BlogPilot

Nhật ký thay đổi

2.0.195

• Admin screens now use the standard light WordPress background by default; dark mode is opt-in via the toggle.
• Fixed low-contrast text on several admin panels in light mode.
• Factual-integrity findings are now advisory: posts are no longer held or regenerated for them, and carry a review warning instead.
• Post Queue content warnings are collapsed behind a one-line summary.
• Fixed the “HELD FROM AUTO-PUBLISH” notice remaining on a row after it was approved and published.

2.0.193

• Changed: Prioritised actions now lists every ranked opportunity on screen instead of the top 25.

2.0.192

• Added: Download CSV on GSC Insights – Prioritised actions. Exports the full ranked opportunity list with score, priority, query, URL, position, impressions, CTR, signal type, recommended action and reasoning.
• Changed: the opportunity ranking now scores up to 100 signals instead of 25.

2.0.191

• Added: a post held back from auto-publishing now says so in the Post Queue. The first quality flag names exactly which required check failed – featured image alt text, keyword density or factual integrity – so no held post is a mystery.
• Fixed: the keyword density flag quoted the per-genre target rather than the band actually enforced, so a rejected post could be shown a figure it had already met.
• Fixed: the featured image alt text flag described a condition the check no longer tests.

2.0.190

• Changed: in auto mode a post that fails the alt text, keyword density or factual integrity check is now regenerated (up to two attempts) before being held for review, so scheduled publishing keeps flowing instead of stalling.
• Fixed: a post held for review no longer consumes that day’s post quota, so the posts-per-day setting delivers the rate you configured.
• Fixed: a held post now leaves the queued state, preventing the same keyword being picked again on the next run and creating duplicate queue entries.

2.0.189

• Changed: the enforced keyword-density band is now 1.5%-2.0% for every genre that uses density. The band is deliberately higher than the raw target because BlogPilot counts grammatical variants of the keyword while RankMath counts only the exact phrase, so RankMath reports a lower figure than BlogPilot measures. Genres set to 0 density are unchanged and remain exempt.
• Fixed: the density trimmer no longer rewrites text inside HTML tags, so image alt attributes, link titles and URLs are left intact.
• Fixed: the featured-image alt check now requires a real focus keyword. It previously fell back to the image keywords and then the post title, neither of which is ever empty, so it passed unconditionally.
• Added: auto-published posts are checked at publish time against the real image attachment. A missing alt text returns the post to the queue as a draft instead of publishing it. Manual approvals are never blocked.
• Added: a factual-integrity check that holds back auto-publishing when a post contains unsourced statistics, uncited attributions, unsupported product claims, software version numbers or unfalsifiable guarantees. News and RSS posts are exempt. The check never blocks the queue if the service is unavailable.

2.0.188

• Fixed: keyword density now has an enforced 1.5% ceiling. An over-optimised post is trimmed back under the ceiling before it is returned, instead of merely being flagged by the quality gate.
• Fixed: the featured image alt text is now always written from the post focus keyword (falling back to the title). Previously an empty focus keyword skipped the write entirely and the image kept the alt text built from the AI image search term.
• Fixed: auto-publish is now blocked when the alt text or keyword density check fails, no matter how high the overall quality score is. Such posts wait in the Post Queue for review. Checks that do not apply to a genre still count as passing.

2.0.187

• Security: no SQL statement anywhere in the plugin is built from a variable. Every table name is a bound %i identifier placeholder (88 statements across 13 files) and the last conditional WHERE fragments were replaced with neutral-value conditions.
• Security: SMTP password now sanitised with sanitize_text_field().
• Fixed: the REST tick endpoint no longer defines the global DOING_CRON constant; it uses a plugin-scoped BPV2_DOING_TICK marker instead.
• Narrowed 194 blanket PHPCS suppressions to 18, all on statements that build a %d placeholder list or run DDL.

2.0.184

• Fixed bulk keyword deletion.

2.0.183

• Fixed list filtering on the keyword pipeline and post queue screens.

2.0.182

• Cleared the remaining input-sanitisation and prepared-statement warnings.

2.0.181

• Admin JavaScript now ships as enqueued files, with values passed through wp_localize_script.
• List filters and the Search Console OAuth callback are nonce-verified.
• Removed the fal.ai image provider; AI images use OpenAI or Gemini.

2.0.178

• Search Console signals can now be scored and prioritised by the BlogPilot API.

2.0.177

• Cross-silo link placement is now performed by the BlogPilot API.

2.0.176

• Google Search Console insights and the Cerebro keyword-import tools are available on every plan.

2.0.175

• Corrected identifier placeholder usage in prepared statements.

2.0.174

• Cross-silo linking (niche pairs) is available on every plan.
• All database queries now use $wpdb->prepare(), including identifier placeholders for table names.
• Removed all output buffering from admin screens and all set_time_limit() calls.
• Minimum WordPress version is now 6.2.

2.0.173

• Plugin folder, main file and text domain aligned to the plugin slug.

2.0.172

• Corrected the plugin’s home page URL.

2.0.171

• Corrected the plugin’s home page URL and removed a donate link that pointed to a page that no longer exists.
• Documented the Internet Archive (Wayback Machine) lookup used by broken-link repair, plus the link-health and RSS requests that go to addresses you supply, in the External services section.

2.0.170

• Plugin author shown as SuperApps.

2.0.169

• Corrected a text domain that did not match the one declared in the plugin header.

2.0.168

• Fixed two code-quality annotations that were being printed on the Post Queue and Settings screens instead of staying in the source.
• Light mode: admin panels, key fields and code blocks that were written with fixed dark colours now switch to light backgrounds with readable text.

2.0.167

• Resolved every error reported by the WordPress Plugin Check plugin.
• The twenty-three repeated “add this column if missing” migrations in the database class were replaced by a single ensure_column() helper, so the schema upgrade path is now defined in one place instead of sixty lines of near-identical code.
• Database calls that build a statement around a table name are now annotated for the code sniffer at the exact lines it inspects, with a stated reason for each.
• Output escaping moved to the point of output in the cron notice, the theme-toggle icons, the queue pagination counter and the subscriber admin screen. Four upgrade prompts were being passed to echo although they print their own markup and return nothing; they are now called directly.
• date() replaced with gmdate() or wp_date(), strip_tags() with wp_strip_all_tags(), and unlink() with wp_delete_file().
• Every sanitised value read from a request now passes through wp_unslash() first. SMTP settings are read with explicit isset() guards.
• Read-only list filters on admin screens are annotated to record that they select what is displayed and change nothing.

2.0.166

• Niches are no longer restricted by plan in the plugin: the “Add Niche” button is available to everyone and any number of niches can be created and configured locally. Plan limits on keyword discovery and content generation are applied by the BlogPilot API.
• The accessibility contrast fix no longer accepts CSS. The scan result offers a colour picker, the plugin composes the rule from the validated element and colour, and the result is printed through wp_add_inline_style() instead of being written into the theme’s Additional CSS. Applied fixes are listed on the Accessibility screen and can be removed individually.
• The Google Search Console OAuth callback now verifies a single-use state token issued when the connection is started, in addition to the capability check.
• Nonces printed into inline JavaScript are escaped with esc_js().
• All remaining inline CSS moved into enqueued stylesheets: admin/assets/bpv2-views.css, assets/css/bpv2-frontend.css and assets/css/bpv2-a11y-widget.css. No style or script tags are printed by the plugin.
• Expanded the Sociophile entry under External services to cover both transmissions, including the conversion-signal call, with its own terms and privacy links.
• Removed two unused files that were never loaded (an admin template and a superseded integration class), and the unused locked-overlay helpers.
• Rewrote the remaining database queries that built a WHERE clause and prepared it in one call: every value is now bound with $wpdb->prepare() at the point its fragment is appended. Queries whose only interpolation is a table name carry an explanatory phpcs:ignore.
• Escaping moved to the output position in the trial notices and the subscriber confirmation pages, rather than being applied when the variable was assigned.
• Superglobal reads that were passed straight to array or string functions now go through wp_unslash() and a sanitiser first.
• Upgrade prompts no longer describe features that are not plan-restricted; they name the hosted API quota instead. Removed an unreachable settings description referring to a checkbox retired in 2.0.121.

2.0.165

• All AI-assisted repair and analysis prompts now run on the BlogPilot API; the plugin no longer builds AI prompts locally.
• Free-plan usage limits are now enforced by the BlogPilot API service, not by code in the plugin; several locally-implemented features (genre filter, pillar toggle, link health, content gaps, accessibility scan, Telegram notifications, discovery settings, auto mode, voice/story tools) are available on every plan.
• Removed unused legacy licensing code; billing is via Paddle only.
• Security hardening: sanitised nonce handling, recursive sanitisation of decoded JSON payloads, wp_json_encode everywhere, escaped template output, sanitize_callback on all registered settings.
• All admin and front-end inline JavaScript now ships through wp_add_inline_script.
• Replaced deprecated get_page_by_title() with WP_Query.
• Expanded the External services disclosure in this readme.

2.0.164

• Front-end search, subscribe and modal scripts moved into an enqueued JavaScript file.
• Keyword pipeline queries rewritten as fully prepared statements.
• Text domain aligned with the plugin slug.

2.0.150

• Prior release.