# Changelog

The WordPress.org-formatted `readme.txt` remains the release-notes source used
by WordPress. This file provides the same concise history for source-package
reviewers.

## 2.0.175

- Moved Dashboard widget layout initialization into the lightweight loader so
  Security Trends reaches its top container before viewport-based asset loading
  begins, removing the refresh-until-scroll race.

## 2.0.174

- Repaired unsupported saved WordPress Dashboard contexts so Security Trends
  remains visible instead of appearing only as a checked Screen Options item.

## 2.0.173

- Rendered the WordPress Dashboard Security Trends widget from indexed daily
  counters in the original page response, removing the delayed second
  `admin-ajax.php` bootstrap.
- Kept the initial Dashboard render bounded by skipping audit-log fallback
  scans when aggregate counters are not available.

## 2.0.172

- Accelerated full backup and isolated restore with adaptive file batches up to
  1,000 items, bounded by a 10-second work target, memory headroom, and a 128 MB
  I/O ceiling.
- Increased the license-server connection timeout to 20 seconds and added a
  scoped Fsockopen retry for timeout, DNS, and connection failures while
  preserving TLS verification and avoiding retries for license rejections.
- Reconciled timed-out activations through validation before sending another
  activation request through the alternate transport.

## 2.0.171

- Restored the early WAF bypass for static assets that carry only safe version
  cache-buster parameters, while keeping other query strings inspected.
- Allowed slower deferred admin pages to finish before showing a retryable
  loading error.
- Changed manual license status checks to contact the license server when a
  stored key is invalid or expired instead of reporting a skipped check.

## 2.0.170

- Changed WAF evaluation-budget exhaustion into a non-blocking operational
  warning while preserving enforcement for genuine attack-rule matches.
- Added explicit time-limit and pattern-limit exhaustion telemetry.

## 2.0.3

- Verified proposed `.htaccess` hardening rules through a cache-bypassed
  same-origin browser preflight before applying them, with Cloudflare
  diagnostics and automatic sandbox cleanup.

## 2.0.2

- Preserved scanner reviews, WAF access filters, and other URL-selected admin
  state through deferred page rendering.

## 2.0.1

- Kept detailed admin result messages out of redirect URLs by using
  session-scoped flash notices across SHIELD-X, Recovery, Scheduler, and
  Updates.
- Rejected raw detailed notice text supplied through admin query parameters
  while preserving compact status flags.

## 2.0.0

- Fixed current WC Key Manager activation acknowledgements so a securely bound successful activation stores the encrypted key and active status.

- Removed all retired compatibility paths from runtime, licensing, updates,
  storage, recovery, scheduling, and backup handling.
- Standardized private updates on one current signing key and one detached
  signature, with explicit vendor-authorized license status required.

## 1.0.45

- Fixed private update checks when WC Key Manager acknowledges a root-site
  activation using the hostname only.
- Passed the updater User-Agent through WordPress' canonical HTTP argument as
  well as the request header.

## 1.0.44

- Completed the WordPress.org review follow-up for request sanitization and
  documented bounded raw-request inspection paths used by the WAF.
- Kept scheduled-scan lease ownership atomic while documenting the narrowly
  scoped direct database operations required for compare-and-swap locking.

## 1.0.43

- Updated verifier storage for WordPress.org review: official core and plugin
  archives are staged only in temporary system workspaces and removed after
  use; SHIELD-X retains signed hash metadata only.
- Core repair no longer retains executable backup copies, and configured
  SHIELD-X storage paths inside plugin directories are rejected.

## 1.0.42

- Encrypted opt-in visitor-profiler IP and user-agent data at rest, restored
  complete URL-encoded form fields after WAF inspection, and made database
  table-inventory cache invalidation race-safe.
- Reused validated request and filesystem metadata on hot paths while retaining
  WAF and rate-limit enforcement semantics.
- Removed the private Extensions companion from core SHIELD-X navigation while
  retaining its updater compatibility path.

## 1.0.41

- Made main-plugin private updates fail closed unless the bundled vendor public
  key and detached package signature are both available.
- Required signed main-package staging in the private update-server workflow.

## 1.0.40

- Deferred display-only Malware/Virus and Lockdown scope work so large
  filesystem walks do not delay the admin page; selected scan coverage and
  enforcement are unchanged.
- Hardened license and protected update-feed authorization to require an
  explicit active instance status from the remote service.
- Refined shared admin navigation and controls, and updated the bundled Pulse,
  Recovery, Scheduler, and Updates extensions.
- Added a separate private update-server staging workflow for the versioned
  main package, protected feed files, and update icons.

## 1.0.39

- Hardened add-on discovery, menu callbacks, signed package handling, and
  private extension storage.
- Added recovery-path safeguards, including protected vault handling, password
  verification throttling, atomic rollback-ready mail delivery ownership, and
  signed CLI configuration compatibility.
- Reduced Pulse and Scheduler I/O with deferred Pulse state writes, status and
  schedule caches, bounded first-run delays, and early-WAF heartbeat throttling.
- Hardened scanner, backup, WAF, cron-remediation, uninstall, and update-feed
  validation paths.

## Earlier releases

See `readme.txt` for the complete WordPress-facing history.
