MegaManager Connector

1.4.7

• SECURITY: Database cleanup will no longer drop a table belonging to a plugin you still have installed. “Orphaned” tables were matched on the table name alone, so a live WooCommerce store listed its Action Scheduler tables as safe to remove — dropping those takes every scheduled order job with them. The plugin now refuses any table still claimed by an installed plugin and reports it back instead of removing it.
• SECURITY: On hosting where one database holds more than one WordPress install, the prefix check now respects table boundaries. Cleanup and site transfer could previously reach a neighbouring installation’s tables, or another subsite’s on multisite, because the prefix “wp_” also matches “wp_2_” and “wp_staging_”.
• SECURITY: The feedback endpoint no longer accepts any request that merely carries a non-empty cookie. It checks the session token’s shape and applies a per-IP limit, so anonymous traffic can no longer hold PHP workers open on a blocking outbound request.
• SECURITY: Rejected API requests can no longer fill the disk. Each one wrote a log line with no size limit; the daily log file is now capped.
• SECURITY: The working files a restore creates — which include a complete database dump — are now removed after four hours even when the restore is interrupted. Previously they were only cleaned up when it finished, and a restore cut short by a timeout left the dump behind.
• SECURITY: Table optimisation now checks the table name against this installation’s prefix and confirms the table exists, the same way the removal path already did.
• FIX: Temporary-access links now last as long as the access you granted. A link created for 24 hours was rejected about a minute later, and because the first click used the token up, trying again reported it invalid rather than expired — the feature could not work at all.
• FIX: Maintenance mode’s “allow administrators” setting is now stored and honoured. It previously had no effect, and administrators were always let through regardless of the choice.
• FIX: Saving auto-update settings no longer switches off the ones it was not asked about. Setting up a plugin automation from the dashboard silently turned off the theme and core auto-updates you had chosen in wp-admin; each setting is now left alone unless it is actually being changed.
• FIX: Page analysis now works on the front page, shop and category archives. Asking about a URL that is not a single post or page returned “page not found” and no script list at all; those pages are now scanned for their real script and stylesheet sizes like any other.
• NEW: The site now reports what it holds — posts, pages and other public content types by status, plus media, comments, registered users and taxonomies — so MegaManager can answer questions about the site’s content instead of guessing from database table sizes.
• NEW: WooCommerce shops additionally report this month’s orders, how many are paid, revenue and the order status split.

1.4.6

• CHANGE: Automatic updates are now off until you turn them on. Earlier versions enabled the auto-update scheduler for every site, including ones that had never asked for it; a fresh install now starts with it switched off, and an install’s existing choice is left untouched.
• FIX: The connector no longer updates itself from its own scheduler. Replacing the running plugin’s files mid-run could break the very process doing it and drop the site’s connection, so the connector is now updated deliberately — from WordPress’ own Plugins screen or an explicit action — never silently in the background.
• FIX: A restore now streams the database dump with a quote-aware SQL splitter, so a backup whose content holds newlines, semicolons or comment markers inside a value restores correctly instead of failing with a syntax error midway.

1.4.5

• FIX: A restore interrupted partway through — by a timeout or a memory limit — no longer leaves the site stuck on the maintenance screen. The maintenance flag it writes is now valid, so an interrupted restore recovers instead of white-screening until the file is removed by hand.
• FIX: Site transfer only rewrites this installation’s own tables. On hosting where one database holds more than one WordPress install, a transfer no longer reaches into the neighbouring site’s tables.
• FIX: After a transfer, the destination keeps its own connection to MegaManager instead of adopting the source’s identity, so both sites continue to report correctly in the dashboard.
• FIX: Database optimize, table cleanup and orphaned-table removal now actually run. A quoting bug made them send invalid SQL and silently do nothing while reporting success.
• FIX: A restore can no longer start a second time while one is already in progress, which previously risked two restores writing over the same tables at once.
• FIX: During a transfer’s address rewrite, tables with a composite primary key are left untouched rather than risking overwriting unrelated rows.
• FIX: A PHP error raised during a backup no longer leaves it stuck showing “in progress” — the backup lock is always released.
• FIX: The backup archive no longer includes a second copy of the database dump, so uploads are smaller.
• SECURITY: The command relay is constrained to MegaManager’s own endpoints; the pairing endpoint is rate limited against token guessing; and a re-pairing site URL is re-checked against private/reserved addresses.

1.3.9

• NEW: Site transfer. MegaManager can copy one connected site over another — a staging build onto the live site, for instance. Addresses are rewritten during the copy, including inside the serialized data that page builders store layouts in, so links and modules keep working on the new domain. The destination keeps its own connection to MegaManager rather than inheriting the source’s.
• NEW: Reviewers keep their WordPress role. An administrator or editor given review access can now resolve and delete comments on the site they administer; everyone else comments only. WordPress remains the authority, so a change of role there applies at the next sign-in.
• NEW: Disconnecting now works both ways. Pressing Disconnect tells MegaManager immediately instead of leaving the dashboard to find out on the next manual sync, and removing a site from the dashboard tells the plugin to let go rather than leaving it calling a site that is no longer managed.
• NEW: uninstall.php — deleting the plugin now removes everything it stored, the shared secret included. Previously those options survived deletion and a reinstall silently re-paired the site with the old key. Deactivating still leaves them alone.
• NEW: The site now says when it is leaving. Deactivating the plugin tells MegaManager at once — and keeps the site’s settings, so switching it back on simply reconnects; deleting it says so while its credentials still exist, so the platform can retire its own copy. Activating sends a check-in immediately instead of waiting for a visitor.
• FIX: Scheduled work no longer depends on the site having visitors. WordPress only runs cron when somebody loads a page, so on a quiet site metrics, automatic updates and the expiry of temporary logins could all sit waiting indefinitely. MegaManager can now run each of them directly; automatic updates started this way still obey the site’s own settings, and a site with them switched off is left alone.
• FIX: Log retention runs from the write path as well as its daily cron, so log files on a site with no traffic are pruned rather than growing without limit.
• FIX: Auto-updates could report “in progress” forever. A plugin update that raised a PHP error skipped the cleanup, and while the lock expired after 30 minutes the status flag had nothing to clear it. The state is now derived from the lock, so even a process killed outright recovers.
• PERFORMANCE: The connector was issuing 24 database queries on every page load of the site it is installed on, including for anonymous visitors — a one-time defaults backfill re-running on every request. Measured on a live site, that is now 3.
• FIX: The log directory’s protection files are re-created if something removes them, rather than only when the directory is first made.
• SECURITY: The two feedback actions that run before a session exists are now rate limited, so a review token cannot be guessed at network speed.
• IMPROVE: Granting a WordPress user review access takes effect on their next page load instead of after a back-off.
• IMPROVE: Saving a comment closes the panel and confirms, instead of reopening it with a “Reply…” box under the sentence you had just written.
• FIX: A marker whose element is hidden — an inactive slider, a closed accordion — is drawn against the nearest visible part of the page and flagged as approximate, instead of being placed off-screen where it could not be seen at all.
• IMPROVE: The feedback toolbar lists every comment on the current page, numbered to match the markers, and the comment panel opens beside its own marker rather than in a fixed corner.

1.3.8

• NEW: WordPress users of the site can be given review access from MegaManager — once granted they get the feedback overlay automatically while logged in, with no link to click. They can comment only, never resolve.
• IMPROVE: The feedback toolbar can be dragged anywhere and folded away with a click, so it never sits on top of a cookie banner or chat bubble. Its position and folded state are remembered.
• NEW: A show/hide switch for comments, so the page can be viewed exactly as a visitor sees it without losing anything.
• NEW: “Open on site” on any comment in the dashboard jumps straight to that comment on the page, with the thread already open.
• COMPATIBILITY: The overlay stays out of visual page builders (Divi, Elementor, WPBakery, Beaver Builder, Oxygen, Bricks, Brizy) and the Customizer — it never loads in an editing canvas, and steps aside if a builder is opened while it is running.

1.3.6

• NEW: Click-to-comment feedback. Reviewers open the site from MegaManager and click anywhere to leave a comment pinned to that exact element; clients can be invited by email and need no account. Comments stay on the same content at any screen width.
• PRIVACY: The feedback overlay is only served to visitors holding a review session — ordinary visitors download no extra JavaScript and the site behaves exactly as before.
• SECURITY: Review sessions are issued by MegaManager, not by the site: the connector only relays the session token it was given, so the site secret alone cannot be used to post as another person. Session cookies are httpOnly and SameSite=Lax.