Changelog
Was ist neu in Relvato
Jedes Update der Relvato-App und des WordPress-Plugins, neueste zuerst.
- New: Relvato sees the plugin updates WordPress is offering, including for plugins that aren't on wordpress.org (paid and vendor plugins), and whether their download is actually provided. The vulnerability scan lists them, and "Update and verify" now works for vendor plugins too.
- New: before any update of a plugin that isn't on wordpress.org — by Relvato, by WordPress's auto-updater, or by you — Relvato zips the current version into wp-content/relvato-backups (blocked from the web, at most two per plugin, removed after 60 days). If the update breaks a check, rolling back restores that backup.
- New: updates that don't take are recorded — a failed download, or a vendor serving the version already installed (usually a licence that isn't active) — so the scan can say why a plugin stays behind.
- Change: the dashboard no longer calls a check that found something a failure. A check "fails" only when a customer action it performs doesn't work (a checkout, a login, a reset email); a check that measures or scans reports what it found — a performance regression, a vulnerability, a change to review.
- New: fix a vulnerable plugin safely. When Relvato's vulnerability scan finds a plugin with a known security issue, it can update that plugin to the version that fixes it — from wordpress.org, and only when your copy is wordpress.org's own, unmodified — or deactivate it. Then it re-runs every check that passed before, and if one of them now fails, it undoes the change on its own: rolls the update back (and holds that version back, so it isn't reinstalled) or reactivates the plugin. Never WooCommerce, never Relvato itself, and never a plugin other active plugins depend on.
- New: roll back a plugin update that broke your site. When a check starts failing right after a plugin updated, Relvato can reinstall the version you had before — from wordpress.org, and only when your copy is wordpress.org's own, unmodified — and hold the version that broke things back, so WordPress doesn't simply reinstall it. The hold covers WordPress's automatic updates and any update installed through WordPress (by a person, WP-CLI or an update service); a newer release installs normally, the Plugins screen shows the hold, and you can release it from the run in Relvato. WooCommerce is never rolled back onto a database it already upgraded.
- New: two more one-click fixes. When your background jobs stall (WooCommerce's Action Scheduler: emails, subscription renewals, stock sync), Relvato can run the queue once — only jobs that were already due, for a few seconds — and tells you if WP-Cron is switched off, which is why it would stall again. When visitors see a maintenance or coming-soon page from WP Maintenance Mode or SeedProd, Relvato can switch that page off, and Undo switches it back on exactly as it was.
- Change: each security-hardening fix now sits next to the finding it fixes, in the run's details in Relvato: "Fix it" applies that one setting, and "Undo" turns just that one back off, leaving the others alone. The Security hardening section is gone from Relvato → Settings, and any setting you already switched on stays on.
- New: security hardening Relvato can switch on for you. When the exposure scan finds something anyone can use to learn about or attack your site, the run in Relvato now offers to fix it in one step, and one Undo reverts it. Nine settings, each off until you or Relvato turns it on: turn off XML-RPC (never while Jetpack is active), hide the public user list, stop username lookups by number, remove the WordPress version tag, remove the X-Powered-By header, turn off the theme and plugin file editor, hide PHP errors from visitors, add safe security headers (never CSP or HSTS), and stop browsing the uploads folder. Nothing on your site is edited: the plugin applies each setting on every request, and you can see and untick all of them under Relvato → Settings → Security hardening.
- Fix: WooCommerce no longer lists Relvato under "Not compatible with WooCommerce features". The plugin already worked with High-Performance Order Storage and the block-based cart and checkout; it now says so, which is how WooCommerce decides. Also: the order-volume check now counts orders from the table WooCommerce actually uses, so a store that switched back from High-Performance Order Storage no longer reads an out-of-date order count.
- Change: the plugin now declares which WordPress and WooCommerce versions it is tested against, so your Plugins and WooCommerce screens stop marking it "untested" on an up-to-date site. Relvato now runs its plugin against the current WordPress (and the next release candidate) automatically, so that claim is verified rather than asserted.
- New: the exposure scan can now find leftovers only the server can see — a database dump or backup archive sitting in your web root under a name nobody could guess ("site-backup-2026-03-11.zip"), a .git directory, an editor's .bak file, or PHP files that have appeared in your uploads folder. It also reports the settings that make any other problem worse: the plugin/theme file editor left on, debug output shown to visitors, WordPress's sample security keys still in wp-config.php, and a wp-config.php anyone on the server can write to. Paths and sizes only — Relvato never reads the contents.
- Change: the exposure scan can now ask your site which sensitive files exist, instead of requesting them over the internet. Requesting files like /.env or /wp-config.php.bak is what a server firewall (Imunify360, Wordfence) is built to block, so on a protected site the scan was cut off mid-run and could no longer see anything. Asking from the inside avoids that entirely, and a firewall's 403 can no longer be mistaken for "that file isn't there". Existence only — Relvato never reads the contents.
- Fix: the payment-methods check no longer reports "no payment methods are available" on stores that take cash on delivery. Relvato now reads the payment methods enabled in WooCommerce settings. Before, it read the methods available to an empty cart, and cash on delivery is hidden until the cart has something to ship.
- Change: the Relvato dashboard now groups your checks into Performance, Security, User flow, Design and Other. Each group is a status card you can click, and opens a short overview written by Relvato: what needs attention (the cause, what to do, and a link to the result), what is fine, and what changed on the site before Relvato re-checked it.
- Change: the real-user Web Vitals beacon is now loaded from Relvato as a small async script instead of being printed inline, so beacon improvements reach your site without a plugin update.
- Add: for slow page views, the beacon also reports what was involved — the element (CSS selector), the main image, and the script that blocked an interaction (address without query strings) — so Relvato can show what to fix. Still cookieless, with no personal data.
- Add: theme-integrity endpoint for Relvato's new Theme-integrity journey — reports a manifest (path + MD5) of your active theme's PHP/JS files, plus any stray executable .php dropped where code shouldn't live (mu-plugins, wp-content root, uploads), so Relvato can catch a tampered checkout template or a dropped malware file by comparing against a baseline you approve. Read-only, token-gated, and bounded so it can't run away on a large uploads folder.