Champlin Pre-Flight Audit

1.0.7

• Plugin review compliance. Managed-host detection no longer assumes a hardcoded server filesystem layout — Plesk is now detected from the DOCUMENT_ROOT/SERVER_SOFTWARE environment signals and the control-panel install directory instead of matching ABSPATH against a fixed vhost path. No functional change: the same hosts are detected, and detection stays open_basedir-safe. Contributors list corrected to the plugin’s WordPress.org account. The legacy-migration success notice now signals via a transient set by the nonce-verified migrate action instead of a URL parameter, resolving the Plugin Check nonce-verification warnings (and making the notice reliably display).

1.0.6

• WordPress.org submission readiness. All Plugin Check ERRORs and most WARNINGs resolved: short PHP tags converted, direct filesystem operations refactored to use WP_Filesystem, $_POST/$_SERVER inputs unslashed before sanitization, readme tags trimmed to 5, build script now excludes hidden files. No functional changes — same audit, same autofixes, same snapshot safety net. Ready for the WP.org plugin directory review.

1.0.5

• Distribution improvements. The self-hosted GitHub variant gained automated release delivery; the WordPress.org distribution uses WordPress.org’s native plugin-update channel.

1.0.4

• Fix: Plesk detection now works under open_basedir restrictions. v1.0.2’s is_dir(/usr/local/psa) check silently failed when the vhost’s open_basedir excluded /usr/local/psa/. New detection uses ABSPATH (/var/www/vhosts/...), DOCUMENT_ROOT, and SERVER_SOFTWARE signals — all open_basedir-safe.
• Grading curve relief during major-release week. Within 14 days of a WordPress major release, plugins and themes still tested against the immediately-prior major (6.9 when current is 7.0) are downgraded from WARN to INFO and excluded from the score. Vendors typically catch up within this window; penalizing every site on day one was unfair. Auto-expires 14 days after the release date.
• Accept-as-known-risk override mechanism. Each warn/fail finding now has an “Accept as known risk” link. Click to acknowledge — the finding still appears in the report (with an “Accepted risk” tag) but is excluded from the readiness score calculation. Real enterprise audit pattern, fully reversible via “Un-accept” button.

1.0.3

• Fix: Re-run audit spinner appearing on page load and never stopping. The v1.0.1 spinner icon used the HTML hidden attribute to start hidden, but the plugin’s .wp7rc-btn__icon class set display: inline-block which silently overrode [hidden]. The spin animation then ran constantly. Added an explicit [hidden] CSS override so the spinner stays hidden until the button is clicked.

1.0.2

• Fix: Custom-code scan no longer false-positives on common vendor plugins. The previous scope included Advanced Custom Fields, WPGraphQL, Two-Factor, page builders, and other widely-installed plugins that ship their own WordPress 7.0 compatibility updates. Flagging their internal code as if it were user-owned created noise. The vendor-skip list now covers 30+ common plugin slugs across page builders, SEO, ACF, GraphQL/headless, security, cache, forms, translation, and backup.
• Fix: Backup-plugin check now detects managed-host snapshot systems. Previously warned even on Plesk / WP Engine / Kinsta / Pantheon / Pressable / SiteGround / Flywheel / GoDaddy Managed WordPress / cPanel / DreamHost installs where host-level backups are the standard. The check now detects 10 managed-host platforms and reports PASS with “host-level snapshots assumed” instead.