TrustBeacon Auditor Changelog

Version 0.1.8

Added:

* New admin dashboard presentation for audit results, replacing the single wide findings table.
* Circular SVG Trust Score gauge with finding-status counts (Passing, Warnings, Failures, Informational).
* Security category summary cards for Email Authentication, Website Security, Visitor Protection, and DNS Security.
* Findings grouped by category, with expandable "Recommendation and business impact" detail per finding using a native <details> element.
* Dedicated pre-audit introductory panel describing what the audit checks before any audit has been run.
* New admin/assets/css/trustbeacon-admin.css stylesheet, enqueued only on the Trust Auditor admin page.
* New includes/class-presentation-helper.php with focused status-counting, category-grouping, and status/rating-to-CSS-key mapping logic.
* New admin/views/ partials (header, disclaimer, empty-state, score-summary, category-summary, findings) replacing the previous monolithic renderer.
* New tests/ directory with a dependency-free assertion script for the presentation helper and a rendering smoke test covering both dashboard states.
* New docs/development.txt with a detailed implementation record for future developers.

Changed:

* Refactored admin/class-admin-page.php from a single renderer method into a small controller that verifies the request and delegates markup to view partials.
* Category-rating calculation (calculate_category_summary/rate_group) moved from the admin page into TBAUD_Presentation_Helper. The averaging logic and 90/75/60 thresholds are unchanged; only the return shape was extended with a stable, untranslated `key` field alongside the existing translated label, so the dashboard can select a CSS status class without matching on translated text.
* Public-trust disclaimer wording was expanded to explicitly state that audits run on demand and are not continuous or live monitoring.

Fixed:

* None.

Security:

* No change to capability checks, nonce verification, input sanitization, or output escaping. All existing `manage_options` and nonce checks were preserved; new view output uses the same esc_html()/esc_attr() escaping conventions as the previous renderer.

Compatibility:

* No change to WordPress 6.0 minimum or PHP 7.4 minimum requirements.
* No external JavaScript frameworks, CSS frameworks, remote fonts, CDNs, analytics, or telemetry were added.
* No new remote requests were added; the plugin still only contacts the audited domain when an administrator clicks Run Audit or Re-scan.

Testing:

* Ran `php -l` against every PHP file in the plugin; no syntax errors.
* Ran tests/test-presentation-helper.php (22 assertions) covering status counting, category grouping, status/tier key mapping, and a regression check confirming TBAUD_Score_Calculator and TBAUD_Finding scoring math is unchanged.
* Ran tests/test-render-smoke.php (32 assertions) covering the pre-audit empty state (no fabricated score/results shown), the completed-results state (score, grade, all four category cards, and every finding field including recommendation and business impact), and asset-enqueue scoping to the plugin's own admin page.
* Reviewed all new/changed PHP for PHP 8-only syntax (nullsafe operator, enums, readonly properties, str_contains/str_starts_with/str_ends_with, match expressions, named arguments); none found. A PHP 7.4 interpreter was not available in the build environment to run the test suite directly under 7.4, so this compatibility check was a manual code review rather than a live run.

Version 0.1.7

- Revised scoring so INFO findings are excluded from the total score denominator.
- Normalized PASS findings to full credit and WARN findings to partial credit.
- Updated trust level ranges to better reflect public trust signals rather than a full security certification.

Version 0.1.0
Initial development version.

Added:

* Basic plugin structure.
* Admin menu page for running the audit.
* Audit runner class.
* Finding structure class.
* Score calculator class.
* Results table in the WordPress admin area.
* Category, check, status, score, message, recommendation, and business impact fields.
* Basic HTTPS-related checks.
* Basic HTTP security header checks.
* SPF record check.
* DKIM-related check.
* DMARC record check.
* DNS-related review where supported by the hosting environment.
* Trust Score display.
* Trust level display.
* Plain-English recommendations.
* Plain-English business impact explanations.

Changed:

* Improved result display structure.
* Added support for business impact text in findings.
* Improved wording for DNS checks where full evaluation is not available.

Fixed:

* Corrected admin results display so all finding fields can be shown.
* Corrected checker file organization during development.
* Restored DKIM checker logic after incorrect file contents were discovered.

Known limitations:

* This is not a full security audit.
* Some DNS checks depend on PHP and hosting support.
* The plugin currently focuses on the installed WordPress site.
* External domain checking is not yet part of the admin interface.
* Score weighting may change as testing improves.

Planned:

* More complete documentation.
* Better admin help text.
* More reliable scoring normalization.
* Better handling of NOT EVALUATED results.
* More test scenarios.
* Possible report export feature.
* Possible audit history feature.
* Possible external domain audit option.
