readme.txt

=== EngineScript Site Optimizer ===
Contributors: enginescript
Tags: optimization, performance, cleanup
Requires at least: 7.0
Tested up to: 7.1
Stable tag: 2.2.0
Requires PHP: 8.2
License: GPLv3 or later
License URI: https://www.gnu.org/licenses/gpl-3.0.html

Configure optional WordPress features and resource hints.

== Description ==

EngineScript Site Optimizer lets you disable selected WordPress features and configure resource hints.
Choose the options that suit your site and check their effects on your theme and plugins.

Key features:
* Disable WordPress emojis
* Remove jQuery Migrate
* Disable classic theme styles
* Remove selected header output (version, RSD, shortlinks, recent comments style)
* DNS prefetch and preconnect management
* Disable Jetpack promotional messages and Blaze promotions
* Disable post via email

== Installation ==

1. Upload the plugin files to the `/wp-content/plugins/enginescript-site-optimizer` directory.
2. Activate the plugin through the 'Plugins' screen in WordPress.
3. Configure the plugin under Settings > Site Optimizer.

== Frequently Asked Questions ==

= Will this plugin break my site? =

Compatibility depends on the features your theme and plugins use. All feature toggles start disabled. Enable options one at a time and check the affected pages, editor and admin screens.

= Do I need technical knowledge to use this plugin? =

No, the plugin has a simple interface where you can toggle features on and off.

= Are settings shared across multisite? =

Each site has separate settings. Network activation does not create shared network settings.

= What can I enter in a resource hint list? =

Preconnect and DNS Prefetch lists start empty. Optional domain suggestions appear as selectable text below each field; copy only the domains your site uses, enable the setting and save. Existing saved lists are preserved.

Enter one HTTPS domain per line, such as https://cdn.example.com. Paths other than a trailing slash, query strings, fragments and credentials are rejected. Preconnect accepts an omitted port or port 443. DNS prefetch uses only the domain name, even if an accepted entry includes a port. Each entry must be valid as written: a malformed port, for example, is rejected and not corrected.

Each list allows 32,768 bytes in total, 100 nonblank lines and 512 bytes per nonblank line, before trimming or removing duplicates and invalid entries. Empty or ASCII-space-only lines are blank.

Saving a blank list clears it. Within the limits, invalid entries are omitted; an entirely invalid list is saved empty. A malformed or oversized submission retains the previous list. Oversized saved lists produce no plugin hints until corrected. Legacy custom-port preconnect entries are skipped without rewriting their saved text until an explicit save.

Validation rejects IP literals, localhost and configured reserved domain name suffixes. It does not resolve DNS or verify that a domain name resolves to a public address. Use hints for domains your pages need and measure their effect; browsers decide whether to use them. The plugin adds its hints to front-end pages only, not to the admin area or the login screen.

= What happens when I deactivate or delete the plugin? =

Deactivation retains settings. Deleting the plugin through WordPress runs uninstall cleanup, including separate site settings across multisite networks. Pause site creation and settings changes during removal. Large installations may need an operator-run uninstall with sufficient time and memory. If cleanup fails, the plugin files stay in place and the message gives the reason and, on a network, the IDs of the sites that could not be cleaned. Resolve the reported problem and retry removal.

= Does hiding the WordPress version fix security issues? =

No. The option removes WordPress's generator output from the page head and from feeds; other version indicators, such as version arguments on asset URLs, can remain. Keep WordPress, themes and plugins updated.


== Changelog ==

= Unreleased =
* Deprecate `es_optimizer_clear_options_cache()`, which has done nothing since WordPress took over option caching; calling it triggers WordPress's deprecation notice.
* Write the plugin's PHP in PHP 8 forms (short arrays, an arrow function, first-class callables); behavior is unchanged.
* Start Preconnect and DNS Prefetch lists empty and show optional, copyable domain suggestions below each field; preserve existing saved lists.
* Let `wp plugin uninstall` remove every site's settings on multisite: treat the site-switch state as empty when WordPress has not set it yet, as under WP-CLI.
* Say why an uninstall failed, with the site ID where one applies. A failure raised by other code keeps its own message and is not shown.
* During a network uninstall, pass over a site whose settings cannot be removed, clean the remaining sites, then fail with the affected site IDs. The plugin files are still retained.
* Return a non-array value from another plugin's filter callback unchanged in the resource-hint, TinyMCE and plugin-action-link callbacks, instead of stopping the page with a type error.
* Reject a domain with a malformed port, a colon without a port, or a bracketed domain name, instead of rewriting it.
* Stop three domain name patterns from matching text that ends in a line break.
* Read on/off settings the way WordPress reads booleans: a stored or submitted string `false` now means off.
* Reject the special-use names `alt` and `onion` in domain lists.
* Raise the minimum WordPress version to 7.0, the version Jetpack requires. PHP 8.2 stays the minimum.
* Use one term, "domain", for an entry of the Preconnect and DNS Prefetch lists in the settings, the rejection reasons, and the documentation. The reasons now read "Invalid domain entry.", "No domain name found.", "Invalid domain name.", and "IP addresses and private, local, or reserved domain names are not allowed."
* Let `es_optimizer_normalize_stored_options()` accept a stored value that is not an array and treat it as empty, instead of failing with a type error.
* Mark only the `fonts.gstatic.com` preconnect hint with `crossorigin`. The hint for `fonts.googleapis.com` no longer carries it, so the stylesheet request can use the connection.
* Confirm a save with "Settings saved." when the same save also reports rejected lines.
* Tell screen-reader users that the EngineScript link on the settings page opens in a new tab.
* Escape the translated menu and page titles of the settings page, so that a translation file cannot put markup into the admin menu.
* Let "Disable Jetpack Promotions" turn off Jetpack's Just-in-Time Messages: the plugin now adds its Jetpack filters when it loads, before Jetpack reads them.
* Reject a domain whose last label is a hexadecimal number, such as `cdn.0x1f`, which browsers treat as an IP address.
* Keep a network uninstall's memory use flat: clear WordPress's in-memory cache after each site, when the object cache supports it.
* Show WordPress's own translation of "Settings saved." beside a rejected-lines warning.
* "Remove WordPress Version" now also removes the generator tag from feeds, and "Remove Shortlink" also removes the shortlink HTTP response header.
* Stop adding the plugin's resource hints to the login screen.
* Write the reasons in a rejected-lines notice as separate sentences, say in words when further rejected lines are not listed, and drop the time-and-memory advice from the uninstall failure message, which now gives its reason.
* Remove the unused function `es_optimizer_resource_hint_exists()`, the unused constant `ES_SITE_OPTIMIZER_PATH`, and the unused `$force_refresh` parameter of `es_optimizer_get_options()`. A call that passes that parameter by name now fails; a positional argument is ignored.
* Remove the filter that took the emoji domain out of DNS prefetch hints, with its parser: WordPress 6.8 and later print no such hint. Remove the two activation and deactivation callbacks, which did nothing. The functions `es_optimizer_disable_emojis_remove_dns_prefetch()`, `es_optimizer_get_resource_hint_host()`, `es_optimizer_activate_plugin()`, and `es_optimizer_deactivate_plugin()` no longer exist.

= 2.2.0 - 2026-09-27 =
* Correct native CI notice assertions, multisite bootstrap timing and post-by-email filter expectations.
* Use system executable paths in automation helpers and add regression checks for executable substitution through PATH.
* Split package validation and automation tests into focused functions while retaining all invalid-package cases.
* Align the WordPress Tested up to metadata at 7.1.
* Document three resource-hint URL false positives for Plugin Check with line-specific exceptions; resource-hint behavior is unchanged.
* Document per-site settings, domain-list limits and uninstall requirements; align contributor guidance and quality-check claims with the repository.
* Correct optimizer packaging and isolate unit/native CI discovery, retaining the existing quality gates and dependency lanes.
* Clarify settings help and Jetpack promotion labels without changing feature behavior or validation rules.
* Refresh the translation template from all production PHP, including uninstall messages, and declare the bundled language directory.
* Limit domain-list work and retain previous values for oversize submissions; skip oversize saved lists without changing their stored text.
* Report rejected-line totals with at most three safe samples and avoid duplicate plugin warnings during repeated validation.
* Build exact resource-hint membership once per callback, preserving foreign entries without unsafe value conversions.
* Explain domain-list byte and line limits and show associated guidance for oversize saved lists.
* Reject unsupported preconnect ports and skip legacy custom-port hints while preserving their saved text until an explicit save.
* Correct admin and embed emoji hooks, safely match equivalent DNS hint hosts, and apply reversible filters using the current site's settings.
* Use the core settings notice display, escape plain-text section and field titles, and associate textarea instructions with their controls.
* Retire the obsolete Windows Live Writer manifest setting; ignore its old key on reads and omit it on a normal save.
* Clarify HTTPS port requirements, hostname-only DNS prefetch behavior, and invalid-list save behavior in settings help.
* Read current-site options through WordPress caching; missing settings remain virtual until a changed save.
* Preserve previous domain lists for malformed submissions and validate original URL text before normalization.
* Use localized rejection reasons and line numbers without submitted URLs or credentials.
* Clean the plugin option across multisite networks on uninstall, verify deletion, restore site context, and stop file removal on failure. Pause site/settings changes during removal; large installations may need an operator-run uninstall with sufficient resources.
* Restore optimizer package, analyzer and contributor-guidance targets without changing locked dependency versions.
* **CODE QUALITY**: Replaced PHP-native IP validation with WordPress native IP validation for resource hint host checks

= 2.1.0 - 2026-06-10 =
* **BUG FIX**: Removed a redundant `is_array()` check in `es_optimizer_disable_emojis_tinymce()` after adding a strict `array` parameter type, resolving a PHPStan always-true warning on PHP 8.3
* **BUG FIX (Critical)**: Fixed License URI pointing to GPL 2.0 instead of GPL 3.0 in plugin header and readme.txt
* **BUG FIX (Critical)**: Fixed release workflow producing incomplete zip files missing `languages/` directory and `readme.txt`
* **BUG FIX**: Fixed changelog parser in release workflow that could not match heading format in CHANGELOG.md
* **BUG FIX**: Consolidated duplicate msgid entries in POT translation file and corrected license header
* **BUG FIX**: Fixed CI lint step that never ran because it checked for wrong PHPCS config filename
* **BUG FIX**: Fixed README.md license text incorrectly stating GPL-2.0+
* **ADDED**: `uninstall.php` to properly clean up plugin options when the plugin is deleted
* **ADDED**: Section headers to settings page for better organization (Performance, Header Cleanup, Additional Features)
* **ADDED**: `phpcompatibility/phpcompatibility-wp` composer dependency required by PHPCS ruleset
* **ADDED**: Composer `scripts` section with `lint:php` and `analyze` commands for CI
* **MODERNIZATION**: Added modern PHP type declarations to all functions
* **MODERNIZATION**: Replaced `isset()` ternaries with null coalescing operator
* **CODE QUALITY**: Standardized all option-checking to use `empty()` with early-return pattern
* **CODE QUALITY**: Consolidated duplicate domain validation functions into shared helpers
* **CODE QUALITY**: Fixed trailing whitespace on blank lines and equals-sign alignment flagged by PHPCS
* **CODE QUALITY**: Removed unnecessary static caching in preconnect and DNS prefetch output functions
* **CODE QUALITY**: Replaced deprecated HTML `valign` attribute in settings form
* **CI**: Updated Node.js from EOL version 16 to LTS version 20
* **DOCS**: Corrected feature lists in GEMINI.md and readme.txt to match actually implemented features
* **DOCS**: Raised the documented WordPress baseline to 6.8+ across plugin metadata and contributor guidance
* **DOCS**: Updated POT translation file with correct line references and new section header strings
* **TOOLING**: Expanded `.gitignore` coverage for local instruction files, IDE settings, caches, logs, temporary files, dependencies, and distribution artifacts
* **SECURITY**: Eliminated `phpcs:ignore` on preconnect output with explicit if/else for crossorigin
* **SECURITY**: Replaced fragile substring crossorigin detection with exact hostname matching

= 2.0.0 - 2026-02-28 =
* **BREAKING**: Renamed plugin from "Simple WP Optimizer" to "EngineScript Site Optimizer" to comply with WordPress.org plugin directory naming restrictions
* Plugin slug changed from `simple-wp-optimizer` to `enginescript-site-optimizer`
* Text domain changed from `simple-wp-optimizer` to `enginescript-site-optimizer`
* Admin menu label changed from "WP Optimizer" to "Site Optimizer"

= 1.8.1 - 2026-02-28 =
* **BUG FIX (Critical)**: Fixed whitespace inside form field `name` attributes that prevented all settings from being saved; browsers sent literal newlines/tabs as part of the field name so WordPress never received the data
* **BUG FIX (Critical)**: Fixed inverted IP-validation logic that caused every preconnect/DNS-prefetch domain name to be incorrectly rejected when saving settings
* **BUG FIX (Critical)**: Fixed `es_optimizer_clear_options_cache()` which was not actually clearing the static options cache
* **BUG FIX**: Fixed textarea content containing leading whitespace between the HTML tag and the PHP value output
* **SECURITY**: Added missing `esc_url()` and `esc_html__()` escaping to the Settings link in the Plugins list
* **SECURITY**: Moved `esc_textarea()` escaping to the point of output for textarea values, preventing a potential XSS vector
* **SECURITY**: Removed redundant custom nonce field and its bypassable verification; CSRF protection is handled by WordPress Settings API
* **CODE QUALITY**: Fixed double-escaping; render callers now pass `__()` instead of `esc_html__()`, with escaping done at output in the render functions
* **CODE QUALITY**: Renamed 11 globally-scoped functions to use the `es_optimizer_` prefix, preventing potential naming collisions with other plugins
* **CODE QUALITY**: Unified all option retrieval calls to use the `es_optimizer_get_options()` caching wrapper
* **CODE QUALITY**: Settings page heading, description, and submit button are now fully translatable
* **CODE QUALITY**: Removed unreachable dead code in `es_optimizer_add_settings_page()`
* **CODE QUALITY**: Refactored textarea rendering to place PHP open/close tags on their own lines, resolving Codacy best-practice warnings

= 1.8.0 - 2025-10-23 =
* **FEATURE**: Added new option to remove RSD (Really Simple Discovery) link from WordPress header
* **FEATURE**: Added separate DNS Prefetch option for lighter-weight domain lookups
* **PERFORMANCE**: Upgraded from DNS-prefetch to Preconnect for critical resources
* **PERFORMANCE**: Preconnect now establishes full connections (DNS + TCP + TLS) instead of just DNS lookup
* **PERFORMANCE**: Added crossorigin attribute for font domains to improve CORS request handling
* **ENHANCEMENT**: Added helpful descriptions explaining when to use Preconnect vs DNS-prefetch
* **ENHANCEMENT**: Added preconnect for Google Tag Manager and additional critical domains
* **ENHANCEMENT**: Added DNS prefetch for Google Ad Service as lighter-weight fallback
* **OPTIMIZATION**: Updated default preconnect domains by removing deprecated Google CDN URLs
* **USER EXPERIENCE**: All optimization options are now disabled by default for better user control
* **CODE QUALITY**: Fixed WordPress coding standards compliance for PHP tag formatting and indentation

= 1.7.0 =
* **ARCHITECTURE**: Major plugin architecture refactor: completely restructured initialization to use the WordPress `plugins_loaded` hook
* **ARCHITECTURE**: Improved plugin load order by removing immediate global scope execution
* **ARCHITECTURE**: Consolidated plugin initialization into proper WordPress lifecycle management
* **ARCHITECTURE**: Enhanced plugin activation, deactivation, and uninstall lifecycle management
* **CODE QUALITY**: Removed unused `es_optimizer_enqueue_admin_scripts()` function (dead code removal)
* **CODE QUALITY**: Fixed inline comment punctuation to comply with WordPress coding standards
* **STABILITY**: Enhanced plugin stability and compatibility with other WordPress plugins

= 1.6.0 =
* **PERFORMANCE**: Implemented conditional admin asset loading - admin scripts and styles now only load on plugin settings page
* **PERFORMANCE**: Added option caching system with `es_optimizer_get_options()` function to reduce database queries
* **PERFORMANCE**: Enhanced DNS prefetch function with static caching, duplicate removal, and AJAX detection
* **SECURITY**: Enhanced DNS prefetch validation to reject file paths, query parameters, and fragments - only clean domains accepted
* **SECURITY**: Strengthened domain validation to prevent file path injection (e.g., `https://google.com/file.php` now rejected)
* **DOCUMENTATION**: Added @since version tags to all PHPDoc blocks for better change tracking
* **DEVELOPER EXPERIENCE**: Created comprehensive CONTRIBUTING.md file with development standards and security requirements
* **USER EXPERIENCE**: Updated DNS prefetch textarea description to clearly explain clean domain requirements
* **CODE QUALITY**: Enhanced function documentation while maintaining WordPress coding standards compliance

= 1.5.12 =
* ADDED: New option to disable the post-via-email feature for enhanced security and performance.
* SECURITY: Hardened all feature-disabling filters to use `PHP_INT_MAX` priority, ensuring they cannot be overridden by other plugins or themes.

= 1.5.11 =
* CODE QUALITY: Converted all code to use spaces instead of tabs for indentation
* CODE STYLE: Fixed file comment header to use "/**" style instead of "/*" style
* CODE STYLE: Added proper spacing around operators (e.g., `! defined` instead of `!defined`)
* CODE STYLE: Added proper full stops to inline comments for consistency
* CODE STYLE: Removed trailing whitespace from documentation blocks
* VARIABLE NAMING: Converted variable names to use snake_case instead of camelCase for WordPress compliance
* FUNCTION FORMATTING: Improved function parameter spacing and alignment
* ARRAY FORMATTING: Enhanced array formatting with proper alignment and trailing commas

= 1.5.10 =
* MAINTENANCE: Updated changelog and version references across documentation files for new release
* DOCUMENTATION: Synced CHANGELOG.md and readme.txt as per project standards
* NO CODE CHANGES: This release is documentation and changelog only

= 1.5.9 =
* REQUIREMENTS: Updated minimum WordPress version requirement to 6.5+ across all files for modern WordPress compatibility
* INTERNATIONALIZATION: Created languages/simple-wp-optimizer.pot file for translation support
* DOCUMENTATION: Updated all version references to reflect new WordPress 6.5+ minimum requirement
* WORKFLOW: Updated GitHub Actions workflow compatibility testing from WordPress 6.0 to 6.5
* COMPLIANCE: Enhanced project structure compliance with copilot coding standards and documentation guidelines

= 1.5.8 =
* **CODE QUALITY**: Fixed all WordPress Plugin Check compliance issues for WordPress.org standards
* **CODE QUALITY**: Implemented camelCase variable naming convention throughout codebase
* **CODE QUALITY**: Reduced function complexity by extracting DNS validation logic into separate functions
* **CODE QUALITY**: Added proper translator comments for all internationalization strings with placeholders
* **CODE QUALITY**: Enhanced $_POST data handling with proper sanitization using sanitize_text_field()
* **CODE QUALITY**: Improved code organization with single responsibility principle
* **CODE QUALITY**: Fixed upgrade notice character limits to meet WordPress.org requirements
* **SECURITY**: Enhanced nonce verification with additional sanitization layer
* **SECURITY**: Improved domain validation architecture with dedicated validation functions
* **MAINTENANCE**: Optimized function structure for better maintainability and testing
* **MAINTENANCE**: Updated code documentation for improved developer experience
* **COMPLIANCE**: Full WordPress Plugin Check compatibility - passes all automated tests

= 1.5.7 =
* **SECURITY ENHANCEMENT**: Added WordPress nonce protection for CSRF security in all form submissions
* **SECURITY ENHANCEMENT**: Enhanced DNS prefetch security with HTTPS-only domain enforcement
* **SECURITY ENHANCEMENT**: Added private IP and localhost blocking for DNS prefetch to prevent SSRF attacks
* **SECURITY ENHANCEMENT**: Implemented comprehensive domain validation with multi-layer security checks
* Added user-friendly error messages for rejected domains with proper HTML escaping
* Added security event notifications for administrators when domains are rejected for security reasons
* Strengthened form security with proper wp_nonce_field() and wp_verify_nonce() implementation
* Improved DNS prefetch domain validation with enhanced URL parsing and filtering
* Enhanced error handling with proper WordPress admin notices and comprehensive escaping
* Updated help text to clearly indicate HTTPS requirement for DNS prefetch domains
* Fixed potential XSS vulnerability in error message display through proper HTML escaping
* Improved domain validation to prevent bypass of security checks and information disclosure
* Better user experience with informative, security-focused error messages
* Comprehensive input validation preventing malicious domain submissions and attacks

= 1.5.6 =
* Enhanced GitHub Actions workflows for comprehensive plugin testing and security analysis
* Added PHPStan WordPress static analysis with proper WordPress stubs configuration
* Integrated WordPress Vulnerability Scanner and comprehensive security scanning
* Fixed PHPStan static analysis errors: register_setting(), remove_action(), wp_print_link_tag() replacement, disable_emojis_tinymce() logic
* Enhanced security implementation with comprehensive OWASP-compliant documentation
* Added detailed security implementation notes following WordPress best practices
* Improved input validation with strict type checking for all user inputs
* Enhanced output escaping with context-appropriate WordPress functions (esc_html, esc_attr, esc_url, esc_textarea)
* Added proper capability checks for all admin functions using current_user_can('manage_options')
* Implemented secure coding patterns and multi-layer domain validation for DNS prefetch
* Added comprehensive code documentation with security explanations and best practices
* Fixed potential security vulnerabilities with proper WordPress coding standards
* Improved code structure and organization for better maintainability
* Enhanced development workflow with reliable testing and WordPress stubs support

= 1.5.5 =
* Enhanced code quality with comprehensive static analysis fixes
* Fixed register_setting function to use proper array parameters instead of string callback
* Corrected remove_action function calls to use proper parameter count (2-3 parameters)
* Replaced non-existent wp_print_link_tag function with proper HTML output using esc_url()
* Improved disable_emojis_tinymce function logic to eliminate unreachable code
* Added comprehensive PHPStan WordPress static analysis with proper WordPress stubs
* Enhanced security scanning with WordPress-specific vulnerability patterns
* Improved workflow reliability by removing problematic external dependencies
* Added Composer support with WordPress stubs for better development experience
* Updated code to pass PHPStan level 5 analysis with zero errors
* Added compatibility with WordPress 6.8
* Fixed text domain to comply with WordPress.org standards (changed from `simple-wp-optimizer-enginescript` to `simple-wp-optimizer`)
* Updated all internationalization function calls with proper text domain
* Fixed missing text domain parameter in translation functions
* Resolved issues with WordPress plugin check requirements
* Fixed issue template formatting for automated GitHub issue creation
* Made the plugin fully compatible with the WordPress Plugin Check tool
* Improved documentation and code comments

== Upgrade Notice ==

= 2.2.0 =
Improves per-site settings, validation and multisite uninstall. Domain lists now have size limits; preconnect accepts HTTPS port 443 or no port. Oversized saved lists and legacy custom-port hints are skipped until corrected. Removes the obsolete Windows Live Writer setting.

= 1.5.9 =
REQUIREMENTS UPDATE: Updated minimum WordPress version to 6.5+. Added translation support and enhanced compliance.

= 1.5.8 =
CODE QUALITY UPDATE: Fixed all WordPress Plugin Check issues for full WordPress.org compliance. Enhanced code organization.

= 1.5.7 =
SECURITY UPDATE: Important security enhancements including CSRF protection and DNS prefetch security. Update recommended.

= 1.5.6 =
Major security enhancement update with OWASP-compliant security implementation. Recommended for all users.

= 1.5.5 =
WordPress 6.8 compatibility and internationalization fixes. Passes all Plugin Check tests.

= 1.5.4 =
This update includes security enhancements and code optimization.