WP-Sweep

2.0.1

• NEW: A Sweep link on the plugin’s row of the Plugins screen, opening Tools -> Sweep.
• FIXED: The Sweep screen timed out on large databases. 2.0.0 computed every count before printing a byte — and asked for each table’s total row count once per row instead of once, so SELECT COUNT(*) ran against the postmeta table four times per load. The screen now renders at once and fetches the counts afterwards, one request at a time, so no single request outlives PHP’s time limit. Without JavaScript, a link computes them with the page the way 2.0.0 always did, and the new wp_sweep_defer_counts filter restores that behaviour outright.
• FIXED: Counting the duplicated meta sweeps fetched every duplicate row’s ids into PHP through GROUP_CONCAT, just to add them up. On a postmeta table with millions of duplicates that alone could exhaust the request. The count now reads per-key totals only; the ids are read where they are needed, by the sweep that deletes them.

2.0.0

• FIXED: Unused Terms read “unused” off the count column, and core’s own counter counts published posts — so a term used only by drafts, pending posts, private posts or posts in the trash showed a count of zero and was deleted, taking its relationships with it. Those posts came back untagged with nothing to say why. A term now has to be attached to nothing at all
• FIXED: Sweeping the terms of a taxonomy nothing registers any more finished with DELETE FROM wp_terms WHERE term_id NOT IN ( SELECT term_id FROM wp_term_taxonomy ), which is every stray row in the table rather than the ones the sweep had just orphaned. Rows the screen had neither counted nor listed were deleted along with them. It names the terms it orphaned now
• FIXED: Orphaned Term Relationships decided a row was an orphan by looking for its object_id in wp_posts — which only asks the right question when the taxonomy belongs to posts. For a taxonomy registered against users or comments, object_id is a user or comment ID, so every relationship whose ID happened to outnumber the posts was deleted while the user was still there. link_category was excluded by hand for exactly this reason; the exclusion is now derived from what each taxonomy is registered against
• FIXED: The oEmbed sweep matched %_oembed_%, and in a LIKE pattern an underscore matches any single character — so it meant “any meta key containing oembed with a character either side”, and it was a contains match rather than a prefix one. Keys belonging to other plugins were hard-deleted along with the caches. WordPress writes these as _oembed_{hash}, so the pattern is now anchored at the start with its underscores escaped
• FIXED: The oEmbed sweep was the one meta sweep that never consulted the protected-keys list, so a key a site had explicitly added to wp_sweep_postmeta_whitelist was deleted anyway — the list was even read for it and then ignored
• FIXED: Optimising the database ran SHOW TABLES with no prefix, which is every table in the schema. On a database shared between installs — an ordinary hosting arrangement — the details view listed every co-tenant’s tables, and the sweep issued OPTIMIZE TABLE against installs this administrator does not administer. It is scoped to this install’s prefix now, with wp_sweep_optimize_tables for a site that wants more
• BREAKING: Requires WordPress 6.8 and PHP 8.2.
• BREAKING: The screen stays under Tools but its address changed, from tools.php?page=wp-sweep/admin.php to tools.php?page=wp-sweep. The old form put the installation directory name into the URL.
• BREAKING: The classes are renamed WPSweep -> WP_Sweep, WPSweep_Api -> WP_Sweep_API and WPSweep_Command -> WP_Sweep_Command. Every filter and action keeps its name.
• BREAKING: WP_Sweep::$limit_details is gone. Read it with limit_details() and change it with the wp_sweep_limit_details filter.
• BREAKING: The six wp_sweep_admin_*_sweep actions fire below the single sweep table, in the order they always had, rather than below six separate ones.
• BREAKING: Sweep All is gone. Tick the header checkbox and apply the Sweep bulk action instead, which does the same thing and lets you leave rows out.
• NEW: Bulk sweeping. Tick the sweeps you want and run them in one go instead of one click at a time.
• NEW: The sweeps are grouped on screen. The unfiltered view puts each under a heading with an icon — Post, Comment, User, Term, Option, Database — while staying one table, so a single bulk sweep still runs everything you tick. Sorting a column drops the headings rather than leaving them describing rows they no longer group.
• NEW: Group filters and sortable columns, from a real WP_List_Table.
• NEW: The whole screen works with JavaScript turned off. The row actions are ordinary nonced links and the bulk action is an ordinary form post.
• NEW: The meta key whitelists protect the duplicated meta sweeps as well as the orphaned ones, which the readme always claimed and the code never did.
• NEW: wp_sweep_capability and wp_sweep_limit_details filters. WP-Sweep has no settings screen: wp_sweep_limit_details is how the Details cap is changed.
• NEW: Every sweep carries a description of what it removes, shown under its name, and counts worth acting on are emphasised.
• NEW: An uninstall.php that cleans up across a whole network rather than the first hundred sites. WP-Sweep itself stores nothing: no option rows, no tables, no capabilities and no scheduled events.
• NEW: Restructured into includes/, following the Plugin Handbook.
• NEW: PHPUnit and vitest suites, and GitHub Actions CI across six WordPress and PHP combinations, single site and multisite.
• CHANGED: Meta key exclusions are matched in PHP rather than with SQL LIKE, so an underscore in a protected key is an underscore rather than a wildcard.
• CHANGED: Every database call goes through one method, and every query is prepared.
• FIXED: A stored XSS on the admin screen. The Details list was built by string concatenation and injected as HTML, so a comment author name containing markup ran as script in the administrator’s browser.
• FIXED: The plugin no longer builds paths from its own directory name, so the admin script loads when it is installed under a directory other than wp-sweep.
• FIXED: Filtering wp_sweep_excluded_termids to an empty array produced invalid SQL, leaving the Unused Terms count blank.
• FIXED: A term was excluded from the Unused Terms sweep whenever its ID matched a default_<taxonomy> option, even if that option pointed at a term that no longer exists. WordPress ships default_link_category set to 2, so on most sites whatever term held ID 2 quietly refused to sweep.
• FIXED: Sweeping without JavaScript deleted data and displayed nothing; the result is now shown.
• FIXED: The multisite uninstall loop stopped at 100 sites, hydrated whole site objects to read one column, and left the switch stack unwound by one.
• FIXED: Request parameters are sanitized and validated against the plugin’s own list of sweeps.
• FIXED: The two “Sweep Complete” messages wp sweep prints were the only strings in the plugin that were never passed through the translation functions