SiteAssure development release history

Earlier development build notes are retained here for reference.
See readme.txt for the current release summary.

= 0.21.80 =
* Report protected plugins that were removed from WordPress so their monitoring can be intentionally stopped from the connected cloud app.
* Allow the signed stop-monitoring command to remove an inactive or no-longer-installed plugin from protected functionality and reconcile its incident with a fresh scan.
* Preserve a missing protected component in the saved baseline until an administrator explicitly retires it.
* Add a local **Stop monitoring** action to protected-component incidents, with the same inactive-or-missing safety rule as the cloud action.

= 0.21.79 =
* Synchronize privacy-safe controlled cloud submission, notification handoff, and verification-email outcomes into each tracked form's health display without replacing local provider evidence.
* Strengthen Divi controlled-form email routing, use natural field-specific test values and a site-domain visitor address, and report privacy-safe final mail-recipient and sender-domain diagnostics.
* Exclude Elementor Header & Footer resources and live URLs that redirect elsewhere from onboarding critical-page choices.
* Replace the first-scan dashboard animation automatically when the completed assurance score becomes available.
* Synchronize saved critical-page and form selections with an active cloud connection immediately, while retaining scheduled retries.
* Simplify the form-monitoring controls and cloud test-page fields.
* Reorganize Form Discovery into a clearer header, live status panel, URL and placement metrics, and separate action footer.

= 0.21.78 =
* Preserve every selected critical page when the onboarding wizard saves Step 2, including during a setup rerun.
* Reuse completed form discovery on the final onboarding screen instead of discarding its checked-URL count and starting a duplicate scan.
* Show accurate completed or in-progress form-discovery status and disable the refresh action while discovery is running.

= 0.21.77 =
* Sanitize synthetic and authorized Contact Form 7 inputs by field type, preserving textarea and checkbox values.
* Isolate Gravity Forms validation from unrelated request data and restore request state and pre-existing filters after processing or exceptions.
* Validate checkout-profile structures, scalar request values, page rows, monitor URLs and proxy headers.
* Escape all admin SVG output through a restricted SVG allowlist.
* Resolve protected admin and AJAX paths through WordPress URL functions.
* Load self-contained report styles through WordPress's style registration and enqueue functions.
* Remove the cloud-connection cap from local scores in the dashboard, reports and notifications.

= 0.21.76 =
* Clarify the weekly activity metric as Website change events in HTML and plain-text emails.

= 0.21.75 =
* Keep the original permalink structure as the comparison while a change warning is open.
* Recognize restoration on the first follow-up scan and keep unexpected changes open.
* Repair comparison values from bounded recent scan history when upgrading older warnings, and avoid coalescing a correction into an earlier post-update scan.
* Add a guarded Diagnostics action to accept intentional permalink changes.
* Earlier release notes are retained in changelog.txt.

= 0.21.74 =
* Use a descriptive plugin-list name while retaining the SiteAssure admin menu and existing slug.
* Consolidate development notes into this release summary; detailed earlier build history is retained in changelog.txt.
* Improve translation context, sanitize fatal-request metadata, preserve WordPress admin notices and complete opt-in uninstall cleanup.
* Include persistent form availability monitoring, clearer per-form findings, improved discovery and request recovery, confirmed update-related fatal alerts, synchronized critical-page baselines and three checkout profiles from the development releases.

= 0.21.73 =
* Preserve selected forms and their last known pages after editing, unpublishing or deletion.
* Report per-form availability changes separately from email configuration warnings.
* Use a neutral icon for monitoring selection.

= 0.21.72 =
* Reconcile older untagged fatal events against recorded updater windows, including a recent SiteAssure ZIP replacement.
* Recognize uploaded plugin and theme ZIP overwrites as update operations while retaining ordinary fatal handling for unrelated installs.
* Keep fatal occurrence counts stable across repeated scans and apply WordPress timezones when comparing older events with update times.
* Replace exact unsent legacy fatal alerts with the existing confirmation policy; connected sites continue to use cloud-owned verification.

= 0.21.71 =

* Confirm update-associated fatal errors after a three-minute settling period using fresh public checks; keep isolated errors in history without a critical alert.
* Keep security challenges inconclusive with bounded quiet retries, preserve distinct fatal occurrences, and protect newer errors from stale cloud confirmation results.

= 0.21.70 =
* Synchronize cloud-accepted critical-page word-count baselines through the authenticated command channel.
* Preserve original UTC acceptance times and users, ignore stale deliveries and newer local edits, and save baselines atomically.
* Retry temporary delivery failures quietly without starting scans or sending notifications.

= 0.21.69 =
* Limit checkout journeys to three profiles per website, including the permanent default profile.
* Enforce the same limit in profile creation, saved settings, onboarding, and cloud synchronization.

= 0.21.68 =
* Treat DNS, timeout, failed page requests, and incomplete redirects as unverified frontend presence instead of a critically missing form.
* Retry only the affected form page at one, five, and fifteen minutes; show a connectivity warning after three unsuccessful recovery attempts.
* Refresh presence findings and recover matching incidents without rerunning validation, mail, or unrelated assurance checks.
* Reconcile local request failures with newer cloud browser evidence for the exact tracked form and page, retaining other form and mail findings.
* Include the affected form name, page URL, and request error in local and cloud presence evidence, and migrate saved request failures on upgrade.

= 0.21.67 =
* Attribute discovered forms to the verified final response URL and destination page after redirects, deduplicating registration pages reached from protected URLs.
* Prioritize public header, footer, and navigation links from the homepage, with assigned WordPress menus ahead of ordinary content.
* Refresh cached URL attribution after updating, preserve explicit monitoring choices, and invalidate redirected results when the destination page changes.
* Update choice-card border and background to the shared theme variables.

= 0.21.66 =
* Discover supported forms on published pages before choosing what to monitor, including during setup.
* Group forms found on live pages above form definitions not located in scanned HTML, showing each form once with its page locations.
* Choose one cloud test page per tracked form, with a custom public URL for popups or other placements not yet discovered.
* Refresh discovered locations without reloading the page or losing unsaved tracking and page selections.
* Refresh only edited published pages in the background, retain unrelated cached locations, and safely defer edits during an active discovery batch.

= 0.21.65 =
* Remove the cloud connection card width limit and adjust cloud action spacing.
* Place the notification email above a two-column grid of four email toggles, stacked vertically on mobile.
* Replace screenshot 7's local report description with Settings.

= 0.21.64 =
* Document the optional SiteAssure API and cloud app, connection consent, transferred data, and service policy links.
* Use the SiteAssure product name consistently and update the plugin website link to wpsiteassure.com. Keep the site-assurance slug and text domain.
* Close stale protected-plugin and capability incidents after confirmed recovery, including incidents left open by earlier versions.
* Preserve intentional administrative notification suppression and avoid treating provisional inactivity checks as recovery.
* Improve translation context, output escaping, and database query handling for WordPress.org submission.
* Omit local actor attribution and sensitive structured fields from cloud scan evidence, and redact recognizable sensitive values in diagnostic text.
* Complete opt-in local uninstall cleanup for queued cloud results, encrypted test credentials, and diagnostic state.

= 0.21.63 =
* Synchronize the four notification toggles with cloud 0.24.98 through signed heartbeats, preserving concurrent local edits and rejecting stale overwrites.
* Report only normalized weekly counters and their time window; WordPress recipient addresses remain local.
* Format standalone weekly assurance summaries as HTML with a plain-text alternative, current score, open issues and a dashboard link.
* Cache weekly metrics for one hour and retain cloud summary timestamps for the local fallback sender.


= 0.21.62 =
* Apply cloud-acknowledged no-submission reminder resets to the local form timer and name affected forms in assurance scan warnings.

= 0.21.61 =
* Add a signed cloud action to stop protecting an inactive plugin, refresh capabilities, and rescan assurance.
