# Godhuli

**Contributors:** emtiaz51921
**Author URI:** https://imtiazshamim.com/
**Requires at least:** 6.0
**Tested up to:** 6.9.4
**Requires PHP:** 7.4
**Stable tag:** 3.0.0
**Tags:** blog, one-column, two-columns, three-columns, right-sidebar, custom-background, custom-logo, custom-colors, custom-header, custom-menu, featured-images, full-width-template, sticky-post, theme-options, threaded-comments, editor-style, translation-ready

![header](https://raw.githubusercontent.com/emtiaz51921/Godhuli/master/screenshot.png)

## Description

Minimal, fast, and responsive WordPress blog theme with flexible layouts, custom widgets, and full Customizer support—perfect for modern bloggers.

## What's New in 3.0.0

This is a major release with a complete security audit, PHP 8.x compatibility update, and a full CSS architecture overhaul. See the [Changelog](#changelog) section below for the full list of changes.

## Installation

### Using The WordPress Dashboard

1. Login to your WordPress dashboard.
2. Go to "Appearance" -> "Themes" and click on "Add New".
3. Click on "Upload Theme" and choose the theme's zip file you downloaded.
4. Click "Install Now".
5. Activate the theme.
6. Go to "Appearance" -> "Customize" to configure theme options.

### Alternatively

1. Login to your WordPress dashboard.
2. Go to "Appearance" -> "Themes" and click "Add New".
3. Search for "Godhuli".
4. Click Install and then Activate.

If you need help, drop a line at https://imtiazshamim.com/contact

## Requirements

| Requirement | Minimum |
| ----------- | ------- |
| WordPress   | 6.0     |
| PHP         | 7.4     |

## Contributing

Pull requests are welcome. For major changes, please open an issue first to discuss what you would like to change.

## Changelog

### 3.0.0 — April 2026

**Added:**

- Centralized CSS design token system (`css/godhuli-tokens.css`) with 60+ custom properties for colors, typography, spacing, layout, and effects
- `Requires at least: 6.0` header to `style.css` for WordPress.org compliance
- `wp_body_open()` call and skip-to-content link for full accessibility compatibility
- `aria-expanded`, `aria-controls`, `aria-label` ARIA attributes to the navigation toggle button
- `aria-hidden="true"` to all decorative icon elements
- `loading="lazy"` to archive, related, and slider images; `loading="eager"` on singular featured images (LCP optimization)
- Google Fonts API v2 with `display=swap` to prevent FOUT
- Dedicated sanitization callbacks: `godhuli_sanitize_layout()`, `godhuli_sanitize_order()`, `godhuli_sanitize_orderby()`

**Updated:**

- Minimum WordPress requirement to 6.0 (was 4.0)
- Minimum PHP requirement to 7.4 (was 5.5)
- Tested up to WordPress 6.8
- Custom logo now uses core `get_custom_logo()` / `has_custom_logo()` API
- `$content_width` global corrected to the WordPress standard variable name
- All stylesheet enqueue calls now use dynamic theme version string for cache busting
- `css/main.css`, `css/blocks.css`, and `style.css` fully refactored to use CSS custom properties
- `inc/dynamic-style.php` now updates `:root` custom properties first — entire color scheme cascades from a single Customizer value
- Footer copyright sanitization changed from `wp_filter_nohtml_kses` to `wp_kses_post` (allows links in copyright text)
- Customizer footer control ID corrected to match its setting ID

**Fixed:**

- Critical bug in `Godhuli_Aboutme_Widget::update()` — switch statement compared against undefined array keys, bypassing all type-specific sanitization
- Same critical switch-statement bug in `Godhuli_Recentpost_Widget::update()`
- `$commenter` undefined variable in `comments.php` (PHP 8 notice on every page with comments)
- `esc_html_e()` inside `printf()` — produced blank format string
- Email and URL comment form fields corrected from `type="text"` to `type="email"` / `type="url"`
- Pingback `<link>` tag had `esc_url()` without `echo`, silently producing empty `href`
- Duplicate blockquote rule groups consolidated into a shared selector
- Duplicate pagination active/hover groups (6 separate groups) collapsed into one
- Related post thumbnail empty `alt` attribute now uses post title
- `<h1>` used as logo text (duplicate H1 per page) — changed to `<span class="site-title">`

**Removed:**

- IE8 and IE9 legacy stylesheet enqueues (`ie8.css`, `ie9.css`)
- `html5shiv` script (IE8 compatibility — no longer needed)
- Redundant `-webkit-`, `-moz-`, `-ms-`, `-o-` vendor prefixes for `transition`, `transform`, `border-radius`, `box-sizing`, `user-select`
- Hardcoded version strings on enqueue calls

**Security:**

- All `theme_mod` values used in `WP_Query` arguments now sanitized before use (`absint`, `sanitize_key`, strict allowlist functions)
- Widget `update()` methods apply correct per-field sanitization (`absint` for IDs, `esc_url_raw` for URLs, `sanitize_textarea_field` for text areas)
- All Customizer output wrapped with appropriate escaping throughout template files
- Removed `add_theme_support('starter-content')` — no starter content defined

### 2.0.4 — June 2021

- Bug fixes

### 2.0.0 — March 2020

- Slider added
- Theme Customizer improvements
- Responsiveness fixes

### 1.0.0 — October 2019

- Initial release

## License

[GNU GPL v3](https://www.gnu.org/licenses/gpl-3.0.en.html)
