What's New
Product Changelog
Updates across every Bodholdt Labs plugin. Dated releases are listed newest first, and a release I have not dated yet sits directly beneath the newest one I can place it against. I ship often. This page keeps each plugin’s most recent releases, and each plugin’s own page carries the release history of the edition you can download today.
Subscribe via RSSPrefer email? Each free plugin's page has an optional update-notices form.
- Visitors can check out only when checkout takes real money. With the simulated checkout, Stripe test keys or the PayPal sandbox, only administrators can place orders, so you can test, and visitors see "This store is not taking orders yet." Before, any visitor could complete an order in those modes without paying, which released files and marked originals sold. Meanwhile the storefront pages ask page caches, server and CDN caches included, not to keep them, since they change when the store goes live.
- Stripe checkout takes card payments only, which include Apple Pay and Google Pay where Stripe offers them. Bank debits and vouchers were treated as paid before the money arrived. If your Stripe account offers them, add the checkout.session.async_payment_succeeded event to your webhook after updating: a payment begun with one before the update is then fulfilled when the money arrives.
- Commission deposits and milestone payments now open Stripe's payment page; they used to end on the WordPress login screen, or on the dashboard for someone signed in to the site. A payment counts only for the amount due when it arrives. One that comes to less, because the artist raised the amount while the buyer was paying, is listed on the commission screen under Payments not counted, and the buyer is told. Without live Stripe, buyers can't pay on the commission page, which says so, and the artist records each payment from the commission screen. Before, the buyer's button marked a payment received when nothing was paid.
- A buyer is charged the price of the license tier they pick (with name your price, at least that price). Every tier of a fixed-price Work used to be charged the artwork's own price, and on a name-your-price Work the amount the buyer named (at least the Work's minimum), whichever tier they picked. A sync license is charged its sync price. On a fixed-price Work, trade buyers get the default trade discount on the tier they choose, and they are no longer offered a promo discount that a trade price does not take. A fixed-price Work with license tiers no longer uses its own wholesale price, so with no default trade discount set, trade buyers pay the tier's price.
- Every license tier can be chosen. Before, tiers whose names came down to the same plain letters and digits shared one choice, for example any two names written only in Japanese.
- The caches of the common page cache plugins are cleared when you save a Work whose license tiers or sync license changed, and once after you update to this version, because some tiers get new keys (such as tiers whose names contain ö, 商 or €): a Work page saved before could not sell them. If another cache plugin, your host or a CDN caches your pages, clear that cache at those times too.
- Store cards and a Work's page show the price of its first license tier, which is what the buy form starts on (with name your price, the least a buyer can pay). A bundle lists each piece, and works out its saving, at the price of the personal license the bundle gives, or the piece's cheapest tier. They used to leave the tiers out.
- Connect with Stripe opens Stripe's onboarding and keeps the artist's profile, and saving the profile no longer disconnects the account. Sales go to an artist's account only once Stripe can pay it out. With Foundry on, the buy panel no longer says the artist keeps 100%, since a collective fee may apply.
- In yen and other currencies without decimal places, a sale through an artist's Stripe account (Foundry) asked Stripe for a collective fee 100 times too large, so the checkout failed or the artist was paid too little. The fee is now the set percentage of the sale.
- Until you connect Stripe or PayPal with live keys, finishing the setup guide adds "Atelier setup finished" to the Activity Log, not "Atelier opened for business". The guide and the dashboard's setup card now promise a published storefront, not an open one, and the guide's last step is Publish the storefront.
- Patron renewals are recorded whatever API version your Stripe webhook uses. With a current version, the default for new Stripe accounts, no renewal was recorded, so a patron who kept paying lost access 33 days after subscribing (368 days on a yearly tier) while Stripe kept charging them. Renewals in yen and other currencies without decimal places are recorded at the amount paid, not a hundredth of it. Each renewal is recorded once, even when Stripe sends its event more than once, and if saving a renewal fails partway, nothing of it is kept and Stripe is asked to send it again.
- Push notifications go only to people who still have agent access.
- Removing an agent also removes their permission to delete tickets, and the update clears that permission where earlier removals left it behind. Remove is no longer offered next to an administrator, whose access comes with the role.
- The customer portal shows tickets only to someone who opened a sign-in link sent to the address, signed in to the site or not. A link opened while signed in stops working when that sign-in ends. Before, anyone with an account could change its email to a customer's address and read that customer's tickets.
- The Support Desk shows customer messages as plain text. Before, a message could put live formatting, images and links into the desk.
- Signing out of the site also signs you out of the customer portal.
- Sign out in the customer portal works on a page left open for days, and the page says so when signing out did not go through. Before, a failed sign-out looked like it worked and left the portal open to the next person at that browser.
- The support panel links to your portal page. It could link to a page that only quotes the portal's shortcode, or to the home page. Without a portal page, visitors no longer see the panel, and administrators see a note saying why. The settings screen, the portal's New request link, the support form's link to the portal, paid support's links and the automatic reply that points people who email you to your support form go by the same pages, and none of them takes a page that only quotes a shortcode for your form or portal page.
- The License screen now says that email support ends 30 days after a license lapses, which is what its notice during those 30 days already said. It used to read as if support ended the moment a license lapsed.
- The privacy notes in docs/PRIVACY.md now say what the update checks are used for, as well as what they send: Bodholdt Labs counts installs from them, one site for each site address that checks for updates.
- No deprecation notices on PHP 8.4 and 8.5. Five functions that restores use were written in a form that PHP 8.4 deprecated, so on PHP 8.4 or later a site with WordPress debugging switched on could show or log five notices from this plugin. They are now written the way current PHP expects. Nothing about what a backup contains or what a restore does has changed.
- In the plugin you run, this release changes the version number, this changelog, the translation template (three of its strings, its version line and the line numbers it cites) and the order confirmation page. If your store uses a translation, those three show in English until your translation adds them.
- While a payment is still being confirmed, the order confirmation page no longer says "Payment went through" or that this normally takes a few seconds. Some payment methods can take longer to clear, and a buyer who paid that way would land on this page before the payment has cleared. The page now says it is waiting for confirmation that the payment has cleared, that this takes a few seconds for a card or a wallet, and that when a payment takes longer, the keys arrive by email once it clears, so there is no need to keep the page open. After its tenth check, it no longer says how long this takes, and it shows its note about the order still being worked on.
- An order confirmation link opened more than a day after its order was delivered now reads like any other old link: it points the buyer to their email and to Manage Licenses for the keys, instead of saying that the order is still being confirmed and checking again.
- In the plugin you run, this release changes the version number, this changelog, the translation template (its version line and the line numbers it cites) and the order confirmation page.
- The order confirmation page no longer keeps anything in the browser's session storage. While a payment is still being confirmed, the page still checks again every three seconds, up to ten times, and now carries the count of those checks in its own address instead. After the tenth check it shows its note about the order still being worked on, as before, and it no longer says that it will check again.
- On bodholdtlabs.com, the three reassurances under the buying page's plans now read "Secure payment", "Delivery when payment clears" and "14-day guarantee". The middle one said "Instant delivery", but keys and downloads go out when the payment clears, which is at once for a card or a wallet and later for a few local payment methods.
- A digest posted to Discord is now shortened when it is longer than 2,000 characters, the most Discord takes in one message. A digest posted to Slack is shortened when it is longer than 4,000 characters, the length Slack recommends for best results. Until now the plugin used smaller limits of its own, counted in bytes, so a digest Slack or Discord would have taken whole could arrive shortened, and with the note added the shortened copy could be longer than the full digest. A shortened copy is still cut between lines, and it now always leaves room for its note and is always shorter than the full digest would be in the chat message.
- With Where it goes set to Both, a shortened chat copy now ends by saying that the full digest went to your digest email address. If your site could not send that email, the chat copy says so and asks you to check the site's mail setup. It used to tell you to choose Both, which you already had.
- The FAQ answer said the update check runs while the plugin is installed. A deactivated copy checks nothing, so the answer now says it runs while the plugin is active.
- The Privacy section now says what the update checks are used for: Bodholdt Labs uses them to count installs, and each site address that checks for updates counts as one site running the plugin. Because the checks are counted, the Privacy section and the 1.0.0 notes below no longer say "no telemetry".
- You can now switch off the count of how often the widget is opened. Add `add_filter( 'bodholdt_contact_open_count_enabled', '__return_false' );` to a small site plugin or your theme's functions.php, and opening the widget sends nothing at all. The activity summary on the settings page and the weekly email then leave opens out, instead of reporting a number that was never counted. Starts and sent messages are still counted. If you do not add that line, opens are counted as before, except on pages your cache saved before this update, which may count no opens until the cache is cleared.
- The External services section now says that update checks are counted by site, to see how many sites run the plugin. Because they are counted, the section no longer makes any claim about analytics. The update check itself is unchanged.
- On sites that count how often the widget is opened, the suggested privacy policy text now also says that the plugin's pseudonymous counters limit how far automated traffic can inflate that count. The lawful basis it asks you to state now covers this processing as a whole, not security alone.
- The External services section now lists everything the AI co-pilot sends to Anthropic. It used to leave out the ticket's subject, your desk and site name, your knowledge-base notes, the summaries agents ask for (a summary also sends the ticket's internal notes), and the site address WordPress puts in every request's user agent. It now names each license detail that goes: the customer's plan, how many active licenses they hold, their products and their next renewal date. Those go when Bodholdt Licensing's license records are on the same site, even while Bodholdt Licensing is deactivated; this section used to say only while it is active. It also says what the Test button sends. Apart from the waitlist change below, the co-pilot works exactly as before.
- The section of this readme about the Bodholdt Labs licensing server now says that the check for a newer version runs whether or not a license key is set. It used to say the server is contacted only when a key is set, and the start of External services said all three services there are only contacted when you enable them. That check sends the product identifier and your site's address, and no license key. Bodholdt Labs counts those update checks by site, to see how many sites run the plugin. The update check itself works exactly as before.
- The AI co-pilot no longer sends a waitlist visitor's IP address to Anthropic. A waitlist signup (the `bt/v1/waitlist` route) opens a ticket whose first message records the visitor's IP address, kept for invitations and abuse triage only. Until now, a draft, a summary or Auto-pilot on that ticket sent the address along with the rest of the conversation. The co-pilot now leaves that line out, and the ticket still keeps it.
- The AI Co-pilot settings screen said "Nothing is sent automatically", but with Auto-pilot on, each new ticket goes to Anthropic as it arrives. It now says what it meant: the co-pilot never sends a reply to a customer on its own.
- The features list said a human always reviews before anything is sent, but with Auto-pilot on, each new ticket goes to Anthropic as it arrives. It now says a co-pilot draft never reaches a customer until an agent reviews and sends it. The FAQ said the co-pilot only drafts. It also writes ticket summaries for your agents and, with Auto-pilot, sets a new ticket's priority and tags, and the FAQ now says so. It still never sends a reply on its own.
- The advice for a backup failure that mentions a quota now asks you to check your storage first. The Logs tab, the Dashboard and the failure email used to say your Google Drive storage may be full and tell you to delete old backups or upgrade your Google storage plan. A message that mentions a quota does not always mean your Google Drive is full, and if it is not, deleting backups only leaves you fewer backups to restore from. The advice now reads: "Check your Google Drive storage. If it is full, delete old backups or upgrade your Google storage plan."
- The privacy notes now say that update checks are counted. This copy has asked bodholdtlabs.com whether a newer version exists since 6.52.0. The Privacy section and the External services entry now say that those checks are counted by site, to see how many sites run the plugin. The Privacy section used to open with four denials that counting the checks by site contradicts. They are gone, and the section now opens with what never reaches us: your site content, database content and backup data. Nothing about what this copy sends has changed.
- When a backup fails with a message about a quota, the advice now asks you to check your storage first. It used to say "Your OneDrive storage may be full. Delete old backups or upgrade your storage plan." A message that mentions a quota does not always mean your OneDrive is full, and if it is not, deleting backups only leaves you fewer backups to restore from. The activity log and the failure email now say "Check your OneDrive storage. If it is full, delete old backups or upgrade your storage plan.", and the one line diagnosis that travels with the failure now says "OneDrive storage may be full. Free up space or expand storage." Nothing about what is backed up, uploaded, kept or restored changes.
- This copy's readme now says that its update checks are counted. Since 5.49.0 this copy has asked bodholdtlabs.com whether a newer version exists, sending the version it is running and this site's address. The Privacy section and the update check's entry under External services now say that those checks are counted by site, to see how many sites run the plugin. Sentences in the Privacy section and in three older notes below that said otherwise have been reworded to match. Nothing about what this copy sends changed.
- In the plugin you run, this release changes the version number, this changelog, the translation template, the Reports screen and the Numbers card for each app under Software. On the Reports screen, the Software section changes its wording, the order of its apps under By app and the days a range reads, and the This month button at the top of that screen now starts on your site's month. On the Numbers card the wording changes. Nothing about how the counts are kept changes, and nothing new is recorded. The change to the buying page is in a file that runs only on bodholdtlabs.com and is not part of the plugin you receive, so it is here for the record.
- On bodholdtlabs.com, a link from another page to a section of the buying page now puts the section's heading below the menu, as a link within the page already did. The page's content slides up a little as it appears, and the browser placed the section before the slide had finished, so the heading came to rest partly under the menu. When the page opens at one of its sections, its content now appears in place and only fades in.
- The Software section of the Reports screen and the Numbers card for each app no longer say how often an app checks for updates. They said an app does it many times a day, or several times a day, and nothing supports either figure: how often an app asks is up to the app and its user. They now say that an update check is counted each time your site sends out an app's update feed, and that downloads and update checks your location rules turn away are counted under Refused instead. One install can make many checks or none, so checks are not an install count.
- Under By app in the Software section, the apps are now listed by downloads, most first, then by update checks, so the longest bar comes first. Since 10.52.4 the bars have measured downloads, while the apps were still listed by update checks.
- The Software section's counts are kept per UTC day, while the Reports screen picks its dates by your site's own day. A range that ends today now always includes the current UTC day, so the newest counts are never left out. Before, on a site west of UTC, a download made late in your day, after midnight UTC, was already counted under the next UTC day, so a range ending today left it out, and on a site east of UTC, until midnight UTC, a range of just today read a UTC day that had not started yet and showed nothing. The line under the four counts names the UTC days the section read and says those days start and end at midnight UTC, which may not be midnight at your site. A range that ends on any other day reads the dates you chose, as UTC days. How the counts are stored does not change.
- On the Reports screen, the This month button now starts on the first day of your site's month. It used the UTC month, so at the turn of each month, between midnight UTC and midnight at your site, it chose the wrong days. The screen's range, its date buttons and its Software section now use one reading of your site's date, so they always agree.
- The translation template gains three strings and drops three, all on the Reports and Software screens: the Software section's description, the line that names the days it read, and the Numbers card's description each replace the old one. If your store uses a translation, those three show in English until your translation adds them.
- 10.52.5 was released only on bodholdtlabs.com and was never offered as an update, so its changes reach you with this release. In the plugin you run it changed only the version number, the changelog and the version line of the translation template.
- The changelog entries for 10.52.5 and 10.52.4 are corrected. The 10.52.5 entry was dated 2026-10-15, its release day in UTC, and is now dated 2026-10-14, the day it was released in Pacific time, as the 10.52.4 entry is. It said that following a link to a section of the buying page puts its heading just below the menu again, which was true of links within the page but not of links from other pages, and it now says so. It said the 10.52.4 entry's item on the Reports screen did not say what changed there, when that item had named some of the changes in shorthand, and it now says that, and that the item did not say the bars for each app now measure downloads. Its phrases about the theme update ("will set", "has not shipped yet", "is not true yet") now say how things stood when 10.52.5 was released, so they stay true once that update ships. The 10.52.4 entry said an app checks for updates many times a day, which nothing supports, and it no longer says so. It said the bars for each app list downloads first, which was true of the figures beside each bar, while the apps stayed in order of update checks until 10.52.6, and it now says that.
- In the plugin you run, nothing changes in this release except the version number, this changelog and the version line of the translation template. The change to the buying page is in a file that runs only on bodholdtlabs.com and is not part of the plugin you receive, so it is here for the record.
- On bodholdtlabs.com, following a link within the buying page to one of its sections puts the section's heading just below the menu again. 10.52.4 removed the page's own offset for those headings ahead of a theme update that sets one on every page, and that update had not shipped when 10.52.5 was released, so the headings landed under the menu. Now the page adds its offset only while the theme does not set one, so a heading never lands twice as far down, and the page's offset switches itself off once the theme sets its own. A link from another page still left the heading partly under the menu, which 10.52.6 fixes.
- The changelog entry for 10.52.4 is corrected. It said the site's theme already set that offset, which was not true when 10.52.5 was released. It left the Software section of the Reports screen out of what changed in the plugin you run. It gave the translation template's count of new and dropped strings from before the Reports changes. Its item on the Reports screen named only some of what changed there, in shorthand, and did not say that the bars for each app now measure downloads instead of update checks, and now it says what changed. And it was dated 2026-10-08, the day it was written, instead of 2026-10-14, the day it was released.
- In the plugin you run, this release changes the version number, this changelog, this readme's entry for the Bodholdt Labs license and update service under External services, the translation template, the Software section of the Reports screen, and two messages that say what happens when a license ends: the trial reminder email and the notice in a client the SDK generator builds. To choose their wording, both now ask the cls_download_serve_lapsed_license filter, and the wording changes only for a product your code opts in through it. Separately, the plain-text trial reminder drops the dash before its sign-off for every product. The archive also rewords comments in two of its stylesheets, which changes nothing you see, and no longer includes tools/verify-paid-claims.php, a check meant only for bodholdtlabs.com's own builds. Everything else in this entry is in a file that runs only on bodholdtlabs.com and is not part of the plugin you receive, so it is here for the record.
- The trial reminder email used to tell every trial user to choose a paid option before the trial ends "to keep downloads, updates, and support." For a product your store keeps serving after its licenses lapse, downloads and updates do not stop when the trial ends, so for that product the email now says "Choose a paid option before the trial ends to keep an active license." It says nothing about what stops, or about when support ends. For every other product the email says what it said before.
- A client the SDK generator builds for such a product ends its "License not active" notice with "to activate it on this site." instead of "to enable updates and support.", because a site whose lapsed key is still entered keeps receiving updates. A client for any other product is generated exactly as before. A client you generated earlier stays as it is until you generate it again.
- cls_download_serve_lapsed_license is now asked in two more places, read only and only to choose that wording. The trial reminder asks about a copy of the trial's license whose end date is set to the day before the email is sent. The SDK generator asks about a stand-in license for the product, with ID 0 and no key or email, so a callback that decides license by license answers the generator for that stand-in. Neither question opens a download.
- The plain-text trial reminder now ends with your sender name on its own line, without a dash in front of it. The translation template gains thirteen strings and drops three. For the trial reminder it gains three and drops one: the new sentence in the HTML email and in the plain-text email, and the plain-text reminder with its new sign-off, which replaces the old one. The other ten it gains and two it drops belong to the Software section of the Reports screen. If your store uses a translation, the plain-text trial reminder, and for a product you opt in the HTML email's new sentence, show in English until your translation adds the new strings.
- This readme's entry for the Bodholdt Labs license and update service now says that WordPress adds your site's address to the user agent of each update check, and that bodholdtlabs.com counts these checks by site. The requests themselves have not changed.
- On bodholdtlabs.com, the buying page no longer adds its own scroll offset above each section heading. This was meant to ship after a theme update that sets one for every page, and that update had not shipped, so following a link to a section of that page put its heading under the menu. 10.52.5 puts the offset back until the theme sets its own.
- On the Reports screen, the Software section is now headed Software (desktop apps) and says what its numbers mean: a download is a file fetch, from a new install or from an app updating itself, and is not a unique person, while an update check is an installed app asking whether a newer version exists, so checks are not an install count. The section now opens with four counts: downloads, update checks and requests refused by your location rules in the date range you chose, and downloads all time. A line under them names the dates that range covers. Two new graphs show downloads and update checks over time, by day, or by month for a range longer than 92 days. The bars for each app, now under By app, measure downloads instead of update checks, and the figures beside each bar start with downloads. The apps were still listed in order of update checks until 10.52.6, which lists them by downloads. All of it reads the counts the plugin already keeps, and nothing new is recorded. If your store uses a translation, the section's new wording shows in English until your translation adds it.
- A copy with no license key entered is no longer offered updates it cannot download. Each update downloads with your key, so until now such a copy was offered every new version and then failed to install it with "Download failed. Forbidden". That includes a site you deactivated, because Deactivate removes the key from that site. Enter your key on the License screen and updates are offered again.
- The License screen, its notice and these notes now say that updates need your license key entered. The 1.10.3 and 1.10.4 notes below say updates arrive in your dashboard whether or not you hold a license. That was never true of this copy, which downloads each update with your key. Since 1 October 2026, a license that lapses keeps receiving updates on any site where its key stays entered.
- A license that lapsed now shows on the License screen as Not active or Expired, and a site where it was confirmed before keeps showing its plan and site allowance. It used to show a one-seat community plan and usually an Invalid label, which suggested the key was wrong, and clearing the key is the one thing that stops the updates a lapsed license still receives. Invalid now appears only when the store does not recognize the key as an Atelier key. The screen also says what a lapse changes: every feature keeps working, updates keep arriving while the key is entered, and email support ends until you renew.
- A site whose license key is entered but not active now gets a notice of its own, in place of the one for an unactivated copy. It says that a lapsed license keeps receiving updates while its key stays entered, and that renewing brings back email support. The old notice suggested activating, which the store refuses for a lapsed key.
- The Music Release description and this readme's feature list no longer name another music platform.
- The feature list in this readme now says that the licensing layer confirms your license key with bodholdtlabs.com and never switches a feature off. It used to call that layer simulated by default.
- The default label of the Bodholdt Friday banner now reads "Bodholdt Friday: support the artist direct". A label you set yourself is unchanged.
- The privacy notes in docs/PRIVACY.md now list every request the plugin makes to bodholdtlabs.com, edition by edition. They used to say the license check ran only if you entered a server URL.
- When WordPress downloads an update, your license key now goes only with this plugin's own download from bodholdtlabs.com, over HTTPS. Until now it was added to any download link of the same shape, including another plugin's download from another store that runs the same licensing software. License checks and update downloads also no longer follow a redirect, so the key cannot be passed on to another address.
- The LICENSE file now names Bodholdt Atelier. It was copied from another Bodholdt plugin when this one was started and still named that plugin. Your rights under the GPL, version 2 or later, are unchanged.
- This copy now says in its own header that it takes updates from bodholdtlabs.com. WordPress matches an installed plugin to WordPress.org by folder name, so if a plugin with this folder name were ever listed there, the header keeps WordPress from offering it in place of this copy. Nothing about how this copy updates changes.
- The contact form's fields now use 16-pixel text, up from 14. It is easier to read, and some phone browsers zoom the whole page in when someone taps a field with smaller text.
- The installation steps now name the Add Plugin screen and its Upload Plugin button, as WordPress labels them.
- In high-contrast color modes, the round contact button now has a border, and its icon is drawn in the system's button text color. Those modes replace a site's own colors, which took away the button's colored circle and could leave its icon the same color as the page behind it.
- The plugin's header now names bodholdtlabs.com as the place its updates come from, in an Update URI line. WordPress matches installed plugins to the listings in its public plugin directory by folder name, so without that line a different plugin listed there under the same folder name could be offered to your site as an update to this one. The update check itself is unchanged.
- The comment at the top of the update checker's code now says the check sends your site address along with the plugin version. It used to say only the version left your server. The External services section of this readme has said so since 5.2.11.
- The External services section now says that after a failed update check the plugin waits an hour before asking again, or less if WordPress installs or updates something, because that clears the cached result. It used to say the plugin waits at least an hour.
- Deleting one edition of Bodholdt Tickets on the Plugins screen no longer deletes what the other edition runs on. Both editions keep their tickets, settings and agent access in the same place, so until now deleting the free edition after installing a paid plan, or the reverse, removed all of it. From this release, a copy you delete while the other edition is still installed leaves everything in place, and the last copy you delete still removes everything. WordPress runs the cleanup of the copy being deleted, so a copy older than 1.6.21 would still remove everything. While this release is active, it refuses to delete such a copy and says how to remove it safely. On a multisite network it can do that only when it is network-activated or active on the main site, because those are the copies the Network Admin screens load.
- The support form's name and email fields now tell the browser what they hold, so it can offer to fill them in for your customers.
- Dropdown menus on the support form, for categories and for any custom field you made a dropdown, now match the text fields around them: the same width, border and focus highlight.
- If the customer portal cannot load, it now shows a Try again button under its message, so a customer can retry without reloading the page.
- With JavaScript turned off, the customer portal now says that it needs JavaScript and asks the customer to turn it on and reload, in place of a Loading message that never finished.
- The See plans link on the License screen, and the plugin's other upgrade links, now open the pricing page at the Bodholdt Tickets plans instead of at the top of the page.
- The plugin details window now names the author as Bodholdt Labs.
- The description on the Plugins screen now reads as a plain list of what the plugin does: a self-hosted help desk with a front-end desk, ticket form, customer portal, canned replies and an optional AI co-pilot that uses your own key.
- The section of this readme about the licensing server now describes only this edition.
- The setup steps in this readme now name the Tickets menu, and the Add Plugin screen where you upload the ZIP, as they appear in your dashboard.
- When a digest is too long for Slack or Discord, the shortened chat copy now ends by telling you how to get all of it: set Where it goes to Both, and the full digest arrives by email as well. It used to send you to the Backup Pro screen, which shows when the next digest is due and when the last one was delivered, but not the digest itself.
- The readme said that nothing about your site reaches Bodholdt Labs, and that nothing there could receive it. That was wrong. The license check sends your license key and your site's address when you activate or deactivate the license, and at most every 12 hours when an admin page loads; an update download sends your license key; and the update check, which sends no key, carries your site's address in the user agent WordPress adds by default. The FAQ answer and the Privacy section of this readme now say so. Nothing about your backups or your schedule is sent.
- The translation template's bug-report address now points to https://bodholdtlabs.com/support/ instead of a WordPress.org forum this plugin has never had.
- A backup is no longer refused because of a folder you did not ask it to back up. If this site loads one of its component folders from a place a backup has no way to record, the run stops and says so, which is right. That check was asking about every folder, including ones outside the backup you had selected, so a site could be refused a database and uploads backup because of where its themes folder sits. It now asks only about the folders your selection covers, which is what the size estimate on the Dashboard was already doing, so the two could disagree: the estimate promised a backup the run then refused. Nothing that was refused for a folder inside your selection changes.
- This readme's short description, Description section and feature list, and the plugin's own description, no longer call the restore one-click. They now say full or selective restore, which is how it works: you choose what comes back, then confirm.
- The note that sent you to bodholdtlabs.com/changelog/ for the complete history of every version is gone, because that page lists the most recent releases, not all of them.
- The FAQ entry for a backup or restore that cannot prepare its staging folder is now titled with the message the plugin shows, "No secure backup staging directory is available", instead of a message it never shows, and it no longer opens with an internal reference. The installation steps also name the plugin's menu as it appears in your admin sidebar.
- The code change is internal only, and nothing about backups or restores changes. It adds one marker that the test suite reads to confirm which archive format this build writes, so that a future change to where files are recorded cannot be checked against a record made for the old format. No file that is backed up, no folder that is restored, and no message the plugin shows while it works is different from 5.50.5.
- This readme's short description, Description section and feature list, and the plugin's own description, no longer call the restore one-click. They now say full or selective restore, which is how it works: you choose what comes back, then confirm.
- The FAQ entry for a restore that stops partway now quotes the restore screen's message exactly as the plugin shows it, "Fetching download link...", quotes this plugin's own staging message instead of another plugin's, and no longer opens with an internal reference.
- In the plugin you run, this release adds one developer filter, and nothing your store or your customers see changes unless your own code uses it. Beyond that, it changes the version number, this changelog, this readme's answer to "What happens after a refund or dispute?", the note under No longer active in your customer portal, which changes only for a product your code opts in, and the translation template, which gains that note's three strings. That readme answer used to say a refund or dispute on a subscription invoice changes its license; it now says when that happens and when it does not. Everything else is in files that run only on bodholdtlabs.com and are not part of the plugin you receive, so it is here for the record.
- New filter: cls_download_serve_lapsed_license. Return true for a product and your store keeps serving that product's downloads and updates to its lapsed licenses, meaning licenses whose term or trial ran out or whose subscription ended. A subscription counts as ended once your Stripe webhook has recorded its end; one whose end reached your store only through Sync from Stripe, or before your store ran 10.37.2, is still refused. The filter stays off unless your code turns it on, and an active license never reaches it. A license you revoked is refused whatever the filter returns, and so is a key your store never issued. A one-time purchase that was fully refunded, lost in a dispute or is under an open dispute is refused too. For a subscription, the plugin may not tie a refund or dispute to the license at all, so a subscription that was refunded or disputed and then ended can be served like any other lapsed license. Revoke the license if you need to stop that. A lapsed license's own menu has no Revoke, so select its checkbox under Manage Licenses and choose Revoke in the bar that appears. Changing its end date does not stop it.
- On bodholdtlabs.com, a Bodholdt Atelier license that has lapsed now keeps receiving updates in your dashboard on any site where its key is still entered. Before this release the update was offered and its download was then refused.
- On the buying page, the answer to "I'm an agency. Do you offer custom pricing?" now says no: I charge everyone the prices and site limits on the cards, Foundry covers up to 127 Licensing installations, and if you need a copy of your receipt, you open a ticket and choose Sales. It no longer mentions invoicing or a master services agreement.
- In the plugin you run, this release changes one heading your customers see, one paragraph of this readme, the translation template and the version number. Everything else is in the file that renders the Bodholdt Labs storefront, which is not part of the plugin you receive, so it is here for the record.
- The customer portal's heading now reads My Account instead of Manage Subscription, because the same page serves one-time and lifetime buyers, who have no subscription to manage. If your store uses a translation, the new heading shows in English until your translation adds it. If the plugin created your portal page, that page's title still reads Manage Subscription; rename it under Pages if you want the two to match.
- This readme's description now says that the plugin you buy runs a seven-day evaluation from its first activation, with every feature unlocked. It used to say "no key or card", which could read as a way to try Bodholdt Licensing without buying it.
- On the storefront, every paid card now carries its terms right under its Buy button: the 14-day money-back guarantee and, for monthly and annual plans, that you can cancel anytime from the customer portal and keep access to the end of the period you paid for. The cancel sentence hides while Lifetime is selected, because a lifetime purchase has nothing to cancel.
- The plans on each paid product's pages now say what happens if a license ends, in that product's own terms. The backup pages instead advise keeping a copy of the plugin's ZIP off your server and downloading a fresh one after each update, because your backups leave the plugin out on purpose, so a restore on a new server starts by installing it. The buying page's answer about backups now says the same.
- The prices now say that they are in US dollars and do not include tax, and that any sales tax, VAT or GST that applies is added at checkout. The line shows only while checkout really does add that tax.
- The answer to "What counts as a site?" now says why the largest plan stops at 127 sites: a license record stores its site count in a small number field whose largest value is 127.
- Bodholdt Contact, which is free, now has its own section after the paid products on the buying page, with a card that links to the free edition on its product page.
- The backup feature tables have one column, so their links now say what they show: "See what the free backup plugins include" on the buying page and "See what the free edition includes" on the backup pages.
- The Bodholdt Licensing and Bodholdt Tickets sections of the buying page now have fixed addresses, /buy-plugins/#clspp-licensing and /buy-plugins/#clspp-tickets, so a link can go straight to them, and a section reached that way no longer hides its heading under the menu bar.
- Smaller fixes: a paid card shows its annual price even before the page's script runs; screen readers no longer read out the tick before every bullet; the cards now spell out the abbreviations SDK, MRR, CSAT, IOSS, CRM, FK and BLOB; the line under the last Buy buttons now ends by saying that annual plans are billed once a year; and some notes meant for developers no longer appear in the page source.
- Nothing in the plugin you run changes in this release apart from its version number, this changelog and one line of its translation template: translation bug reports now point to https://bodholdtlabs.com/support/ instead of a WordPress.org forum this plugin has never had. Everything else is in the file that renders the Bodholdt Labs storefront, which is not part of the plugin you receive, so it is here for the record.
- What changed there, starting with the Bodholdt Licensing plans: the "Keep 100%" badge and the matching bullet came off Foundry, because they made something true of every plan look like a Foundry extra. The section now says, for every plan, that I take no cut of your sales and that your payment processor's normal fees still apply, and it says what a Bodholdt Licensing key does and what Studio and Foundry add.
- The "Most popular" badge is gone from the Bodholdt Tickets plans, because no sales figure stood behind it. The Bodholdt Tickets section now says what any paid plan adds, and its description no longer leads with license-aware tickets, which only the paid plans have.
- The Bodholdt Atelier section now says what a license adds. Its card says "What a license gets you:" instead of "The same features, plus:", and the 127-site allowance is stated as a limit instead of listed as something a license adds. The free Bodholdt Atelier edition is called Free, like the other free editions, rather than Free Lite, and its card and the comparison table both say every work type, because the free edition carries all of them.
- Buttons on the storefront say what they do. The free-edition buttons read "See the free edition", because they take you to the free edition on its product page rather than start a download, and the Bodholdt Backup Pro button says Buy like the others. The Bodholdt Backup Pro card also says that it works with both backup plugins at once and that its email support is for Bodholdt Backup Pro.
- The Annual, Monthly and Lifetime switch on the buying page now sits in the Bodholdt Backup Pro section, the first with paid plans, instead of above two free cards it cannot change. The Bodholdt Backup for Google Drive and Bodholdt Backup for OneDrive landing pages, which have only a free card, no longer show it at all.
- The lifetime answer on the buying page now says what happens if I discontinue a product in the normal way: I aim to announce it at least 12 months ahead and give lifetime customers a free license for the closest equivalent successor product.
- Three lines on the storefront were wrong and are now right. The free cards for Bodholdt Backup for Google Drive and Bodholdt Backup for OneDrive no longer end with "no telemetry", because each free build's update check sends the site's address. The Bodholdt Licensing trial answer on the buying page no longer says "no key or card", which could read as a way to try Bodholdt Licensing without buying it; it now says that the plugin you buy runs for seven days from its first activation, with every feature unlocked, before it needs a key. And Bodholdt Backup for OneDrive is now called a sister plugin to Bodholdt Backup for Google Drive instead of the same backup engine, because the two no longer work identically.
- New: software distribution. You can now distribute desktop apps from your store, not only WordPress plugins. Add a product under Software, give it the app's public signing key, and publish releases with one file per platform. The plugin serves update feeds that Sparkle (macOS) and WinSparkle (Windows) read, plus a JSON feed, and a download button shortcode.
- Every file's signature is checked against the product's key when it is attached and again when the release is published, so a feed never points at a file that installed apps would refuse. Published files are never replaced, the build number must rise with every release, and a file that an earlier release already carried cannot be published again under a new version.
- Signed feeds: a product can require its feeds to be signed on your build machine with Sparkle's sign_update. The plugin checks the signature and that the signed feed says exactly what it rendered, and keeps serving the previous signed feed until then.
- A critical release stays critical in every later release's feed entry, so someone several versions behind cannot skip a security fix. Security advisories reach installed apps before a fix exists, and leave the feed once one is published.
- Remove a release from the feeds while its files stay downloadable, or withdraw a compromised build so its files are refused.
- Location rules per product, from a country source you choose (a variable your web server sets, or Cloudflare with a secret header). Every unknown case refuses, and anything that widens access is a wp-config constant, never a setting.
- Download counts per day and version, with nothing about the person downloading stored anywhere. Each product shows its own numbers in every edition.
- Files are kept in a private folder outside the web root, re-checked every day, and sent by PHP, or by nginx once a built-in test downloads a file from outside and confirms the headers and that the folder cannot be reached directly.
- Build machines can publish through the REST API with an Application Password for an account that holds only the new Software publisher role. An administrator's Application Password is refused there.
- Software products do not count toward your plan's product limit.
- A backup now records where this site keeps its folders, and a restore puts them back there. If your plugins, must-use plugins, uploads, themes or translations are loaded from somewhere other than where WordPress puts them by default, the backup writes that down and a restore returns the files to that same place. Until now the backup filed those files under the standard location, so restoring them could write them where WordPress does not read them, and take away what was really there. On a site whose folders are where WordPress puts them, nothing changes at all: the backup holds the same files under the same names it always has.
- A site that has moved its plugins folder no longer backs up the backup plugin itself. Both backup plugins are meant to be left out of every archive, because a restore writes back everything the archive holds and would write over the plugin while it was running. That exclusion was worked out from the standard plugins location, so on a site that keeps its plugins anywhere else it matched nothing and the plugins were archived after all. This also covers the case where WP_PLUGIN_DIR points to a folder inside the usual one, which was never handled correctly. Sites with their plugins folder in the usual place were not affected.
- A folder left behind at the old standard location is named rather than quietly skipped. When a folder has been moved, anything still sitting at the place it used to be is not part of the backup. The run now says so and names the folder, so an archive that holds nothing for it is never mistaken for a folder that holds nothing.
- A backup that could not be restored is refused before it is uploaded. If the record of where a folder lives disagrees with what the backup actually holds, the run stops, says so, and changes nothing on this site. A backup like that would look complete and would remove files when restored, so stopping costs you one upload and the alternative costs somebody their files.
- A backup taken on a site that keeps one of those folders outside wp-content can only be restored by version 6.55.0 or later. A site that merely points a folder somewhere else INSIDE wp-content is not affected: its backups record nothing new and every older version reads them exactly as before. Older copies of the plugin stop before changing anything, which is the safe outcome, but they do not explain themselves well. Version 6.54.x names both folders and suggests editing wp-config.php to match the backup, which is the wrong advice when you are restoring onto the site that made the backup: update the plugin instead. Anything older stops with a short message and a support reference, which reads like a damaged backup and is not one. The backup is sound. Backups taken on sites whose folders are in the usual places are not affected, and older versions still read them exactly as before.
- The first backup after updating is a full one. Where this site keeps its folders is now part of what the plugin checks before it continues an incremental backup, and no earlier backup recorded it. Backups after that one are incremental again as usual.
- A backup that cannot confirm its Google Drive folder now says why. That check runs before anything is archived, and if it fails the whole run stops. Until now it recorded only that it had stopped, so a run that ended because the connection stalled looked exactly like one that ended because Google refused the request. The run now writes one line to your server error log naming which of the two it was, and for a connection failure it names the kind: timed out, could not be resolved, refused, or a certificate problem. Where Google refuses and gives a reason, that reason is named too, so being asked to slow down is no longer mistaken for a permission that needs fixing.
- Every failed run now records its error code in the activity log. The code was already worked out, and it already went out with the failure email. The log row was the one place it was dropped, so a failure that carried no category arrived with nothing but how long it had run.
- Nothing about what is backed up, what is uploaded, or when a run stops has changed. The refusal happens at the same point, for the same reasons, and says the same thing to you. Google's own error text is never written down: it is reduced to a code and a short reference that lets one night be compared with another, so nothing from the provider is stored.
- A saved backup folder that is no longer a folder now says so in the log. OneDrive is checked two ways: by path, and by the identifier saved when the folder was first created. Both refuse to continue if what they find is not a folder, because carrying on would write a backup somewhere it could not be read back from. The check by path wrote a line saying so. The check by identifier, which is the one an established install follows, refused in silence. It writes the same kind of line now, worded so the two cannot be confused. What the run does, what it refuses, and what it tells you on screen are all unchanged.
- Every failed run now records its error code in the activity log. The code was already worked out, and it already went out with the failure email. The log row was the one place it was dropped, so a failure that carried no category arrived with nothing but how long it had run. Both backup plugins write to the same log table, so until now a Google Drive failure could be identified from its row and a OneDrive failure could not. Both can now.
- Nothing else changes. What is backed up, what is uploaded, when a run stops, and what it tells you are all exactly as before. The code is recorded rather than shown, so no screen changes and no wording changes.
- Groundwork, with no change to what a backup contains or where a restore writes. The restore path used to work out where themes, plugins, must-use plugins, uploads and translations live by rebuilding those paths by hand in six separate places. Nothing checked that the six agreed, and they governed different things: what a restore deletes, what it snapshots first, what it checks it can write to, and where it stops tidying up empty folders. They now read one answer. On every site the answer is exactly what those six lists produced before, and this release is verified to make no other difference.
- This edition can now read a backup that records where its folders were. Nothing writes one yet. Shipping the reader on its own, ahead of the writer, means that by the time such a backup can exist, installs are already able to read it. A backup of that kind taken by a future release is refused, safely and before anything is changed, by every version older than this one.
- A restore onto a site laid out differently from the backup is refused by name. If a future backup records its plugins folder somewhere this site does not load plugins from, the restore stops before touching anything and names the setting to change. Restoring it anyway would write the files where WordPress would not read them, and delete what is there now.
- Deleting the plugin could interrupt a running backup or restore on hosts that set WP_TEMP_DIR. The plugin writes its staging folders and its operation locks under WordPress's own temporary directory, which honours that constant. The uninstaller looked under the system temporary directory instead. Where the two differ, the busy check that is supposed to stop Delete while a backup or restore is in flight looked in the wrong place, found no lock, and reported the plugin idle. On the same hosts, staging holding a full database export was left behind after Delete. Uninstall now resolves the directory exactly as the plugin does, a regression test proves the two can never part again, and cleanup also sweeps the old location so anything already orphaned is collected.
- Core directory locations. The wp-includes folder is now read through WordPress's own WPINC constant, the plugins and must-use plugins folders through WP_PLUGIN_DIR and WPMU_PLUGIN_DIR, and the plugin's own folder through plugin_dir_path(). Twenty-nine defensive checks for constants WordPress always defines before a plugin loads have been removed, along with the hardcoded folder names they fell back to. What a backup reads and the names it records inside the archive are unchanged, and existing backups are unaffected.
- Deleting the plugin could interrupt a running backup or restore on hosts that set WP_TEMP_DIR. The plugin writes its staging folders and its operation locks under WordPress's own temporary directory, which honours that constant. The uninstaller looked under the system temporary directory instead. Where the two differ, the busy check that is supposed to stop Delete while a backup or restore is in flight looked in the wrong place, found no lock, and reported the plugin idle. On the same hosts, staging holding a full database export was left behind after Delete. Uninstall now resolves the directory exactly as the plugin does, a regression test proves the two can never part again, and cleanup also sweeps the old location so anything already orphaned is collected.
- Core directory locations. The wp-includes folder is now read through WordPress's own WPINC constant, the plugins and must-use plugins folders through WP_PLUGIN_DIR and WPMU_PLUGIN_DIR, and the plugin's own folder through plugin_dir_path(). Twenty-nine defensive checks for constants WordPress always defines before a plugin loads have been removed, along with the hardcoded folder names they fell back to. What a backup reads and the names it records inside the archive are unchanged, and existing backups are unaffected.
- The readme described a paid backup edition that does not exist, and a free one from WordPress.org that is not there either. Both backup plugins are free and come from bodholdtlabs.com, and the companion works the same with either one or with both at once. A FAQ answering "I have the paid backup edition with alerts built in" has gone with it, because nobody can be in that situation.
- The Manage Account link in the license screen now points at the address that answers directly, instead of one that redirects first.
- Two notices counted down to something that never happens. If a license could not be confirmed, the plugin said the features it unlocks would keep working for so many more days, which reads as a warning that they will then stop. They will not. Every feature in this plugin works on every install whether or not a license is active, and it always has. What a license actually carries is email support and a site allowance, so that is what the notices now count down to.
- The readme in this download described a paid edition that does not exist. It said a license adds commissions, patron subscriptions, the Foundry, the marketplace, the Lightroom pipeline, priority support and managed updates. Six of those seven are in the edition you already have, and the seventh, priority support, was retired everywhere on the same day this was written, because nothing ever delivered it. Nothing about the plugin changes here. It only stops describing itself wrongly. What a license actually adds is email support from the developer while it is active, and a site allowance of up to 127 activations.
- Wording only. Seven notices and hints used a dash where a full stop or a comma belongs. House style here is plain sentences, and a dash standing in for punctuation is the one thing our own writing rules single out. Nothing about behaviour changes. Dashes that stand in for "no value yet" in a table cell or an empty dropdown are left exactly as they are, because there they are not punctuation.
- The changelog now reads like a changelog. Several entries from August described release machinery rather than the plugin: package validators, audit receipts, hash-bound tool inputs and publishing gates. None of it is anything you can see or use, and it was sitting on the product page and the site changelog where people decide whether to install. Removed rather than reworded, because there is no reader-facing version of most of it. Everything describing an actual change to the plugin is untouched.
- One of those bullets also claimed the translation template pointed at our support address. It did not; the file carried the WordPress.org default, which goes nowhere for a plugin that is not hosted there. The claim is withdrawn from the release it was attached to.
- The note about turning the arcade back on pointed at an "Arcade settings" screen that does not exist. It is under Settings, then Bodholdt Contact, in the row headed "Working the Door".
- The full download no longer contains a second readme describing the WordPress.org build, which creates a different set of database tables. Two readmes disagreeing about the same product is confusing on its own; the build now refuses to ship it.
- The Manage account link in the license screen now points at the address that answers directly, instead of one that redirects first.
- The customer portal page now tells browsers and proxies not to store it. It carried no caching instruction at all, while the account pages beside it did, so a signed-in customer's ticket list and their session token could be kept by a shared browser and shown to whoever opened the page next. A page that merely quotes the shortcode in documentation is left alone, because it is not an account page.
- You can now use any Claude model your key has access to, instead of only the three this plugin was built with. The Model setting was a fixed dropdown, and the save handler refused anything that was not one of those three, so when Anthropic released something newer there was no way to select it: the field quietly fell back to the default and the plugin treated its own age as your mistake. It is now a text field with the same three offered as suggestions, and it accepts any model id. Use Test connection after changing it.
- The model id also used to be written down in seven places across three files, which is how a list like that ends up half updated. It is written down once now, and the shipped suggestions are unchanged in this release.
- An email with no plain-text part became a blank ticket. Inbound email-to-ticket read only the plain-text body a message carries, and mail sent as HTML alone has none, so the ticket was created with nothing in it while the endpoint reported success. The agent alert then said "(no message body)" and the customer receipt quoted nothing back, which reads at both ends like the desk lost the message. The HTML part is now used when there is no text part, converted to readable text so a message looks the same however it was sent.
- The readme fix in 6.53.1 landed in the wrong file. These plugins ship one edition, the free one, and its readme is built from readme-wporg.txt. That file still carried every sentence the 6.53.1 entry said had gone: a verify button on every backup row, a one-click full restore, and log status pills reading success, error and running. So the note describing the correction shipped without the correction. The Screenshots section you are reading now matches what the plugin actually shows.
- The Screenshots list in this readme described a few screens that are no longer here. The Logs page has counted chips for complete, error and warning rather than a filter and sort pair, and there was never a "running" or "success" status in the log itself. The backup list shows verify only where an archive can actually be checked. And the restore section now says the two things that matter most: you choose exactly what comes back, and there is no undo. Nothing about the plugin changed in this release. It only stops describing itself wrongly.
Bodholdt Backup for Google Drive
v6.53.0
- The check that asks your own site whether it came back up is now careful about who it will trust. After a restore, and again before your first backup, this plugin asks your own site for one page and reads nothing but the answer code. That request goes to the very address you are being served from, so it has always accepted that address's certificate without checking it, which is what lets the check work on a staging site with a self signed certificate. The list of addresses it asks for can be redirected by a filter, and until now anything the filter supplied was accepted the same way. From this release only the address you are being served from right now is accepted unchecked. Every other address is verified exactly like every other request this plugin makes.
- This still cannot change the outcome of a restore. It never rolls anything back and it never turns a finished restore into a failed one. When it cannot get an answer, for any reason at all, it says nothing rather than guessing. A certificate your server cannot verify is now one of those reasons.
- One thing to know if you use that filter. If you point the check at an address over https whose certificate does not validate on your server, you will get no verdict instead of a wrong one. Point it at an http address, or at a name the certificate is valid for.
- Held in place by tests. All four answers this check can give, healthy, server error, maintenance and no answer, are now pinned for an address on your own site and for one the filter supplied, so this cannot quietly drift back.
Bodholdt Backup for Google Drive
v6.52.4
- The list of requests that never leave your own site was one short. That section said it was complete and named two: cron starting a backup, and the check after a restore. There is a third. Before your first backup, and again each time you start a backup by hand, the plugin asks your own admin screen whether your site can answer itself, which is how the setup check knows to warn you that backups may not start on their own. It has worked that way since 6.50.8, it never leaves your server, and nothing about it has changed. It is now described alongside the other two.
- The wording no longer depends on counting. "Two more requests" is a promise that has to be rechecked by hand every time anything is added, which is exactly how it went out of date. The Privacy section and the External services section now describe every request this plugin makes to your own site, which stays true whatever the number is.
- The note for 6.52.3 counted them too, and no longer does.
- Waking cron is described more accurately. It happens when you start a restore by hand as well as a backup.
- Nothing in the plugin changed. This release is readme wording only.
Bodholdt Backup for Google Drive
v6.52.3
- The privacy wording is now generated from one description of what this copy sends, and where. The Privacy section, the External services section and the FAQ answer about the log table were each written at a different time and had drifted apart from one another. All three now come from the same statement, so a claim cannot be true in one of them and false in another three screens down. Nothing in the plugin changed, and nothing about what it sends changed.
- The Privacy section no longer contradicts itself. It said nothing about your site or its contents ever reaches us, and then, two sentences later, that the update check sends this site's address. Your address is something about your site, so the first half of that was simply wrong. It now names what never goes to us and what does, in the same breath.
- The answer about the log table was wrong, and is now right. It said the backup history rows are never sent anywhere. They are never sent to us and never to anyone else, but a database backup exports every table in your database, so those rows do travel inside `database.sql` to your own Google Drive like every other table. The same answer now also lists the four arcade tables this copy creates, which it had never mentioned at all.
- The update check is described honestly. "About twice a day" was only the twelve hour cache on a good answer; a failure is cached for one hour, so while our server is unreachable the check can ask up to once an hour. "You can switch it off" meant a one line PHP filter and not a setting, and the section now says so. It also now says what happens when you accept an update, and that we count the download.
- Two things that were never written down now are. The requests this plugin makes to Google carry the user agent WordPress itself sets, which names your WordPress version and your site address, so Google sees your address on every backup call. And some requests go to your own site and nowhere else: cron starting a backup, and the check after a restore that asks your own site whether it came back up. Both are described under External services.
- The install step no longer offers a plugin directory listing that does not exist. It tells you to install the file you downloaded from bodholdtlabs.com and keep it, because this is the copy that offers you new versions in your dashboard.
Bodholdt Backup for Google Drive
v6.52.2
- A correction to the release notes, not to the plugin. The note for 6.52.1 was written about the WordPress.org copy of this plugin, and it was wrong about the copy you are holding. It said nothing here had changed, and that this copy updates from WordPress.org. Neither was ever true of it. The corrected note is below, and nothing in the plugin itself changed here.
Bodholdt Backup for Google Drive
v6.52.1
- This copy now says in its own header where it updates from. You downloaded this plugin from bodholdtlabs.com, and it installs into the same folder name a WordPress.org listing would use. WordPress matches an installed plugin to WordPress.org by that folder name, so if these plugins are ever listed there, WordPress could have replaced this copy with the WordPress.org build without anybody asking, and that build carries no update channel of its own. This copy now states in its own header that it updates from bodholdtlabs.com, which is WordPress's own way of saying leave this one where it is. It goes on updating from bodholdtlabs.com, the way it has since 6.52.0, and the check it makes is described under External services above.
Bodholdt Backup for Google Drive
v6.52.0
- The card advertising a paid edition is gone. A small card sat at the top of every screen of this plugin, pointing at a paid edition of it. That edition has been retired, so the card was advertising something nobody can buy. It has been removed and nothing replaced it: there is now no upsell of any kind anywhere in this plugin.
- The description now says what is actually true. One edition, free, no tiers, nothing switched off: full and incremental backups, scheduling, retention, full restore, selective restore, multisite, unlimited sites, and email notifications after every backup whether it succeeded or failed. Nothing on that list will ever move behind a payment.
- The readme fix in 5.50.1 landed in the wrong file. These plugins ship one edition, the free one, and its readme is built from readme-wporg.txt. That file still carried every sentence the 5.50.1 entry said had gone: a verify button on every backup row, a one-click full restore, and log status pills reading success, error and running. So the note describing the correction shipped without the correction. The Screenshots section you are reading now matches what the plugin actually shows.
- The Screenshots list in this readme described a few screens that are no longer here. The Logs page has counted chips for complete, error and warning rather than a filter and sort pair, and there was never a "running" or "success" status in the log itself. The backup list shows verify only where an archive can actually be checked. And the restore section now says the two things that matter most: you choose exactly what comes back, and there is no undo. Nothing about the plugin changed in this release. It only stops describing itself wrongly.
Bodholdt Backup for OneDrive
v5.50.0
- The check that asks your own site whether it came back up is now careful about who it will trust. After a restore, and again before your first backup, this plugin asks your own site for one page and reads nothing but the answer code. That request goes to the very address you are being served from, so it has always accepted that address's certificate without checking it, which is what lets the check work on a staging site with a self signed certificate. The list of addresses it asks for can be redirected by a filter, and until now anything the filter supplied was accepted the same way. From this release only the address you are being served from right now is accepted unchecked. Every other address is verified exactly like every other request this plugin makes.
- This still cannot change the outcome of a restore. It never rolls anything back and it never turns a finished restore into a failed one. When it cannot get an answer, for any reason at all, it says nothing rather than guessing. A certificate your server cannot verify is now one of those reasons.
- One thing to know if you use that filter. If you point the check at an address over https whose certificate does not validate on your server, you will get no verdict instead of a wrong one. Point it at an http address, or at a name the certificate is valid for.
- Held in place by tests. All four answers this check can give, healthy, server error, maintenance and no answer, are now pinned for an address on your own site and for one the filter supplied, so this cannot quietly drift back.
Bodholdt Backup for OneDrive
v5.49.5
- The list of requests that never leave your own site was one short. That section said it was complete and named two: cron starting a backup, and the check after a restore. There is a third. Before your first backup, and again each time you start a backup by hand, the plugin asks your own admin screen whether your site can answer itself, which is how the setup check knows to warn you that backups may not start on their own. It has worked that way since 5.46.10, it never leaves your server, and nothing about it has changed. It is now described alongside the other two.
- The wording no longer depends on counting. "Two more requests" is a promise that has to be rechecked by hand every time anything is added, which is exactly how it went out of date. The Privacy section and the External services section now describe every request this plugin makes to your own site, which stays true whatever the number is.
- The note for 5.49.4 counted them too, and no longer does.
- Waking cron is described more accurately. It happens when you start a restore by hand as well as a backup.
- Nothing in the plugin changed. This release is readme wording only.
Bodholdt Backup for OneDrive
v5.49.4
- The privacy wording is now generated from one description of what this copy sends, and where. The Privacy section, the External services section and the FAQ answer about the log table were each written at a different time and had drifted apart from one another. All three now come from the same statement, so a claim cannot be true in one of them and false in another three screens down. Nothing in the plugin changed, and nothing about what it sends changed.
- The answer about the log table was wrong, and is now right. It said none of the backup history rows are ever sent anywhere. They are never sent to us and never to anyone else, but a database backup exports every table in your database, so those rows do travel inside `database.sql` to your own OneDrive like every other table. The same answer now also lists the four arcade tables this copy creates, which it had never mentioned at all.
- Two sentences in the note for 5.49.3 were wrong about themselves, and are gone. It said the External services section had described the update check in full since 5.49.0. That section did not say what happens when you accept an update until 5.49.3, so it had not described it in full. It also gave a cadence of about twice a day without saying that a failed check is retried far more often than that.
- The update check is described honestly. Twelve hours is the cache on a good answer, so about twice a day; a failure is cached for one hour, so while our server is unreachable the check can ask up to once an hour. "You can switch it off" meant a one line PHP filter and not a setting, and the section now says so. It also now says what happens when you accept an update, and that we count the download.
- The 5.21.0 note below no longer calls the Microsoft calls this plugin's only outbound requests. Some requests go to your own site and were never counted: cron starting a backup, and the check after a restore that asks your own site whether it came back up. Both are now described under External services.
- One more thing that was never written down now is. The requests this plugin makes to Microsoft carry the user agent WordPress itself sets, which names your WordPress version and your site address, so Microsoft sees your address on every backup call.
- The install step no longer offers a plugin directory listing that does not exist. It tells you to install the file you downloaded from bodholdtlabs.com and keep it, because this is the copy that offers you new versions in your dashboard.
Bodholdt Backup for OneDrive
v5.49.3
- Two sentences in these notes were wrong about this copy, and are now right. Nothing in the plugin changed. Under 5.43.2 and 5.21.0 below, this changelog said this copy reports nothing back to us, and that nothing about your site is ever sent to us. Neither was true. This copy was downloaded from bodholdtlabs.com, so it asks one address of ours whether a newer version exists, and that request carries the version it is running and this site's address in its user agent. Both entries now say so, and the External services section above describes the check. What the plugin sends is unchanged in this release, and no site content or backup data ever reaches us.
Bodholdt Backup for OneDrive
v5.49.2
- A correction to the release notes, not to the plugin. The note for 5.49.1 was written about the WordPress.org copy of this plugin, and it was wrong about the copy you are holding. It said nothing here had changed, and that this copy updates from WordPress.org. Neither was ever true of it. The corrected note is below, and nothing in the plugin itself changed here.
Bodholdt Backup for OneDrive
v5.49.1
- This copy now says in its own header where it updates from. You downloaded this plugin from bodholdtlabs.com, and it installs into the same folder name a WordPress.org listing would use. WordPress matches an installed plugin to WordPress.org by that folder name, so if these plugins are ever listed there, WordPress could have replaced this copy with the WordPress.org build without anybody asking, and that build carries no update channel of its own. This copy now states in its own header that it updates from bodholdtlabs.com, which is WordPress's own way of saying leave this one where it is. It goes on updating from bodholdtlabs.com, the way it has since 5.49.0, and the check it makes is described under External services above.
Bodholdt Backup for OneDrive
v5.49.0
- The card advertising a paid edition is gone. A small card sat at the top of every screen of this plugin, pointing at a paid edition of it. That edition has been retired, so the card was advertising something nobody can buy. It has been removed and nothing replaced it: there is now no upsell of any kind anywhere in this plugin.
- The description now says what is actually true. One edition, free, no tiers, nothing switched off: full and incremental backups, scheduling, retention, full restore, selective restore, multisite, unlimited sites, and email notifications after every backup whether it succeeded or failed. Nothing on that list will ever move behind a payment.
Bodholdt Backup for OneDrive
v5.48.2
- A backup that cannot reach OneDrive now ends as a failure, and tells you. If your Microsoft connection had expired or been withdrawn, the backup got as far as signing in and then simply stopped. Nothing was recorded as a failure, no "Backup Failed" email arrived, and the dashboard was left saying "Authenticating with OneDrive..." at 10 per cent until that status aged out an hour later. The run now ends the way every other failure ends, so the log entry, the email, and anything else listening all happen once, and the message names the expired connection and the control that fixes it. A connection you removed on purpose, and a site that has never connected, stay quiet exactly as before, and the dashboard no longer claims a backup is running after one of those.
- A failed backup now carries a one line diagnosis with it. The plugin already works out a short cure for the failures it recognises, such as "Re-authenticate OneDrive in Settings.", and until now only the paid Slack and Discord alerts could see it. That sentence now travels with the failure itself, so anything listening for a failed backup can lead with the cure instead of the raw error text. When there is no honest short answer, such as a brief outage at Microsoft's end, the sentence is deliberately left empty and the full message is always there behind it. What the paid alerts send is unchanged.
- Wording only. When a license has ended, the page that lists it now says that if you need a copy of what you had, you should write in and we will sort it out. It previously pointed you at buying again, which is not an answer to the question somebody in that position is actually asking. Nothing about what a license does or does not allow has changed: an ended license still does not download or update, and the plugins it licensed keep running on your sites, because they are GPL and self-hosted and the copy you installed is yours.
- Your purchase email now says which tier you bought and how many sites the key covers. It named only the product, so a Studio or Foundry buyer had to open the portal to find out what they actually had.
- The billing button on the licenses page no longer does nothing when the page has been open a while. An expired page token made the button silently reload the page with your email wiped and no message at all, which reads exactly like a broken site. It now says the request expired and asks you to try again.
- The "not included" dash in the plan comparison table was too faint to meet the contrast standard. It is now readable, and still visibly dimmer than the text around it.
- The buying page said every plugin ships with a money-back guarantee and email support. Both are true of the paid plugins; the free-only ones have nothing to refund and no license to carry support. GPL licensing, which really is true of all of them, is now its own sentence.
- Translators following the source references in the shipped catalog no longer land on files that are not in the download.
- A one-time purchase no longer receives an email explaining how to cancel a subscription. Every purchase email ended with a Manage Subscription heading and button, whichever way you had paid, so a customer who bought a lifetime license was given cancellation instructions for something they never had. The destination was always right, because that page is where both kinds of customer manage their licenses; only the label was wrong. It now says what the order actually was, worked out from the licenses in the order rather than restated.
- The billing-link form can no longer be used to send repeated emails to somebody else's address. It is a public form that takes any email, and it was capped only by requests per minute per visitor, so one visitor could aim a long run of messages at an address they chose. It is now also capped per recipient, in the same shape the verification-code form has used since 10.18. Both caps answer exactly as a successful request does, so nothing about them reveals whether an address has an account.
- The key-lookup page no longer says a code was sent when it sent nothing. If you asked for a code less than a minute ago, or you have reached the daily limit, it now says exactly that instead of "New code sent! Check your inbox." This mattered most to the person it was worst for: if your license email had not arrived, the order page sends you here to look your keys up, and clicking Resend a few times could leave you told five times that a code was on its way when none was. The Resend button also counts down now rather than letting you ask again into a wall.
- A license that has ended is shown to you instead of being hidden. Before, an expired or cancelled license vanished from the lookup entirely and the page said it could not find any licenses for your email and suggested you check the spelling, which is the wrong thing to tell someone about a purchase they really made. Ended licenses are now listed with the date they ended, marked clearly as no longer active, and with no download button, because they do not download or update. What you can still do is unchanged.
- The Bodholdt Tickets plans now say that licensing-aware customer context needs Bodholdt Licensing installed on the same site. It always did, and the plugin's own readme said so, but the buying page did not.
- Nothing in your install changes in this release either. Like 10.51.3 it touches only the file that renders the Bodholdt Labs storefront, which is not part of the plugin you receive.
- What changed there: the Bodholdt Atelier comparison box told a free-edition reader that email support was not included, and then two lines below told them that bug reports, pre-sales and billing questions are always free. Both were true and together they were confusing. The note now says the whole of it, including that free-edition questions get answered when we can. The row is unchanged, because a license really is what makes support a commitment rather than a courtesy.
- Nothing in your install changes in this release. The only file it touches is the one that renders the Bodholdt Labs storefront, which is not part of the plugin you receive, so this entry is here for the record rather than because there is anything for you to do.
- What changed there: our own top tier no longer claims priority email support, because nothing anywhere ever delivered it. There was no mailbox rule, no queue, no service level and no routing that treated one customer's email differently from another's, so the claim described an intention rather than a behaviour. It is deleted rather than softened, since a gentler version of the same sentence would still say that customers on the tiers below wait longer, and that would have been a new thing to be wrong about. Every paid tier gets email support from the developer while the license is active, which is what our support page has always said and what actually happens.
- The License screen said your license includes one year of updates and support, and that the plugin keeps working after it expires. Both halves were wrong. A one-time purchase does not expire at all, and a monthly plan is not a year. More importantly, this plugin does not keep working: alerts and the digest are what it does, and both stop when a license is inactive. Silence from something whose job is telling you your backups failed is the worst thing it could do quietly, so the screen now says exactly that, and says the part that is genuinely reassuring: your backup plugin is free and keeps backing up either way.
- The License screen still had one sentence contradicting the table right underneath it. 1.10.3 corrected the table to say that updates arrive in your dashboard whether or not you hold a license, and left the paragraph above it saying a license adds them. The paragraph now agrees with the table. What a license adds is email support and a record of your site count.
- The setup checklist said "this build runs a simulated checkout, no keys needed", which was never true of the build. Simulated checkout is where you start, and live Stripe and PayPal are both in every copy. It now says that.
- The unactivated notice said activating "unlocks updates". It does not, and the License screen in the same release says so. It now says what activating actually does.
- Two headings used a dash where a comma or a colon belongs.
- The License screen had two rows that were not true. It said an unlicensed copy gets "updates by manual download", when the free edition has updated itself from your dashboard for some time now, exactly like a licensed one. And it offered "community support", which is a channel we have never actually run. The table now says updates work the same either way, and that what a license adds is email support from the developer. Nothing about what a license does has changed; the screen was describing it wrongly.
- Confetti in the admin now really does start switched off, the way the documentation has always said it does. The setting was never written down when the plugin was activated, so a new site fell back to the checkbox's own default and started with it on. If you already had confetti, you keep it; nothing is switched off underneath you.
- Your account now says what your support actually is. A verified customer sees one plain line about email support whether or not the paid support model is switched on, instead of a support panel that simply vanished when it was off.
- The support-status endpoint no longer hands its checkout links to anonymous callers. The buy details were assembled one line above the check that decides whether the caller is allowed to see them, so any unauthenticated request could read them. They are assembled after that check now.
- A lifetime grant can no longer exceed the ceiling that was already applied to it. This plugin was handed a capped number by Bodholdt Licensing and recomputed its own from scratch, discarding the cap, so a 127-site lifetime tier could issue 762 non-expiring credits. It now takes whichever is smaller. Switching paid support off also stops the grant outright, which it did not do before.
- Asking to grant zero credits now grants zero. It granted one, because the count was clamped to a minimum of one before it was used.
- Wording only, on our own store: the customer portal no longer offers to manage support credits. The credit feature itself is untouched and is still yours to switch on for your own desk.
- The Visit plugin site link on the Plugins screen now goes to this plugin's own product page, at bodholdtlabs.com/software/bodholdt-backup-pro/, which is published as of today. In 1.1.0 it pointed at the product index instead, because this page did not exist yet and the conventional address answered not found. Nothing else changed in this release.
Bodholdt Backup Pro
v1.1.0
- Failure alerts now lead with the cure, not just the refusal. When a backup fails, the backup plugin works out a one line suggestion for what to do about it, and that sentence now travels to your Slack or Discord channel alongside the error. An expired cloud connection says to re-authenticate in Settings, a full cloud says to free up space, and so on. This is the same sentence the paid backup editions have always put in their own alerts, so moving to the free backup plugin plus this companion no longer costs you the diagnosis. Backup plugins older than Bodholdt Backup for Google Drive 6.51.2 or Bodholdt Backup for OneDrive 5.48.2 do not send the sentence, and the alert then reads exactly as it did before, with no empty line and no label with nothing after it.
- The Visit plugin site link on the Plugins screen now goes to a page that exists. It pointed at a product page that has not been published yet, so it answered not found.
Bodholdt Backup Pro
v1.0.1
- The digest no longer calls a site healthy when its newest verified backup is far older than the schedule you chose. A site can hold a saved daily schedule, show a next run on the clock, and still not have produced a backup in days, because the runs are failing or because nothing is triggering scheduled tasks. The digest now compares the newest verified backup against your own schedule, allows one missed run, and then says so plainly and marks the digest as needing attention. When the backup plugin's own stale-backup watchdog is already raised, the digest leaves that sentence to it instead of saying the same thing twice.
Bodholdt Backup Pro
v1.0.0
- First release. Everything below is new, because there is no earlier release to compare it to. The 0.9.0 builds mentioned in our development notes were never published and were never installable by anyone outside Bodholdt Labs.
- Slack and Discord alerts for the five lifecycle events both backup plugins announce: a backup completed and verified, a backup failed, a restore was started, backups have gone stale, and pre-flight found something that would block the next run. Success and failure alerts are on by default and every event has its own toggle.
- Every alert is capped by a short timeout and is sent after the backup's outcome has already been recorded, so a slow or broken webhook can never fail, delay, or change a backup or a restore.
- The settings screen shows one plain line per channel with the result and the time of the most recent delivery, including manual tests, so a webhook that has quietly stopped working says so instead of going silent.
- Backup-health digest, off or weekly or daily, to an inbox, to Slack or Discord, or to both. It reads the backup plugin's own records rather than only the events this companion has witnessed, so a site that was backing up long before you installed the companion is described accurately in the first digest. It reports the schedule your backups are really on, whether a run is actually armed, how fresh the last verified backup is, the stale-backup watchdog, the cloud connection, and the runs, errors, and warnings in the period. The subject line says whether anything needs a person.
- Works with either backup plugin or both at once.
- Nothing in this plugin sends data to Bodholdt Labs except activating or validating your license key and checking for updates. Your webhook URLs, alert payloads, and digest emails go straight from your site to your own Slack, Discord, or inbox. No third-party scripts, no cookies.
- One number, everywhere. The License screen's summary said a license adds "an unlimited site allowance", while the table directly beneath it, the storefront and the update notice all said up to 127 activations. 127 is the real figure and always has been: a license record stores the site allowance as a signed tinyint, so 127 is this plugin's unlimited rather than a placeholder. The summary now says it too, and the 1.10.1 and 1.10.0 notes below have been corrected for the same reason. Nothing about what a license does has changed.
Bodholdt Atelier
v1.10.1
- The admin screens caught up with the change. The License screen still showed a three-row plan table naming Solo, Pro and Agency with 5, 10 and 25 seats, and four screens could still say a feature was "available on Atelier Pro and above". None of it was reachable, because nothing is gated any more, but it was still there to read. The License screen now describes what a license actually adds: automatic updates, email support, and a site allowance of up to 127 activations.
Bodholdt Atelier
v1.10.0
- Atelier is one product now. The Solo, Pro and Agency tiers are retired. Everything the plugin can do is in every copy of it: patron subscriptions with content drip, commissions with milestone payments and booking, the multi-artist Foundry with Stripe Connect payouts, the cross-artist Marketplace, and the Publish API with its Adobe Lightroom plugin. A license buys automatic updates in your dashboard, support, and a site allowance of up to 127 activations. It does not buy a feature.
- Why. The free edition already shipped an all-open licensing stub, while a paid base-tier license locked the Foundry, the Marketplace and the Lightroom publish API. Paying made the product worse than not paying. Agency, meanwhile, added no feature over Pro at all. Rather than keep a ladder that ran the wrong way, the ladder is gone.
- Nothing is taken away. If you hold a license of any tier, you keep everything you had and gain whatever your old tier withheld. Your site allowance is now up to 127 activations.
Bodholdt Atelier
v1.9.8
- Plainer writing in the storefront and the work editor. Checkout messages, the maker's proof captions and every field label used long dashes where a full stop or a colon reads more easily.
Bodholdt Atelier
v1.9.7
- Plainer writing. A few messages used long dashes where a full stop or a separator reads more easily. Nothing functional changed.
Bodholdt Atelier
v1.9.6
- Plainer writing. The description, the feature list and the FAQ answers used long dashes where a colon, a comma or a full stop reads more easily. Nothing about the plugin changed, only how it is described.
Bodholdt Atelier
v1.9.5
- The docs your readme cites are now in your download. The build excluded `docs/TESTING.md` and `docs/PAYMENTS.md` while this readme pointed you at both. Both ship again, and a build-time guard refuses to package an archive whose readme cites a file that is not in it.
- Editions are named before you buy. The feature list and the FAQ now say which edition carries commissions and patron subscriptions (Atelier Solo and up) and which carries the multi-artist Foundry, the cross-artist Marketplace, and the Lightroom publish API (Atelier Pro and up), instead of answering an unqualified yes.
- `docs/PAYMENTS.md` opens by saying what your edition includes, and its menu paths and quoted confirmation screens match what the plugin actually shows.
- The Door Report no longer looks broken before it has anything to report. On the first open after you turn on Working the Door, all four counters were zero, and the display font draws a zero with a diagonal bar through it, which reads as the browser's broken-image icon. A panel that has not counted anything now says so in a sentence, and once real counts exist the big numerals come back. A single zero sitting among real counts is drawn in the plain admin font instead.
- You can now see the bot trap working. The contact form has always hidden a trap field that only automated senders fill in, but nothing ever showed you it was doing anything unless you had switched the activity report on. The settings status card now carries a line for it, and there is a matching entry under Tools, Site Health. It counts trap trips over the last 7 days and says nothing more than that, because a sender turned away earlier by the request checks never reaches the trap and cannot be counted.
- The verification email says who it is from. The subject was "Your site name: verification code" and is now "Your {site name} verification code", so it reads as a sentence and is easier to find in a crowded inbox. Your site name, or the brand you set in the plugin, is what appears.
Bodholdt Contact
v5.2.12
- The widget stops offering categories that need a support ticket, and stops quietly turning one into an email. When Bodholdt Tickets is installed with its paid support model switched on, the widget used to mirror every category, including the ones that cost a credit. If someone picked one, the ticket engine refused, this plugin threw the reason away, sent the message to you as plain email instead, and told the visitor it had been sent. So the same question was paid on one page and free on another, and you got it as mail with no ticket to track. The widget now leaves those categories out, and in the rare case one is submitted anyway, the visitor is told plainly to open it on the Support page instead of being quietly rerouted.
Bodholdt Contact
v5.2.11
- The readme now describes the one request this plugin makes. The External services section said the plugin made no external requests and had no update checker. It has had an update checker since 5.2.6, and that section was never updated. It now says exactly what the check asks for, what it sends (the plugin version and your site address, and nothing else), how long each answer is cached, and how to switch it off.
- The update check now has an off switch. Add `add_filter( 'bodholdt_contact_update_check_enabled', '__return_false' );` and the plugin makes no outside requests at all.
- Uninstall now removes the update-check cache it had been leaving behind.
Bodholdt Contact
v5.2.10
- The arcade is fully translatable now, and its toasts can be dismissed. Several labels the arcade shows (the dismiss button, the "Nice" message on a plain points toast, and the level badge) stayed in English no matter what language your site runs in, because the shared arcade code never passed them through for translation. They now translate like everything else, the level number is formatted for your locale, and every celebration has a close button. Toasts also pause while you hover or focus them, and skip their timer entirely if you have asked your system to reduce motion.
- A site that cannot create the arcade tables now keeps trying. On a host where the database user is not allowed to create tables, the plugin recorded the arcade as installed anyway and never tried again, so the arcade stayed silently broken forever. It now confirms the tables really exist before recording success, and retries later if they do not.
Bodholdt Contact
v5.2.9
- The arcade settings box now matches the arcade. Since 5.2.8 the arcade has been off on a fresh install, but the checkbox on the Settings screen still drew itself as switched on, and saving your settings for any reason turned the arcade on for real. The box now shows the truth, and saving your settings leaves the arcade exactly as you found it. If you had turned it on yourself, it stays on.
Bodholdt Contact
v5.2.8
- Gamification is now off by default. The arcade (XP, ranks, the HUD, and confetti) starts off. Turn it on any time under Settings, then Bodholdt Contact, in the row headed "Working the Door". Nothing else changes.
Bodholdt Contact
v5.2.7
- American spellings throughout. The plugin and this changelog used British spellings in places (licence, colour, behaviour, cancelled). They now match the rest of Bodholdt Labs. Wording only, nothing behaves differently.
- Tested with WordPress 7.1.
- The arcade panel now filters the markup it draws through an allowlist instead of printing it as given. Nothing about how it looks or behaves changes, and the progress bar keeps the labels a screen reader reads out. The small script behind the milestone popups was tightened the same way.
- Ticket attachments are now encrypted on disk. Attachments live in your uploads folder, and whether that folder can be read directly over the web is decided by your web server, not by this plugin: Apache and LiteSpeed honour the rule the plugin writes, nginx and Caddy do not. Encrypting the files means a direct request returns unreadable data, so the support desk, which checks whether you are an agent or the customer who owns the ticket, is the only way to the file again. Existing attachments are converted quietly in the background, and files from before this release keep working either way. A new entry under Tools, Site Health tells you whether your server exposes the folder.
- Attachment filenames now come from a cryptographic random source. They were generated with a WordPress helper that other plugins are allowed to filter, which meant another plugin could decide how unguessable your attachment names were. Stored files are also written with tighter permissions.
- Plainer writing. A few messages used long dashes where a full stop or a separator reads more easily. Nothing functional changed.
- The free contact widget no longer offers the categories that cost a support credit. If you have turned the paid support model on, a question about one of your products was a tracked ticket on the Support page and a free message one click away on the same page. The widget now asks Tickets which categories are credited and simply leaves those out, so each door offers what it is for. Nothing changes if you have not turned the paid model on, because then nothing is credited.
- There is now a plain list of every ticket inside WordPress admin. The Support Desk is an app, and when an app fails it takes the whole queue with it. That is exactly what happened when the desk stopped loading on sites using Plain permalinks: for as long as it lasted there was no other way to see a single ticket. Under Tickets you will now find All Tickets, a straightforward table of every ticket with its status, the customer and their email address, which filters, searches and pages. WordPress builds it directly, with no JavaScript of its own, so it keeps working when the desk does not and it works with JavaScript switched off. It is read only on purpose. It is there so you can see the queue and answer people from your own mail, not to become a second desk. Your agents can open it too, not just administrators.
- The desk no longer names the wrong plan beside a locked report. Per-agent and per-department reporting unlocks on the first paid plan, but the reports screen said Studio: in the badge, on the button, and in three separate sentences. Anyone who saw those sections was being pointed at a plan more expensive than the feature actually needs. The plan name now comes from the same place as the check that unlocks the feature, so the two cannot drift apart again.
- Everything the desk and the forms say can now be translated. The plugin's JavaScript asks WordPress for translations exactly as its PHP does, but the translation catalog was built by scanning PHP only, so not one of those strings was ever offered to a translator. A fully translated site still showed the Support Desk, the customer portal, the support form and the widget in English, with no way to tell why. The catalog now includes them: 331 more strings, the desk among them. Nothing changed in the code that shows them, so an untranslated site looks exactly as it did.
- This plugin can now update itself. Until today it had no update client at all, so a new version, including a security fix, only reached you if you happened to visit the site and reinstall by hand. Bodholdt Contact now checks for a newer version and offers it on your Plugins screen like any other plugin. It carries no license key and sends none: the check asks a public address for the current version number, and the download is the same public link a person would click.
- The contact card now takes keyboard focus when it opens. The card is hidden behind a short fade, and focus was being moved into it before that fade had started, so the browser discarded it and focus stayed on the button behind the card. Anyone using a keyboard or a screen reader landed outside a dialog that announces itself as modal, and pressing Tab walked into the page behind instead of moving through the form. Focus now waits for the card to be on screen, which also restores the Tab trap that keeps you inside the form until you close it.
- Failed-code accounting is proven or unavailable. The OTP repository validates the exact database write, follow-up row, counter, state, and database error before returning a remaining-attempt count. Storage uncertainty returns a visible 503 without an invented attempt budget, while a concurrent fifth failure returns the proven locked count.
- Legacy IPv6 rate rows have a complete transition. Before the 5.2.4 database marker can advance, the bounded upgrade deletes every Contact-owned pre-canonical ephemeral rate row and verifies the table is empty. New collection, export, and erasure use one canonical `inet_pton()`/`inet_ntop()` representation for every equivalent IPv6 spelling.
- Identifier matching is canonical end to end. Collection, export, and erasure share one validated lowercase email normalizer. Source addresses use `inet_pton()`/`inet_ntop()` at collection and lookup, with a bounded compatibility set for still-active pre-5.2.3 IPv6 HMAC rows.
- Rate-limit storage faults fail closed. The deciding counter read and its write accept only exact database result types and reject false, null, non-integer, negative, or last-error states with a visible storage-unavailable response.
- Diagnostics cannot retain subject data. Mail health stores only allowlisted context/status timestamps for at most seven days, and an upgrade removes the older arbitrary-error field. Debug logs accept only request-independent event codes; ticket IDs, challenge IDs, addresses, inputs, and exception text are not accepted by the logger.
- Cookie wording matches runtime. The inventory now distinguishes the JavaScript-unreadable HttpOnly cookie from flow values returned in same-origin JSON to the widget.
This page shows the 15 most recent releases for each plugin. Each plugin's own page carries the release history of the edition you can download today.