Changelog
What’s new in Relvato
Every update to the Relvato app and the WordPress plugin, newest first.
- Add: admin-roster endpoint for Relvato's new Admin-roster journey — reports your administrator accounts (login, display name, roles, registration date, email DOMAIN only; never full emails or other PII), so Relvato can flag a customer/subscriber account elevated to administrator or a brand-new admin — the rogue-admin persistence trick attackers use after a break-in. Read-only and token-gated.
- Add: a user-role change signal — when a user is granted the administrator role (or an admin is registered), Relvato re-runs the Admin-roster audit immediately, so an elevation is caught in minutes rather than on the next scheduled scan.
- First versioned release of the Relvato app — continuous verification for WordPress, WooCommerce and any deployed site.
- Monitoring journeys across checkout, login, storefront, prices & stock, uptime, SSL, Core Web Vitals, Real-user Web Vitals (RUM), visual regression, structure drift, SEO, AI feature output, vulnerabilities, file integrity, background jobs and more.
- AI site overview: a plain-language read of each site that separates real problems from likely false positives.
- Notifications: a live-derived alert bell for failing runs, plugin and beacon issues, and billing.
- One-click fixes for a safe, reversible set of WordPress issues, plus AI-suggested fixes for failing checks.
- Review tools for visual & structure changes — accept a new baseline, ignore only specific sections, and a per-decision undo.
- Vulnerability scanning of plugins and themes, backed by the Wordfence Intelligence feed and WPScan.
- Change: the Relvato plugin graduates to its 1.x line — the same continuous-verification plugin, now out of its 0.x phase.
- Change: the plugin-inventory endpoint now also reports installed themes (slug + version), so Relvato's vulnerability scan checks your themes for known CVEs (via the Wordfence Intelligence feed / WPScan) and for themes closed or abandoned on wp.org — not just plugins. Read-only and token-gated, shared only when you run the vulnerability journey.
- Change: the background-jobs (Action Scheduler) health endpoint now also reports how many pending actions are meaningfully past due and when the scheduler last ran anything. Relvato uses this to tell a genuinely stalled queue (nothing draining) from a single wedged/orphaned action left behind by a removed or updated plugin — the latter is now surfaced as a warning to clean up rather than a hard failure.
- Add: two more one-click fixes for Relvato's "Relvato can fix this" flow — Re-enable search-engine indexing (turns off WordPress's "Discourage search engines" setting when an accidental site-wide noindex is detected; records the previous value for Undo) and Clear the stuck maintenance page (deletes a leftover .maintenance file from an interrupted update that walls the whole site). The plugin also now reports the site's search-engine-visibility setting (blog_public) so the indexing fix is only offered when it will actually help.
- Change: the plugin now reports whether the Real-user Web Vitals beacon is enabled to Relvato, so the dashboard can tell "still collecting data" apart from "collection is turned off" and prompt accordingly.
- Change: the Real-user Core Web Vitals beacon is now ON by default (still anonymous, cookieless, no page URLs or personal data, ~15% sampled). Uncheck "Real-user Web Vitals" under Settings → Relvato to stop collecting.
- Add: optional Real-user Core Web Vitals beacon (off by default). When enabled, a tiny cookieless script measures real visitors' LCP/INP/CLS/FCP/TTFB and sends anonymous, aggregated timings to Relvato (no page URLs, no personal data, ~15% sampled) so the new field-vitals journey can catch an update that slows the site for actual users. Toggle under Settings → Relvato.
- Add: two endpoints for Relvato's new monitoring journeys — plugin-inventory (installed plugin slugs/versions, for the vulnerability & abandoned-plugin scan; shared only when you add that journey) and order-stats (this hour's order count + the expected rate for this hour-of-week, for order-anomaly detection). Both token-gated and read-only.
- Add: three update-safety health endpoints for Relvato's new monitoring journeys — background-jobs (Action Scheduler queue depth / stalled jobs), email delivery (a real wp_mail test send), and file integrity (core + wp.org-plugin checksum verification, the supply-chain tripwire). All token-gated, read-only, and bounded.
- Add: cleanup-entries endpoint — Relvato's form-submit monitor auto-deletes the synthetic test entries it creates (recent + marker-matched + capped, so real submissions are never touched). Supports Formidable, Gravity Forms, and Flamingo/Contact Form 7.
- Add: two more one-click fixes — turn off WooCommerce "Coming soon" mode, and Undo the last applied fix (restores the previous value Relvato recorded). Applying a fix now also re-runs the check so you can watch it go green.
- Add: token-gated "apply-fix" endpoint so Relvato can apply a small, fixed set of safe, reversible fixes for you (flush permalinks, enable guest checkout, clear the cache) when a check fails — one click in the app, with your confirmation. It only ever runs these known actions (never arbitrary code), records the previous state, and logs each change.
- Add: the Dashboard now features the same analytics Relvato shows in the app — an overall pass-rate ring, a "recent runs across all checks" history strip, and a per-journey run-history strip alongside each check's status and pass rate.
- Change: "Send change events to Relvato" is now ON by default on a new install (it's what makes verification run when risk is introduced). Turning it off now shows a warning explaining that verification will then only run on schedule or manually.
- Change: the "Test orders" option is disabled on sites without WooCommerce — it only governs WooCommerce verification checkouts, so there's nothing for it to do there.