CryptX

4.2.1

• Fixed with the JavaScript variant switched on, the script is now delivered on every page, not only on pages that themselves carry a protected address. Themes that exchange page content in the browser without rebuilding the document — swup.js and other client-side routers work that way — brought protected links onto the screen for which no click handler had ever been loaded. Those links did nothing at all until the visitor reloaded the page in full. It has been that way since 4.0.12, when delivery was made conditional on the page at hand
• Fixed the same for the stylesheet with “Instead of the address, show” set to one of the picture options: css/cryptx.css is now delivered as soon as a picture variant is configured, so a link that reaches the browser after the page was built is still shown at the right size
• Fixed a single click could open the mail program twice wherever a theme or a loader runs the script a second time on the same document. The guard against attaching the click handler twice is now kept on the document rather than inside the script, which also makes initCryptxLinkHandler(document) work on a second document, as it was always meant to
• if you run a full-page cache, empty it after the update: pages stored before it do not carry the script yet, and they stay broken until the cache turns over by itself

4.2.0

• New on a multisite network, the network administrator can set the defaults a newly created site starts with, under Network Admin / Settings / CryptX. Sites that already exist are never changed — every site keeps its own settings, as it has since 4.1.1. Two settings are deliberately not shareable: excluded post IDs and the uploaded image refer to things that exist on one site only, and copying the first of them is exactly what left addresses unprotected before 4.1.1
• New WP-CLI: wp cryptx settings reads and writes the settings, wp cryptx scan runs the body and the title of every published post through the real filters and reports the ones that still carry a readable address — including addresses in titles, which CryptX cannot protect because a title reaches the page along a path no plugin filter touches. With --url both work per site, so a network can be handled from a shell loop rather than from forty screens
• Fixed changing “Key strengthening” under Advanced silently broke every link that had already been delivered — in every cached page and in every browser tab still open. The number of rounds was read from the page’s configuration at the moment of the click, not from the link, so a link made with the old value could no longer be opened. Each link now records what it was made with, and the ones written before this update keep working as they did
• New the encryption secrets can be replaced, under Advanced. Useful after restoring a backup that may have been seen by somebody else. Links already published keep working, because each carries the key it was made with; the secret behind the picture variant is opened on your server instead, so the replaced one is kept for 30 days and pictures in pages still cached go on working until then
• Security with “The address drawn into a picture” selected, the address stood in the web address the picture is fetched under. It was written into the page as HTML entities, which looks hidden and is not — the browser resolves them before it makes the request, so the address travelled in plain text in the request line of every image load: into your access log, and through every proxy and CDN on the way. The variant meant to hide addresses best handed them to more machines than a plainly written one would have. The picture is now fetched under a token that says nothing about the address, and the alt text no longer carries it either. Pictures in pages that were already cached keep working — that fallback is a bridge over the lifetime of a page cache and is planned to go in 5.0
• New a block for the editor: “Protected email address”, with fields for the link text and for a prefilled subject, message, cc and bcc. Until now the only deliberate way to protect one address was to type a shortcode into a paragraph, which works but is invisible in the inserter. The block is rendered on the server on every request, so nothing encrypted is stored in the post — a saved link would stop working the moment the encryption secret changed
• New single addresses can be left alone. A new field under Exceptions takes a list — “info@example.com” for one address, “@example.com” for every address at a domain — and CryptX leaves those exactly as written: no masking, no link, no encryption. Until now the answer was that it could not be done, which left no way to keep a helpdesk address machine-readable or an address in a code example intact. Two limits on purpose: inside [cryptx]...[/cryptx] nothing is exempt, because a shortcode is a narrower instruction than a setting; and in comments only a whole address counts, not the domain form, so an exempt domain cannot be used to harvest the addresses visitors leave behind
• Fixed the marker CryptX leaves behind while it sets a shortcode aside could be written by an author. Whoever typed it — in a post explaining CryptX, in a code example, or in a comment — had the set-aside content substituted into their text. The marker now carries a random part per page, so it cannot be typed
• New a Site Health check reports whether addresses really are hidden. It runs a test address through the same filters your pages use and judges the result, instead of describing what the settings ought to do. Choices that deliberately leave addresses in the open — unprotected feeds, excluded posts, a filter switched off — are listed but do not count against the result
• New after a feature update, CryptX asks once whether you would write a review. Once, and with every limit that word implies: a fortnight after the update rather than on the day of it, never after a bugfix release, gone by itself after a month even if you ignore it, and gone for good the moment you decline — for you, not for your colleagues, who each get their own chance to answer. Nothing is attached to it: no setting unlocked in return, no reminder that comes back later

4.1.1

• Fixed a mailto link carrying a subject lost it, and the address inside the encrypted link was corrupted — “sales@example.com?subject=Hello” became “sales@example.comsubjectHello” and the link went nowhere. Subject, body, cc and bcc now travel inside the encrypted link (thx to pbmedia)
• New the shortcode understands subject, body, cc and bcc: [cryptx subject="Price enquiry" cc="sales@example.com"]info@example.com[/cryptx]. The attribute “subject” was accepted and silently discarded before
• Fixed cryptx_encrypt() turned markup in the passed content into visible text — a <br> came out as <br>. It now keeps what a post may contain and still drops scripts (thx to Fint Studio)
• Fixed an address directly following a tag, as in Contact:<br>info@example.com, was not linked, while the display text was replaced anyway — the address disappeared from the page without a working link taking its place
• the setting for the old “javascript:” link format now warns that page builders which run content through wp_kses_post, Elementor’s text widget among them, strip the protocol and break every link
• Fixed on block themes the shortcode did nothing at all: CryptX runs on render_block, which fires before do_shortcode, so it saw the raw “[cryptx]” text. The address went unlinked but was replaced anyway, and the inserted “[at]”/”[dot]” tore the shortcode apart. Unexpanded shortcodes are now left alone until they are expanded
• Fixed a link written “MAILTO:” in capitals kept its href and ended up dead
• the shortcode is left alone only where WordPress expands it afterwards; in comments, excerpts and custom fields it stays visible as text, but the address inside it is obfuscated as before
• Fixed a shortcode inside a registered block pattern was left unprotected: core/pattern renders with do_blocks() alone, so nothing came along afterwards to expand it
• Fixed with “Leave RSS feeds unprotected” switched off, the feed still carried the address in its <description>. A feed is built from its own filters — the_excerpt_rss and the_content_feed — and CryptX was on neither
• Fixed a very long subject or body produced a link the browser refused to follow: the limit counted characters before encoding, while the browser counts the encoded address. 400 characters of Japanese became more than 3600
• when a mailto link has to be shortened to stay inside the length a browser will follow, whole cc and bcc addresses are dropped rather than cut — a fragment like “chef@examp” in a header is worse than a missing recipient
• with “Leave RSS feeds unprotected” on, CryptX now leaves feeds alone entirely; the autolink step still rewrote bare addresses there
• Fixed every update reset settings it had no business touching: the chosen font fell back to the first available one, the text colour gained another “#” each time — “#3366ff” became “##3366ff” — and the encryption secret was discarded, so links on already cached pages stopped resolving. These were one-time migrations from 4.0.12 that ran on every version bump; each is now tied to the version it belongs to
• Security on a multisite network, activating the plugin network-wide copied the first site’s settings to every other site. The exclusion list came with them, so a post ID excluded on the first site left the post with that ID unprotected on all the others — addresses in plain text on sites whose administrator had excluded nothing. The encryption secret was copied as well; that matters less, because it is published in every generated link anyway, but it did let one site’s key open a stray ciphertext from another. Each site now keeps its own settings
• New full multisite support: network activation sets every site up individually, sites created later are handled the same way, deactivation clears the transients of all of them, and errors that only a network administrator can act on are now shown in the network backend
• Fixed the front end script declared CONFIG, ITERATIONS, SecureUtils and other very general names in the global scope. A second script using any of them did not overwrite CryptX, it stopped one of the two scripts outright. Everything now lives in a closure; the documented entry points stay where they were and a window.CryptX namespace was added
• the link in the plugin list is built from the settings page slug instead of the directory name, so renaming the folder no longer breaks it
• version warnings on activation are shown only to users who can act on them
• removed a registration on “wp_update_post”, a hook WordPress does not have; updates were always covered by “wp_insert_post”

4.1.0

• New the settings screen has been rebuilt from scratch: mobile first, with every option explained where you set it
• New a live preview shows what visitors see and what a spam bot finds in the source, updated as you change settings — including a warning when a setting leaves an address readable
• the settings are now grouped by what you want to achieve: Protection, Appearance, Exceptions, Advanced, Help
• the link format and the PBKDF2 iteration count can now be set in the interface; previously they could only be changed in the database
• “Use secure encryption” and “Encryption mode” were two switches for one decision and could contradict each other. They are now a single choice
• switching tabs no longer reloads the page, and the address bar still carries the tab so links and bookmarks keep working
• unsaved changes are kept when switching tabs, and leaving the page warns about them

4.0.12

• Security fixed an issue where a failed PNG request could print PHP warnings into the image stream, disclosing the server path, and where a long request URL could make the plugin allocate hundreds of megabytes — an unauthenticated way to exhaust the memory limit
• Security the exclusion setting “Disable CryptX for this post/page” is now protected by a nonce and a capability check
• Fixed “Disable CryptX for this post/page” no longer gets silently cleared. Any save that did not come from the classic editor form — the REST API, WP-CLI, an autosave, the block editor — used to drop the post from the exclusion list
• Performance the encryption key is now derived once per page instead of once per email address. On a page with 20 addresses in secure mode this cuts about 1.8 seconds of server time
• Performance javascript and stylesheet are only loaded when the page actually contains a protected address
• Encrypted links no longer use a “javascript:” URI, which any stricter Content-Security-Policy blocks outright. The payload now travels in data attributes and a click handler takes over. Links already delivered keep working; set the option “link_mode” to “js” to get the old form back
• The encryption password is no longer derived from AUTH_KEY. It is published in the page markup, so it is now a random secret instead. Existing installations keep their stored value
• added uninstall.php — the plugin option used to stay in the database forever after deletion
• fixed broken markup in the image variant, where the alt attribute was missing its closing quote
• content is no longer lost if a regular expression hits the PCRE backtrack limit
• Security the PBKDF2 iteration count from the settings is now validated. A non-numeric or zero value made the front end fatal on every page carrying an address
• Fixed a font whose name ends in a letter that also appears in “.ttf” was shown truncated in the settings (“Liberation Seri”)
• Fixed anchors carrying a “>” inside an attribute value are no longer mangled when the address is encrypted
• Fixed the changelog tab no longer breaks if the readme cannot be parsed
• Fixed presentation settings were losing a backslash on every save
• declared compatibility with WordPress 7.0
• Licensing replaced the bundled fonts Arial, Times New Roman and Verdana with the freely licensed Liberation Sans, Liberation Serif and DejaVu Sans. The previous files were the original Monotype/Microsoft typefaces, whose licence does not allow redistribution inside a GPL package. If you had selected one of them, CryptX falls back to the first available font automatically.
• fixed the plugin version constant, which still read 4.0.10 in version 4.0.11 and therefore kept browsers from loading the updated javascript
• corrected the declared PHP requirement to 8.1, matching the check performed at runtime
• fixed the minimum WordPress version shown in the error notice (said 5.0, checked for 6.7)
• fixed a PHP warning caused by an undefined variable when activating the plugin without a font setting
• the default font is now chosen in a reproducible order instead of depending on the file system
• the shortcode documentation listed the attributes “linktext” and “subject”, which were never evaluated. It now describes the attributes that actually work.

4.0.11

• fixed a bug in the deprecated “encryptx” function (thx to Machtnix)