Custom Login Page Customizer

2.3.0

• Security: Hardened custom-CSS sanitization. Dangerous directives (@import, javascript:, expression(), behavior:, -moz-binding:, data: URIs) were previously stripped in a single pass, so a nested payload could reassemble itself into a working token. Filtering now repeats until the value stops changing.
• Security: The review-notice AJAX handler now performs a capability check, and its dismissal is stored per user instead of in a shared site-wide option.
• Security: Added direct-access guards to the files that were missing them.
• Security: CSS values are now escaped with a CSS-aware filter at print time instead of esc_attr(), which offered no protection inside a element while corrupting quoted values such as font stacks.
• Security: Login page title is filtered through kses, closing a possible breakout via the unescaped element.
• Fix: The “Hide privacy policy link” option no longer registers its filter on every request, so it can no longer affect the privacy policy link on the front end.
• Fix: Corrected double-escaped login text. Labels that WordPress already escapes (Log In, Register and Get New Password buttons, Remember Me) were escaped a second time, so an ampersand or apostrophe rendered as & or '.
• Fix: The “Back to site text” setting works again. WordPress 5.7 renamed the underlying string from “Back to %s” to “Go to %s”; both are now matched.
• Fix: Uninstall now removes the options and transients the plugin actually creates (including the admin menu location preference), no longer iterates every user on the site, and no longer flushes the entire object cache.
• New: Modern CSS support in colour and dimension fields — hsl(), 4- and 8-digit hex, space-separated rgb(0 0 0 / 50%), var(), color-mix(), calc(), clamp(), min(), max() and the dvh/svh/lvh/ch viewport units.
• Performance: The static base stylesheet is now a real, browser-cacheable file instead of being inlined on every login page view.
• Performance: Settings and the selector map are only loaded on the login page and in the Customizer preview, rather than on every front-end, admin and AJAX request.
• Performance: Removed ~1,250 lines of unused code (the jQuery minicolors library and four superseded Customizer controls) and their orphaned stylesheets.
• Fix: The “requires PHP 8.0” notice can now actually appear. The bootstrap file used PHP 7.1+ return types, and PHP parses a whole file before running it, so on an older PHP the plugin died with a parse error instead of explaining itself.
• i18n: The Customizer preview now reuses WordPress core’s own translations for the login form labels it copies from wp-login.php, so the preview matches the real login page in every locale instead of depending on those core strings being re-translated into this plugin.
• Housekeeping: Removed two unused images (three-column.png, four-column.png).
• Fix: The two-column “form above” and “form below” layouts no longer force a horizontal scrollbar. Running the flex container in column direction while it still inherited flex-wrap made it start a second column once the two rows were taller than the viewport, doubling the page width.
• Fix: Removed a JavaScript error (“_customizePartialRefreshExports is not defined”) from the Customizer preview. The preview template mirrors wp-login.php and never runs wp_head(), so WordPress never printed the selective-refresh data its own script expects.
• Fix: Restored the “Logo Title”, “Login Page Title” and “Form Horizontal Alignment” settings to the defaults list — without an entry there they were silently discarded when importing a settings file.
• Dev: Added a PHPUnit suite covering the sanitization layer and the generated login stylesheet, and replaced Travis CI with GitHub Actions running PHP 8.0 through 8.5.

2.2.1

• Fix: The plugin settings page (with the new export/import, reset and menu-location tools) is now reachable instead of redirecting straight to the Customizer
• Fix: Custom text above the form and the custom footer links/text are no longer hidden behind the background when a custom background image or color is set

2.2.0

• New: “Footer & Links” section — add custom text above the login form and a custom footer below it, add up to 3 custom footer links (Imprint, Privacy, Terms, etc.), and toggles to hide the privacy policy link and the language switcher
• New: Export and import your settings as a JSON file, plus a one-click “Reset to defaults”
• New: Choose where the plugin’s admin menu appears — top level, under Settings, or under Appearance
• New: Login button width control
• New: Background blur and brightness controls
• Enhancement: The login form height is now responsive and grows with its content, and supports “auto”
• Fix: CSS dimension values that already include a unit or keyword (such as 100% or auto) are no longer corrupted

2.1.2

• Fix: Custom logo is no longer lost when switching between templates in the Customizer (#172)
• Fix: Large logos now stay centered on desktop instead of shifting off-center when wider than the form (#70)
• Fix: The login page language switcher now appears centered below the form instead of beside it (#173)

2.1.1

• Security: Hardened output escaping across the login page, the admin review notice, and the settings page (esc_url, esc_attr, esc_html, esc_js, wp_kses_post)
• Fix: Corrected legacy logo-settings migration so older installs that used a text logo upgrade to the correct logo display mode
• Enhancement: Plugin styles and scripts are now versioned by the plugin version for reliable cache-busting after updates
• Compatibility: Verified and tested with PHP 8.5
• Compatibility: Tested up to WordPress 7.0
• Code: Brought the codebase to full WordPress Coding Standards (WPCS 3.3) compliance — phpcs reports zero errors and warnings
• Code: Added documentation blocks throughout and switched to timezone-safe date handling in the review notice
• Code: Added PHP 8.4 and 8.5 to the CI test matrix

2.1.0

• New: Added 5 new professionally designed login page templates:
  • Gradient Sunset – Modern vibrant purple-pink gradient with rounded form
  • Dark Professional – Sleek dark theme for corporate/professional sites
  • Glassmorphism – Trendy glass effect with blur and transparency
  • Geometric Bold – Two-column layout with bold amber geometric CSS shapes
  • Minimal Clean – Ultra-minimal design with maximum whitespace
• Fix: Password field width now matches username field width consistently
• Fix: Password visibility toggle (eye icon) properly centered in input field
• Enhancement: All new templates use CSS-only effects (no additional images required)
• Enhancement: Templates work consistently in both Customizer preview and live login page