Force login to make the site private - Gozer — Full changelog

For each release, see the entries below. The latest version is always at the top.
The current release notes also live in readme.txt under "== Changelog ==".

= 2.1.1 =
* Improved: Compatible with WordPress 7.1.
* Improved: The WP-Cron, WP-CLI and "Static files" exceptions now describe what they actually do — cron and CLI requests run without a browser session, and real files (CSS, JavaScript, images, fonts, uploads) are served by the web server without loading WordPress, so Gozer never sees those requests and turning the exceptions off closed nothing. Wording only; protection behavior is unchanged.

= 2.1.0 =
* New: "Visitor IP detection" setting — choose where the visitor IP is read from: direct connection (new default), CF-Connecting-IP, X-Real-IP, or X-Forwarded-For, for sites behind Cloudflare or a reverse proxy.
* New: Optional reverse-DNS verification of search engine bots — a visitor claiming to be Googlebot, Bingbot, Slurp, YandexBot, Baiduspider or Applebot must pass forward-confirmed reverse DNS against the engine's official domains (cached per IP); unverifiable bots are blocked while it is on.
* Improved: The "Search engine bots" setting now states plainly that the user agent can be forged and points to verification or disabling the exception for hermetic sites.
* Improved: Recommendations banner synced with the AyudaWP catalog (updated plugin names and descriptions).
* Fix: Security hardening of the allowed-IPs exception — the visitor IP was read from client-controlled proxy headers even on sites not behind a proxy, so a forged header could impersonate an allowed IP. Only the direct connection is trusted unless a proxy header is explicitly selected, and X-Forwarded-For uses the proxy-added address, not the client-editable first entry.

= 2.0.0 =
* New: Minimum access level — require a minimum role for logged-in users on the front-end; lower roles get a 403 instead of the content. Independent from dashboard capabilities.
* New: Customizable 403 block screen (title + basic-HTML message) without editing the theme; a theme 403.php still wins.
* Improved: Page cache hardening — DONOTCACHEPAGE and no-cache headers on all block paths (login, custom URL, 403); public exceptions stay cacheable; known page caches purged on plugin (de)activation and when private mode or settings change.
* Improved: REST API, XML-RPC and AJAX exceptions now actually block logged-out visitors (previously they had no effect); /wp-json/ stops leaking content when off and XML-RPC is blocked by default. Logged-in users and IP/user-agent/token exceptions are respected.
* Fix: An "Allowed paths" entry of "/" opened the whole site instead of only the homepage; it now matches the homepage alone, also on subdirectory installs.
* Fix: Subdirectory installs doubled the site path in the post-login return URL (/site/site/), landing visitors on a 404 after signing in.
* Fix: The virtual robots.txt (served as /?robots=1 on "plain" permalinks) was blocked even with the robots exception on; both virtual and physical robots.txt are now recognized.
* Fix: "Allowed paths" were ignored on subdirectory installs; rules now also match with the install base prefixed, so "/contact/" matches "/site/contact/".
* Fix: IP whitelist wildcards (e.g. 192.168.*) matched no real IPv4 address; a trailing * now covers the rest of the address as the docs promise.
* Fix: "Redirect to custom URL" sent external addresses to wp-admin (wp_safe_redirect host allowlist); the configured host is now allowed so external redirects work.

= 1.0.4 =
* Fix: Security hardening of the access-control exceptions. Appending a query string such as `?x=wp-admin` or `?x=sitemap` to a protected URL could bypass the login requirement and expose the page to logged-out visitors. Login-page and sitemap detection now matches the parsed URL path only, never the raw request URI. Updating is strongly recommended for any site relying on Gozer to keep content private.

= 1.0.3 =
* Fix: Fixed promotional banner button alignment on WordPress 7.0 due to core CSS specificity changes
* Tested up to WordPress 7.0

= 1.0.2 =
* Improved: Better name to make it easier to find the plugin

= 1.0.1 =
* Improved: Tokens table layout for better responsiveness on smaller screens
* Improved: Copy tokens button moved to Actions column for a better user experience
* Improved: The recommendations banner now displays plugins and services randomly

= 1.0.0 =
* Initial release
* Force login functionality with configurable exceptions
* Admin bar indicator with quick toggle switch
* System exceptions (REST API, WP-Cron, WP-CLI, AJAX, XML-RPC)
* SEO exceptions (sitemaps, robots.txt, feeds, search bots)
* Technical exceptions (HEAD requests, static files)
* Custom exceptions (paths, IPs with CIDR/wildcards, user agents)
* Temporary bypass tokens with expiration
* Redirect options (login, 403, custom URL)
* Two-column settings layout
