Tu Soporte Online — Swiss Knife: Advanced Maintenance & Developer Toolkit
Changelog (older versions). The three latest versions are in readme.txt.

= 1.1.8 =
* Overview: new checks (broken links via TSO Link Inspector, PHP support window, inactive plugins, expired transients, compressed files), a TSO Link Inspector recommendation, score trend, more status tiles, a 7-day usage card and shortcuts that follow your Favorites bar.
* Redirects: sortable 404 Monitor columns, live search in the 404 log (bulk actions only affect the rows shown) and a readable column layout in the rules table.
* View Counter: downloads are also counted by file extension (no download attribute needed), visits can be excluded by user role and IP/range, and the Media Library has a "TSO Downloads" column.
* Media Cleaner and Search & Replace: compressed archives (zip, rar, 7z…) are counted apart from unattached media, and the table picker has a live filter box.
* Security and Cron: permission checks now explain the risk and the recommended value (.htaccess 0644, wp-config.php 0640/0600), and WordPress core hooks show the "WordPress" badge instead of "Unknown".

= 1.1.7 =
* Reliability review: bulk "delete inactive users" never deletes users who own content; Search & Replace saves its undo snapshot after every table and keeps failed cells for retry; the sandbox now actually starts (its loader was being deleted right after install) and no longer overwrites the real active plugins list; client IP detection can use a trusted proxy header; uninstall removes every plugin option, user meta and multisite data; the uploads PHP-execution check no longer writes a test .php file.
* Image Sizes Audit: lists core sizes (medium, medium_large, 1536x1536, 2048x2048) with a core badge; all but thumbnail, medium and large can be turned off, and sizes no longer registered by any theme or plugin can be turned off too.
* Image Sizes Audit: new "Reuse the files of <old size>" button so a renamed size (same dimensions) uses the existing thumbnails without regenerating; only metadata changes, no file is touched.
* Image Sizes Audit: references column shows which posts, meta, options and code file:line use a size; smarter "probably replaced by" and code detection; long notes moved into info popovers.
* Image Sizes Audit: safer quarantine (records before moving, 6-hour audit cache, warnings for equivalent sizes) and site_icon sizes are protected.
* View Counter: optional counting of theme header links and file downloads (with a "Most downloaded files" report), plain-comma CSV export plus an Excel (semicolon) button, and a confirmation before importing the same source twice.

= 1.1.6 =
* Meta Editor: changing the Post/User context now closes the open editor, and Save/Delete always use the context of the row being edited (it could overwrite the wrong meta row).
* Options Editor: protected option patterns (theme_mods_*, widget_*, transients…) are now really enforced; before they could be edited or deleted.
* Options Editor and Option Library: options that look like secrets (keys, tokens, licenses) no longer show a value preview.
* Options Editor: options flagged "Caution" can be edited again (the warning banner says so) while read-only ones stay locked; saving no longer creates options that do not exist; Undo of an added serialized option now works; autoload "off" is saved as "no" on all WordPress versions.
* Option Library: options documented as read-only are also locked in the Options Editor.
* Meta Editor: adding a value with backslashes (JSON, paths) no longer loses them, failed inserts are reported instead of "Meta row added", and more secret-looking keys (token, secret, oauth, two_factor…) are protected.
* Meta Editor: edits, deletes and additions are logged with the before/after values in the History tab; value search no longer probes protected keys; the new row is shown after adding it; errors when opening a row are displayed.
* Export/Import: the previous settings are saved automatically on import and can be restored with "Restore previous settings"; API keys are excluded from exports by default and kept when missing in the file; operational logs are unchecked by default on import; existing autoload flags are preserved; warnings for maintenance, REST API and update-blocking imports.
* Search & Replace: URLs stored with escaped slashes in JSON (Elementor, blocks) are now found and replaced too.
* Search & Replace: the site cache is flushed after Execute and Restore so changed options and meta take effect immediately.
* Search & Replace: regex replacements now scan tables in a stable order (rows could be skipped or visited twice); a pattern containing an escaped "#" no longer breaks.
* Search & Replace: the preview now warns about tables sampled only, tables skipped for having no primary key, and cells left unchanged because they hold PHP objects; Execute reports errors and skipped cells instead of reloading silently.
* Search & Replace: the automatic backup is checked after saving and you are warned when it could not be saved or when a new replace will overwrite the previous backup.

= 1.1.5 =
* Image Sizes Audit: "Free up space" now shows detected references per size (content, post meta, options, and active theme/plugin code), pre-selects only sizes with none, and flags old sizes that a registered size with the same dimensions probably replaced.
* Image Sizes Audit: moving old thumbnails to quarantine is now safe against interruptions and can be restored exactly; it warns if content still links to those sizes, keeps sizes registered only on the front end, refreshes the list after saving, and works on hosts that need FTP credentials.
* Redirects: the 404 monitor queue no longer stops on already-covered URLs, and adds Suggested patterns (one 410 rule per prefix) and bulk 410/redirect actions; the rules list gains search, filters, sorting, bulk actions, CSV export/import and a phone layout.
* Slug Manager: renaming keeps accented letters (transliterated) and creates 301 redirects for child pages without chains; uppercase slugs, duplicates and URL clashes are reported, and the SEO notes were corrected (default long-slug threshold: 75).
* Media Cleaner: the scan now runs in resumable batches with far fewer false positives, and also detects wrong stored paths, empty files, missing sizes, offloaded media and orphaned attachments, with summary cards.
* Uploads Disk Footprint and Folder hygiene: batched scan with Resume, no symlink loops, new space-by-folder and month tables, and a 30-day quarantine that is purged by a scheduled task and no longer scans uploads twice.

Older versions: see changelog.txt in the plugin folder.

= 1.1.4 =
* Redirects: 404 monitor now shows requester IP with bot detection, a "Delete selected" button and an "Already covered" badge; duplicate and shadowed rules are now detected and blocked; fixed rules that silently never matched because of a duplicated site subdirectory in their path.
* View Counter: fixed several legacy-table cleanup issues (stale opcode cache after a plain file upload, wrong table-prefix detection, incomplete removal on DB errors) and improved visibility when a leftover table can't be removed.
* Server & Runtime: added a plain-language explanation of what the OPcache "Reset OPcache" button actually does and its limits.

= 1.1.3 =
* Maintenance mode: visitors and search engines now really receive "503 Service Unavailable" (it was answering 200 OK, so the maintenance page could be indexed as the real site).
* Login Protect: failed logins with usernames such as "admin" now count toward the brute-force lockout when "Block forbidden usernames" is off (they were silently ignored).
* Login Protect: custom login URLs with accents or ñ (e.g. "acceso-administración") are now converted to plain letters and work; existing accented slugs are fixed automatically on the next page load (they made the login page unreachable).
* Redirects and 404 monitor: URLs with accents or ñ are now matched and logged correctly (they were stripped, so "/ñandú/" was treated as "/and/").
* Rewrite Rules: fixed a fatal error on sites using Plain permalinks.
* Search & Replace: table and column lists now work with database drivers that return upper-case column names.
* Robustness: saving settings or calling the public view counter with malformed input (arrays, very large numbers, very long names) no longer triggers PHP errors or warnings; corrupted log entries (History, 404 monitor, login lockouts) are skipped instead of breaking the screen.
* View Counter: recovers automatically from duplicate views/links tables left over by an old, removed table-naming scheme (a stale PHP opcode cache after a manual FTP upload could keep that old code running for a while); any such leftover table is merged into the real one and then dropped, instead of splitting the view count between two tables.

= 1.1.2 =
* Debug: WP_DEBUG_LOG / WP_DEBUG_DISPLAY values that WordPress sets by default are now labelled "WordPress default" and "No effect: WP_DEBUG is off" instead of looking active; the Health Report no longer warns about on-screen errors while WP_DEBUG is off.
* Debug: the Debug Constants list is now a clean table with Value, Source (wp-config.php, Developer mode or WordPress default) and Status columns.
* Debug: the error-log help box is rewritten in plain language and now shows the exact wp-config.php line (with a Copy button) needed to empty/shrink the log from the plugin.
* Debug: the wp-config.php debug constants guide is now a highlighted, collapsed panel below the constants table, and the "Read-only here" badge next to wp-content/debug.log was removed.
* UI: the explanatory guide boxes (File Integrity, Meta Editor, Redirects, REST API, Rewrite Rules, Search & Replace, Update Manager) are now collapsed by default and open with one click.
* Overview: the "Hide WordPress Site Health notices" options moved from the Health Report tab to the Overview tab.
* Redirects: fixed the 404 monitor table so the "Last visit" date no longer overlaps the Referrer column; the User-Agent hint is now easier to read.
* Redirects: fixed the check that blocks capture tokens ($1, $2…) in the host of an absolute redirect target; a broken pattern meant it never ran.
* Media Footprint / Image Sizes Audit: fixed a fatal error when the uploads folder is missing or unreadable (the scan now shows the error message instead).
* Comment Anti-Spam: fixed a PHP warning when checking Gravity Forms fields without a label.
* Hooks Inspector: the filter box now also narrows the current page instantly while typing.
* Debug: Developer mode texts now say what it really does — it only turns on SAVEQUERIES, because WordPress sets WP_DEBUG, WP_DEBUG_LOG, WP_DEBUG_DISPLAY and SCRIPT_DEBUG before plugins load; the constants table no longer labels those as coming from Developer mode.
* Spanish and Catalan translations: restored missing accents and ñ across the interface.
* Uninstall now also removes the Anti-Spam learning log, REST blocked-requests log, Search & Replace backup, media quarantine list and View Counter import marker.

= 1.1.1 =
* New: REST API Controls now keeps a log of actually blocked requests (disabled access, blocked user listing, disabled namespaces) with time, IP and route, so you can review real traffic instead of guessing what the settings above are doing.
* New: Comment Anti-Spam now has a Learning mode: nothing is blocked, but every submission that would have been rejected is logged (with counts and a "would block" log) so you can check for false positives before turning on real enforcement.
* New: Media Cleaner / Uploads Disk Footprint: folders removed via Folder hygiene now go through a 30-day recoverable Quarantine (restore or delete permanently) instead of being deleted immediately, expired entries purge automatically, and disk usage by file type is now shown as a proportional space chart alongside the existing table.
* New: Heartbeat Controls now measures real Heartbeat traffic (this hour, last 24 hours, average per hour, and a breakdown by screen) so you can see actual numbers before changing the mode or interval, instead of guessing.
* New: Slow Query Monitor can now attribute slow queries to the plugin, theme, or WordPress core they came from (opt-in, off by default due to the extra overhead), flag likely N+1 query patterns within a request, and suggest a missing index for common WHERE/ORDER BY shapes.
* New: Plugin Sandbox can now bisect your normally active plugins automatically (binary search) to narrow down which one is causing a problem, instead of testing combinations by hand; ends with the likely culprit isolated and sandboxed on its own for confirmation.
* New: Search & Replace now keeps an automatic backup of the last operation's original values (on top of the existing mandatory Preview step), with one-click Restore and a JSON download from the tool's own tab; Restore skips any row changed by something else since the replace ran.
* New: Options Editor entries in Activity History now offer an "Undo" button for simple value changes (update, add, delete), guarded against protected options and against overwriting a newer edit.
* Health Report: the PHP-errors-on-screen check now has a plain-language title and a short explanation instead of the bare WP_DEBUG_DISPLAY constant name; small hint text under toggles is now easier to read.
* Dashboard "Needs attention" and Health/Security check links now jump straight to the relevant section of each tool instead of just the top of the tab.
* Security: the XML-RPC check and toggle now name active plugins that need it (Jetpack, MainWP Child, ManageWP, InfiniteWP) instead of just warning.
* New: Overview dashboard (now the landing tab) with a site score, items needing attention, quick vitals, shortcuts and recent activity.

= 1.1.0 =
* Slow Query Monitor: redesigned admin-bar item (severity dot, count pills, sectioned submenu, compact SQL with full text on hover); the slow-query log, live counters and duplicate detection now all ignore queries fired by the admin bar itself; fixed singular/plural wording.
* Security: capped the number of outbound-link URLs the public View Counter beacon will track, and fixed Staging Mode mail log CSV formula injection.
* Fixed: Database Search & Replace infinite loop, regex preview mismatch and serialized-object corruption.
* Fixed: Redirects wildcard loop detection, Content Audit shortcode removal stripping block backslashes, Admin Menu rules hitting the wrong plugin page, robots.txt "Allow: /" override, Image Sizes Audit core-size validation, and leftover legacy .php flag files.
* Fixed: several View Counter issues (table upgrade on admin_init, import sources, CSV in Excel, timezone date range, mobile overflow); added a 7/15/30-day summary email period and persistent import results; removed the unused "Keep daily detail for" setting.
* Removed an unused module file (File Footprint).
* Docs: FAQ explains that debug.log lives inside the web root (wp-content/debug.log), what it can leak, and how to block it or move it outside the web root via wp-config.php.

= 1.0.9 =
* New: View Counter module. Counts post, page and outbound-link-click visits with a small front-end beacon, so counting keeps working even behind a full-page cache (LiteSpeed, etc.). No cookies — de-duplication uses a short-lived, server-side fingerprint only. Adds a "TSO Views" column (with icon) to the Posts/Pages list, sortable by total views, and an importer for totals previously collected by Post Views Counter, WP-PostViews or WP Statistics (WP Statistics' real per-day history is preserved; the other two only expose a lifetime total, so that one lands dated today). Includes a Top Content report (most viewed posts/pages and most clicked outbound links, filterable by period), a CSV export of the daily detail, and an optional weekly summary email.
* Security: real-time email alert when a new Administrator account is created or a user is promoted to Administrator, including the IP address and how the request reached WordPress (normal admin form vs. a silent REST/AJAX/XML-RPC request) — the same pattern seen in real-world "hidden rogue admin" incidents caused by a compromised browser extension.
* Security: Application Passwords audit — lists every active Application Password site-wide with its owner, name, creation and last-used dates and last IP, with per-item and "Revoke All" buttons, since these survive deletion of the user account that created them.
* Security: added "Application Passwords" and "Recent administrator accounts" checks to the Security Checks table, plus an informational notice explaining that a compromised browser extension can act with a logged-in admin's session without touching the server, which is outside any WordPress plugin's control.
* Security: new "PHP Execution in Uploads" test and one-click protection — probes whether the server executes PHP files placed inside wp-content/uploads (the single control that most often stops an arbitrary-file-upload exploit from becoming a full takeover) and can write the blocking rule into wp-content/uploads/.htaccess on Apache/LiteSpeed.
* Security: detects administrator accounts that share their exact creation timestamp with another user — a known technique some malware uses to hide a rogue admin from "sort users by newest".
* File Integrity: now also scans wp-content/uploads for files with an executable script extension (.php, .phtml, .phar…), since uploads should only ever contain media/data and this is exactly where file-upload exploits drop their payload.
* REST API: added an option to block anonymous access to /wp-json/wp/v2/users specifically (user enumeration), without disabling the rest of the wp/v2 namespace that the Block Editor needs.
* Fixed slow queries flagged by Query Monitor: Login Protect and Admin Menu settings options are now autoloaded (both are read on every request/admin screen), instead of triggering a dedicated DB query each time. Existing installs are migrated automatically.
* Security fix: Login Protect's custom login URL could be revealed to a logged-out visitor on the first request to any wp-admin page, since WordPress core's own redirect used the same filtered login URL. Direct /wp-admin/ access is now blocked for logged-out visitors before that redirect can happen.
* Fixed: the REST API namespace-blocking option could also block an unrelated namespace that happened to start with the same text (e.g. blocking "foo/v1" also blocked "foo/v10").
* Security: the "user promoted to Administrator" alert now also fires when a role is added via WP_User::add_role(), not only via the classic role-change dropdown.

= 1.0.8 =
* Admin Menu: the menu manifest (previously an uncached direct DB query on every admin screen) is now cached via the standard WP object cache, compatible with any persistent object-cache backend (Redis, Memcached, LiteSpeed object cache).

= 1.0.7 =
* Debug: clearer developer-mode vs wp-config debug state; scroll-to-end on log toolbar; wp-content/debug.log policy copy and managed-log workaround.
* Server Files: smarter robots.txt parser (line-specific full-site block vs path prefixes); scoped .htaccess deny detection.
* Media Footprint: folder hygiene scan for legacy TSO uploads folders and .tmb caches, with safe delete allowlist.
* Update Manager: install pending wordpress.org language packs button; removed auto_all updates preset.
* Security: Login Protect 2FA rate limit; Meta Editor protected-key preview and serialized validation.
* Health Report and config export hardening; refreshed CA/ES translations.

= 1.0.6 =
* New: Staging Mode (admin-bar label, noindex without touching blog_public, hold email, pause WP-Cron, database mail log + CSV).
* New: URL & HTTPS Doctor (read-only diagnostics, loopback without following redirects, leftover http:// count with Search & Replace prefill).
* New: Server & Runtime panel (PHP limits, drop-ins, MU-plugins, clock skew, optional OPcache reset).
* Incomplete plugin uploads show an admin notice listing missing files.
* Language switcher (CAT/ES/ENG) also applies to plugin AJAX and Health Report downloads.
* Cron: core hooks are fully read-only (no Run / Edit / Delete); detection uses an explicit list only.
* Transients: multisite site-transient purge uses sitemeta and requires super/network admin.
* Meta Editor: key-only search without object ID; adding serialized values no longer double-serializes.
* Login Protect: purge custom login rewrite before flush on deactivate, settings save, and snapshot import.
* Export/Import: clearer exclusions; warn if Staging switches import enabled; Staging option stays autoloaded.
* Uninstall: remove activity log settings, email diagnostics history, and staging mail log; force rewrite regeneration.
* Health headers probe caches raw data / error codes (not mixed-language strings).

= 1.0.5 =
* Cron Manager: core events are read-only in the UI and blocked from delete/reschedule in AJAX.
* Transients: purge expired/all also clears site transients.
* Roles: confirm before applying a capability template.
* Meta Editor and Slug Manager: ignore stale search AJAX responses.
* Debug Mode readme matches the Developer mode preset (no per-constant toggles).
* Regenerated CA/ES translations; removed leftover Recovery Mode strings.

= 1.0.4 =
* Prefill queue no longer cleared when loading the next 404 redirect form.
* Meta and Options editors: avoid double-serializing values; meta delete clears object cache.
* Redirects and Slug Manager: strip home subdirectory on source paths and loop detection.
* Content Audit: shortcode removal uses a tag boundary so [foo] does not match [foobar].
* Transients listing and purge: escape LIKE wildcards correctly.
* Slow Query Monitor: ignore admin-bar stacks for duplicate detection (like Query Monitor); keep last-page duplicate SQL at the top of the tab.

= 1.0.3 =
* Safer cron reschedule, meta edits by row ID, and search-replace primary-key handling.
* Redirects: subdirectory path matching, 404 alert counters, and prefill queue fixes.
* Options Editor protections, Content Audit empty-title query, uninstall cleanup, Requires at least 6.1.

= 1.0.2 =
* Health: site URL details on separate lines; autoload total includes yes/on/auto; accurate overdue cron count; security headers probe cached 15 minutes.
* Redirects: 404 log checkbox alignment; bulk prefill queue advances automatically after each save; 404 hit counts stay in sync under write throttling.
* Site Snapshot: environment diff panel clears after import.
* Content Audit: duplicate titles and shortcode inventory.
* Cron Manager: missed scheduled posts panel.

= 1.0.1 =
* Fixed bugs in modules.

= 1.0.0 =
* Initial release.
