Changelog
What’s new in Relvato
Every update to the Relvato app and the WordPress plugin, newest first.
Relvato appv1.0.0
WordPress pluginv1.4.0
WordPressWP 7.1Tested up to WP 7.1 ✓
The Relvato app updates automatically — you always get the latest version when you open it. The WordPress plugin updates through WordPress, automatically or manually depending on your site’s update settings.
- Add: theme-integrity endpoint for Relvato's new Theme-integrity journey — reports a manifest (path + MD5) of your active theme's PHP/JS files, plus any stray executable .php dropped where code shouldn't live (mu-plugins, wp-content root, uploads), so Relvato can catch a tampered checkout template or a dropped malware file by comparing against a baseline you approve. Read-only, token-gated, and bounded so it can't run away on a large uploads folder.
- Add: admin-roster endpoint for Relvato's new Admin-roster journey — reports your administrator accounts (login, display name, roles, registration date, email DOMAIN only; never full emails or other PII), so Relvato can flag a customer/subscriber account elevated to administrator or a brand-new admin — the rogue-admin persistence trick attackers use after a break-in. Read-only and token-gated.
- Add: a user-role change signal — when a user is granted the administrator role (or an admin is registered), Relvato re-runs the Admin-roster audit immediately, so an elevation is caught in minutes rather than on the next scheduled scan.
- First versioned release of the Relvato app — continuous verification for WordPress, WooCommerce and any deployed site.
- Monitoring journeys across checkout, login, storefront, prices & stock, uptime, SSL, Core Web Vitals, Real-user Web Vitals (RUM), visual regression, structure drift, SEO, AI feature output, vulnerabilities, file integrity, background jobs and more.
- AI site overview: a plain-language read of each site that separates real problems from likely false positives.
- Notifications: a live-derived alert bell for failing runs, plugin and beacon issues, and billing.
- One-click fixes for a safe, reversible set of WordPress issues, plus AI-suggested fixes for failing checks.
- Review tools for visual & structure changes — accept a new baseline, ignore only specific sections, and a per-decision undo.
- Vulnerability scanning of plugins and themes, backed by the Wordfence Intelligence feed and WPScan.
- Change: the Relvato plugin graduates to its 1.x line — the same continuous-verification plugin, now out of its 0.x phase.
- Change: the plugin-inventory endpoint now also reports installed themes (slug + version), so Relvato's vulnerability scan checks your themes for known CVEs (via the Wordfence Intelligence feed / WPScan) and for themes closed or abandoned on wp.org — not just plugins. Read-only and token-gated, shared only when you run the vulnerability journey.
- Change: the background-jobs (Action Scheduler) health endpoint now also reports how many pending actions are meaningfully past due and when the scheduler last ran anything. Relvato uses this to tell a genuinely stalled queue (nothing draining) from a single wedged/orphaned action left behind by a removed or updated plugin — the latter is now surfaced as a warning to clean up rather than a hard failure.
- Add: two more one-click fixes for Relvato's "Relvato can fix this" flow — Re-enable search-engine indexing (turns off WordPress's "Discourage search engines" setting when an accidental site-wide noindex is detected; records the previous value for Undo) and Clear the stuck maintenance page (deletes a leftover .maintenance file from an interrupted update that walls the whole site). The plugin also now reports the site's search-engine-visibility setting (blog_public) so the indexing fix is only offered when it will actually help.
- Change: the plugin now reports whether the Real-user Web Vitals beacon is enabled to Relvato, so the dashboard can tell "still collecting data" apart from "collection is turned off" and prompt accordingly.
- Change: the Real-user Core Web Vitals beacon is now ON by default (still anonymous, cookieless, no page URLs or personal data, ~15% sampled). Uncheck "Real-user Web Vitals" under Settings → Relvato to stop collecting.
- Add: optional Real-user Core Web Vitals beacon (off by default). When enabled, a tiny cookieless script measures real visitors' LCP/INP/CLS/FCP/TTFB and sends anonymous, aggregated timings to Relvato (no page URLs, no personal data, ~15% sampled) so the new field-vitals journey can catch an update that slows the site for actual users. Toggle under Settings → Relvato.
- Add: two endpoints for Relvato's new monitoring journeys — plugin-inventory (installed plugin slugs/versions, for the vulnerability & abandoned-plugin scan; shared only when you add that journey) and order-stats (this hour's order count + the expected rate for this hour-of-week, for order-anomaly detection). Both token-gated and read-only.
- Add: three update-safety health endpoints for Relvato's new monitoring journeys — background-jobs (Action Scheduler queue depth / stalled jobs), email delivery (a real wp_mail test send), and file integrity (core + wp.org-plugin checksum verification, the supply-chain tripwire). All token-gated, read-only, and bounded.
- Add: cleanup-entries endpoint — Relvato's form-submit monitor auto-deletes the synthetic test entries it creates (recent + marker-matched + capped, so real submissions are never touched). Supports Formidable, Gravity Forms, and Flamingo/Contact Form 7.
- Add: two more one-click fixes — turn off WooCommerce "Coming soon" mode, and Undo the last applied fix (restores the previous value Relvato recorded). Applying a fix now also re-runs the check so you can watch it go green.
- Add: token-gated "apply-fix" endpoint so Relvato can apply a small, fixed set of safe, reversible fixes for you (flush permalinks, enable guest checkout, clear the cache) when a check fails — one click in the app, with your confirmation. It only ever runs these known actions (never arbitrary code), records the previous state, and logs each change.
- Add: the Dashboard now features the same analytics Relvato shows in the app — an overall pass-rate ring, a "recent runs across all checks" history strip, and a per-journey run-history strip alongside each check's status and pass rate.
- Change: "Send change events to Relvato" is now ON by default on a new install (it's what makes verification run when risk is introduced). Turning it off now shows a warning explaining that verification will then only run on schedule or manually.
- Change: the "Test orders" option is disabled on sites without WooCommerce — it only governs WooCommerce verification checkouts, so there's nothing for it to do there.
- Fix: the new Relvato Dashboard page fataled ("call to undefined method is_connected()") on 0.2.24.
- Add: the plugin now announces its connection to Relvato outbound (a signed "hello" on connect), so setup detects it within seconds even on sites whose REST API isn't reachable from Relvato (plain permalinks, a security plugin, or a host catch-all). Relvato also now reaches your plugin's endpoints via the permalink-independent form automatically, so a store on plain permalinks connects without any configuration change.
- Add: Relvato now has its own top-level admin menu (instead of living under Settings), with two pages: Dashboard — a read-only overview of this site's checks (journeys, statuses, pass rates, recent runs, mirrored from your Relvato dashboard) plus a prominent link to the full app — and
- *Settings** (unchanged).
- Fix: Logged-in checkout email delivery. The dedicated verification user's WooCommerce BILLING email is now kept in sync with the verification inbox, so a logged-in test order's confirmation email reaches the inbox and delivery can be verified. Previously a logged-in checkout (which hides the checkout email field behind the saved address) sent the confirmation to a stale saved billing address, showing a false "email not delivered".
- Change: Clicking "Check again" on Dashboard → Updates now bypasses the plugin's own update cache, so a newly-shipped Relvato version appears immediately instead of after up to 6 hours.
- Fix: WordPress core update version reporting. A core update now reports the correct new version (e.g. "7.0.2 → 7.1"). Previously the version was read during the update request, when WordPress still had the OLD version in memory, so it could report a stale/wrong "to" version. Core changes are now detected on the next page load, where the version is authoritative.
- Change: Relvato moved to its own domain (app.relvato.com). This only affects the default used by the "Connect with Relvato" button and update checks on sites that aren't connected yet — already-connected sites keep working unchanged (they use the endpoint from your connect token).
- Add: store-info now reports your site's CAPABILITIES — a categorized summary of your theme and active plugins (e.g. "WooCommerce + Elementor + Contact Form 7"), NOT the raw plugin list. Relvato uses this to recommend the checks that fit your store instead of making you pick from a long list. Only capability categories are sent; the individual plugin names/versions never leave your site.
- Add: the plugin now updates itself. WordPress shows a normal "update available" notice and a one-click update on the Plugins screen when a new Relvato version ships, served securely from Relvato (not the wordpress.org directory). Note: this self-update capability starts working from 0.2.20 onward, so this one release must be installed manually; every version after it updates in place.
- Fix: The plugin no longer reports changes to ITSELF — activating, deactivating, or updating Relvato won't trigger a verification run (previously an activation fired a "plugin changed" event and kicked off journeys). Relvato's server also ignores self-only plugin events, so this is fixed even on older plugins.
- Add: token-gated endpoint that triggers WordPress's password-reset email for the dedicated verification user (server-side, no login form / CAPTCHA). Powers Relvato's new "Password reset" journey, which confirms the store still SENDS the reset email and that it DELIVERS to the inbox. Only touches the non-admin verification user; the reset link goes to the verification inbox and is never used, so the user's password is unchanged.
- Add: token-gated login-credential endpoint so Relvato's new "Customer login" journey can exercise the REAL login form (not just the trusted-cookie shortcut). It vends a one-time random password for the dedicated verification user — rotated on every call, so the previous one is instantly invalid — and only ever touches that non-admin user. No customer password is stored or handled.
- Add: store-info now reports the store's canonical page URLs (shop, cart, checkout, account) plus a sample product category. Relvato's new visual-regression journey uses these to snapshot the right pages without guessing.
- Fix: Serialize the debounced change-event buffer with a MySQL advisory lock, so simultaneous updates (a plugin activating while another finishes updating) can no longer clobber each other's entry and drop an event. The dispatch drain now holds the same lock, so an event queued at the moment of dispatch can't be deleted unsent.
- Add: change events now carry per-target detail — the human name and the from→to version — so a run triggered by an update shows exactly what changed (e.g. "WooCommerce updated 8.1.0 → 8.2.0", "Yoast SEO activated"). Versions are diffed against a one-time snapshot of installed plugin/theme/core versions. This powers the run's "What changed" panel, making it easy to pinpoint which update a new failure lines up with.
- Add: store-info now reports checkout capabilities for onboarding calibration — whether guest checkout is enabled, and the store's base country/state/city/postcode. Relvato uses these to drive an arbitrary store's checkout deterministically (a valid sample address for the store's own country instead of a hardcoded region), and to know whether guest checkout is available without guessing.
- Fix: MailPoet auto-confirm now also handles an already-existing unconfirmed verification subscriber (MailPoet's public API can only create one as confirmed, not flip an existing one). So the robot inbox stays deliverable and email checks confirm delivery on MailPoet stores without any manual step.
- Add: Email "dispatch" signal — the plugin now records when WooCommerce generates the customer order-confirmation email for a verification order, exposed via a token-gated endpoint. Relvato can confirm your store *sends* order emails even when they don't reach the verification inbox (e.g. MailPoet won't email a non-subscriber), so email checks are robust across every email setup.
- Add: When MailPoet is active, the verification address is marked as a confirmed subscriber automatically, so MailPoet's double opt-in doesn't silently stop delivery to it. Best-effort.
- Fix: Coupon removal now actually clears the cart. Over REST, remove_coupon() was a no-op (the code wasn't found in the un-hydrated cart, then recalculation restored it from the session), so a 100%-off verification coupon could persist and zero a later run's totals. Now clears the session coupon state directly and force-saves it.
- Fix: Persist coupon apply/remove to the cart session in the REST endpoint (WC()->cart->set_session), so a removed verification coupon actually stays removed. Without this a 100%-off verification coupon could linger on the logged-in verification user's cart and zero out a later run's totals.
- Add: Server-side coupon apply/remove endpoint so coupon verification is theme-independent — no need to find a theme's coupon field (some themes, e.g. Rey, hide it with no standard toggle).
- Fix: The runner's REST calls now load the correct cart for logged-in (authenticated-journey) verification. WordPress ignores cookie auth on REST without a nonce, so cart totals, coupons, and shipping were read from an empty cart; the token-gated endpoints now honor the runner's auth cookie.
- Add: Signed REST endpoints (cart-state, store-info) so Relvato reads structured cart totals, coupons, and shipping directly from WooCommerce instead of scraping the page — robust across themes and locales. Token-gated to the verification runner.
- Add: Coupon support for checkout verification — verify a coupon applies (or is correctly rejected), and place real "free" test orders on stores without cash on delivery via an auto-created, restricted 100%-off verification coupon (locked to the verification user, never public).
- Add: "Connect with Relvato" onboarding — a one-click button (and an admin prompt when unconnected) that opens the dashboard pre-filled for this store, so you just pick/create the site and paste the connect token back. Guided two-step setup.
- Change: Connection is now a single "connect token" pasted from the dashboard, instead of separate Endpoint / Site ID / Signing secret fields — fewer fields to copy and no risk of a mismatch. Existing connections keep working; leave the token blank to keep the current connection.
- Add: Email-delivery verification support. The verification user's email is pointed at the site's Relvato inbox so order-confirmation emails can be checked for actual delivery.
- Add: Store-owner order notifications (new/cancelled/failed) are suppressed for verification test orders, so running verifications no longer emails the merchant. Customer emails are untouched.
- Fix: block-based (Store API) checkouts now tag and auto-remove verification test orders too — previously only classic shortcode checkouts were cleaned up, so block-checkout stores left the test order in place.
- Add: "Settings" link on the Plugins screen for quick access to the configuration page.
- Add: Settings page (Endpoint, Site ID, Signing secret, Verification user, Enable/disable, Test orders).
- Add: Authenticated checkout — token-gated trusted login as a dedicated verification user (no password stored).
- Add: Test-order hygiene — verification checkouts no longer change stock; test orders are auto-trashed.
- Add: Verification-mode bypass for WooCommerce "Coming soon" so staging/pre-launch stores can be verified.
- Initial release: change detection (core/plugin/theme/WooCommerce updates), HMAC-signed change events with debounced dispatch, and verification-mode token handling.