Rank Authority SEO Connector

Isbeddellada

1.0.61

• Security: removed the post_meta parameter from the update endpoint. It accepted any meta key outside a short blocklist and wrote the value unchanged, which let an authenticated request set meta that themes and page builders render on the frontend. The rank_authority_post_meta_blocklist filter is removed with it
• Security: restoring a page builder layout no longer writes values from the request. When the plugin clears builder meta it now keeps its own copy on the post, and a restore reads that copy, so request input never reaches keys such as _wpb_shortcodes_custom_css, _wpb_post_custom_css, or _elementor_data, which builders emit as CSS or render as widgets
• The update endpoint still accepts builder_meta and the response still reports cleared_builder_meta, so existing integrations keep working; the submitted values are ignored in favour of the stored copy
• The stored builder copy is removed once a restore applies it, and on uninstall
• The update response reports builder_restored: true when a restore applied the stored copy, false when this site had none to restore from (layouts cleared by an earlier version), and null when no restore was requested

1.0.60

• Removed arbitrary CSS handling: the publishing endpoint no longer extracts <style> blocks from submitted HTML into post meta, and the plugin no longer prints stored CSS into wp_head. Rows written by earlier versions are deleted on upgrade
• Security: markup supplied by the recommendation service is now filtered through wp_kses_post() before it is inserted into a page, so script tags, event-handler attributes, and disallowed protocols cannot reach the rendered HTML
• Security: recommendations may only set attributes on an allow list. Event handlers, style, srcdoc, and formaction are refused outright, and href / src values are restricted to http, https, mailto, and tel
• Security: element re-tagging is limited to layout and text tags, so a recommendation can no longer rename an element to script
• Security: JSON-LD is emitted with JSON_HEX_TAG, JSON_HEX_AMP, JSON_HEX_APOS, and JSON_HEX_QUOT, so no schema value can terminate the surrounding script block
• Removed a step that rewrote \u003C-style escapes in the raw snippet response before decoding it; json_decode() already resolves them, so the rewrite only undid escaping the transport had applied
• Schema supplied as HTML is now decoded and validated at save time, so post meta holds JSON data instead of <script> markup
• Fixed SSR page titles losing a literal &: the title was written by assigning nodeValue, which libxml reads as entity references, so “Tips & tricks” was rendered as “Tips tricks”. Titles are now written as a text node
• Fixed element re-tagging acting on the wrong tag: a new_selector such as h2.title took the last token and produced a <title> element inside the body (and div.wrapper produced <wrapper>). Re-tagging now applies only to recognised layout and text tags and is skipped otherwise, leaving the original element untouched
• Coding standards: json_encode() calls replaced with wp_json_encode(), admin banner output escaped, and the ra_highlight query flag unslashed and sanitized

1.0.59

• Renamed the plugin display name to “Rank Authority SEO Connector” so it describes the plugin itself rather than the wider platform, and removed the Plugin URI header, which pointed at a page that no longer exists
• Security: bearer-token authentication now rejects the request when the stored token is empty, instead of treating an empty Authorization: Bearer header as a match
• Documented every external service the plugin contacts (snippet CDN, snippet API, dashboard, Google Fonts) in a dedicated External Services section, including what is sent and when
• Corrected the feature list and privacy notes to match current behaviour: recommendations are applied server-side and no third-party script is loaded for visitors
• Coding standards: swapped parse_url(), strip_tags(), and unlink() for their WordPress equivalents, unslashed and sanitized every $_SERVER read, escaped the IndexNow key-file body, and set explicit versions on the registered admin assets
• Tested against WordPress 7.0

1.0.58

• SSR: link recommendations now fall back to the visible anchor text when their CSS selector does not match the live DOM (parity with content/heading recommendations), improving reliability on CMS-connected sites

1.0.57

• Added authenticated GET /ra/v1/content?slug=<slug> route: returns a published post/page body plus SEO metadata (effective seo_title, meta_description, canonical, yoast_keyword) in one call, so the Rank Authority scanner can audit title/meta-description tags for CMS-connected sites (the public wp/v2 body does not carry <head> metadata)
• GET /ra/v1/post/{id} (and /ra/v1/page/{id}) responses now also include seo_title and canonical, resolving Yoast / RankMath / AIOSEO meta with a post-title / permalink fallback
• SEO title falls back to the post title when the stored value is an unexpanded template (e.g. Yoast %%title%%, RankMath %title%)

1.0.56

• RA-driven post/page deletion now unpublishes to draft (restorable) instead of permanent delete, while the URL still serves 410
• Added authenticated GET /ra/v1/inventory route returning paginated published permalinks across all public post types, for authoritative URL inventory

1.0.55

• GEO page template (page-geo.php): the article now has its own light surface — white background, dark base text color, padding, and rounded corners — so dark-themed sites (or themes whose custom header forces body { background: #000 }) can no longer render the generated GEO content invisible
• GEO category template (category-geo.php): archive content wrapped in the same light surface; post titles and the page title get explicit dark colors instead of inheriting theme colors designed for a dark background
• Links without inline colors inside GEO content get a dark fallback color so theme link colors meant for dark backgrounds stay readable on the light surface

1.0.54

• Fixed POST /ra/v1/upgrade leaving the plugin deactivated after a successful self-update: WordPress’ Plugin_Upgrader silently deactivates the plugin before replacing its files (deactivate_plugin_before_upgrade on non-cron contexts), and the REST path had no admin redirect to reactivate it
• The endpoint now captures the pre-upgrade active state (including network-activation on multisite) and silently re-activates the plugin after the files are swapped, matching how a normal admin update preserves an active plugin
• If re-activation fails, the endpoint returns an error instead of reporting success, so the dashboard never shows a healthy connection while the plugin is actually inactive

1.0.53

• SSR robustness: inline <script>, <style>, <svg>, and <noscript> blocks are stashed behind comment tokens before the DOMDocument load/save round-trip and spliced back verbatim afterward, so libxml can no longer mangle page-builder HTML widgets whose scripts embed markup (template literals containing </div>, etc.) — this was leaking raw JS into the rendered page on Elementor homepages
• JSON-LD <script type="application/ld+json"> is deliberately left in the DOM so it is still located and updated in place; no change to title/meta/canonical/content/link recommendation behavior

1.0.52

• Fixed POST /ra/v1/upgrade falsely reporting “already up to date” on sites that were genuinely behind: the self-update now queries wordpress.org directly via plugins_api() and compares with version_compare() instead of relying on WP’s cached update_plugins transient (which stays empty when the plugin folder slug differs from rank-authority or the update cron check is stale/blocked)
• The wp.org package is injected into the update transient keyed by the actual installed plugin file before running Plugin_Upgrader, so the upgrade proceeds even when WP’s own update check never flagged it

1.0.51

• Added authenticated POST /ra/v1/posts/bulk-delete endpoint: removes multiple posts/pages by slug in a single request, resolving each slug via the site’s permalink structure (url_to_postid()), hierarchical page path, then post_name fallback, and returning per-slug deleted / not_found / failed results
• Deleted URLs are now recorded and served an HTTP 410 Gone response on the front end (via template_redirect at priority 0, before canonical redirects and 404 handling) instead of a 404, signaling a permanent/intentional removal to search engines for faster, cleaner deindexing — the homepage is never marked gone
• The gone marker is recorded BEFORE deletion (since get_permalink() is empty afterward) for both single and bulk deletes, and is automatically cleared on publish/update when a URL is reused by a live post so it serves 200 again

1.0.50

• Added optional slug parameter on publish (POST): when the Rank Authority Dashboard sends a custom slug, it is applied via post_name (sanitized with sanitize_title()); omitted slug still derives from the title as before, and WordPress handles collision suffixing automatically

1.0.49

• Added authenticated POST /ra/v1/upgrade endpoint so the Rank Authority Dashboard can trigger a one-click plugin self-update from wordpress.org (runs WP’s Plugin_Upgrader; reports the resulting version, or reports “already up to date” when no update is pending)
• Self-update now pre-checks the filesystem method and returns a clear error when the site requires FTP/SSH credentials (instead of failing opaquely), and guards against concurrent upgrade requests with a short-lived lock
• Reverse-proxy/load-balancer compatibility: HTTPS detection on authenticated and bootstrap endpoints now honors the X-Forwarded-Proto/X-Forwarded-SSL headers so sites that terminate TLS upstream are no longer wrongly rejected

1.0.48

• Added author selection: publish (POST) and update (PUT) handlers now honor an explicit author field from the Rank Authority Dashboard, applying it only when it resolves to a real, publish-capable user (otherwise the create default or the live post author is preserved)
• Added authenticated GET /ra/v1/authors endpoint returning all publish-capable users (id, name, slug, email) for author selection in the dashboard
• Hardened post creation: wp_insert_post() is now called with $wp_error = true so a failed insert returns a WP_Error instead of silently passing a 0 post ID

1.0.47

• Server-side rendering (SSR): approved SEO recommendations are now applied to the rendered page HTML on the server (new includes/class-ra-ssr-optimizer.php), so optimized title/meta/content/links are present in the raw source for all crawlers — a faithful port of the previous client-side script
• Body-level recommendations are confined to the WordPress post content region (via the_content markers, with a content-container fallback) so theme chrome (header/nav/footer) is never modified
• Dashboard toggle repurposed: “AI SEO Optimization” now controls whether recommendations are applied server-side rather than whether a tracking script is injected; the legacy client-side script is no longer enqueued
• Full-page cache integration: SSR output is applied through the rocket_buffer filter so it is what WP Rocket caches, with an idempotency marker (<!--ra-ssr-applied-->) to prevent double application across nested buffers/caches
• Caches are purged automatically when the toggle (or website_id) changes so the new state takes effect immediately
• Data source is unchanged from the client script: CDN snippet first (sha256 of the cleaned URL), public API fallback, cached in a transient

1.0.46

• Internal: Stored schema markup rendering (HTML script blocks, raw JSON, and array-of-schemas) is consolidated back into output_schema_markup(); the render_stored_schema_markup() helper was removed with no change to emitted JSON-LD or RankLink supplemental graph output

1.0.45

• Front-end: RankLink content is now scanned once per request and the result is shared between the JSON-LD schema graph and the <meta name="ra-ranklink"> summary, eliminating a duplicate preg_match_all pass on every singular page render
• Front-end: Site host and scheme are computed once per request when normalizing internal RankLink URLs instead of calling home_url() / parse_url() for every anchor
• Front-end: Placement counts (exact_phrase, paragraph_sentence, related_reading) are now attributed per anchor based on the enclosing wrapper block (with anchor-level data-ra-placement taking precedence), replacing the previous attribute-occurrence heuristic so multi-link wrappers and self-tagged anchors are counted correctly
• Internal: output_schema_markup split into a smaller entry point plus a dedicated render_stored_schema_markup helper for readability; behavior of stored HTML / JSON / array-of-schemas rendering is unchanged

1.0.44

• RankLink HTML markers (data-ra-link-id, data-ra-block-id, data-ra-placement) are allowed in post content through wp_kses so Rank Authority internal links survive editor saves
• REST API: Added GET and PUT /ra/v1/page/{id} as aliases of the existing post read/update handlers
• JSON-LD: When content contains RankLink anchors, outputs supplemental WebPage @graph schema with relatedLink and significantLink for same-site URLs (capped at 20); refactored JSON-LD script output into a shared helper; RankLink graph can emit even when stored post schema meta is empty
• Front-end: wp_head emits an HTML comment and <meta name="rank-authority-ranklink"> with internal link and placement counts; ?ra_highlight=1 (or true) adds highlight styling for quick visual QA

1.0.43

• Updated the plugin display name for the WordPress.org listing and WordPress admin plugin screen

1.0.42

• Added POST /ra/v1/bootstrap for first-time Rank Authority Dashboard connection setup after WordPress administrator authorization
• Bootstrap responses include the plugin bearer token, website ID, IndexNow setup metadata, permalink status, and plugin version
• Bootstrap connection setup requires HTTPS and manage_options capability

1.0.41

• Added authenticated IndexNow configuration and status endpoints for Rank Authority Dashboard setup
• Serves the stored IndexNow key at /{key}.txt only on an exact path match, without requiring rewrite-rule flushes
• Connection and IndexNow status responses now include plugin version and IndexNow setup metadata

1.0.40

• Added POST /ra/v1/posts/bulk-delete endpoint to delete multiple posts or pages by slug in one authenticated request

1.0.39

• Fixed the Rank Authority settings page layout so WordPress admin navigation and top-level admin chrome keep their normal positioning
• Scoped the settings page background and spacing to the plugin content area instead of applying layout styles to the whole admin body
• Hid unrelated third-party admin notices on the Rank Authority settings page and restyled plugin-generated success messages for consistent alignment

1.0.38

• Schema: Site-level placeholder tokens ([SITE NAME], [SITE URL], [LOGO URL], [PAGE URL]) emitted by the LLM are now resolved to real WordPress values at publish time
• [LOGO URL] falls back to the site icon (favicon) when no Customizer logo is set; left as a literal token if neither exists to avoid emitting an empty-URL ImageObject
• Placeholder substitution runs after field-specific replacements on both POST and PUT, recursively walking decoded JSON-LD as well as raw JSON / HTML schema strings
• Render-time normalization: wp_head now re-applies site-placeholder substitution and refreshes mainEntityOfPage.@id with the current permalink so structured data stays in sync after slug, site name, URL, or logo changes

1.0.37

• RSS 2.0 feeds: added WebSub (PubSubHubbub) hub discovery (atom:link rel="hub") pointing to the public hub at https://pubsubhubbub.appspot.com/ so hubs and subscribers can receive push-style feed notifications when you publish or update posts
• Complements 1.0.36 feed behavior (sort by modified date, up to 50 items per feed request)

1.0.36

• RSS / Atom feeds: main site feed orders posts by last modified date (newest changes first) instead of publish date only
• Feed requests up to 50 items per request so recently updated posts surface faster for crawlers and subscribers

1.0.35

• PUT response now always includes schema (stored schema or null)
• Previously schema was only included when schema was sent in the request

1.0.34

• Schema publisher.name now replaced with WordPress site name (Settings > General)
• Schema author fully replaced with WordPress post author as Person (@type Person, name, url)
• Ensures schema uses your site’s publisher name and post author for consistent structured data

1.0.33

• PUT update: Page builder meta (Elementor, WPBakery, Divi, Beaver Builder, Bricks) now cleared when updating content so frontend uses post_content
• PUT response includes cleared_builder and cleared_builder_meta (saved builder data for restore)
• PUT accepts builder_meta to restore page builder layout (send cleared_builder_meta back to re-apply)
• PUT accepts post_meta for arbitrary post meta updates (blocklist protects sensitive keys)
• Elementor CSS file (post-{id}.css) deleted when clearing Elementor meta to avoid orphaned CSS loading
• Filters: rank_authority_page_builder_meta_keys, rank_authority_post_meta_blocklist

1.0.32

• GEO page template: Increased top padding to 10rem for better clearance of theme fixed headers
• Ensures GEO content is fully visible below sticky headers on all themes

1.0.31

• GEO page template: Increased top padding for theme fixed/sticky headers in public view
• Fixes content being cut off at top when viewing GEO pages as non-logged-in visitor
• Applies to both page-geo.php and category-geo.php templates

1.0.30

• PUT response now includes full updated content (title, content, excerpt, etc.)
• Auto-clear post cache after POST/PUT so public view shows new content immediately
• Supports WP Rocket, W3 Total Cache, LiteSpeed Cache; hook rank_authority_post_cache_cleared for custom cache plugins

1.0.29

• Added GET /ra/v1/post/{id} endpoint to retrieve post or page by ID
• Returns content, meta_description, schema, yoast_keyword, featured_image, categories, tags, is_geo
• Works with same Bearer token; supports draft, private, and pending posts/pages

1.0.28

• GEO page template: Added padding for admin bar so content is not covered when logged in
• Prevents WordPress toolbar from overlapping page content on GEO pages

1.0.27

• GEO: When yoast_keyword is not provided, use page title as Yoast focus keyphrase
• Enables Yoast SEO score display for prompt-based GEO content (no explicit keyword)
• Applies to both publish and update endpoints

1.0.26

• GEO content now published as WordPress pages instead of posts
• Use is_geo: true or include Geo category ID in categories to publish as page
• GET /ra/v1/geo-category now returns publish_as_page: true for Dashboard compatibility
• Added templates/page-geo.php for GEO page display (text-focused, no thumbnails)
• Geo pages marked with _rank_authority_geo meta for identification
• Delete endpoint works for both posts and pages (unchanged behavior)

1.0.25

• Fixed admin page layout – scoped CSS reset to plugin content only
• Prevents WordPress admin nav and sidebar from being misaligned on Rank Authority settings page

1.0.24

• Publisher logo dimensions now scaled to fit Google guideline (max 600px width)
• Prevents Search Console structured data validation warnings for oversized logos

1.0.23

• Schema mainEntityOfPage.@id now replaced with actual published post URL
• Publish and update post API responses now include final schema (JSON) in response
• Ensures schema references the correct permalink for SEO and rich results

1.0.22

• Schema mainEntityOfPage.@id now replaced with actual published post URL
• Publish and update post API responses now include final schema (JSON) in response
• Ensures schema references the correct permalink for SEO and rich results

1.0.21

• Schema mainEntityOfPage.@id now replaced with actual published post URL
• Publish and update post API responses now include final schema (JSON) in response
• Ensures schema references the correct permalink for SEO and rich results

1.0.20

• Schema image replacement – replaces placeholder images with actual uploaded URLs
• Supports featured_image_url, images, and images_urls parameters for schema image swap
• Schema logo replacement – replaces publisher.logo with WordPress site logo from Customizer when available
• Keeps ImageObject structure for logo (url, width, height)
• Full support for @graph schema format (BlogPosting, FAQPage, etc.)

1.0.19

• Fixed Geo exclusion on /blog and custom Blog pages
• Applies to pages whose slug contains “blog” or “news” (e.g. /blog, /blog-2, /news, /news-en)
• Filters: ra_geo_exclude_page_slugs (exact match), ra_geo_exclude_slug_contains (partial match)
• Applies to main query and secondary queries (custom page templates, page builders)

1.0.18

• Exclude Geo category posts from main blog/posts page
• Blog page now shows only non-Geo posts – Geo posts visible only at /category/geo/
• Prevents image-less GEO content from appearing in blog listing

1.0.17

• Added Geo category for Generative Engine Optimization (GEO) content
• Auto-creates “Geo” category on plugin install and update
• Geo category archive uses custom template – text-only list without thumbnails
• Added GET /ra/v1/geo-category API endpoint to fetch Geo category ID for Dashboard
• Use Geo category for AI-optimized posts without featured images

1.0.16

• Added loading overlay and progress indicator for token reset functionality
• Improved user experience during token regeneration – prevents accidental button clicks
• Enhanced visual feedback with animated spinner and status messages
• Better UX with disabled buttons during reset process to prevent user errors

1.0.15

• Added new /ra/v1/check REST API endpoint for connection verification
• Connection check endpoint validates website_id without registration
• Improved connection verification workflow – can now check if a site is connected without modifying settings
• Enhanced API functionality with dedicated connection verification endpoint

1.0.14

• Token reset functionality now available to all administrators with manage_options capability
• Removed owner-only restriction for token regeneration
• Improved flexibility for team environments where multiple administrators need token management access
• Enhanced security by maintaining manage_options capability requirement

1.0.13

• Added full HTML document parsing support – automatically extracts title, meta tags, schema, and styles
• Enhanced schema support to handle HTML format with multiple script tags
• Added automatic meta tag extraction from HTML head (description, canonical, Open Graph, Twitter Card)
• Added automatic style tag extraction and output in wp_head
• Improved schema merging – combines schemas from HTML and schema parameter
• Added JSON validation for schema content before output
• Improved security by validating JSON-LD content extraction
• Support for multiple schema types in single HTML string format
• Better handling of complex schema structures with @id references
• Backward compatible – still supports previous format without full HTML documents

1.0.12

• Added support for schema parameter in publish and update post endpoints
• Added JSON-LD structured data output in wp_head for SEO
• Enhanced schema compatibility with multiple SEO plugins (Yoast SEO, Rank Math, All in One SEO)
• Improved structured data support for better search engine visibility

1.0.11

• Added support for meta_description parameter in publish and update post endpoints
• Added support for keyword parameter to set Yoast SEO focus keyphrase
• Enhanced SEO plugin compatibility (Yoast SEO, Rank Math, All in One SEO)
• Improved API functionality with SEO metadata support

1.0.10

• Moved version information from header to footer above “Powered by” text
• Improved UI layout by removing version from company name row
• Enhanced footer styling with dedicated version display

1.0.9

• Updated support email address to support@rankauthority.com

1.0.8

• Changed default admin menu icon color to #9BA2A6 (light gray-blue)
• Improved icon color consistency using CSS mask instead of filters
• Enhanced icon visibility with better color contrast

1.0.7

• Improved Reset button form styling with CSS classes instead of inline styles
• Fixed button width alignment issue by adding dedicated CSS class for reset form
• Enhanced code maintainability with cleaner CSS structure
• Improved “What Gets Tracked” card layout with better flex alignment
• Added custom hover color (#72AEE6) for admin menu icon

1.0.6

• Fixed Copy Token and Reset button widths to be perfectly equal
• Improved button flex layout with min-width and white-space properties
• Enhanced button alignment and visual consistency

1.0.5

• Fixed Reset button width to match Copy button width
• Improved admin menu icon styling – default gray color for better consistency
• Enhanced icon visibility with adjusted brightness and opacity

1.0.4

• Fixed AI SEO Tracking toggle functionality – now works correctly when clicking toggle button
• Improved toggle button interaction – both banner and toggle button clicks now work properly
• Enhanced visual feedback for active/inactive states
• Fixed toggle button label implementation for better accessibility
• Improved form submission handling for status changes

1.0.3

• Complete UI redesign with modern, beautiful interface
• Added interactive status toggle banner for SEO tracking
• Improved user experience with card-based layout
• Enhanced visual feedback with animations and transitions
• Better information display with icon-based info cards
• Streamlined settings page with improved accessibility

1.0.2

• Fixed custom SVG icon display issue in WordPress admin menu
• Improved menu icon CSS with better fallback support
• Enhanced icon rendering reliability

1.0.1

• Added custom SVG icon for admin menu
• Improved uninstall cleanup to remove all plugin options
• Enhanced admin menu styling with custom Rank Authority logo

1.0.0

• Initial release
• Secure REST API endpoints for publishing, updating, and deleting posts
• Token-based authentication
• SEO script injection
• Owner-based token management
• Disconnect functionality