What's New
Product Changelog
Updates across every Bodholdt Labs plugin. Dated releases are listed newest first, and a release we have not dated yet sits directly beneath the newest one we can place it against. We ship often, and we write it all down.
Subscribe via RSS- Groundwork, with no change to what a backup contains or where a restore writes. The restore path used to work out where themes, plugins, must-use plugins, uploads and translations live by rebuilding those paths by hand in six separate places. Nothing checked that the six agreed, and they governed different things: what a restore deletes, what it snapshots first, what it checks it can write to, and where it stops tidying up empty folders. They now read one answer. On every site the answer is exactly what those six lists produced before, and this release is verified to make no other difference.
- This edition can now read a backup that records where its folders were. Nothing writes one yet. Shipping the reader on its own, ahead of the writer, means that by the time such a backup can exist, installs are already able to read it. A backup of that kind taken by a future release is refused, safely and before anything is changed, by every version older than this one.
- A restore onto a site laid out differently from the backup is refused by name. If a future backup records its plugins folder somewhere this site does not load plugins from, the restore stops before touching anything and names the setting to change. Restoring it anyway would write the files where WordPress would not read them, and delete what is there now.
- Deleting the plugin could interrupt a running backup or restore on hosts that set WP_TEMP_DIR. The plugin writes its staging folders and its operation locks under WordPress's own temporary directory, which honours that constant. The uninstaller looked under the system temporary directory instead. Where the two differ, the busy check that is supposed to stop Delete while a backup or restore is in flight looked in the wrong place, found no lock, and reported the plugin idle. On the same hosts, staging holding a full database export was left behind after Delete. Uninstall now resolves the directory exactly as the plugin does, a regression test proves the two can never part again, and cleanup also sweeps the old location so anything already orphaned is collected.
- Core directory locations. The wp-includes folder is now read through WordPress's own WPINC constant, the plugins and must-use plugins folders through WP_PLUGIN_DIR and WPMU_PLUGIN_DIR, and the plugin's own folder through plugin_dir_path(). Twenty-nine defensive checks for constants WordPress always defines before a plugin loads have been removed, along with the hardcoded folder names they fell back to. What a backup reads and the names it records inside the archive are unchanged, and existing backups are unaffected.
- Deleting the plugin could interrupt a running backup or restore on hosts that set WP_TEMP_DIR. The plugin writes its staging folders and its operation locks under WordPress's own temporary directory, which honours that constant. The uninstaller looked under the system temporary directory instead. Where the two differ, the busy check that is supposed to stop Delete while a backup or restore is in flight looked in the wrong place, found no lock, and reported the plugin idle. On the same hosts, staging holding a full database export was left behind after Delete. Uninstall now resolves the directory exactly as the plugin does, a regression test proves the two can never part again, and cleanup also sweeps the old location so anything already orphaned is collected.
- Core directory locations. The wp-includes folder is now read through WordPress's own WPINC constant, the plugins and must-use plugins folders through WP_PLUGIN_DIR and WPMU_PLUGIN_DIR, and the plugin's own folder through plugin_dir_path(). Twenty-nine defensive checks for constants WordPress always defines before a plugin loads have been removed, along with the hardcoded folder names they fell back to. What a backup reads and the names it records inside the archive are unchanged, and existing backups are unaffected.
- The readme described a paid backup edition that does not exist, and a free one from WordPress.org that is not there either. Both backup plugins are free and come from bodholdtlabs.com, and the companion works the same with either one or with both at once. A FAQ answering "I have the paid backup edition with alerts built in" has gone with it, because nobody can be in that situation.
- The Manage Account link in the license screen now points at the address that answers directly, instead of one that redirects first.
- Two notices counted down to something that never happens. If a license could not be confirmed, the plugin said the features it unlocks would keep working for so many more days, which reads as a warning that they will then stop. They will not. Every feature in this plugin works on every install whether or not a license is active, and it always has. What a license actually carries is email support and a site allowance, so that is what the notices now count down to.
- The readme in this download described a paid edition that does not exist. It said a license adds commissions, patron subscriptions, the Foundry, the marketplace, the Lightroom pipeline, priority support and managed updates. Six of those seven are in the edition you already have, and the seventh, priority support, was retired everywhere on the same day this was written, because nothing ever delivered it. Nothing about the plugin changes here. It only stops describing itself wrongly. What a license actually adds is email support from the developer while it is active, and a site allowance of up to 127 activations.
- Wording only. Seven notices and hints used a dash where a full stop or a comma belongs. House style here is plain sentences, and a dash standing in for punctuation is the one thing our own writing rules single out. Nothing about behaviour changes. Dashes that stand in for "no value yet" in a table cell or an empty dropdown are left exactly as they are, because there they are not punctuation.
- The changelog now reads like a changelog. Several entries from August described release machinery rather than the plugin: package validators, audit receipts, hash-bound tool inputs and publishing gates. None of it is anything you can see or use, and it was sitting on the product page and the site changelog where people decide whether to install. Removed rather than reworded, because there is no reader-facing version of most of it. Everything describing an actual change to the plugin is untouched.
- One of those bullets also claimed the translation template pointed at our support address. It did not; the file carried the WordPress.org default, which goes nowhere for a plugin that is not hosted there. The claim is withdrawn from the release it was attached to.
- The note about turning the arcade back on pointed at an "Arcade settings" screen that does not exist. It is under Settings, then Bodholdt Contact, in the row headed "Working the Door".
- The full download no longer contains a second readme describing the WordPress.org build, which creates a different set of database tables. Two readmes disagreeing about the same product is confusing on its own; the build now refuses to ship it.
- The Manage account link in the license screen now points at the address that answers directly, instead of one that redirects first.
- The customer portal page now tells browsers and proxies not to store it. It carried no caching instruction at all, while the account pages beside it did, so a signed-in customer's ticket list and their session token could be kept by a shared browser and shown to whoever opened the page next. A page that merely quotes the shortcode in documentation is left alone, because it is not an account page.
- You can now use any Claude model your key has access to, instead of only the three this plugin was built with. The Model setting was a fixed dropdown, and the save handler refused anything that was not one of those three, so when Anthropic released something newer there was no way to select it: the field quietly fell back to the default and the plugin treated its own age as your mistake. It is now a text field with the same three offered as suggestions, and it accepts any model id. Use Test connection after changing it.
- The model id also used to be written down in seven places across three files, which is how a list like that ends up half updated. It is written down once now, and the shipped suggestions are unchanged in this release.
- An email with no plain-text part became a blank ticket. Inbound email-to-ticket read only the plain-text body a message carries, and mail sent as HTML alone has none, so the ticket was created with nothing in it while the endpoint reported success. The agent alert then said "(no message body)" and the customer receipt quoted nothing back, which reads at both ends like the desk lost the message. The HTML part is now used when there is no text part, converted to readable text so a message looks the same however it was sent.
- The readme fix in 6.53.1 landed in the wrong file. These plugins ship one edition, the free one, and its readme is built from readme-wporg.txt. That file still carried every sentence the 6.53.1 entry said had gone: a verify button on every backup row, a one-click full restore, and log status pills reading success, error and running. So the note describing the correction shipped without the correction. The Screenshots section you are reading now matches what the plugin actually shows.
- The Screenshots list in this readme described a few screens that are no longer here. The Logs page has counted chips for complete, error and warning rather than a filter and sort pair, and there was never a "running" or "success" status in the log itself. The backup list shows verify only where an archive can actually be checked. And the restore section now says the two things that matter most: you choose exactly what comes back, and there is no undo. Nothing about the plugin changed in this release. It only stops describing itself wrongly.
- Recent releases are listed here. The complete history for every version is at https://bodholdtlabs.com/changelog/
Bodholdt Backup for Google Drive
v6.53.0
- The check that asks your own site whether it came back up is now careful about who it will trust. After a restore, and again before your first backup, this plugin asks your own site for one page and reads nothing but the answer code. That request goes to the very address you are being served from, so it has always accepted that address's certificate without checking it, which is what lets the check work on a staging site with a self signed certificate. The list of addresses it asks for can be redirected by a filter, and until now anything the filter supplied was accepted the same way. From this release only the address you are being served from right now is accepted unchecked. Every other address is verified exactly like every other request this plugin makes.
- This still cannot change the outcome of a restore. It never rolls anything back and it never turns a finished restore into a failed one. When it cannot get an answer, for any reason at all, it says nothing rather than guessing. A certificate your server cannot verify is now one of those reasons.
- One thing to know if you use that filter. If you point the check at an address over https whose certificate does not validate on your server, you will get no verdict instead of a wrong one. Point it at an http address, or at a name the certificate is valid for.
- Held in place by tests. All four answers this check can give, healthy, server error, maintenance and no answer, are now pinned for an address on your own site and for one the filter supplied, so this cannot quietly drift back.
Bodholdt Backup for Google Drive
v6.52.4
- The list of requests that never leave your own site was one short. That section said it was complete and named two: cron starting a backup, and the check after a restore. There is a third. Before your first backup, and again each time you start a backup by hand, the plugin asks your own admin screen whether your site can answer itself, which is how the setup check knows to warn you that backups may not start on their own. It has worked that way since 6.50.8, it never leaves your server, and nothing about it has changed. It is now described alongside the other two.
- The wording no longer depends on counting. "Two more requests" is a promise that has to be rechecked by hand every time anything is added, which is exactly how it went out of date. The Privacy section and the External services section now describe every request this plugin makes to your own site, which stays true whatever the number is.
- The note for 6.52.3 counted them too, and no longer does.
- Waking cron is described more accurately. It happens when you start a restore by hand as well as a backup.
- Nothing in the plugin changed. This release is readme wording only.
Bodholdt Backup for Google Drive
v6.52.3
- The privacy wording is now generated from one description of what this copy sends, and where. The Privacy section, the External services section and the FAQ answer about the log table were each written at a different time and had drifted apart from one another. All three now come from the same statement, so a claim cannot be true in one of them and false in another three screens down. Nothing in the plugin changed, and nothing about what it sends changed.
- The Privacy section no longer contradicts itself. It said nothing about your site or its contents ever reaches us, and then, two sentences later, that the update check sends this site's address. Your address is something about your site, so the first half of that was simply wrong. It now names what never goes to us and what does, in the same breath.
- The answer about the log table was wrong, and is now right. It said the backup history rows are never sent anywhere. They are never sent to us and never to anyone else, but a database backup exports every table in your database, so those rows do travel inside `database.sql` to your own Google Drive like every other table. The same answer now also lists the four arcade tables this copy creates, which it had never mentioned at all.
- The update check is described honestly. "About twice a day" was only the twelve hour cache on a good answer; a failure is cached for one hour, so while our server is unreachable the check can ask up to once an hour. "You can switch it off" meant a one line PHP filter and not a setting, and the section now says so. It also now says what happens when you accept an update, and that we count the download.
- Two things that were never written down now are. The requests this plugin makes to Google carry the user agent WordPress itself sets, which names your WordPress version and your site address, so Google sees your address on every backup call. And some requests go to your own site and nowhere else: cron starting a backup, and the check after a restore that asks your own site whether it came back up. Both are described under External services.
- The install step no longer offers a plugin directory listing that does not exist. It tells you to install the file you downloaded from bodholdtlabs.com and keep it, because this is the copy that offers you new versions in your dashboard.
Bodholdt Backup for Google Drive
v6.52.2
- A correction to the release notes, not to the plugin. The note for 6.52.1 was written about the WordPress.org copy of this plugin, and it was wrong about the copy you are holding. It said nothing here had changed, and that this copy updates from WordPress.org. Neither was ever true of it. The corrected note is below, and nothing in the plugin itself changed here.
Bodholdt Backup for Google Drive
v6.52.1
- This copy now says in its own header where it updates from. You downloaded this plugin from bodholdtlabs.com, and it installs into the same folder name a WordPress.org listing would use. WordPress matches an installed plugin to WordPress.org by that folder name, so if these plugins are ever listed there, WordPress could have replaced this copy with the WordPress.org build without anybody asking, and that build carries no update channel of its own. This copy now states in its own header that it updates from bodholdtlabs.com, which is WordPress's own way of saying leave this one where it is. It goes on updating from bodholdtlabs.com, the way it has since 6.52.0, and the check it makes is described under External services above.
Bodholdt Backup for Google Drive
v6.52.0
- The card advertising a paid edition is gone. A small card sat at the top of every screen of this plugin, pointing at a paid edition of it. That edition has been retired, so the card was advertising something nobody can buy. It has been removed and nothing replaced it: there is now no upsell of any kind anywhere in this plugin.
- The description now says what is actually true. One edition, free, no tiers, nothing switched off: full and incremental backups, scheduling, retention, full restore, selective restore, multisite, unlimited sites, and email notifications after every backup whether it succeeded or failed. Nothing on that list will ever move behind a payment.
Bodholdt Backup for Google Drive
v6.51.2
- A backup that cannot reach Google Drive now ends as a failure, and tells you. If your Google connection had expired or been withdrawn, the backup got as far as signing in and then simply stopped. Nothing was recorded as a failure, no "Backup Failed" email arrived, and the dashboard was left saying "Authenticating with Google..." at 10 per cent until that status aged out an hour later. The run now ends the way every other failure ends, so the log entry, the email, and anything else listening all happen once, and the message names the expired connection and the control that fixes it. A connection you removed on purpose, and a site that has never connected, stay quiet exactly as before, and the dashboard no longer claims a backup is running after one of those.
- A failed backup now carries a one line diagnosis with it. The plugin already works out a short cure for the failures it recognises, such as "Re-authenticate Google Drive in Settings.", and until now only the paid Slack and Discord alerts could see it. That sentence now travels with the failure itself, so anything listening for a failed backup can lead with the cure instead of the raw error text. When there is no honest short answer, such as a brief outage at Google's end, the sentence is deliberately left empty and the full message is always there behind it. What the paid alerts send is unchanged.
Bodholdt Backup for Google Drive
v6.51.1
- Free build packaging cleanup. No functional changes in either edition.
Bodholdt Backup for Google Drive
v6.51.0
- Developers can now listen for what the plugin does. The backup engine announces five moments as ordinary WordPress actions: `bodholdt_gdrive_backup_success`, `bodholdt_gdrive_backup_failure`, `bodholdt_gdrive_restore_initiated`, `bodholdt_gdrive_watchdog_stale`, and `bodholdt_gdrive_preflight_blocked`. Each one hands over a single array of plain facts, such as the archive name and size. A sixth action, `bodholdt_gdrive_settings_sections`, lets other code add a section to the end of the Settings screen. If you do not write code against WordPress, nothing changes for you.
- Tidier packaging for the free edition. The free download no longer carries fragments of paid-only code it could never run. This is housekeeping in how the package is put together. No feature was added or removed in either edition.
Bodholdt Backup for Google Drive
v6.50.13
- The setup wizard now checks what you pasted, and says what looks wrong. A Google client ID ends in .apps.googleusercontent.com and a client secret starts with GOCSPX-, and they sit next to each other on the Credentials page. If one looks wrong, or if the two look swapped, you are told which field to look at instead of finding out later from a refused connection. It never stops you saving.
- A connection that dies after a week now tells you why. Google's "Testing" publishing status expires access after 7 days, and the failure used to look identical to someone revoking access by hand. The plugin now remembers when you connected, and if the connection is refused within 8 days it names the likely cause and the exact control to fix it, rather than sending you round the same loop to the same result.
Bodholdt Backup for Google Drive
v6.50.12
- Plainer writing. A few messages used long dashes where a full stop or a separator reads more easily. Nothing functional changed.
- The readme fix in 5.50.1 landed in the wrong file. These plugins ship one edition, the free one, and its readme is built from readme-wporg.txt. That file still carried every sentence the 5.50.1 entry said had gone: a verify button on every backup row, a one-click full restore, and log status pills reading success, error and running. So the note describing the correction shipped without the correction. The Screenshots section you are reading now matches what the plugin actually shows.
- The Screenshots list in this readme described a few screens that are no longer here. The Logs page has counted chips for complete, error and warning rather than a filter and sort pair, and there was never a "running" or "success" status in the log itself. The backup list shows verify only where an archive can actually be checked. And the restore section now says the two things that matter most: you choose exactly what comes back, and there is no undo. Nothing about the plugin changed in this release. It only stops describing itself wrongly.
Bodholdt Backup for OneDrive
v5.50.0
- The check that asks your own site whether it came back up is now careful about who it will trust. After a restore, and again before your first backup, this plugin asks your own site for one page and reads nothing but the answer code. That request goes to the very address you are being served from, so it has always accepted that address's certificate without checking it, which is what lets the check work on a staging site with a self signed certificate. The list of addresses it asks for can be redirected by a filter, and until now anything the filter supplied was accepted the same way. From this release only the address you are being served from right now is accepted unchecked. Every other address is verified exactly like every other request this plugin makes.
- This still cannot change the outcome of a restore. It never rolls anything back and it never turns a finished restore into a failed one. When it cannot get an answer, for any reason at all, it says nothing rather than guessing. A certificate your server cannot verify is now one of those reasons.
- One thing to know if you use that filter. If you point the check at an address over https whose certificate does not validate on your server, you will get no verdict instead of a wrong one. Point it at an http address, or at a name the certificate is valid for.
- Held in place by tests. All four answers this check can give, healthy, server error, maintenance and no answer, are now pinned for an address on your own site and for one the filter supplied, so this cannot quietly drift back.
Bodholdt Backup for OneDrive
v5.49.5
- The list of requests that never leave your own site was one short. That section said it was complete and named two: cron starting a backup, and the check after a restore. There is a third. Before your first backup, and again each time you start a backup by hand, the plugin asks your own admin screen whether your site can answer itself, which is how the setup check knows to warn you that backups may not start on their own. It has worked that way since 5.46.10, it never leaves your server, and nothing about it has changed. It is now described alongside the other two.
- The wording no longer depends on counting. "Two more requests" is a promise that has to be rechecked by hand every time anything is added, which is exactly how it went out of date. The Privacy section and the External services section now describe every request this plugin makes to your own site, which stays true whatever the number is.
- The note for 5.49.4 counted them too, and no longer does.
- Waking cron is described more accurately. It happens when you start a restore by hand as well as a backup.
- Nothing in the plugin changed. This release is readme wording only.
Bodholdt Backup for OneDrive
v5.49.4
- The privacy wording is now generated from one description of what this copy sends, and where. The Privacy section, the External services section and the FAQ answer about the log table were each written at a different time and had drifted apart from one another. All three now come from the same statement, so a claim cannot be true in one of them and false in another three screens down. Nothing in the plugin changed, and nothing about what it sends changed.
- The answer about the log table was wrong, and is now right. It said none of the backup history rows are ever sent anywhere. They are never sent to us and never to anyone else, but a database backup exports every table in your database, so those rows do travel inside `database.sql` to your own OneDrive like every other table. The same answer now also lists the four arcade tables this copy creates, which it had never mentioned at all.
- Two sentences in the note for 5.49.3 were wrong about themselves, and are gone. It said the External services section had described the update check in full since 5.49.0. That section did not say what happens when you accept an update until 5.49.3, so it had not described it in full. It also gave a cadence of about twice a day without saying that a failed check is retried far more often than that.
- The update check is described honestly. Twelve hours is the cache on a good answer, so about twice a day; a failure is cached for one hour, so while our server is unreachable the check can ask up to once an hour. "You can switch it off" meant a one line PHP filter and not a setting, and the section now says so. It also now says what happens when you accept an update, and that we count the download.
- The 5.21.0 note below no longer calls the Microsoft calls this plugin's only outbound requests. Some requests go to your own site and were never counted: cron starting a backup, and the check after a restore that asks your own site whether it came back up. Both are now described under External services.
- One more thing that was never written down now is. The requests this plugin makes to Microsoft carry the user agent WordPress itself sets, which names your WordPress version and your site address, so Microsoft sees your address on every backup call.
- The install step no longer offers a plugin directory listing that does not exist. It tells you to install the file you downloaded from bodholdtlabs.com and keep it, because this is the copy that offers you new versions in your dashboard.
Bodholdt Backup for OneDrive
v5.49.3
- Two sentences in these notes were wrong about this copy, and are now right. Nothing in the plugin changed. Under 5.43.2 and 5.21.0 below, this changelog said this copy reports nothing back to us, and that nothing about your site is ever sent to us. Neither was true. This copy was downloaded from bodholdtlabs.com, so it asks one address of ours whether a newer version exists, and that request carries the version it is running and this site's address in its user agent. Both entries now say so, and the External services section above describes the check. What the plugin sends is unchanged in this release. There is still no telemetry, no analytics and no tracking, and no site content or backup data ever reaches us.
Bodholdt Backup for OneDrive
v5.49.2
- A correction to the release notes, not to the plugin. The note for 5.49.1 was written about the WordPress.org copy of this plugin, and it was wrong about the copy you are holding. It said nothing here had changed, and that this copy updates from WordPress.org. Neither was ever true of it. The corrected note is below, and nothing in the plugin itself changed here.
Bodholdt Backup for OneDrive
v5.49.1
- This copy now says in its own header where it updates from. You downloaded this plugin from bodholdtlabs.com, and it installs into the same folder name a WordPress.org listing would use. WordPress matches an installed plugin to WordPress.org by that folder name, so if these plugins are ever listed there, WordPress could have replaced this copy with the WordPress.org build without anybody asking, and that build carries no update channel of its own. This copy now states in its own header that it updates from bodholdtlabs.com, which is WordPress's own way of saying leave this one where it is. It goes on updating from bodholdtlabs.com, the way it has since 5.49.0, and the check it makes is described under External services above.
Bodholdt Backup for OneDrive
v5.49.0
- The card advertising a paid edition is gone. A small card sat at the top of every screen of this plugin, pointing at a paid edition of it. That edition has been retired, so the card was advertising something nobody can buy. It has been removed and nothing replaced it: there is now no upsell of any kind anywhere in this plugin.
- The description now says what is actually true. One edition, free, no tiers, nothing switched off: full and incremental backups, scheduling, retention, full restore, selective restore, multisite, unlimited sites, and email notifications after every backup whether it succeeded or failed. Nothing on that list will ever move behind a payment.
Bodholdt Backup for OneDrive
v5.48.2
- A backup that cannot reach OneDrive now ends as a failure, and tells you. If your Microsoft connection had expired or been withdrawn, the backup got as far as signing in and then simply stopped. Nothing was recorded as a failure, no "Backup Failed" email arrived, and the dashboard was left saying "Authenticating with OneDrive..." at 10 per cent until that status aged out an hour later. The run now ends the way every other failure ends, so the log entry, the email, and anything else listening all happen once, and the message names the expired connection and the control that fixes it. A connection you removed on purpose, and a site that has never connected, stay quiet exactly as before, and the dashboard no longer claims a backup is running after one of those.
- A failed backup now carries a one line diagnosis with it. The plugin already works out a short cure for the failures it recognises, such as "Re-authenticate OneDrive in Settings.", and until now only the paid Slack and Discord alerts could see it. That sentence now travels with the failure itself, so anything listening for a failed backup can lead with the cure instead of the raw error text. When there is no honest short answer, such as a brief outage at Microsoft's end, the sentence is deliberately left empty and the full message is always there behind it. What the paid alerts send is unchanged.
Bodholdt Backup for OneDrive
v5.48.1
- Free build packaging cleanup. No functional changes in either edition.
Bodholdt Backup for OneDrive
v5.48.0
- Developers can now listen for what the plugin does. The backup engine announces five moments as ordinary WordPress actions: `bodholdt_od_backup_success`, `bodholdt_od_backup_failure`, `bodholdt_od_restore_initiated`, `bodholdt_od_watchdog_stale`, and `bodholdt_od_preflight_blocked`. Each one hands over a single array of plain facts, such as the archive name and size. A sixth action, `bodholdt_od_settings_sections`, lets other code add a section to the end of the Settings screen. If you do not write code against WordPress, nothing changes for you.
- Tidier packaging for the free edition. The free download no longer carries fragments of paid-only code it could never run. This is housekeeping in how the package is put together. No feature was added or removed in either edition.
Bodholdt Backup for OneDrive
v5.47.4
- Clearer notes for translators. Three of the delete confirmation messages now carry a note explaining what their placeholders stand for, so a translator can see that one is a count of backups and another is the word you have to type. Nothing about how the plugin works has changed.
Bodholdt Backup for OneDrive
v5.47.3
- The setup wizard now checks what you pasted, and says what looks wrong. In Azure a client secret has both a Secret ID and a Value, they sit side by side, and only the Value works. Pasting the Secret ID is the easiest mistake to make, and it is now recognised on sight and explained, including the awkward part: the Value is shown once, so if you have navigated away you need a new secret. It never stops you saving.
- Wording only. When a license has ended, the page that lists it now says that if you need a copy of what you had, you should write in and we will sort it out. It previously pointed you at buying again, which is not an answer to the question somebody in that position is actually asking. Nothing about what a license does or does not allow has changed: an ended license still does not download or update, and the plugins it licensed keep running on your sites, because they are GPL and self-hosted and the copy you installed is yours.
- Your purchase email now says which tier you bought and how many sites the key covers. It named only the product, so a Studio or Foundry buyer had to open the portal to find out what they actually had.
- The billing button on the licenses page no longer does nothing when the page has been open a while. An expired page token made the button silently reload the page with your email wiped and no message at all, which reads exactly like a broken site. It now says the request expired and asks you to try again.
- The "not included" dash in the plan comparison table was too faint to meet the contrast standard. It is now readable, and still visibly dimmer than the text around it.
- The buying page said every plugin ships with a money-back guarantee and email support. Both are true of the paid plugins; the free-only ones have nothing to refund and no license to carry support. GPL licensing, which really is true of all of them, is now its own sentence.
- Translators following the source references in the shipped catalog no longer land on files that are not in the download.
- A one-time purchase no longer receives an email explaining how to cancel a subscription. Every purchase email ended with a Manage Subscription heading and button, whichever way you had paid, so a customer who bought a lifetime license was given cancellation instructions for something they never had. The destination was always right, because that page is where both kinds of customer manage their licenses; only the label was wrong. It now says what the order actually was, worked out from the licenses in the order rather than restated.
- The billing-link form can no longer be used to send repeated emails to somebody else's address. It is a public form that takes any email, and it was capped only by requests per minute per visitor, so one visitor could aim a long run of messages at an address they chose. It is now also capped per recipient, in the same shape the verification-code form has used since 10.18. Both caps answer exactly as a successful request does, so nothing about them reveals whether an address has an account.
- The key-lookup page no longer says a code was sent when it sent nothing. If you asked for a code less than a minute ago, or you have reached the daily limit, it now says exactly that instead of "New code sent! Check your inbox." This mattered most to the person it was worst for: if your license email had not arrived, the order page sends you here to look your keys up, and clicking Resend a few times could leave you told five times that a code was on its way when none was. The Resend button also counts down now rather than letting you ask again into a wall.
- A license that has ended is shown to you instead of being hidden. Before, an expired or cancelled license vanished from the lookup entirely and the page said it could not find any licenses for your email and suggested you check the spelling, which is the wrong thing to tell someone about a purchase they really made. Ended licenses are now listed with the date they ended, marked clearly as no longer active, and with no download button, because they do not download or update. What you can still do is unchanged.
- The Bodholdt Tickets plans now say that licensing-aware customer context needs Bodholdt Licensing installed on the same site. It always did, and the plugin's own readme said so, but the buying page did not.
- Nothing in your install changes in this release either. Like 10.51.3 it touches only the file that renders the Bodholdt Labs storefront, which is not part of the plugin you receive.
- What changed there: the Bodholdt Atelier comparison box told a free-edition reader that email support was not included, and then two lines below told them that bug reports, pre-sales and billing questions are always free. Both were true and together they were confusing. The note now says the whole of it, including that free-edition questions get answered when we can. The row is unchanged, because a license really is what makes support a commitment rather than a courtesy.
- Nothing in your install changes in this release. The only file it touches is the one that renders the Bodholdt Labs storefront, which is not part of the plugin you receive, so this entry is here for the record rather than because there is anything for you to do.
- What changed there: our own top tier no longer claims priority email support, because nothing anywhere ever delivered it. There was no mailbox rule, no queue, no service level and no routing that treated one customer's email differently from another's, so the claim described an intention rather than a behaviour. It is deleted rather than softened, since a gentler version of the same sentence would still say that customers on the tiers below wait longer, and that would have been a new thing to be wrong about. Every paid tier gets email support from the developer while the license is active, which is what our support page has always said and what actually happens.
- The License screen said your license includes one year of updates and support, and that the plugin keeps working after it expires. Both halves were wrong. A one-time purchase does not expire at all, and a monthly plan is not a year. More importantly, this plugin does not keep working: alerts and the digest are what it does, and both stop when a license is inactive. Silence from something whose job is telling you your backups failed is the worst thing it could do quietly, so the screen now says exactly that, and says the part that is genuinely reassuring: your backup plugin is free and keeps backing up either way.
- The License screen still had one sentence contradicting the table right underneath it. 1.10.3 corrected the table to say that updates arrive in your dashboard whether or not you hold a license, and left the paragraph above it saying a license adds them. The paragraph now agrees with the table. What a license adds is email support and a record of your site count.
- The setup checklist said "this build runs a simulated checkout, no keys needed", which was never true of the build. Simulated checkout is where you start, and live Stripe and PayPal are both in every copy. It now says that.
- The unactivated notice said activating "unlocks updates". It does not, and the License screen in the same release says so. It now says what activating actually does.
- Two headings used a dash where a comma or a colon belongs.
- The License screen had two rows that were not true. It said an unlicensed copy gets "updates by manual download", when the free edition has updated itself from your dashboard for some time now, exactly like a licensed one. And it offered "community support", which is a channel we have never actually run. The table now says updates work the same either way, and that what a license adds is email support from the developer. Nothing about what a license does has changed; the screen was describing it wrongly.
- Confetti in the admin now really does start switched off, the way the documentation has always said it does. The setting was never written down when the plugin was activated, so a new site fell back to the checkbox's own default and started with it on. If you already had confetti, you keep it; nothing is switched off underneath you.
- Your account now says what your support actually is. A verified customer sees one plain line about email support whether or not the paid support model is switched on, instead of a support panel that simply vanished when it was off.
- The support-status endpoint no longer hands its checkout links to anonymous callers. The buy details were assembled one line above the check that decides whether the caller is allowed to see them, so any unauthenticated request could read them. They are assembled after that check now.
- A lifetime grant can no longer exceed the ceiling that was already applied to it. This plugin was handed a capped number by Bodholdt Licensing and recomputed its own from scratch, discarding the cap, so a 127-site lifetime tier could issue 762 non-expiring credits. It now takes whichever is smaller. Switching paid support off also stops the grant outright, which it did not do before.
- Asking to grant zero credits now grants zero. It granted one, because the count was clamped to a minimum of one before it was used.
- Wording only, on our own store: the customer portal no longer offers to manage support credits. The credit feature itself is untouched and is still yours to switch on for your own desk.
- A store no longer locks itself when it cannot reach us. If thirty days passed without a successful licence check, this plugin used to treat that as an expired licence and switch off checkout, the pricing page and new licence creation, even though nothing was wrong with the licence and the only thing that had failed was reaching bodholdtlabs.com. Your own outage is not your customers' problem, and it is not ours to make yours. The store now keeps working, and the admin notice asking you to check that your server can reach us stays on screen while it does. A licence we have actually declined still stops new licence creation, exactly as before.
- Support credits are retired. Every paid licence now includes email support from the developer for as long as the licence is active, and a one-time licence has no renewal date to stop it. Lifetime purchases no longer grant a credit balance, the pricing pages no longer describe one, and nothing is taken from anyone: no credit was ever issued. If you run your own support desk on Bodholdt Tickets, its credit feature is untouched and still yours to switch on.
- The two update check routes no longer invent a version. A product that is in your catalog but has no entry on the Product Versions screen used to be answered with version 1.0.0, tested up to 6.9, requires PHP 8.0 and an empty changelog, none of which you had set. Both routes now answer it the way they answer a product they have never heard of: the query string route with result error and Product not found, the REST route with a 404. Nothing changes for any product that has a version set, and nothing changes for the free self-served products, which already answered this way.
- No installed copy could have been harmed by the old answer, because 1.0.0 never compares higher than a version that is already installed. The route was simply stating a version that did not exist, and this release makes it say so instead.
- Reports, Downloads now records two versions for every download instead of one. The first is the version your Product Versions screen advertised at the moment of the download, which is what the report has always shown. The second is the version read from the plugin header inside the ZIP that was actually sent. When the two differ the row says so, a short notice sits above the table with the count, and the CSV export gains a Served version column and a Match column so the same comparison survives a spreadsheet.
- Why both: a version pointer and a file on disk can drift apart, and until now the report could only ever repeat the pointer. Recording what was really sent makes that drift visible in the one place you already look.
- Where the second version comes from. Bodholdt Licensing does not open archives itself. It asks for a reader through the new cls_downloads_served_version_reader filter, which takes a callable that receives the absolute path of the file about to be streamed and returns its version, or an empty string. If nothing supplies a reader the column stays empty and the report shows "not read", never a match it did not establish. The reading happens before the first byte is sent and can never cost anyone the download: anything the reader prints is discarded and any error it raises is swallowed.
- This adds one column, served_version, to the downloads table. It arrives the way every schema change here arrives, through the self-heal that runs on the first page load after an update, so there is no activation step. The table stays anonymous: no address, no browser, no key. A file's version is a fact about the file.
- On the Bodholdt Labs store itself, a host-only change that is not part of the plugin you run: the download button on the two free backup plugin pages keeps recording a real version after the retired paid entries are stood down, by reading the free edition's own version entry instead.
- The Visit plugin site link on the Plugins screen now goes to this plugin's own product page, at bodholdtlabs.com/software/bodholdt-backup-pro/, which is published as of today. In 1.1.0 it pointed at the product index instead, because this page did not exist yet and the conventional address answered not found. Nothing else changed in this release.
Bodholdt Backup Pro
v1.1.0
- Failure alerts now lead with the cure, not just the refusal. When a backup fails, the backup plugin works out a one line suggestion for what to do about it, and that sentence now travels to your Slack or Discord channel alongside the error. An expired cloud connection says to re-authenticate in Settings, a full cloud says to free up space, and so on. This is the same sentence the paid backup editions have always put in their own alerts, so moving to the free backup plugin plus this companion no longer costs you the diagnosis. Backup plugins older than Bodholdt Backup for Google Drive 6.51.2 or Bodholdt Backup for OneDrive 5.48.2 do not send the sentence, and the alert then reads exactly as it did before, with no empty line and no label with nothing after it.
- The Visit plugin site link on the Plugins screen now goes to a page that exists. It pointed at a product page that has not been published yet, so it answered not found.
Bodholdt Backup Pro
v1.0.1
- The digest no longer calls a site healthy when its newest verified backup is far older than the schedule you chose. A site can hold a saved daily schedule, show a next run on the clock, and still not have produced a backup in days, because the runs are failing or because nothing is triggering scheduled tasks. The digest now compares the newest verified backup against your own schedule, allows one missed run, and then says so plainly and marks the digest as needing attention. When the backup plugin's own stale-backup watchdog is already raised, the digest leaves that sentence to it instead of saying the same thing twice.
Bodholdt Backup Pro
v1.0.0
- First release. Everything below is new, because there is no earlier release to compare it to. The 0.9.0 builds mentioned in our development notes were never published and were never installable by anyone outside Bodholdt Labs.
- Slack and Discord alerts for the five lifecycle events both backup plugins announce: a backup completed and verified, a backup failed, a restore was started, backups have gone stale, and pre-flight found something that would block the next run. Success and failure alerts are on by default and every event has its own toggle.
- Every alert is capped by a short timeout and is sent after the backup's outcome has already been recorded, so a slow or broken webhook can never fail, delay, or change a backup or a restore.
- The settings screen shows one plain line per channel with the result and the time of the most recent delivery, including manual tests, so a webhook that has quietly stopped working says so instead of going silent.
- Backup-health digest, off or weekly or daily, to an inbox, to Slack or Discord, or to both. It reads the backup plugin's own records rather than only the events this companion has witnessed, so a site that was backing up long before you installed the companion is described accurately in the first digest. It reports the schedule your backups are really on, whether a run is actually armed, how fresh the last verified backup is, the stale-backup watchdog, the cloud connection, and the runs, errors, and warnings in the period. The subject line says whether anything needs a person.
- Works with either backup plugin or both at once.
- Nothing in this plugin sends data to Bodholdt Labs except activating or validating your license key and checking for updates. Your webhook URLs, alert payloads, and digest emails go straight from your site to your own Slack, Discord, or inbox. No telemetry, no third-party scripts, no cookies.
- One number, everywhere. The License screen's summary said a license adds "an unlimited site allowance", while the table directly beneath it, the storefront and the update notice all said up to 127 activations. 127 is the real figure and always has been: a license record stores the site allowance as a signed tinyint, so 127 is this plugin's unlimited rather than a placeholder. The summary now says it too, and the 1.10.1 and 1.10.0 notes below have been corrected for the same reason. Nothing about what a license does has changed.
Bodholdt Atelier
v1.10.1
- The admin screens caught up with the change. The License screen still showed a three-row plan table naming Solo, Pro and Agency with 5, 10 and 25 seats, and four screens could still say a feature was "available on Atelier Pro and above". None of it was reachable, because nothing is gated any more, but it was still there to read. The License screen now describes what a license actually adds: automatic updates, email support, and a site allowance of up to 127 activations.
Bodholdt Atelier
v1.10.0
- Atelier is one product now. The Solo, Pro and Agency tiers are retired. Everything the plugin can do is in every copy of it: patron subscriptions with content drip, commissions with milestone payments and booking, the multi-artist Foundry with Stripe Connect payouts, the cross-artist Marketplace, and the Publish API with its Adobe Lightroom plugin. A license buys automatic updates in your dashboard, support, and a site allowance of up to 127 activations. It does not buy a feature.
- Why. The free edition already shipped an all-open licensing stub, while a paid base-tier license locked the Foundry, the Marketplace and the Lightroom publish API. Paying made the product worse than not paying. Agency, meanwhile, added no feature over Pro at all. Rather than keep a ladder that ran the wrong way, the ladder is gone.
- Nothing is taken away. If you hold a license of any tier, you keep everything you had and gain whatever your old tier withheld. Your site allowance is now up to 127 activations.
Bodholdt Atelier
v1.9.8
- Plainer writing in the storefront and the work editor. Checkout messages, the maker's proof captions and every field label used long dashes where a full stop or a colon reads more easily.
Bodholdt Atelier
v1.9.7
- Plainer writing. A few messages used long dashes where a full stop or a separator reads more easily. Nothing functional changed.
Bodholdt Atelier
v1.9.6
- Plainer writing. The description, the feature list and the FAQ answers used long dashes where a colon, a comma or a full stop reads more easily. Nothing about the plugin changed, only how it is described.
Bodholdt Atelier
v1.9.5
- The docs your readme cites are now in your download. The build excluded `docs/TESTING.md` and `docs/PAYMENTS.md` while this readme pointed you at both. Both ship again, and a build-time guard refuses to package an archive whose readme cites a file that is not in it.
- Editions are named before you buy. The feature list and the FAQ now say which edition carries commissions and patron subscriptions (Atelier Solo and up) and which carries the multi-artist Foundry, the cross-artist Marketplace, and the Lightroom publish API (Atelier Pro and up), instead of answering an unqualified yes.
- `docs/PAYMENTS.md` opens by saying what your edition includes, and its menu paths and quoted confirmation screens match what the plugin actually shows.
Bodholdt Atelier
v1.9.4
- The arcade (XP, ranks, HUD, level-up effects) and the Trophy Case are now off by default. Turn them on any time under the Game Feel tab in Settings. The setup guide is now a plain step-by-step checklist. Nothing else changes.
Bodholdt Atelier
v1.9.3
- American spellings throughout. The plugin and this changelog used British spellings in places (licence, colour, behaviour, cancelled). They now match the rest of Bodholdt Labs. Wording only, nothing behaves differently.
Bodholdt Atelier
v1.9.2
- The License screen now shows the number of sites you actually bought. Atelier Solo covers 5 sites and Atelier Pro covers 10, which is what the store has been issuing all along, but the plugin was printing 1 and 5. If you bought Solo and the screen read “Seats: 1”, nothing was ever wrong with your license and nothing was limiting you. The number on the screen was simply wrong. Atelier Agency is unchanged at 25.
- Fixed the “items left” count under a limited-edition work so it reads correctly in every language.
- A storefront-only release. Nothing in the plugin you run changed. The files that changed are the Bodholdt Labs store pages, which are host-only and have never been part of the distributed plugin, so this build is byte-for-byte 10.50.0 apart from the version strings and this note. There is no reason to hurry the update.
- Recorded here because the store's changelog and yours are the same file. Bodholdt Backup Pro, the paid companion for the two backup plugins, is on the store's pricing page now instead of only being reachable by a direct link: it gets its own section, its own card and its real prices, and the two free backup sections link to it rather than only naming it.
- The wording is careful for the same reason it was careful last release. The free backup editions already email you after every backup attempt, success or failure, and both new paragraphs say so before they say anything about the companion, so nobody can read this as the moment they start being notified. What is sold is the delivery channel and the digest, never "alerts" on their own.
- The companion's own section leads with the fact that it is an add-on and takes no backups of its own, because one of the two backup plugins has to be running for it to have anything to report on.
- No price changed. The backup plugins are still free with no paid plan, and their checkout is still closed with the same explanation.
- The two backup plugins are free now, with no paid plan, and the store says so everywhere at once.
- Bodholdt Backup for Google Drive and Bodholdt Backup for OneDrive had a $29/yr Complete plan. It is retired. Everything it included is in the free edition, including the dashboard updates that were the last thing it alone could do, and the Slack and Discord delivery it also carried now lives in Bodholdt Backup Pro, a separate companion that covers both clouds on one license and adds a scheduled backup-health digest. So the buy links, the cart builder and the public products feed all stop offering the two backup plugins, and the free card is the only card left on their pricing block.
- Nothing was deleted to do it. Both products keep their catalog entries, their Stripe objects and their update pointers exactly as they were, because existing licenses activate and update through them. If you hold one, nothing about it changed. Only the checkout closed, and a stale buy link now explains that the plugin is free rather than failing with an unhelpful error.
- Two things this release is careful about, because they have been got wrong before. The free backup builds have always emailed you after every backup attempt, success or failure, so no copy anywhere now implies a free user hears nothing when a backup fails; the companion is described by what it actually adds, which is the chat channel and the digest. And the pricing block no longer falls back to the backup family's copy for a product it does not recognize. It used to, which is how a companion plugin that takes no backups once rendered a card promising full and incremental backups. An unknown product now renders nothing.
- The free-download line under each download button names the product when the product has one edition, and keeps naming the edition when it does not.
- Two fixes: a way to keep a product out of the store listing without taking it off sale, and an update check that finally reports the WordPress versions you configured.
- Products can now be marked "Unlisted". An unlisted product is left out of the cart builder and the public products feed, so it is not advertised, but nothing else about it changes. Anyone with a direct buy link can still buy it, licenses still activate, downloads still work, and updates still arrive. There is a checkbox for it in the product editor, and the products list shows an Unlisted badge so it is not forgotten.
- The update check now answers with the WordPress compatibility fields it was given. It was renaming "tested_wp" and "requires_wp" to "tested" and "requires" in the response, while every client reads the original names. The result was that installed plugins showed an empty "Tested up to" and a fixed "Requires WordPress 6.0" no matter what was published for them. Both spellings are sent now, so existing installs are fixed without anyone needing to update anything first.
- The store now says what a paid backup plan is really for, and the checkout page looks like ours.
- The paid backup plan's bullet list led with automatic updates. Alerts and support are the substance of the plan, so they come first now, and the updates line says plainly that updates install from your dashboard while your license is active.
- The free download blurb is scoped to the edition it describes. It used to promise "no license key" in the name of the whole product, on the same page that sells a keyed edition of that product.
- The Atelier pages no longer sell automatic updates as something a license adds. The free Lite edition ships a working updater with no key to enter, so that line was wrong. A license adds email support and a site allowance of up to 127 activations.
- The "Confirm your purchase" page now carries the Bodholdt Labs mark, wordmark, and site colors, so it reads as part of bodholdtlabs.com instead of a plain unbranded page. It still loads nothing from anywhere: no external requests, no third-party assets, and the checkout flow itself is unchanged.
- Rate limits on the public endpoints now allow the number they say.
- WordPress asks a REST route for permission twice on every request, once to serve it and once more to work out which methods that route allows. Both asks were counted, so a limit set to thirty a minute was letting through fifteen. The answer is now worked out once per request and reused, so the configured number is the number enforced. Nothing about the limits themselves changed.
- The page you land on after paying no longer says your purchase is unavailable.
- Stripe sends you back to the site the moment your payment goes through, but the confirmation that unlocks your keys arrives separately, a second or two later. The page could not tell that short wait apart from a link that had genuinely expired, so it showed the same discouraging message for both, and it never updated.
- It now says your order is being confirmed, checks again on its own for up to thirty seconds, and then, if something really is stuck, tells you plainly what to do and gives you a support address. A link that has actually expired reads the same as before.
- The Door Report no longer looks broken before it has anything to report. On the first open after you turn on Working the Door, all four counters were zero, and the display font draws a zero with a diagonal bar through it, which reads as the browser's broken-image icon. A panel that has not counted anything now says so in a sentence, and once real counts exist the big numerals come back. A single zero sitting among real counts is drawn in the plain admin font instead.
- You can now see the bot trap working. The contact form has always hidden a trap field that only automated senders fill in, but nothing ever showed you it was doing anything unless you had switched the activity report on. The settings status card now carries a line for it, and there is a matching entry under Tools, Site Health. It counts trap trips over the last 7 days and says nothing more than that, because a sender turned away earlier by the request checks never reaches the trap and cannot be counted.
- The verification email says who it is from. The subject was "Your site name: verification code" and is now "Your {site name} verification code", so it reads as a sentence and is easier to find in a crowded inbox. Your site name, or the brand you set in the plugin, is what appears.
Bodholdt Contact
v5.2.12
- The widget stops offering categories that need a support ticket, and stops quietly turning one into an email. When Bodholdt Tickets is installed with its paid support model switched on, the widget used to mirror every category, including the ones that cost a credit. If someone picked one, the ticket engine refused, this plugin threw the reason away, sent the message to you as plain email instead, and told the visitor it had been sent. So the same question was paid on one page and free on another, and you got it as mail with no ticket to track. The widget now leaves those categories out, and in the rare case one is submitted anyway, the visitor is told plainly to open it on the Support page instead of being quietly rerouted.
Bodholdt Contact
v5.2.11
- The readme now describes the one request this plugin makes. The External services section said the plugin made no external requests and had no update checker. It has had an update checker since 5.2.6, and that section was never updated. It now says exactly what the check asks for, what it sends (the plugin version and your site address, and nothing else), how long each answer is cached, and how to switch it off.
- The update check now has an off switch. Add `add_filter( 'bodholdt_contact_update_check_enabled', '__return_false' );` and the plugin makes no outside requests at all.
- Uninstall now removes the update-check cache it had been leaving behind.
Bodholdt Contact
v5.2.10
- The arcade is fully translatable now, and its toasts can be dismissed. Several labels the arcade shows (the dismiss button, the "Nice" message on a plain points toast, and the level badge) stayed in English no matter what language your site runs in, because the shared arcade code never passed them through for translation. They now translate like everything else, the level number is formatted for your locale, and every celebration has a close button. Toasts also pause while you hover or focus them, and skip their timer entirely if you have asked your system to reduce motion.
- A site that cannot create the arcade tables now keeps trying. On a host where the database user is not allowed to create tables, the plugin recorded the arcade as installed anyway and never tried again, so the arcade stayed silently broken forever. It now confirms the tables really exist before recording success, and retries later if they do not.
Bodholdt Contact
v5.2.9
- The arcade settings box now matches the arcade. Since 5.2.8 the arcade has been off on a fresh install, but the checkbox on the Settings screen still drew itself as switched on, and saving your settings for any reason turned the arcade on for real. The box now shows the truth, and saving your settings leaves the arcade exactly as you found it. If you had turned it on yourself, it stays on.
Bodholdt Contact
v5.2.8
- Gamification is now off by default. The arcade (XP, ranks, the HUD, and confetti) starts off. Turn it on any time under Settings, then Bodholdt Contact, in the row headed "Working the Door". Nothing else changes.
Bodholdt Contact
v5.2.7
- American spellings throughout. The plugin and this changelog used British spellings in places (licence, colour, behaviour, cancelled). They now match the rest of Bodholdt Labs. Wording only, nothing behaves differently.
- Tested with WordPress 7.1.
- The arcade panel now filters the markup it draws through an allowlist instead of printing it as given. Nothing about how it looks or behaves changes, and the progress bar keeps the labels a screen reader reads out. The small script behind the milestone popups was tightened the same way.
- Ticket attachments are now encrypted on disk. Attachments live in your uploads folder, and whether that folder can be read directly over the web is decided by your web server, not by this plugin: Apache and LiteSpeed honour the rule the plugin writes, nginx and Caddy do not. Encrypting the files means a direct request returns unreadable data, so the support desk, which checks whether you are an agent or the customer who owns the ticket, is the only way to the file again. Existing attachments are converted quietly in the background, and files from before this release keep working either way. A new entry under Tools, Site Health tells you whether your server exposes the folder.
- Attachment filenames now come from a cryptographic random source. They were generated with a WordPress helper that other plugins are allowed to filter, which meant another plugin could decide how unguessable your attachment names were. Stored files are also written with tighter permissions.
- Plainer writing. A few messages used long dashes where a full stop or a separator reads more easily. Nothing functional changed.
- The free contact widget no longer offers the categories that cost a support credit. If you have turned the paid support model on, a question about one of your products was a tracked ticket on the Support page and a free message one click away on the same page. The widget now asks Tickets which categories are credited and simply leaves those out, so each door offers what it is for. Nothing changes if you have not turned the paid model on, because then nothing is credited.
- There is now a plain list of every ticket inside WordPress admin. The Support Desk is an app, and when an app fails it takes the whole queue with it. That is exactly what happened when the desk stopped loading on sites using Plain permalinks: for as long as it lasted there was no other way to see a single ticket. Under Tickets you will now find All Tickets, a straightforward table of every ticket with its status, the customer and their email address, which filters, searches and pages. WordPress builds it directly, with no JavaScript of its own, so it keeps working when the desk does not and it works with JavaScript switched off. It is read only on purpose. It is there so you can see the queue and answer people from your own mail, not to become a second desk. Your agents can open it too, not just administrators.
- The desk no longer names the wrong plan beside a locked report. Per-agent and per-department reporting unlocks on the first paid plan, but the reports screen said Studio: in the badge, on the button, and in three separate sentences. Anyone who saw those sections was being pointed at a plan more expensive than the feature actually needs. The plan name now comes from the same place as the check that unlocks the feature, so the two cannot drift apart again.
- Everything the desk and the forms say can now be translated. The plugin's JavaScript asks WordPress for translations exactly as its PHP does, but the translation catalog was built by scanning PHP only, so not one of those strings was ever offered to a translator. A fully translated site still showed the Support Desk, the customer portal, the support form and the widget in English, with no way to tell why. The catalog now includes them: 331 more strings, the desk among them. Nothing changed in the code that shows them, so an untranslated site looks exactly as it did.
- The support paywall no longer throws away what you typed. A customer who filled in the form, attached a file, and pressed Send watched the whole message vanish and be replaced by a request for payment. The form now stays exactly where it was, the buy panel appears alongside it, and "Back to your message" returns everything untouched. The Send button is restored too, instead of staying stuck on "Sending...".
- The paywall stopped claiming something that was not true. It said an active subscription or an in-window license includes support. Under the credits model the in-window allowance is deliberately not used, so half that sentence was dead on arrival for the stores most likely to show it. It now states only what is true wherever it appears: the request needs one support credit, and the credit opens a tracked, prioritized ticket.
- "New request" in the customer portal goes to the support form again. The portal looked for any published page containing the shortcode and took whatever the database returned first, which could be a documentation page that merely quotes it. The plugin now records the pages it creates and prefers them, and the fallback lookup is ordered instead of arbitrary.
- The Support model help text now matches the code, including that the in-window lifetime allowance applies to the window model and not to credits.
- The arcade is fully translatable now, and its toasts can be dismissed. Several labels the arcade shows (the dismiss button, the "Nice" message on a plain points toast, and the level badge) stayed in English no matter what language your site runs in, because the shared arcade code never passed them through for translation. They now translate like everything else, the level number is formatted for your locale, and every celebration has a close button. Toasts also pause while you hover or focus them, and skip their timer entirely if you have asked your system to reduce motion.
- A site that cannot create the arcade tables now keeps trying. On a host where the database user is not allowed to create tables, the plugin recorded the arcade as installed anyway and never tried again, so the arcade stayed silently broken forever. It now confirms the tables really exist before recording success, and retries later if they do not.
- The arcade now has an off switch, and it covers the Support Desk too. Since 1.6.5 the arcade has been off by default, but there was no control for it anywhere, so there was no way to turn it back on. There is now one under Appearance, alongside confetti and sound. It also does more than it used to: the Support Desk kept showing agents the XP chip, the leaderboard, and a points toast on every reply no matter what, because only the WordPress admin scoreboard honored the switch. One control now covers both. If you want the arcade on your desk, turn it on under Appearance.
- This plugin can now update itself. Until today it had no update client at all, so a new version, including a security fix, only reached you if you happened to visit the site and reinstall by hand. Bodholdt Contact now checks for a newer version and offers it on your Plugins screen like any other plugin. It carries no license key and sends none: the check asks a public address for the current version number, and the download is the same public link a person would click.
- The contact card now takes keyboard focus when it opens. The card is hidden behind a short fade, and focus was being moved into it before that fade had started, so the browser discarded it and focus stayed on the button behind the card. Anyone using a keyboard or a screen reader landed outside a dialog that announces itself as modal, and pressing Tab walked into the page behind instead of moving through the form. Focus now waits for the card to be on screen, which also restores the Tab trap that keeps you inside the form until you close it.
- Failed-code accounting is proven or unavailable. The OTP repository validates the exact database write, follow-up row, counter, state, and database error before returning a remaining-attempt count. Storage uncertainty returns a visible 503 without an invented attempt budget, while a concurrent fifth failure returns the proven locked count.
- Legacy IPv6 rate rows have a complete transition. Before the 5.2.4 database marker can advance, the bounded upgrade deletes every Contact-owned pre-canonical ephemeral rate row and verifies the table is empty. New collection, export, and erasure use one canonical `inet_pton()`/`inet_ntop()` representation for every equivalent IPv6 spelling.
- Identifier matching is canonical end to end. Collection, export, and erasure share one validated lowercase email normalizer. Source addresses use `inet_pton()`/`inet_ntop()` at collection and lookup, with a bounded compatibility set for still-active pre-5.2.3 IPv6 HMAC rows.
- Rate-limit storage faults fail closed. The deciding counter read and its write accept only exact database result types and reject false, null, non-integer, negative, or last-error states with a visible storage-unavailable response.
- Diagnostics cannot retain subject data. Mail health stores only allowlisted context/status timestamps for at most seven days, and an upgrade removes the older arbitrary-error field. Debug logs accept only request-independent event codes; ticket IDs, challenge IDs, addresses, inputs, and exception text are not accepted by the logger.
- Cookie wording matches runtime. The inventory now distinguishes the JavaScript-unreadable HttpOnly cookie from flow values returned in same-origin JSON to the widget.
- Pseudonymous counters are classified and handled truthfully. The privacy inventory, suggested policy, exporter, and eraser now cover still-active email-keyed abuse counters. A bounded operator API handles a separately supplied IP address without scanning or exposing unrelated rows. Database read, delete, and partial-delete faults remain visible rather than reporting a completed request.
- Delivery diagnostics are subject-free. A rejected message logs only a request-independent transport error; no stable email-derived identifier or raw sender address is written to the server log.
- The necessary flow cookie is disclosed. Operator copy names `bodholdt_contact_flow`, its opaque purpose, 10-minute maximum, `HttpOnly`/`SameSite=Lax` controls, HTTPS-only Secure flag, and early deletion.
- Privacy requests now fail visibly if storage fails. Export and erase callbacks return a WordPress error when the verification table cannot be read, a delete fails, or only part of the selected page is deleted. They no longer report a completed request that never reached the data.
- Failed resends no longer spend delivery quota. When the mail transport returns false or throws, the destination and source-address hits are refunded to the exact windows originally charged while global anti-abuse counters remain in place.
- No held-product promotion. The settings-page Ticketing cross-sell and its sales link were removed. Passive local compatibility with already-installed Tickets and Licensing releases remains documented without a purchase link.
This page shows the 15 most recent releases for each plugin. Each plugin's own page carries the release history of the edition you can download today.