== Changelog ==

Full release history for Yedekalma. The readme.txt file only lists the most
recent releases; everything else is kept here.

= 1.40.5 — 2026-07-31 =
* UX: "Settings" has moved to the bottom of the Yedekalma admin menu, so the pages you use daily — Backups, Malware Scanner and Pro — stay at the top.

= 1.40.4 — 2026-07-31 =
* UX: The Backups table is much easier to read — the Domain column is gone (the page only ever shows this site), Start and End have been merged into a single "Created" date, and the full file path no longer stretches the row (it moved into the source badge's tooltip).
* UX: Restore and Download are now icon buttons with a hover label explaining what they do.
* FIX: A backup taken through the panel but stored inside the plugin's own uploads folder was mislabelled as "WP plugin". The source is now decided by the archive's layout rather than by which folder it was found in, and previously mislabelled rows are corrected automatically.

= 1.40.3 — 2026-07-31 =
* PERFORMANCE: Large backups were far slower than they should be. Every slice closed and reopened the archive, and closing a ZIP rewrites it from scratch — so with ~10,000 files the cost grew quadratically and a single slice eventually took over two minutes. Slice size now adapts to the measured cost of the last archive write, cutting the number of full rewrites dramatically.
* FIX: The progress console only printed the last file of each slice, so the counter jumped from 4800 straight to 5200 and the screen looked frozen. Every file added is now logged, and progress is published every two seconds during a slice instead of only at the end.
* FIX: Cancelling a large backup no longer waits for a full archive rewrite; pending entries are discarded immediately.
* FIX: Total byte size is recomputed if it is missing, so a backup started before the upgrade no longer shows "1 MB / 0 B".
* UX: The "Account status" card has been removed from the dashboard — with the quota model retired it only showed an empty column — and the backup card now uses the full width, with a taller log console.

= 1.40.2 — 2026-07-31 =
* NEW: The Backups page now also lists archives found on disk, even when they have no database record — after a plugin re-install, a wiped option or a manual file drop, your existing backups are no longer invisible.
* NEW: Each row now shows where the backup came from — **Panel** (taken through yedekalma.com with the PHP module) or **WP plugin** (taken by this plugin) — and whether it was already registered in the database or was just discovered on disk.
* NEW: A "scanned folders" list on the same page shows exactly which directories were searched, so a missing backup is easy to diagnose.
* FIX: Download, restore and delete now resolve the archive's real path, so backups living outside the plugin's own folder work too. Only paths under a scanned backup root are accepted.

= 1.40.1 — 2026-07-31 =
* FIX: The backup progress console repeated the same file name over and over. Status is polled about once a second while a single slice takes longer, so the unchanged line was re-printed dozens of times — on one large file it filled the whole console. The line is now printed once and refreshed in place with an elapsed-seconds counter, so you can see it is still working rather than stuck.
* NEW: Byte-level progress. The progress line now shows how much has been packed and how much is left (e.g. "2400 / 9699 files · 1.2 GB / 4.5 GB (2.3 GB left)"), plus the size of the file being added. The progress bar itself is now byte-based, so one huge file no longer counts the same as one tiny file.
* UX: "Open Yedekalma panel" buttons now go straight to the login screen instead of the marketing home page.

= 1.24.0 — 2026-07-29 =
* NEW: The plugin now reports a **configuration summary** to the Yedekalma panel, so the panel's **Backup Plan** step enables or locks each component (Files / Database / Mail) based on what you actually set up on your site — exactly like the standalone PHP backup module already did. If you have **not added any email account** on the *Yedekalma Pro → E-posta* tab, the *Mail backup* row is locked in the panel (no more misleading "mail backup" appearing active when there is nothing to back up). Files and the WordPress database are always available. Only counts and masked names are sent — no passwords ever leave your site.

= 1.23.0 — 2026-07-29 =
* IMPROVED: On the **Yedekalma Pro → File System** tab, the folder browser is now open by default (no extra "Browse folders" click) and loads the site root automatically.
* IMPROVED: Excluded paths now show a green "✓ excluded" badge in the browser, both for items you just excluded and for paths already in your exclude list, so you can see at a glance what is left out.
* NOTE: This release also bumps the asset version, so browsers reliably load the latest admin scripts — this ensures the 1.22.x fixes (Pro connect/disconnect returning to the Pro page, and the real backup-status panel) actually take effect. If a previous update looked like it "did nothing", installing 1.23.0 and hard-refreshing (Ctrl+Shift+R) resolves it.

= 1.22.2 — 2026-07-29 =
* NEW: The **Yedekalma Pro** page now shows the real backup status from your cloud panel — *Awaiting payment / not started*, *Expired*, or *Active* — plus the last backup time. Previously the "connected" box alone could give the false impression that scheduled backups were running when payment was still pending.

= 1.22.1 — 2026-07-29 =
* FIX: After connecting or disconnecting your Yedekalma account from the **Yedekalma Pro** page, the browser now returns to the Pro page instead of jumping to the main control panel.

= 1.22.0 — 2026-07-28 =
* REMOVED: Real-time **Instant Backup** (WooCommerce order / post-page change trigger). Each trigger re-packaged the whole component (it was not incremental), which caused heavy CPU, disk and bandwidth load on large sites. Scheduled incremental backups — as often as every few minutes — cover this need efficiently. All related hooks and settings were removed.

= 1.16.0 — 2026-07-28 =
* NEW: One-click Staging (test environment). Clone your live site into a `/staging` subfolder with a separate `stg_` table prefix — all on your own hosting — so you can safely try plugin/theme updates or changes without touching the live site. The clone runs entirely on your server (files copied on disk, database duplicated with `CREATE TABLE ... LIKE` + `INSERT SELECT`), URLs are rewritten serialization-safely, `WP_HOME`/`WP_SITEURL` are set, and the copy is marked noindex. Managed from your Yedekalma panel. Your live site is never modified — only new `stg_`/`staging` are created. WordPress only.

= 1.15.0 — 2026-07-27 =
* NEW: A one-time, respectful review request appears only inside Yedekalma's own admin pages after you have completed at least three successful backups. It never touches the rest of wp-admin, "Remind me later" postpones it for 30 days, and "Already reviewed / Dismiss" hides it for good. It makes no external connection — clicking "Rate" simply opens the WordPress.org review page in a new tab.
* DOCS: Added FAQ answers for restoring a WordPress backup for free, free site migration, malware scanning without a subscription, and recommended backup frequency.

= 1.14.0 — 2026-07-27 =
* NEW: Manual backups now run in the background on your own server — start a backup, then leave the page or switch menus and it keeps going; it automatically resumes tracking when you return, and shows a confirmation dialog and jumps to the Backups page when finished.
* NEW: Backups on disk are auto-recovered — if a backup file exists in your uploads folder but is missing from the list, it is detected and re-added so it stays visible and restorable.
* IMPROVED: Restore now only offers the sections your backup actually contains (a database-only backup offers only "Database", etc.).
* IMPROVED: "Yedekalma Pro" screen clearly reflects that it is the Yedekalma (yedekalma.com) cloud service; its Files/Database/E-mail tabs stay inactive until you connect. Database and e-mail sections now let you auto-discover accounts and test the connection before saving; the exclude-folder browser also lists files.
* IMPROVED: Admin pages no longer hang when your host blocks outbound connections to yedekalma.com (short timeouts + graceful fallback).
* Various UI polish and fixes.

= 1.22.0 =
Real-time Instant Backup has been removed — it re-packaged the whole site on every change and could overload large sites. Use scheduled incremental backups (as frequent as every few minutes) instead.

= 1.15.0 =
Adds a one-time, respectful in-plugin review request (shown only after three successful backups, easy to dismiss, no external connection) and new FAQ entries. Recommended for all users.

= 1.40.0 — 2026-07-30 =
* SECURITY: Hardened the malware-scanner results view against a stored-XSS vector. A maliciously named file (e.g. one containing a quote and an event handler) could break out of an HTML attribute and run script in wp-admin when scan results were rendered. File paths are now fully attribute-escaped (both quotes).
* SECURITY: The restore downloader now pins the validated IP for the actual request (curl CURLOPT_RESOLVE), closing a DNS-rebinding window between the SSRF safety check and the fetch.
* SECURITY: When `AUTH_KEY` is undefined, the at-rest encryption fallback key is now stored outside the database (in a web-inaccessible file) rather than in `wp_options`, so a database dump no longer contains both the ciphertext and its key.

= 1.37.0 — 2026-07-30 =
* NEW: Email (IMAP) restore. A full restore now also re-injects the archived `.eml` messages back into your mailboxes over IMAP (matching each archived account to your configured e-mail account), completing the round-trip started in 1.36.0. Messages are added with `imap_append` and never deleted; a message already present (matched by its Message-ID) is skipped, so restoring twice is safe and never creates duplicates. Missing folders are created automatically. If the PHP `imap` extension is missing or an account can't be reached, e-mail restore is skipped and reported — the file and database restore still complete. (The archived `.eml` files are no longer written into the web root during restore.)

= 1.36.0 — 2026-07-30 =
* NEW: Email (IMAP) backup for panel-triggered backups. When you have configured e-mail accounts in the plugin (Pro → E-mail), a full backup now also archives every folder of every account as `.eml` files (under `eposta/<account>/<folder>/`), just like the files and database. It runs inside the same resilient chunked engine — a few seconds of messages per step — so even large mailboxes finish without timing out, with live progress. Messages are fetched read-only (they are never marked as read and the mailbox is never modified). Each message is scanned for malware; a malicious message is left in the mailbox but kept out of the archive (so your antivirus can't lock the whole backup) and reported. If the PHP `imap` extension is missing or an account cannot be reached, e-mail is skipped and reported — the file and database backup still complete. (One-click e-mail restore from the panel is coming in a follow-up; until then the messages are available as `.eml` files inside the archive.)

= 1.35.0 — 2026-07-30 =
* UX: The "Connection" tab (Pro page) now opens instantly. Previously the page waited 3-4 seconds for two remote calls (backup status + recent backups) before rendering, so the "Connect with Google" screen flashed before the connected view appeared. Those two panels are now loaded asynchronously after the page opens, with a loading spinner in their place, so the connected screen shows immediately and the flash is gone.

= 1.34.0 — 2026-07-30 =
* CHANGE: Local backups are now stored in a per-site, unguessable folder named `YedekAlmaBackup-wp-XXXXXXXX` under `wp-content/uploads/` instead of the fixed, predictable `yedekalma-backups`. This makes a WordPress-panel backup easy to identify and adds a layer of defence (the folder name can no longer be guessed). On update, any existing `yedekalma-backups` folder is renamed to the new name automatically, so your existing backups and download links keep working — nothing is lost. If the rename cannot be performed, the old folder name is kept safely.

= 1.33.0 — 2026-07-30 =
* NEW: Database malware scanning. In addition to scanning files, a backup now scans the high-risk database tables (posts, options, comments and their meta) for injected malicious code — hidden redirect iframes, spam/skimmer scripts and obfuscated PHP/JS — as the database is dumped. Findings are reported to the Yedekalma panel exactly like file findings (the panel's per-domain file/database scan toggles decide what is kept). Scanning is read-only and never alters the dump; it is deduplicated per table and capped so even a very large database adds negligible overhead.

= 1.32.0 — 2026-07-30 =
* NEW: Multiple storage destinations (fan-out). When your Yedekalma panel configures more than one storage target for a domain, a panel-triggered backup is now copied to every target — not just the first. After the primary destination completes, the same archive is uploaded to each additional destination (each gets its own backup record and download/restore entry). A failure on an extra destination never affects the primary backup. This brings panel-driven WordPress backups in line with the standalone PHP module.

= 1.31.0 — 2026-07-30 =
* FIX: Malware scanner no longer flags pristine WordPress core files as threats. Several signatures were too broad and matched the legitimate content of WordPress core (and legitimate plugins), so a clean install downloaded from WordPress.org showed dozens of "threats". Removed or narrowed the offending signatures: (1) the long hex-escape signature that matched crypto/media byte tables (sodium_compat constants, getID3 magic-byte detection like the PNG signature, SimplePie whitespace tables, compat-utf8) is removed — real hex payloads are still caught inside an execution context; (2) the bare `wp_create_user`/`wp_insert_user`/`add_cap`/`wp_roles`/`grant_super_admin` and `add_filter('determine_current_user')` signatures are removed — those are WordPress's own core user/role/auth API used by pluggable.php, user.php, capabilities.php, class-wp-roles.php, user-edit.php and every legitimate membership plugin; genuine rogue-admin injection is still caught by the raw-SQL signatures; (3) the hidden-iframe signature now requires an external `src`, so plupload's upload iframe and WordPress oEmbed no longer match; (4) `strrev(...strrev(...))` reverse-string idioms (getID3 Lyrics3, wp-admin/post.php) no longer match the nested-obfuscation signature; (5) the temp-dropper signature no longer matches core's `require $file; die` bootstrap. Detection of real web shells, compiled binaries in the web root, and `include $x; unlink($x)` droppers is unchanged.

= 1.30.0 — 2026-07-30 =
* UX: Malware scanner results now have a "Show only deletable threats" filter (on by default). Findings that match WordPress core files are protected and cannot be deleted; the filter hides those protected rows so the actionable threats you can actually select and quarantine are shown first, with a small note of how many protected rows are hidden. Toggle it off to see every finding again.

= 1.29.0 — 2026-07-30 =
* FIX: Malware scanner no longer flags the plugin's own files as threats. The scanner's signature table literally contains web-shell family names (c99shell, r57shell, …) and command-parameter patterns, so left-over COPIES of the plugin outside the active folder — WordPress's own wp-content/upgrade/ update staging folder and any trashed/old copies — were being reported as "known web shell / backdoor". The self-exclusion now recognises the plugin's file layout in any location, not just the active plugin directory.
* FIX: Fewer false positives generally. The bare English words "webshell" and "backdoor" were removed from the known-web-shell signature (they appear in legitimate security plugins, comments and documentation; real shells are still caught by their specific family names). The command-parameter signature no longer matches $_POST['pass'] / ['pwd'] / ['code'], which normal login forms and verification/coupon-code fields use — only genuine command params (cmd/exec/payload/execute) remain.

= 1.28.0 — 2026-07-30 =
* DOCS: Refreshed the WordPress.org listing for clarity and search. Corrected the short description (real-time Instant Backup was removed in 1.22.0 and is no longer advertised), gave each supported cloud destination its own line (Google Drive, Dropbox, OneDrive, Amazon S3 / Backblaze B2 / Wasabi / Cloudflare R2 / MinIO, FTP/SFTP), added a dedicated "backup to your own cloud storage" heading, and expanded the FAQ from ~14 to ~30 entries with truthful answers about WooCommerce backups, large (5–10 GB+) sites, hosting compatibility (shared hosting, cPanel, Plesk, DirectAdmin, LiteSpeed, Nginx, Apache), per-section restore (database-only, uploads-only), scheduled and incremental backups, and client-side AES-256 encryption. Tags trimmed to the five most relevant terms (backup, migration, restore, database backup, malware scanner). No functional changes.

= 1.27.0 — 2026-07-29 =
* NEW: "On this server (Domain internal)" storage target support for panel-triggered backups. When you pick this target in the Yedekalma panel, a panel-triggered backup is now stored on the WordPress server itself (in the hardened wp-content/uploads/yedekalma-backups/ folder, using the path chosen by the panel) instead of failing. A permanent, unguessable-token download link (a public REST endpoint guarded by a 32-hex token) is returned so the backup can be downloaded from the panel; the file itself stays behind the folder's Apache deny rules. Cloud and "own server module" targets are unchanged.

= 1.26.0 — 2026-07-29 =
* NEW: Inbound provisioning for egress-blocked sites. Some servers block all outbound connections, so the plugin's handshake (which carries the secure pull key) can never reach the Yedekalma panel — leaving the panel unable to read the database / files / email summary. A new authenticated `provision` REST endpoint lets the panel pull the key **inbound** instead: the panel already holds the site's API token, presents it as a Bearer credential, and receives the pull key + REST pull URL over TLS. No outbound call from the site is required. The token is accepted only in the Authorization header (never a query string), and the endpoint is guarded by the exact API token the panel issued for this site.

= 1.25.0 — 2026-07-29 =
* NEW: Self-healing connection. The 6-hourly heartbeat now sends full site info (including the secure pull_secret + REST pull URL) in the POST body, so a connection that skipped the full handshake (e.g. connected via Google or an older version) is automatically upgraded to a working data-pull channel on the next heartbeat — no manual reconnect needed. The panel can then read the database / files / email component summary directly from WordPress. The secret travels only in the POST body (never a query string) so it never lands in access logs. On plugin upgrade the heal fires immediately on the first admin page load instead of waiting up to 6 hours.

= 1.21.0 — 2026-07-28 =
* NEW: Restore-to-staging. New ep_staging op='restore' + Test Ortamı page "Yedekten Oluştur": builds the /staging copy from a local backup zip (files at root + database_backup.sql[.gz]) instead of cloning live. Extracts files into /staging, imports the dump into the stg_ prefix (original prefix detected from the dump, table names rewritten to stg_), rewrites the backup's embedded URL to the staging URL (serialize-safe), writes staging wp-config + noindex .htaccess. Reuses all ep_staging helpers; on any import error the stg_ tables + /staging are removed (clean rollback). Live site (ABSPATH + live prefix) is never touched. Runs in the background; the page polls status. Phase 1 = local backups; cloud/panel backups to follow.

= 1.20.0 — 2026-07-28 =
* IMPROVED: Instant Backup activation latency. A lightweight 30-minute config-sync cron (yedekalma_config_sync_event, only when connected to the panel) now caches the instant-backup setting, so enabling it in the panel takes effect within ~30 min without waiting for the 6h heartbeat or an admin visit.
* IMPROVED: Content-triggered instant backup (non-WooCommerce sites) now uses component 'all' (files + database, incremental) so newly uploaded media in a post/page is captured too; WooCommerce order-triggered instant backup stays database-only (fast).

= 1.19.0 — 2026-07-28 =
* NEW: Staging (test environment) built into the plugin admin. New "Test Ortamı" submenu → a page to create/open/re-create/delete a `/staging` copy (files + `stg_` DB prefix) of the live site, entirely on the customer's own server, without needing the cloud panel. Uses the same engine (Yedekalma_Rest_Bridge::ep_staging) the panel uses; the long "create" runs in the background (loopback, ignore_user_abort) and the page polls status. WordPress only; live site never modified.

= 1.18.0 — 2026-07-28 =
* NEW: Instant Backup extended to regular WordPress content. On sites without WooCommerce, publishing or updating a post or page triggers an automatic incremental backup within seconds (debounced into a single backup; autosaves, revisions, auto-drafts and trashed items are ignored). Requires the optional Yedekalma cloud service. WordPress only.
* IMPROVED: The one-time in-plugin review request now counts cloud/scheduled/instant backups in addition to local ones, so it shows for connected sites that have real backups rather than only local-mode users.

= 1.17.0 — 2026-07-28 =
* NEW: Real-time Instant Backup for WooCommerce. A new order, an order status change or a completed payment triggers an automatic incremental backup within seconds. Events are debounced/merged so a busy sale period produces a single backup rather than one per order. The backup runs entirely on your own server through the plugin's own engine (in-process, no extra outbound call) and goes to your configured storage; nothing is kept on Yedekalma. Requires the optional Yedekalma cloud service. WooCommerce only.
* The panel shows the option only on WordPress sites (WooCommerce sites see order-based wording; other WordPress sites see content-based wording); non-WordPress connections never see it.

= 1.13.0 — 2026-07-27 =
* NEW: S3-compatible storage target in Yedekalma Pro (Amazon S3, Backblaze B2, Wasabi, Cloudflare R2, MinIO). Client-side AWS SigV4 presigned PUT — scheduled backups upload straight from your server to your bucket. Secret key AES-256 encrypted on your own site; never sent to Yedekalma (zero-data). Path-style toggle for B2/Wasabi/MinIO compatibility.

= 1.12.0 — 2026-07-25 =
* NEW: "Yedekalma Pro" admin menu — a single hub with tabs for Connection, Backup Content (files, database and e-mail/IMAP components; exclude paths with a browsable folder tree; client-side AES-256 BYOK passphrase), Storage Target (your own FTP/SFTP — credentials stored encrypted on your own site, never on Yedekalma), and Scheduling. Scheduled backups run on your own server (WP-Cron) and are sent straight to your own storage; IMAP mailboxes are backed up as .eml files. Zero data is kept on Yedekalma — backup content and storage/e-mail passwords never leave your site.
* NEW: "Connect with Google" — a one-click button links the site to your Yedekalma account through your browser, using Google sign-in on yedekalma.com. Because the whole handshake runs in your browser (not the web server), it works even on hosting that blocks the server's outbound connections. Only your email address (to create/find your account) and the Site URL are used; no Google Drive or other permission is requested. The one-time connection token is returned in the URL fragment (never sent to server logs) and stored encrypted on your own site.
* NEW: Optional, opt-in site registration. A dashboard button lets you register the site with Yedekalma so it appears in your panel; it sends only the Site URL and technical version info (plugin/WordPress/PHP version, locale) and never runs unless you click it. Fully disclosed under readme "External services"; no automatic phone-home (WordPress.org Guideline 6 / KVKK / GDPR compliant).
* SECURITY: Restore-time database search-replace now unserializes option values with `allowed_classes => false`, so a crafted serialized payload inside a restored row can never trigger PHP object injection (POP-gadget) during a migration/restore.
* SECURITY: Upload-limit raising (runtime ini_set and the optional `.user.ini` directive line) now runs only on Yedekalma admin screens and the plugin's own AJAX endpoints instead of on every wp-admin request — least-privilege, and no unnecessary global/site-wide PHP configuration changes. Note that upload_max_filesize/post_max_size are PHP_INI_PERDIR and were never actually changeable via ini_set at runtime; they are handled through .user.ini only.
* HARDENING: Completed strict WordPress.org late-escaping: the admin maximum-upload-limit notice and the PHP-CLI cron command hint now escape their dynamic values (esc_html). Bulk threat-file removal input is now wp_unslash'd and string-cast before path validation.

= 1.11.7 — 2026-07-22 =
* I18N: Completed the English, German, Russian and Arabic interface translations. 69 strings — confirmation dialogs, error messages, progress text and settings labels — previously fell back to the Turkish source text. All five bundled languages are now at 100%.
* I18N: The plugin name and description shown on the Plugins screen are now translatable.

= 1.11.6 — 2026-07-21 =
* DOCS: Rewrote the plugin description, feature list and FAQ.
* ASSETS: Added plugin directory icon and banner images.

= 1.11.5 — 2026-07-21 =
* FIX: Responsive threat table layout. Adjusted column widths and increased action column width to 110px so the protected shield badges fit cleanly without horizontal overflow.

= 1.11.4 — 2026-07-21 =
* FEATURE: Finalized malware scanner enhancements, core protection filters, and uninstall cleanup logic.

= 1.11.3 — 2026-07-20 =
* FEATURE: Custom malware scan protection layout. Integrated granular, detailed reasons for critical files (wp-config.php, active theme assets, root boot scripts, drop-ins, and admin/includes core files) to protect them from deletion, while still allowing the deletion of planted non-core exploits.

= 1.11.2 — 2026-07-20 =
* FIX: Robust option structure mapping. Hardened list rendering and DB option cleanup to support both array and object elements, preventing PHP type-error crashes on page loads and threat file deletions.

= 1.11.1 — 2026-07-20 =
* FIX: WordPress core protection. Added a strict safety check to prevent accidental deletion of critical WordPress files (such as files inside wp-admin, wp-includes, wp-config.php, index.php, etc.) via the malware scanner deletion tool.

= 1.11.0 — 2026-07-20 =
* NEW: Built-in Malware & Virus Scanner. Scan all PHP, JS, and configuration files for code injections, web shells, backdoors, and malicious patterns.
* NEW: Persistent Scan Results. Scanner results are securely saved on your site so they persist across page refreshes.
* NEW: Bulk Actions. Select all or specific detected threat files and delete them collectively with one click.
* NEW: Responsive Threats Table. Improved threats list layout and added responsive container with horizontal scrolling so long paths and patterns fit beautifully on all screens.
* NEW: Security Reminders. Contextual security notices recommend taking a virus scan before taking backups or restoring a backup.
* NEW: Space-saving Tabs UI. Combined vertical backup upload and import sections into a sleek, premium tabbed layout.

= 1.10.4 — 2026-07-20 =
* NEW: Added drag-and-drop local backup file upload zone (.zip, .sql, .sql.gz) with real-time progress bar.
* FIX: Fixed critical bug where restored backups disappeared from the list due to options database caching.
* FIX: Fixed settings loss on restore by correcting options key preservation to 'yedekalma_settings'.

= 1.10.3 — 2026-07-18 =
* WARNING: Added an explicit warning notice to the backup restoration modal to inform users that restoring a backup to a different domain will trigger an automatic site URL/domain configuration update in the database.
* LOCALIZATION: Updated Turkish, English, German, Russian, and Arabic translation files with the new domain warning string and rebuilt the compiled .mo files.

= 1.10.2 — 2026-07-15 =
* NEW: Cleaned settings page to focus on custom language preferences and system info.
* NEW: Made Settings (Ayarlar) page visible in the WordPress left sidebar menu.

= 1.10.1 — 2026-07-15 =
* NEW: Internationalization added with translations for English, German, Russian, Arabic, and Turkish.
* NEW: Added new SVG brand logo and official asset icons.
* FIX: Resolved permission issue with hidden settings page access.

= 1.10.0 — 2026-07-13 =
* SECURITY: The chunked-backup progress state is stored in a transient with a plugin-specific key prefix (yedekalma_chk_) so it can never collide with another plugin's transients.
* SECURITY: The backup encryption passphrase is now encrypted (with the site's AUTH_KEY) before it is written into that transient — it is never persisted in plaintext.
* PERFORMANCE: Bulky per-file backup state arrays (file list, manifest, reference file list) are kept in private system temp files instead of the transient, keeping the option/transient store small.

= 1.9.0 — 2026-07-08 =
* NEW: Multi-channel source size measurement for the cloud "Kontrol Et" (check) flow.

= 1.8.19 — 2026-07-04 =
* COMPLIANCE: PHP `memory_limit`/`set_time_limit` are now raised only inside the specific backup/restore endpoints that need them (via a helper), never as a global default on init.
* COMPLIANCE: Replaced all raw cURL calls with the WordPress HTTP API (`wp_remote_*`); large streaming uploads use the `http_api_curl` hook as recommended.
* COMPLIANCE: Restore-time `wp-config.php` update now uses the WordPress Filesystem API (`WP_Filesystem`) with strict value sanitization; no `.bak` copy is left in the site.
* COMPLIANCE: Renamed the internal notify-card guard constant to use the full `YEDEKALMA_` prefix.

= 1.8.18 — 2026-07-03 =
* FEATURE: Keyset pagination for database dumping to optimize performance on large sites.
* FEATURE: Native .sql.gz compression support for streaming database backups.
* FEATURE: Chunked execution flow for database and file backups.

= 1.8.16 — 2026-07-02 =
* UX: Removed the "Bulut Hesabına Bağlan" (Connect to Cloud Account) link from the admin submenu. The connect page stays accessible from the in-page CTA; only the sidebar menu item is hidden (via remove_submenu_page) to keep the menu clean.

= 1.8.15 — 2026-07-01 =
* COMPLIANCE (Guideline 5): No built-in feature is locked behind an account any more. When no Yedekalma account is connected, the plugin now runs fully in local mode by default — one-click backup (files + database), local/FTP/SFTP targets, download and restore all work with no account. The optional cloud connection only changes where backups are delivered.
* PRIVACY (Guideline 6 / no phone-home): Removed automatic anonymous registration and anonymous heartbeat. The plugin now makes NO external connection unless you deliberately connect the optional Yedekalma cloud service (enter an API token). This matches the "External services" section exactly.
* SECURITY: Hardened the local backup directory (wp-content/uploads/yedekalma-backups) — Apache 2.2 & 2.4 deny rules + index.php/index.html + directory-listing off, and backup archive filenames now include an unguessable random token so the file cannot be reached by direct URL (important on Nginx where .htaccess is ignored). Raw SQL dumps are written only to the private system temp dir and removed after archiving.

= 1.8.14 — 2026-06-30 =
* FIX: Recent/local backup list showed the wrong date & time. Timestamps are stored in the site's local timezone, but the list rendered them through get_date_from_gmt(), which re-applied the UTC offset. Now displayed with mysql2date() (no double conversion) on both the dashboard and the backups list.

= 1.8.13 — 2026-06-30 =
* FIX: Local backup could fail at finalization with "archive could not be opened" when the file list resolved to zero entries (e.g. database-only, or an empty temporary archive). libzip does not write an empty archive to disk, so re-opening it failed. The intermediate and finalize steps now open the archive with the CREATE flag, making the chunked backup resilient.

= 1.8.12 — 2026-06-30 =
* UX: Local backup now runs in time-sliced chunks, so the progress bar advances smoothly file-by-file (it no longer appears stuck at 50% on large sites). Added a "Show details" log panel that shows, in real time, which file is currently being added (n/total).

= 1.8.11 — 2026-06-30 =
* PRIVACY: True client-side BYOK. The backup encryption passphrase is now entered and stored only on your own site (Yedekalma → Connect Cloud → Backup Encryption), encrypted with your AUTH_KEY. It is never sent to or stored on the Yedekalma servers — the key stays entirely with you. Backup/restore/verify read the passphrase locally.

= 1.8.10 — 2026-06-30 =
* FIX: Local backup produced an empty archive ("Yedek arşivi boş üretildi") on sites with many files. ZipArchive keeps a file handle open per added file until close(), so large sites hit the OS open-files limit and close() failed silently. The builder now adds files in batches (close/reopen every 400 files) and verifies close() succeeded. The local backups folder is also excluded from the archive (prevents bloat and self-inclusion).

= 1.8.9 — 2026-06-30 =
* FIX: Local backup could appear stuck at 50%. The archive build now runs without the default time/memory limits (and continues server-side even if the connection drops), a lock prevents duplicate concurrent builds, and the admin progress poller now handles request timeouts/errors (retries, and surfaces the real error instead of freezing).
* HARDENING: Additional output escaping (esc_attr/esc_html) on schedule selects and the notification field; wp_unslash on the restore mode input.

= 1.8.8 — 2026-06-30 =
* COMPLIANCE: Clarified that the plugin is fully functional standalone — local one-click backup, download and restore work with no account and no external service; the Yedekalma cloud service is clearly documented as optional (Guidelines 5 & 6). Updated readme/description and FAQ accordingly.
* FIX: Removed the diagnostic log file written under wp-content/uploads; diagnostic steps now go to PHP error_log() only when WP_DEBUG is on (no predictable, web-accessible log file).
* SECURITY: The temporary wp-config.php safety copy made during a config-restore is now written to the system temp directory (outside the web root) instead of next to wp-config.php, so database credentials are never left in a downloadable file.

= 1.8.7 — 2026-06-30 =
* NEW: Use the plugin without a Yedekalma account. On activation the site is registered anonymously (technical info only — domain & versions, no personal data) so it can back up and restore right away.
* NEW: "Where should backup notifications go?" email field with double opt-in verification and an optional product-updates consent. Entering an email turns the install into a lead; signing up on yedekalma.com later with the same address automatically links this site to your account (no duplicate accounts).
* PRIVACY: Marketing consent is stored separately from transactional notifications; commercial messaging is gated behind explicit opt-in.

= 1.8.6 — 2026-06-30 =
* SECURITY: Real client-side AES-256 backup encryption (BYOK). When a passphrase is set, the archive is encrypted with AES-256 (CBC + HMAC) on your own server before upload and can only be opened with your passphrase. Each encrypted backup is self-verified (decrypt + checksum) before upload, so an unrecoverable archive is never sent. Restore and integrity-check transparently decrypt.

= 1.8.5 — 2026-06-29 =
* INFRA: Panel servers migrated to Turkey (turkticaret infrastructure); data is not transferred abroad (KVKK). Removed unverified certification wording.

= 1.8.4 — 2026-06-29 =
* RELIABILITY: Added a read-only backup integrity verification endpoint (downloads + checks SHA-256, archive and completion marker; never restores), so backups taken via the plugin can be auto-verified.

= 1.8.3 — 2026-06-29 =
* RELIABILITY: Incremental backups now compare real file mtime (not just size), so files whose content changes without a size change are correctly captured.

= 1.8.2 — 2026-06-29 =
* SECURITY: SSRF protection on restore download URLs (https + public-IP only). DATA INTEGRITY: DB dumps now write and verify a completion marker on the plain .sql path too (partial dumps are refused on restore).

= 1.8.1 — 2026-06-29 =
* CLARITY: When the selected storage target is not configured (e.g. "My Own Storage / FTP-SFTP" chosen but no credentials entered), the backup now fails with a clear, actionable message instead of a cryptic "no direct upload" error.

= 1.8.0 — 2026-06-29 =
* CLARITY: Renamed the "Bandwidth" quota to "Backup Quota" (Yedekleme Kotası) with a one-line explanation, so customers understand the monthly quota measures the data our engine packages and sends to your cloud — not the central server's bandwidth.

= 1.7.9 — 2026-06-29 =
* RELIABILITY: Full & files-only backups can now complete on restricted hosts (exec disabled) via chunked, time-sliced processing. Restore transparently handles the gzipped SQL stored inside the chunked archive.

= 1.7.8 — 2026-06-29 =
* RELIABILITY: Chunked database restore now verifies a completion marker and aborts loudly on a truncated/corrupt archive instead of silently applying a partial restore (data-loss protection).

= 1.7.5 — 2026-06-29 =
* COMPLIANCE: Removed all trial-expired premium locking screens and replaced them with non-blocking warning notices, fully complying with WordPress.org Guideline 5 (Trial/Expired Software).

= 1.7.4 — 2026-06-29 =
* SECURITY: Enforced strict Zero-Server-Storage architecture. Restores and backups are now processed strictly client-side or streamed direct-to-cloud; no temporary backup files or SQL dumps are ever cached/stored on the central backup servers.
* COMPLIANCE: Removed the custom updater class to fully comply with official WordPress.org Plugin Guidelines (Section 3: "Plugins may not bypass the update system").
* COMPATIBILITY: Compatibility enhancements and optimization for PHP 8.x and latest WordPress versions.

= 1.5.6 — 2026-06-27 =
* FIX: Restore button is now a progressive-enhanced link — it opens the secure panel login even if admin JavaScript is unavailable, and shows an in-admin confirmation modal when JS is loaded.

= 1.5.5 — 2026-06-27 =
* RENAME: Plugin display name and slug updated to "Yedekalma — Cloud Backup & Restore" (slug: yedekalma), now that domain ownership is verified.
* DOCS: Clarified the Restore Drill description to match the actual weekly integrity verification.

= 1.5.4 — 2026-06-27 =
* UX: "Restore" button now opens an in-admin confirmation modal.

= 1.5.3 — 2026-06-27 =
* NEW: In-admin "Restore" button on dashboard.
* FIX: Escaped translation strings and resolved REST API route permission callbacks.
* RENAME: Renamed plugin display name and slug to avoid WP brand confusion.
* REMOVE: Removed custom updater to comply with WordPress.org guidelines.

= 1.5.2 — 2026-06-25 =
* RESTORE: Added new `/restore-wpconfig` endpoint to update DB details in `wp-config.php` during database restores to a different host.
* RESILIENCE: Bridge URLs migrated to `?rest_route=` format for compatibility with plain permalink sites.

= 1.5.1 — 2026-06-25 =
* INFO: Added notes to Backup Frequency page explaining synchronization with the optional cloud service.

= 1.4.0 — 2026-06-24 =
* SPEED: Added chunked file transfer support via `/zip-batch` (POST) to speed up backups.

= 1.3.0 — 2026-06-24 =
* Support for large sites: added manifest-based file transfer to avoid execution time limits.

= 1.2.1 — 2026-06-24 =
* Folder exclusions and shared hosting permission handling improvements in file bridge.

= 1.2.0 — 2026-06-24 =
* PLUG-AND-PLAY: FTP/SFTP or MySQL credentials are no longer required to take backups.

= 1.1.4 — 2026-06-24 =
* Bandwidth usage indicator widgets added to admin bar and side dashboard panel.

= 1.1.3 — 2026-06-18 =
* New billing model: 1 GB free bandwidth for new accounts.

= 1.0.0 — 2026-06-17 =
* Initial release.
