== Changelog ==

Full release history for Yedekalma. The readme.txt file only lists the most
recent releases; everything else is kept here.

= 1.37.0 — 2026-07-30 =
* NEW: Email (IMAP) restore. A full restore now also re-injects the archived `.eml` messages back into your mailboxes over IMAP (matching each archived account to your configured e-mail account), completing the round-trip started in 1.36.0. Messages are added with `imap_append` and never deleted; a message already present (matched by its Message-ID) is skipped, so restoring twice is safe and never creates duplicates. Missing folders are created automatically. If the PHP `imap` extension is missing or an account can't be reached, e-mail restore is skipped and reported — the file and database restore still complete. (The archived `.eml` files are no longer written into the web root during restore.)

= 1.36.0 — 2026-07-30 =
* NEW: Email (IMAP) backup for panel-triggered backups. When you have configured e-mail accounts in the plugin (Pro → E-mail), a full backup now also archives every folder of every account as `.eml` files (under `eposta/<account>/<folder>/`), just like the files and database. It runs inside the same resilient chunked engine — a few seconds of messages per step — so even large mailboxes finish without timing out, with live progress. Messages are fetched read-only (they are never marked as read and the mailbox is never modified). Each message is scanned for malware; a malicious message is left in the mailbox but kept out of the archive (so your antivirus can't lock the whole backup) and reported. If the PHP `imap` extension is missing or an account cannot be reached, e-mail is skipped and reported — the file and database backup still complete. (One-click e-mail restore from the panel is coming in a follow-up; until then the messages are available as `.eml` files inside the archive.)

= 1.35.0 — 2026-07-30 =
* UX: The "Connection" tab (Pro page) now opens instantly. Previously the page waited 3-4 seconds for two remote calls (backup status + recent backups) before rendering, so the "Connect with Google" screen flashed before the connected view appeared. Those two panels are now loaded asynchronously after the page opens, with a loading spinner in their place, so the connected screen shows immediately and the flash is gone.

= 1.34.0 — 2026-07-30 =
* CHANGE: Local backups are now stored in a per-site, unguessable folder named `YedekAlmaBackup-wp-XXXXXXXX` under `wp-content/uploads/` instead of the fixed, predictable `yedekalma-backups`. This makes a WordPress-panel backup easy to identify and adds a layer of defence (the folder name can no longer be guessed). On update, any existing `yedekalma-backups` folder is renamed to the new name automatically, so your existing backups and download links keep working — nothing is lost. If the rename cannot be performed, the old folder name is kept safely.

= 1.33.0 — 2026-07-30 =
* NEW: Database malware scanning. In addition to scanning files, a backup now scans the high-risk database tables (posts, options, comments and their meta) for injected malicious code — hidden redirect iframes, spam/skimmer scripts and obfuscated PHP/JS — as the database is dumped. Findings are reported to the Yedekalma panel exactly like file findings (the panel's per-domain file/database scan toggles decide what is kept). Scanning is read-only and never alters the dump; it is deduplicated per table and capped so even a very large database adds negligible overhead.

= 1.32.0 — 2026-07-30 =
* NEW: Multiple storage destinations (fan-out). When your Yedekalma panel configures more than one storage target for a domain, a panel-triggered backup is now copied to every target — not just the first. After the primary destination completes, the same archive is uploaded to each additional destination (each gets its own backup record and download/restore entry). A failure on an extra destination never affects the primary backup. This brings panel-driven WordPress backups in line with the standalone PHP module.

= 1.31.0 — 2026-07-30 =
* FIX: Malware scanner no longer flags pristine WordPress core files as threats. Several signatures were too broad and matched the legitimate content of WordPress core (and legitimate plugins), so a clean install downloaded from WordPress.org showed dozens of "threats". Removed or narrowed the offending signatures: (1) the long hex-escape signature that matched crypto/media byte tables (sodium_compat constants, getID3 magic-byte detection like the PNG signature, SimplePie whitespace tables, compat-utf8) is removed — real hex payloads are still caught inside an execution context; (2) the bare `wp_create_user`/`wp_insert_user`/`add_cap`/`wp_roles`/`grant_super_admin` and `add_filter('determine_current_user')` signatures are removed — those are WordPress's own core user/role/auth API used by pluggable.php, user.php, capabilities.php, class-wp-roles.php, user-edit.php and every legitimate membership plugin; genuine rogue-admin injection is still caught by the raw-SQL signatures; (3) the hidden-iframe signature now requires an external `src`, so plupload's upload iframe and WordPress oEmbed no longer match; (4) `strrev(...strrev(...))` reverse-string idioms (getID3 Lyrics3, wp-admin/post.php) no longer match the nested-obfuscation signature; (5) the temp-dropper signature no longer matches core's `require $file; die` bootstrap. Detection of real web shells, compiled binaries in the web root, and `include $x; unlink($x)` droppers is unchanged.

= 1.30.0 — 2026-07-30 =
* UX: Malware scanner results now have a "Show only deletable threats" filter (on by default). Findings that match WordPress core files are protected and cannot be deleted; the filter hides those protected rows so the actionable threats you can actually select and quarantine are shown first, with a small note of how many protected rows are hidden. Toggle it off to see every finding again.

= 1.29.0 — 2026-07-30 =
* FIX: Malware scanner no longer flags the plugin's own files as threats. The scanner's signature table literally contains web-shell family names (c99shell, r57shell, …) and command-parameter patterns, so left-over COPIES of the plugin outside the active folder — WordPress's own wp-content/upgrade/ update staging folder and any trashed/old copies — were being reported as "known web shell / backdoor". The self-exclusion now recognises the plugin's file layout in any location, not just the active plugin directory.
* FIX: Fewer false positives generally. The bare English words "webshell" and "backdoor" were removed from the known-web-shell signature (they appear in legitimate security plugins, comments and documentation; real shells are still caught by their specific family names). The command-parameter signature no longer matches $_POST['pass'] / ['pwd'] / ['code'], which normal login forms and verification/coupon-code fields use — only genuine command params (cmd/exec/payload/execute) remain.

= 1.28.0 — 2026-07-30 =
* DOCS: Refreshed the WordPress.org listing for clarity and search. Corrected the short description (real-time Instant Backup was removed in 1.22.0 and is no longer advertised), gave each supported cloud destination its own line (Google Drive, Dropbox, OneDrive, Amazon S3 / Backblaze B2 / Wasabi / Cloudflare R2 / MinIO, FTP/SFTP), added a dedicated "backup to your own cloud storage" heading, and expanded the FAQ from ~14 to ~30 entries with truthful answers about WooCommerce backups, large (5–10 GB+) sites, hosting compatibility (shared hosting, cPanel, Plesk, DirectAdmin, LiteSpeed, Nginx, Apache), per-section restore (database-only, uploads-only), scheduled and incremental backups, and client-side AES-256 encryption. Tags trimmed to the five most relevant terms (backup, migration, restore, database backup, malware scanner). No functional changes.

= 1.27.0 — 2026-07-29 =
* NEW: "On this server (Domain internal)" storage target support for panel-triggered backups. When you pick this target in the Yedekalma panel, a panel-triggered backup is now stored on the WordPress server itself (in the hardened wp-content/uploads/yedekalma-backups/ folder, using the path chosen by the panel) instead of failing. A permanent, unguessable-token download link (a public REST endpoint guarded by a 32-hex token) is returned so the backup can be downloaded from the panel; the file itself stays behind the folder's Apache deny rules. Cloud and "own server module" targets are unchanged.

= 1.26.0 — 2026-07-29 =
* NEW: Inbound provisioning for egress-blocked sites. Some servers block all outbound connections, so the plugin's handshake (which carries the secure pull key) can never reach the Yedekalma panel — leaving the panel unable to read the database / files / email summary. A new authenticated `provision` REST endpoint lets the panel pull the key **inbound** instead: the panel already holds the site's API token, presents it as a Bearer credential, and receives the pull key + REST pull URL over TLS. No outbound call from the site is required. The token is accepted only in the Authorization header (never a query string), and the endpoint is guarded by the exact API token the panel issued for this site.

= 1.25.0 — 2026-07-29 =
* NEW: Self-healing connection. The 6-hourly heartbeat now sends full site info (including the secure pull_secret + REST pull URL) in the POST body, so a connection that skipped the full handshake (e.g. connected via Google or an older version) is automatically upgraded to a working data-pull channel on the next heartbeat — no manual reconnect needed. The panel can then read the database / files / email component summary directly from WordPress. The secret travels only in the POST body (never a query string) so it never lands in access logs. On plugin upgrade the heal fires immediately on the first admin page load instead of waiting up to 6 hours.

= 1.21.0 — 2026-07-28 =
* NEW: Restore-to-staging. New ep_staging op='restore' + Test Ortamı page "Yedekten Oluştur": builds the /staging copy from a local backup zip (files at root + database_backup.sql[.gz]) instead of cloning live. Extracts files into /staging, imports the dump into the stg_ prefix (original prefix detected from the dump, table names rewritten to stg_), rewrites the backup's embedded URL to the staging URL (serialize-safe), writes staging wp-config + noindex .htaccess. Reuses all ep_staging helpers; on any import error the stg_ tables + /staging are removed (clean rollback). Live site (ABSPATH + live prefix) is never touched. Runs in the background; the page polls status. Phase 1 = local backups; cloud/panel backups to follow.

= 1.20.0 — 2026-07-28 =
* IMPROVED: Instant Backup activation latency. A lightweight 30-minute config-sync cron (yedekalma_config_sync_event, only when connected to the panel) now caches the instant-backup setting, so enabling it in the panel takes effect within ~30 min without waiting for the 6h heartbeat or an admin visit.
* IMPROVED: Content-triggered instant backup (non-WooCommerce sites) now uses component 'all' (files + database, incremental) so newly uploaded media in a post/page is captured too; WooCommerce order-triggered instant backup stays database-only (fast).

= 1.19.0 — 2026-07-28 =
* NEW: Staging (test environment) built into the plugin admin. New "Test Ortamı" submenu → a page to create/open/re-create/delete a `/staging` copy (files + `stg_` DB prefix) of the live site, entirely on the customer's own server, without needing the cloud panel. Uses the same engine (Yedekalma_Rest_Bridge::ep_staging) the panel uses; the long "create" runs in the background (loopback, ignore_user_abort) and the page polls status. WordPress only; live site never modified.

= 1.18.0 — 2026-07-28 =
* NEW: Instant Backup extended to regular WordPress content. On sites without WooCommerce, publishing or updating a post or page triggers an automatic incremental backup within seconds (debounced into a single backup; autosaves, revisions, auto-drafts and trashed items are ignored). Requires the optional Yedekalma cloud service. WordPress only.
* IMPROVED: The one-time in-plugin review request now counts cloud/scheduled/instant backups in addition to local ones, so it shows for connected sites that have real backups rather than only local-mode users.

= 1.17.0 — 2026-07-28 =
* NEW: Real-time Instant Backup for WooCommerce. A new order, an order status change or a completed payment triggers an automatic incremental backup within seconds. Events are debounced/merged so a busy sale period produces a single backup rather than one per order. The backup runs entirely on your own server through the plugin's own engine (in-process, no extra outbound call) and goes to your configured storage; nothing is kept on Yedekalma. Requires the optional Yedekalma cloud service. WooCommerce only.
* The panel shows the option only on WordPress sites (WooCommerce sites see order-based wording; other WordPress sites see content-based wording); non-WordPress connections never see it.

= 1.13.0 — 2026-07-27 =
* NEW: S3-compatible storage target in Yedekalma Pro (Amazon S3, Backblaze B2, Wasabi, Cloudflare R2, MinIO). Client-side AWS SigV4 presigned PUT — scheduled backups upload straight from your server to your bucket. Secret key AES-256 encrypted on your own site; never sent to Yedekalma (zero-data). Path-style toggle for B2/Wasabi/MinIO compatibility.

= 1.12.0 — 2026-07-25 =
* NEW: "Yedekalma Pro" admin menu — a single hub with tabs for Connection, Backup Content (files, database and e-mail/IMAP components; exclude paths with a browsable folder tree; client-side AES-256 BYOK passphrase), Storage Target (your own FTP/SFTP — credentials stored encrypted on your own site, never on Yedekalma), and Scheduling. Scheduled backups run on your own server (WP-Cron) and are sent straight to your own storage; IMAP mailboxes are backed up as .eml files. Zero data is kept on Yedekalma — backup content and storage/e-mail passwords never leave your site.
* NEW: "Connect with Google" — a one-click button links the site to your Yedekalma account through your browser, using Google sign-in on yedekalma.com. Because the whole handshake runs in your browser (not the web server), it works even on hosting that blocks the server's outbound connections. Only your email address (to create/find your account) and the Site URL are used; no Google Drive or other permission is requested. The one-time connection token is returned in the URL fragment (never sent to server logs) and stored encrypted on your own site.
* NEW: Optional, opt-in site registration. A dashboard button lets you register the site with Yedekalma so it appears in your panel; it sends only the Site URL and technical version info (plugin/WordPress/PHP version, locale) and never runs unless you click it. Fully disclosed under readme "External services"; no automatic phone-home (WordPress.org Guideline 6 / KVKK / GDPR compliant).
* SECURITY: Restore-time database search-replace now unserializes option values with `allowed_classes => false`, so a crafted serialized payload inside a restored row can never trigger PHP object injection (POP-gadget) during a migration/restore.
* SECURITY: Upload-limit raising (runtime ini_set and the optional `.user.ini` directive line) now runs only on Yedekalma admin screens and the plugin's own AJAX endpoints instead of on every wp-admin request — least-privilege, and no unnecessary global/site-wide PHP configuration changes. Note that upload_max_filesize/post_max_size are PHP_INI_PERDIR and were never actually changeable via ini_set at runtime; they are handled through .user.ini only.
* HARDENING: Completed strict WordPress.org late-escaping: the admin maximum-upload-limit notice and the PHP-CLI cron command hint now escape their dynamic values (esc_html). Bulk threat-file removal input is now wp_unslash'd and string-cast before path validation.

= 1.11.7 — 2026-07-22 =
* I18N: Completed the English, German, Russian and Arabic interface translations. 69 strings — confirmation dialogs, error messages, progress text and settings labels — previously fell back to the Turkish source text. All five bundled languages are now at 100%.
* I18N: The plugin name and description shown on the Plugins screen are now translatable.

= 1.11.6 — 2026-07-21 =
* DOCS: Rewrote the plugin description, feature list and FAQ.
* ASSETS: Added plugin directory icon and banner images.

= 1.11.5 — 2026-07-21 =
* FIX: Responsive threat table layout. Adjusted column widths and increased action column width to 110px so the protected shield badges fit cleanly without horizontal overflow.

= 1.11.4 — 2026-07-21 =
* FEATURE: Finalized malware scanner enhancements, core protection filters, and uninstall cleanup logic.

= 1.11.3 — 2026-07-20 =
* FEATURE: Custom malware scan protection layout. Integrated granular, detailed reasons for critical files (wp-config.php, active theme assets, root boot scripts, drop-ins, and admin/includes core files) to protect them from deletion, while still allowing the deletion of planted non-core exploits.

= 1.11.2 — 2026-07-20 =
* FIX: Robust option structure mapping. Hardened list rendering and DB option cleanup to support both array and object elements, preventing PHP type-error crashes on page loads and threat file deletions.

= 1.11.1 — 2026-07-20 =
* FIX: WordPress core protection. Added a strict safety check to prevent accidental deletion of critical WordPress files (such as files inside wp-admin, wp-includes, wp-config.php, index.php, etc.) via the malware scanner deletion tool.

= 1.11.0 — 2026-07-20 =
* NEW: Built-in Malware & Virus Scanner. Scan all PHP, JS, and configuration files for code injections, web shells, backdoors, and malicious patterns.
* NEW: Persistent Scan Results. Scanner results are securely saved on your site so they persist across page refreshes.
* NEW: Bulk Actions. Select all or specific detected threat files and delete them collectively with one click.
* NEW: Responsive Threats Table. Improved threats list layout and added responsive container with horizontal scrolling so long paths and patterns fit beautifully on all screens.
* NEW: Security Reminders. Contextual security notices recommend taking a virus scan before taking backups or restoring a backup.
* NEW: Space-saving Tabs UI. Combined vertical backup upload and import sections into a sleek, premium tabbed layout.

= 1.10.4 — 2026-07-20 =
* NEW: Added drag-and-drop local backup file upload zone (.zip, .sql, .sql.gz) with real-time progress bar.
* FIX: Fixed critical bug where restored backups disappeared from the list due to options database caching.
* FIX: Fixed settings loss on restore by correcting options key preservation to 'yedekalma_settings'.

= 1.10.3 — 2026-07-18 =
* WARNING: Added an explicit warning notice to the backup restoration modal to inform users that restoring a backup to a different domain will trigger an automatic site URL/domain configuration update in the database.
* LOCALIZATION: Updated Turkish, English, German, Russian, and Arabic translation files with the new domain warning string and rebuilt the compiled .mo files.

= 1.10.2 — 2026-07-15 =
* NEW: Cleaned settings page to focus on custom language preferences and system info.
* NEW: Made Settings (Ayarlar) page visible in the WordPress left sidebar menu.

= 1.10.1 — 2026-07-15 =
* NEW: Internationalization added with translations for English, German, Russian, Arabic, and Turkish.
* NEW: Added new SVG brand logo and official asset icons.
* FIX: Resolved permission issue with hidden settings page access.

= 1.10.0 — 2026-07-13 =
* SECURITY: The chunked-backup progress state is stored in a transient with a plugin-specific key prefix (yedekalma_chk_) so it can never collide with another plugin's transients.
* SECURITY: The backup encryption passphrase is now encrypted (with the site's AUTH_KEY) before it is written into that transient — it is never persisted in plaintext.
* PERFORMANCE: Bulky per-file backup state arrays (file list, manifest, reference file list) are kept in private system temp files instead of the transient, keeping the option/transient store small.

= 1.9.0 — 2026-07-08 =
* NEW: Multi-channel source size measurement for the cloud "Kontrol Et" (check) flow.

= 1.8.19 — 2026-07-04 =
* COMPLIANCE: PHP `memory_limit`/`set_time_limit` are now raised only inside the specific backup/restore endpoints that need them (via a helper), never as a global default on init.
* COMPLIANCE: Replaced all raw cURL calls with the WordPress HTTP API (`wp_remote_*`); large streaming uploads use the `http_api_curl` hook as recommended.
* COMPLIANCE: Restore-time `wp-config.php` update now uses the WordPress Filesystem API (`WP_Filesystem`) with strict value sanitization; no `.bak` copy is left in the site.
* COMPLIANCE: Renamed the internal notify-card guard constant to use the full `YEDEKALMA_` prefix.

= 1.8.18 — 2026-07-03 =
* FEATURE: Keyset pagination for database dumping to optimize performance on large sites.
* FEATURE: Native .sql.gz compression support for streaming database backups.
* FEATURE: Chunked execution flow for database and file backups.

= 1.8.16 — 2026-07-02 =
* UX: Removed the "Bulut Hesabına Bağlan" (Connect to Cloud Account) link from the admin submenu. The connect page stays accessible from the in-page CTA; only the sidebar menu item is hidden (via remove_submenu_page) to keep the menu clean.

= 1.8.15 — 2026-07-01 =
* COMPLIANCE (Guideline 5): No built-in feature is locked behind an account any more. When no Yedekalma account is connected, the plugin now runs fully in local mode by default — one-click backup (files + database), local/FTP/SFTP targets, download and restore all work with no account. The optional cloud connection only changes where backups are delivered.
* PRIVACY (Guideline 6 / no phone-home): Removed automatic anonymous registration and anonymous heartbeat. The plugin now makes NO external connection unless you deliberately connect the optional Yedekalma cloud service (enter an API token). This matches the "External services" section exactly.
* SECURITY: Hardened the local backup directory (wp-content/uploads/yedekalma-backups) — Apache 2.2 & 2.4 deny rules + index.php/index.html + directory-listing off, and backup archive filenames now include an unguessable random token so the file cannot be reached by direct URL (important on Nginx where .htaccess is ignored). Raw SQL dumps are written only to the private system temp dir and removed after archiving.

= 1.8.14 — 2026-06-30 =
* FIX: Recent/local backup list showed the wrong date & time. Timestamps are stored in the site's local timezone, but the list rendered them through get_date_from_gmt(), which re-applied the UTC offset. Now displayed with mysql2date() (no double conversion) on both the dashboard and the backups list.

= 1.8.13 — 2026-06-30 =
* FIX: Local backup could fail at finalization with "archive could not be opened" when the file list resolved to zero entries (e.g. database-only, or an empty temporary archive). libzip does not write an empty archive to disk, so re-opening it failed. The intermediate and finalize steps now open the archive with the CREATE flag, making the chunked backup resilient.

= 1.8.12 — 2026-06-30 =
* UX: Local backup now runs in time-sliced chunks, so the progress bar advances smoothly file-by-file (it no longer appears stuck at 50% on large sites). Added a "Show details" log panel that shows, in real time, which file is currently being added (n/total).

= 1.8.11 — 2026-06-30 =
* PRIVACY: True client-side BYOK. The backup encryption passphrase is now entered and stored only on your own site (Yedekalma → Connect Cloud → Backup Encryption), encrypted with your AUTH_KEY. It is never sent to or stored on the Yedekalma servers — the key stays entirely with you. Backup/restore/verify read the passphrase locally.

= 1.8.10 — 2026-06-30 =
* FIX: Local backup produced an empty archive ("Yedek arşivi boş üretildi") on sites with many files. ZipArchive keeps a file handle open per added file until close(), so large sites hit the OS open-files limit and close() failed silently. The builder now adds files in batches (close/reopen every 400 files) and verifies close() succeeded. The local backups folder is also excluded from the archive (prevents bloat and self-inclusion).

= 1.8.9 — 2026-06-30 =
* FIX: Local backup could appear stuck at 50%. The archive build now runs without the default time/memory limits (and continues server-side even if the connection drops), a lock prevents duplicate concurrent builds, and the admin progress poller now handles request timeouts/errors (retries, and surfaces the real error instead of freezing).
* HARDENING: Additional output escaping (esc_attr/esc_html) on schedule selects and the notification field; wp_unslash on the restore mode input.

= 1.8.8 — 2026-06-30 =
* COMPLIANCE: Clarified that the plugin is fully functional standalone — local one-click backup, download and restore work with no account and no external service; the Yedekalma cloud service is clearly documented as optional (Guidelines 5 & 6). Updated readme/description and FAQ accordingly.
* FIX: Removed the diagnostic log file written under wp-content/uploads; diagnostic steps now go to PHP error_log() only when WP_DEBUG is on (no predictable, web-accessible log file).
* SECURITY: The temporary wp-config.php safety copy made during a config-restore is now written to the system temp directory (outside the web root) instead of next to wp-config.php, so database credentials are never left in a downloadable file.

= 1.8.7 — 2026-06-30 =
* NEW: Use the plugin without a Yedekalma account. On activation the site is registered anonymously (technical info only — domain & versions, no personal data) so it can back up and restore right away.
* NEW: "Where should backup notifications go?" email field with double opt-in verification and an optional product-updates consent. Entering an email turns the install into a lead; signing up on yedekalma.com later with the same address automatically links this site to your account (no duplicate accounts).
* PRIVACY: Marketing consent is stored separately from transactional notifications; commercial messaging is gated behind explicit opt-in.

= 1.8.6 — 2026-06-30 =
* SECURITY: Real client-side AES-256 backup encryption (BYOK). When a passphrase is set, the archive is encrypted with AES-256 (CBC + HMAC) on your own server before upload and can only be opened with your passphrase. Each encrypted backup is self-verified (decrypt + checksum) before upload, so an unrecoverable archive is never sent. Restore and integrity-check transparently decrypt.

= 1.8.5 — 2026-06-29 =
* INFRA: Panel servers migrated to Turkey (turkticaret infrastructure); data is not transferred abroad (KVKK). Removed unverified certification wording.

= 1.8.4 — 2026-06-29 =
* RELIABILITY: Added a read-only backup integrity verification endpoint (downloads + checks SHA-256, archive and completion marker; never restores), so backups taken via the plugin can be auto-verified.

= 1.8.3 — 2026-06-29 =
* RELIABILITY: Incremental backups now compare real file mtime (not just size), so files whose content changes without a size change are correctly captured.

= 1.8.2 — 2026-06-29 =
* SECURITY: SSRF protection on restore download URLs (https + public-IP only). DATA INTEGRITY: DB dumps now write and verify a completion marker on the plain .sql path too (partial dumps are refused on restore).

= 1.8.1 — 2026-06-29 =
* CLARITY: When the selected storage target is not configured (e.g. "My Own Storage / FTP-SFTP" chosen but no credentials entered), the backup now fails with a clear, actionable message instead of a cryptic "no direct upload" error.

= 1.8.0 — 2026-06-29 =
* CLARITY: Renamed the "Bandwidth" quota to "Backup Quota" (Yedekleme Kotası) with a one-line explanation, so customers understand the monthly quota measures the data our engine packages and sends to your cloud — not the central server's bandwidth.

= 1.7.9 — 2026-06-29 =
* RELIABILITY: Full & files-only backups can now complete on restricted hosts (exec disabled) via chunked, time-sliced processing. Restore transparently handles the gzipped SQL stored inside the chunked archive.

= 1.7.8 — 2026-06-29 =
* RELIABILITY: Chunked database restore now verifies a completion marker and aborts loudly on a truncated/corrupt archive instead of silently applying a partial restore (data-loss protection).

= 1.7.5 — 2026-06-29 =
* COMPLIANCE: Removed all trial-expired premium locking screens and replaced them with non-blocking warning notices, fully complying with WordPress.org Guideline 5 (Trial/Expired Software).

= 1.7.4 — 2026-06-29 =
* SECURITY: Enforced strict Zero-Server-Storage architecture. Restores and backups are now processed strictly client-side or streamed direct-to-cloud; no temporary backup files or SQL dumps are ever cached/stored on the central backup servers.
* COMPLIANCE: Removed the custom updater class to fully comply with official WordPress.org Plugin Guidelines (Section 3: "Plugins may not bypass the update system").
* COMPATIBILITY: Compatibility enhancements and optimization for PHP 8.x and latest WordPress versions.

= 1.5.6 — 2026-06-27 =
* FIX: Restore button is now a progressive-enhanced link — it opens the secure panel login even if admin JavaScript is unavailable, and shows an in-admin confirmation modal when JS is loaded.

= 1.5.5 — 2026-06-27 =
* RENAME: Plugin display name and slug updated to "Yedekalma — Cloud Backup & Restore" (slug: yedekalma), now that domain ownership is verified.
* DOCS: Clarified the Restore Drill description to match the actual weekly integrity verification.

= 1.5.4 — 2026-06-27 =
* UX: "Restore" button now opens an in-admin confirmation modal.

= 1.5.3 — 2026-06-27 =
* NEW: In-admin "Restore" button on dashboard.
* FIX: Escaped translation strings and resolved REST API route permission callbacks.
* RENAME: Renamed plugin display name and slug to avoid WP brand confusion.
* REMOVE: Removed custom updater to comply with WordPress.org guidelines.

= 1.5.2 — 2026-06-25 =
* RESTORE: Added new `/restore-wpconfig` endpoint to update DB details in `wp-config.php` during database restores to a different host.
* RESILIENCE: Bridge URLs migrated to `?rest_route=` format for compatibility with plain permalink sites.

= 1.5.1 — 2026-06-25 =
* INFO: Added notes to Backup Frequency page explaining synchronization with the optional cloud service.

= 1.4.0 — 2026-06-24 =
* SPEED: Added chunked file transfer support via `/zip-batch` (POST) to speed up backups.

= 1.3.0 — 2026-06-24 =
* Support for large sites: added manifest-based file transfer to avoid execution time limits.

= 1.2.1 — 2026-06-24 =
* Folder exclusions and shared hosting permission handling improvements in file bridge.

= 1.2.0 — 2026-06-24 =
* PLUG-AND-PLAY: FTP/SFTP or MySQL credentials are no longer required to take backups.

= 1.1.4 — 2026-06-24 =
* Bandwidth usage indicator widgets added to admin bar and side dashboard panel.

= 1.1.3 — 2026-06-18 =
* New billing model: 1 GB free bandwidth for new accounts.

= 1.0.0 — 2026-06-17 =
* Initial release.
