plugin features: Getting started, Uptime monitoring, SSL & domain expiry, Email alerts, Performance charts & statistics, Malware scanning, WHOIS / DNS lookup, Dashboard widget, CSV export / import, Card management, and step-by-step guides for both API keys.
- IMPROVE: Top toolbar now shows a compact API keys notice with direct links to Google Cloud Console and abuse.ch, replacing the old generic description block.
- IMPROVE: 21 new i18n strings added to all 16 supported languages.

================================
Version: 2026-03-25 — v0.9.1

- NEW: Malware scanning powered by Google Safe Browsing API (free key required) and URLhaus (abuse.ch). Scan button on each site card opens a security report modal.
- NEW: Per-site automatic scan schedule (Never / Daily / Weekly) with WP Cron integration.
- NEW: Security report modal with per-source results, threat types, global status, and one-click PDF download.
- NEW: Google Safe Browsing API Key field in Settings → Security scanning section.
- NEW: 28 new i18n strings added to all 16 supported languages.

================================
Version: 2026-03-16 — v0.9.1

- NEW: Dedicated database table (`lmnsimo_response_log`) for full response-time history — created on activation, removed cleanly on uninstall.
- NEW: Response time (ms) measured and stored on every HTTP check; rolling window of 500 entries per site.
- NEW: **Bar chart** — average response time comparison across all monitored sites.
- NEW: **Global trend chart** — global min/avg/max band over time (hourly for 24 h, daily for 7/30 d); no legend clutter.
- NEW: **Response time distribution chart** — horizontal bar chart grouping sites by speed tier (< 500 ms · 500 ms–1 s · 1–2 s · 2–5 s · > 5 s), color-coded green → red.
- NEW: Period selector shared by all three charts and the statistics modal (Last 24 h · Last 7 days · Last 30 days).
- NEW: **Statistics modal** with per-site table: total checks, average / min / max response time and uptime %.
- NEW: CSV export and Print/PDF export of the statistics table.
- NEW: Chart.js 4.5.1 and chartjs-adapter-date-fns 3.0.0 self-hosted (GDPR-safe, no external CDN).
- NEW: 25 new strings translated across all 16 supported languages; `.pot` and all `.po` files updated.
- IMPROVE: Charts and modal adapt to the plugin's light/dark theme automatically.
Note: If you already had the plugin installed, you may need to deactivate it and reactivate it after updating, in order for the new tables to be created.

================================
Version: 2026-03-14 — v0.8.1

- FIX: Fix translation errors.

================================ 
Version: 2026-03-14 — v0.8.0

- NEW: New languages: Arabic, German, Basque, Italian, Japanese, Korean, Dutch, Portuguese, Turkish, Ukrainian, and Simplified Chinese.
- NEW: Automatic retry after downtime to avoid false positives.
- NEW: Domain expiry notifications.
- MAINT: i18n maintained; PHPCS/WPCS compliant.

================================ 
Version: 2026-03-03 — v0.7.0

- NEW: Cards are now wider, displaying more information at a glance.
- NEW: Bulk actions now include sorting options: alphabetical (A→Z) and by date added.
- NEW: Drag-and-drop card reordering with persistent storage between sessions.
- NEW: Pin system — pin any site to keep it fixed at the top, excluded from sorting.
- NEW: WHOIS / DNS lookup button on each card: shows IP, DNS provider, NS, MX records, TTL and SSL expiry. Native PHP only, no external APIs or API keys required.
- NEW: JetBrains Mono font integrated for monospace elements, self-hosted (GDPR-safe, no external CDN).
- IMPROVE: Full PHPCS / WPCS compliance — zero warnings. Proper nonce and capability checks, sanitization and escaping throughout.
- IMPROVE: All new strings are fully translatable and i18n-compatible.
- IMPROVE: Responsive design preserved and refined across all screen sizes.
- FIX: Removed duplicate `wp_mail_failed` hook and unified error handlers.
- FIX: Native WP cron schedules (`hourly`, `daily`) are no longer overwritten.
- FIX: Added `file_exists()` check before reading `changelog.txt`.
- FIX: Added missing `wp_unslash()` in widget preferences handler.
- FIX: SSL badge severity now syncs with the user-configured expiry threshold.
- FIX: PHPCS `MissingTranslatorsComment` resolved in alert email builders.
- IMPROVE: Removed dead `load_textdomain()` method.
- IMPROVE: Fixed inconsistent indentation in `ajax_save_order`.

================================  
Version: 2025-10-31 — v0.6.5  
Notes: Duplicate ID removal and accessibility improvements.

* NEW: Full internationalization (en_US, es_ES, ca, fr_FR).
* NEW: Added Catalan (ca) and French (fr_FR) translations.
* IMPROVE: Hybrid textdomain loader – automatically loads WP.org language packs and falls back to /languages for ZIP installs.
* FIX: Added translators comments for all placeholders to comply with WordPress I18n standards.
* FIX: Escaped all dynamic outputs in admin interface and header tips.
* MAINT: Removed deprecated load_plugin_textdomain() function per Plugin Check recommendations.

=================================
Version: 2025-10-25 — v0.6.4
Notes: Full sanitization and 0 warnings.

Security:
- Full sanitization applied to all handlers (`$_GET`, `$_POST`, `$_FILES`).
- `nonce` and permissions verification reordered before accessing superglobals.

Code Quality:
- All PHPCS/WPCS warnings removed.
- Code fully compliant with WordPress Coding Standards.

================================
Version: 2025-10-16 — v0.6.3
Notes: Duplicate ID removal and accessibility improvements.

UI:
- FIX: Unique IDs in forms (nonces and submit buttons).
- FIX: Console warnings removed for duplicated #_wpnonce and #submit IDs.
- IMPROVE: Admin panel accessibility and DOM structure.

Maintenance:
- Version bumped to v0.6.3.

================================
Version: 2025-10-15 — v0.6.2
Notes: Safe Markdown in changelog + version badge + unified header.

UI:
- IMPROVE: Unified blue header (h2.hndle) with v0.6.2 badge.
- ADD: Lightweight Markdown rendering (headings, lists, **bold**, `code`, separators).
- KEEP: Consistent padding and structure (.postbox.lm-card > h2.hndle + .inside).

Maintenance:
- Version bumped to v0.6.2.

================================
Version: 2025-10-15 — v0.6.1
Notes: “Changelog” tab with lightweight Markdown and better readability.

UI:
- NEW: “Changelog” tab with direct reading of `changelog.txt`.
- IMPROVE: Cleaner background, improved padding and typographic rhythm.
- IMPROVE: Lightweight Markdown rendering for **bold**, `code`, titles (# ## ###) and list prefixes (NEW, FIX, IMPROVE…).

Maintenance:
- Version bumped to v0.6.1.

===========================================
Version: 2025-10-14
Notes: SMTP adjustments + UI cards + minor fixes.

Functional:
- SMTP fully operational: form aligned with real keys (`smtp_*`) and authentication.
- Preserves SMTP password if saved empty (not overwritten).
- Compatibility with Gmail (app passwords) and Office 365.

UI:
- Listing replaced by responsive grid of cards (auto-fit/minmax).
- “OK” status (green/white text) and “Down” (red/white text).
- Down sites highlighted with red border + soft pulse (respects reduced motion).
- Inline styles cleaned → moved to `assets/admin-theme.css`.

Maintenance:
- Nonces and handlers verified; no changes in cron or check logic.
- CSV import/export and bulk actions untouched.

===========================================
Version: 2025-10-07 — v0.6.0

- NEW: CSV import using the same format as export (adds URLs without removing existing ones).
- NEW: Bulk actions in list (Delete selected) using standard WordPress handlers.
- IMPROVE: Listing UI with master checkbox, batch action bar, and confirmations.
- IMPROVE: Error handling and post-action messages for imports or bulk operations.

===========================================
Version: 2025-10-06 — v0.5.3

- NEW: CSV export from the “About Site Monitor” section.
- NEW: “About Site Monitor” section with quick metrics and cron status.
- IMPROVE: Minor cleanup in headers and constants (VERSION).

===========================================
Version: 2025-10-06 — v0.5.2

- NEW: “About Site Monitor” box in the right column of the admin dashboard.

===========================================
Version: 2025-10-06 — v0.5.1

- CHANGE: Default light HTML email + automatic dark mode via `prefers-color-scheme`.

===========================================
Version: 2025-10-06 — v0.5.0

- NEW: HTML alert email with badges, detail table, and action buttons.
- NEW: Per-user preference in dashboard widget (number of sites displayed).
- IMPROVE: Classic UI (light/dark themes, responsive tables and forms).
- FIX: Text contrast in dark theme (labels, cells, and descriptions).

===========================================
Version: 2025-10-05 — v0.4.0

- NEW: Admin page with listing, quick actions, and settings.
- NEW: HTTP and SSL expiry checks with email alerts.
- NEW: Configurable cron (5 min, 15 min, hourly, daily) and “force check” option.
