== Changelog ==

Full release history for Yedekalma. The readme.txt file only lists the most
recent releases; everything else is kept here.

= 1.11.7 — 2026-07-22 =
* I18N: Completed the English, German, Russian and Arabic interface translations. 69 strings — confirmation dialogs, error messages, progress text and settings labels — previously fell back to the Turkish source text. All five bundled languages are now at 100%.
* I18N: The plugin name and description shown on the Plugins screen are now translatable.

= 1.11.6 — 2026-07-21 =
* DOCS: Rewrote the plugin description, feature list and FAQ.
* ASSETS: Added plugin directory icon and banner images.

= 1.11.5 — 2026-07-21 =
* FIX: Responsive threat table layout. Adjusted column widths and increased action column width to 110px so the protected shield badges fit cleanly without horizontal overflow.

= 1.11.4 — 2026-07-21 =
* FEATURE: Finalized malware scanner enhancements, core protection filters, and uninstall cleanup logic.

= 1.11.3 — 2026-07-20 =
* FEATURE: Custom malware scan protection layout. Integrated granular, detailed reasons for critical files (wp-config.php, active theme assets, root boot scripts, drop-ins, and admin/includes core files) to protect them from deletion, while still allowing the deletion of planted non-core exploits.

= 1.11.2 — 2026-07-20 =
* FIX: Robust option structure mapping. Hardened list rendering and DB option cleanup to support both array and object elements, preventing PHP type-error crashes on page loads and threat file deletions.

= 1.11.1 — 2026-07-20 =
* FIX: WordPress core protection. Added a strict safety check to prevent accidental deletion of critical WordPress files (such as files inside wp-admin, wp-includes, wp-config.php, index.php, etc.) via the malware scanner deletion tool.

= 1.11.0 — 2026-07-20 =
* NEW: Built-in Malware & Virus Scanner. Scan all PHP, JS, and configuration files for code injections, web shells, backdoors, and malicious patterns.
* NEW: Persistent Scan Results. Scanner results are securely saved on your site so they persist across page refreshes.
* NEW: Bulk Actions. Select all or specific detected threat files and delete them collectively with one click.
* NEW: Responsive Threats Table. Improved threats list layout and added responsive container with horizontal scrolling so long paths and patterns fit beautifully on all screens.
* NEW: Security Reminders. Contextual security notices recommend taking a virus scan before taking backups or restoring a backup.
* NEW: Space-saving Tabs UI. Combined vertical backup upload and import sections into a sleek, premium tabbed layout.

= 1.10.4 — 2026-07-20 =
* NEW: Added drag-and-drop local backup file upload zone (.zip, .sql, .sql.gz) with real-time progress bar.
* FIX: Fixed critical bug where restored backups disappeared from the list due to options database caching.
* FIX: Fixed settings loss on restore by correcting options key preservation to 'yedekalma_settings'.

= 1.10.3 — 2026-07-18 =
* WARNING: Added an explicit warning notice to the backup restoration modal to inform users that restoring a backup to a different domain will trigger an automatic site URL/domain configuration update in the database.
* LOCALIZATION: Updated Turkish, English, German, Russian, and Arabic translation files with the new domain warning string and rebuilt the compiled .mo files.

= 1.10.2 — 2026-07-15 =
* NEW: Cleaned settings page to focus on custom language preferences and system info.
* NEW: Made Settings (Ayarlar) page visible in the WordPress left sidebar menu.

= 1.10.1 — 2026-07-15 =
* NEW: Internationalization added with translations for English, German, Russian, Arabic, and Turkish.
* NEW: Added new SVG brand logo and official asset icons.
* FIX: Resolved permission issue with hidden settings page access.

= 1.10.0 — 2026-07-13 =
* SECURITY: The chunked-backup progress state is stored in a transient with a plugin-specific key prefix (yedekalma_chk_) so it can never collide with another plugin's transients.
* SECURITY: The backup encryption passphrase is now encrypted (with the site's AUTH_KEY) before it is written into that transient — it is never persisted in plaintext.
* PERFORMANCE: Bulky per-file backup state arrays (file list, manifest, reference file list) are kept in private system temp files instead of the transient, keeping the option/transient store small.

= 1.9.0 — 2026-07-08 =
* NEW: Multi-channel source size measurement for the cloud "Kontrol Et" (check) flow.

= 1.8.19 — 2026-07-04 =
* COMPLIANCE: PHP `memory_limit`/`set_time_limit` are now raised only inside the specific backup/restore endpoints that need them (via a helper), never as a global default on init.
* COMPLIANCE: Replaced all raw cURL calls with the WordPress HTTP API (`wp_remote_*`); large streaming uploads use the `http_api_curl` hook as recommended.
* COMPLIANCE: Restore-time `wp-config.php` update now uses the WordPress Filesystem API (`WP_Filesystem`) with strict value sanitization; no `.bak` copy is left in the site.
* COMPLIANCE: Renamed the internal notify-card guard constant to use the full `YEDEKALMA_` prefix.

= 1.8.18 — 2026-07-03 =
* FEATURE: Keyset pagination for database dumping to optimize performance on large sites.
* FEATURE: Native .sql.gz compression support for streaming database backups.
* FEATURE: Chunked execution flow for database and file backups.

= 1.8.16 — 2026-07-02 =
* UX: Removed the "Bulut Hesabına Bağlan" (Connect to Cloud Account) link from the admin submenu. The connect page stays accessible from the in-page CTA; only the sidebar menu item is hidden (via remove_submenu_page) to keep the menu clean.

= 1.8.15 — 2026-07-01 =
* COMPLIANCE (Guideline 5): No built-in feature is locked behind an account any more. When no Yedekalma account is connected, the plugin now runs fully in local mode by default — one-click backup (files + database), local/FTP/SFTP targets, download and restore all work with no account. The optional cloud connection only changes where backups are delivered.
* PRIVACY (Guideline 6 / no phone-home): Removed automatic anonymous registration and anonymous heartbeat. The plugin now makes NO external connection unless you deliberately connect the optional Yedekalma cloud service (enter an API token). This matches the "External services" section exactly.
* SECURITY: Hardened the local backup directory (wp-content/uploads/yedekalma-backups) — Apache 2.2 & 2.4 deny rules + index.php/index.html + directory-listing off, and backup archive filenames now include an unguessable random token so the file cannot be reached by direct URL (important on Nginx where .htaccess is ignored). Raw SQL dumps are written only to the private system temp dir and removed after archiving.

= 1.8.14 — 2026-06-30 =
* FIX: Recent/local backup list showed the wrong date & time. Timestamps are stored in the site's local timezone, but the list rendered them through get_date_from_gmt(), which re-applied the UTC offset. Now displayed with mysql2date() (no double conversion) on both the dashboard and the backups list.

= 1.8.13 — 2026-06-30 =
* FIX: Local backup could fail at finalization with "archive could not be opened" when the file list resolved to zero entries (e.g. database-only, or an empty temporary archive). libzip does not write an empty archive to disk, so re-opening it failed. The intermediate and finalize steps now open the archive with the CREATE flag, making the chunked backup resilient.

= 1.8.12 — 2026-06-30 =
* UX: Local backup now runs in time-sliced chunks, so the progress bar advances smoothly file-by-file (it no longer appears stuck at 50% on large sites). Added a "Show details" log panel that shows, in real time, which file is currently being added (n/total).

= 1.8.11 — 2026-06-30 =
* PRIVACY: True client-side BYOK. The backup encryption passphrase is now entered and stored only on your own site (Yedekalma → Connect Cloud → Backup Encryption), encrypted with your AUTH_KEY. It is never sent to or stored on the Yedekalma servers — the key stays entirely with you. Backup/restore/verify read the passphrase locally.

= 1.8.10 — 2026-06-30 =
* FIX: Local backup produced an empty archive ("Yedek arşivi boş üretildi") on sites with many files. ZipArchive keeps a file handle open per added file until close(), so large sites hit the OS open-files limit and close() failed silently. The builder now adds files in batches (close/reopen every 400 files) and verifies close() succeeded. The local backups folder is also excluded from the archive (prevents bloat and self-inclusion).

= 1.8.9 — 2026-06-30 =
* FIX: Local backup could appear stuck at 50%. The archive build now runs without the default time/memory limits (and continues server-side even if the connection drops), a lock prevents duplicate concurrent builds, and the admin progress poller now handles request timeouts/errors (retries, and surfaces the real error instead of freezing).
* HARDENING: Additional output escaping (esc_attr/esc_html) on schedule selects and the notification field; wp_unslash on the restore mode input.

= 1.8.8 — 2026-06-30 =
* COMPLIANCE: Clarified that the plugin is fully functional standalone — local one-click backup, download and restore work with no account and no external service; the Yedekalma cloud service is clearly documented as optional (Guidelines 5 & 6). Updated readme/description and FAQ accordingly.
* FIX: Removed the diagnostic log file written under wp-content/uploads; diagnostic steps now go to PHP error_log() only when WP_DEBUG is on (no predictable, web-accessible log file).
* SECURITY: The temporary wp-config.php safety copy made during a config-restore is now written to the system temp directory (outside the web root) instead of next to wp-config.php, so database credentials are never left in a downloadable file.

= 1.8.7 — 2026-06-30 =
* NEW: Use the plugin without a Yedekalma account. On activation the site is registered anonymously (technical info only — domain & versions, no personal data) so it can back up and restore right away.
* NEW: "Where should backup notifications go?" email field with double opt-in verification and an optional product-updates consent. Entering an email turns the install into a lead; signing up on yedekalma.com later with the same address automatically links this site to your account (no duplicate accounts).
* PRIVACY: Marketing consent is stored separately from transactional notifications; commercial messaging is gated behind explicit opt-in.

= 1.8.6 — 2026-06-30 =
* SECURITY: Real client-side AES-256 backup encryption (BYOK). When a passphrase is set, the archive is encrypted with AES-256 (CBC + HMAC) on your own server before upload and can only be opened with your passphrase. Each encrypted backup is self-verified (decrypt + checksum) before upload, so an unrecoverable archive is never sent. Restore and integrity-check transparently decrypt.

= 1.8.5 — 2026-06-29 =
* INFRA: Panel servers migrated to Turkey (turkticaret infrastructure); data is not transferred abroad (KVKK). Removed unverified certification wording.

= 1.8.4 — 2026-06-29 =
* RELIABILITY: Added a read-only backup integrity verification endpoint (downloads + checks SHA-256, archive and completion marker; never restores), so backups taken via the plugin can be auto-verified.

= 1.8.3 — 2026-06-29 =
* RELIABILITY: Incremental backups now compare real file mtime (not just size), so files whose content changes without a size change are correctly captured.

= 1.8.2 — 2026-06-29 =
* SECURITY: SSRF protection on restore download URLs (https + public-IP only). DATA INTEGRITY: DB dumps now write and verify a completion marker on the plain .sql path too (partial dumps are refused on restore).

= 1.8.1 — 2026-06-29 =
* CLARITY: When the selected storage target is not configured (e.g. "My Own Storage / FTP-SFTP" chosen but no credentials entered), the backup now fails with a clear, actionable message instead of a cryptic "no direct upload" error.

= 1.8.0 — 2026-06-29 =
* CLARITY: Renamed the "Bandwidth" quota to "Backup Quota" (Yedekleme Kotası) with a one-line explanation, so customers understand the monthly quota measures the data our engine packages and sends to your cloud — not the central server's bandwidth.

= 1.7.9 — 2026-06-29 =
* RELIABILITY: Full & files-only backups can now complete on restricted hosts (exec disabled) via chunked, time-sliced processing. Restore transparently handles the gzipped SQL stored inside the chunked archive.

= 1.7.8 — 2026-06-29 =
* RELIABILITY: Chunked database restore now verifies a completion marker and aborts loudly on a truncated/corrupt archive instead of silently applying a partial restore (data-loss protection).

= 1.7.5 — 2026-06-29 =
* COMPLIANCE: Removed all trial-expired premium locking screens and replaced them with non-blocking warning notices, fully complying with WordPress.org Guideline 5 (Trial/Expired Software).

= 1.7.4 — 2026-06-29 =
* SECURITY: Enforced strict Zero-Server-Storage architecture. Restores and backups are now processed strictly client-side or streamed direct-to-cloud; no temporary backup files or SQL dumps are ever cached/stored on the central backup servers.
* COMPLIANCE: Removed the custom updater class to fully comply with official WordPress.org Plugin Guidelines (Section 3: "Plugins may not bypass the update system").
* COMPATIBILITY: Compatibility enhancements and optimization for PHP 8.x and latest WordPress versions.

= 1.5.6 — 2026-06-27 =
* FIX: Restore button is now a progressive-enhanced link — it opens the secure panel login even if admin JavaScript is unavailable, and shows an in-admin confirmation modal when JS is loaded.

= 1.5.5 — 2026-06-27 =
* RENAME: Plugin display name and slug updated to "Yedekalma — Cloud Backup & Restore" (slug: yedekalma), now that domain ownership is verified.
* DOCS: Clarified the Restore Drill description to match the actual weekly integrity verification.

= 1.5.4 — 2026-06-27 =
* UX: "Restore" button now opens an in-admin confirmation modal.

= 1.5.3 — 2026-06-27 =
* NEW: In-admin "Restore" button on dashboard.
* FIX: Escaped translation strings and resolved REST API route permission callbacks.
* RENAME: Renamed plugin display name and slug to avoid WP brand confusion.
* REMOVE: Removed custom updater to comply with WordPress.org guidelines.

= 1.5.2 — 2026-06-25 =
* RESTORE: Added new `/restore-wpconfig` endpoint to update DB details in `wp-config.php` during database restores to a different host.
* RESILIENCE: Bridge URLs migrated to `?rest_route=` format for compatibility with plain permalink sites.

= 1.5.1 — 2026-06-25 =
* INFO: Added notes to Backup Frequency page explaining synchronization with the optional cloud service.

= 1.4.0 — 2026-06-24 =
* SPEED: Added chunked file transfer support via `/zip-batch` (POST) to speed up backups.

= 1.3.0 — 2026-06-24 =
* Support for large sites: added manifest-based file transfer to avoid execution time limits.

= 1.2.1 — 2026-06-24 =
* Folder exclusions and shared hosting permission handling improvements in file bridge.

= 1.2.0 — 2026-06-24 =
* PLUG-AND-PLAY: FTP/SFTP or MySQL credentials are no longer required to take backups.

= 1.1.4 — 2026-06-24 =
* Bandwidth usage indicator widgets added to admin bar and side dashboard panel.

= 1.1.3 — 2026-06-18 =
* New billing model: 1 GB free bandwidth for new accounts.

= 1.0.0 — 2026-06-17 =
* Initial release.
