Changelog
Was ist neu in Relvato
Jedes Update der Relvato-App und des WordPress-Plugins, neueste zuerst.
Relvato-Appv1.1.0
WordPress-Pluginv1.23.1
WordPressWP 7.1.2Getestet bis WP 7.1.2 ✓
Die Relvato-App aktualisiert sich automatisch – beim Öffnen hast du immer die neueste Version. Das WordPress-Plugin wird über WordPress aktualisiert, automatisch oder manuell, je nach den Update-Einstellungen deiner Website.
- Change: verified against WordPress 7.1.2. Relvato runs its plugin inside a real WordPress on every release, so this is a result rather than a claim.
- New: Google Search and Bing Search numbers on the SEO / AEO tab, the same as in the Relvato app. Once you connect Google Search Console or Bing Webmaster Tools in Relvato, each engine gets a row with its headline numbers against the site's usual (clicks, impressions, average position and pages in results for Google; pages in the index, pages crawled a day and not-found pages for Bing) and what the latest check found.
- Improved: the dashboard uses the same collapsible rows as the Relvato app. Each section shows a status icon, its title, a one-line summary and a badge, and opens on a click: Site health, Health over time and Real-user performance on the Overview, and Biggest wins, Needs attention, All good and What changed in each check group. The check groups on the Overview are rows too. Sections start closed, remember whether you opened them, and work without JavaScript.
- New: Quarantine mode support. When you put a cleaned site in quarantine in the Relvato app, the plugin reports the changes malware makes when it comes back, as they happen: new users and role changes, an administrator's email or password changing, key settings (site address, open registration, the default role for new users), new scheduled tasks, PHP files uploaded, and files saved in WordPress's theme and plugin editor. Emails are sent as their domain only, and passwords and option values are never sent.
- New: a fingerprint of the places malware comes back to, every ~10 minutes during quarantine: the site root and wp-config.php, drop-ins, must-use plugins, PHP files in uploads, themes, plugins and WordPress core. Only file paths, sizes and dates are compared, never file contents, plus the administrator list, key settings and scheduled tasks.
- New: pause plugin and theme auto-updates for the rest of a quarantine with one click in the app, so every change in the log is one you made. WordPress's own security updates stay on. The pause and the reports switch themselves off when the quarantine ends.
- New: the Performance tab shows the site's biggest wins — the top three changes that would speed it up the most, most valuable first. Each one says what to change, the estimated effect, the evidence behind it and how to do it, combining the latest lab test with what real visitors experience. The same wins show in the Relvato app.
- Fix: uploading the plugin zip (Plugins → Add New → Upload) no longer gets a 403 from hosts that scan uploads. The zip had been shipping Relvato's own test files, whose sample malware (used to test the detector) looked like the real thing to a server's malware scanner. The zip now holds only the plugin itself, and the plugin's own detector no longer spells out the function names it looks for. Updating also removes those test files from sites that already have them.
- Fix: the "Silence is golden" index.php placeholders that WordPress and many plugins put in upload folders are no longer reported as PHP files dropped into uploads. The plugin now tells Relvato which uploads PHP files contain no code at all — only PHP tags, comments and whitespace — judged by PHP's own tokenizer, not by the file's name. Paths only, never contents. Any file with even one line of code is still reported.
- Change: your homepage now carries a small <meta name="relvato-site"> tag naming the Relvato site this plugin is connected to. Relvato now counts the plugin as connected only when it sees it from outside — the plugin's REST API answering, or this tag on your homepage — rather than from a message the plugin sends, which is what lets Relvato be sure it's checking a site you actually run. The tag grants nothing on its own.
- Security: the verification coupon (relvato-verify) now only applies inside a verified Relvato check. Before, a shopper who typed the right billing email could use it for a free order. Deactivating the plugin now also deletes the coupon.
- Security: the token Relvato's browser sends while checking your pages can no longer open any of the plugin's REST endpoints — only Relvato's own servers can. A script running on a checked page, including an injected one, can't use it to change anything.
- Security: the verification user can no longer be an account that can edit content or the site. If the setting names one, Relvato refuses it and changes nothing on that account.
- Security: plugin updates are only fetched from the Relvato app over https, never from an address in a pasted connect token, and a connect token must point at an https address.
- Change: uninstalling the plugin now removes what it created — the coupon, its settings, its records, its plugin backups and the verification user it set up.
- New: the file-integrity check finds code running from where no plugin, theme or WordPress put it. Malware that "heals" itself keeps its code in the database and has a small file evaluate it on every page load, so the code running has no file of its own. The plugin traces every hook, scheduled task and REST route back to where its code was defined, and reports code evaluated by anything other than a plugin, code in the uploads folder, and routes added to WordPress's own REST namespaces. Names and places only — never the code.
- New: it also lists options that hold PHP code or one large encoded blob — the copy malware keeps to reinstall its files after a clean-up — as a warning to review, since a few plugins do store code there.
- New: the file-integrity check says how each plugin got there. From the moment this version runs, the plugin notes every plugin WordPress installs (from the Plugins screen, an upload, WP-CLI or an update service) and reports a plugin that turns up any other way — copied in by FTP, a file manager, a deploy, or malware. What's installed when it starts watching counts as known.
- New: it also reports a plugin hidden from the Plugins screen, and a security plugin whose folder was renamed ("wordfence.disabled_1"), which is how malware switches Wordfence, Sucuri, Solid Security and others off without a deactivation anyone sees.
- New: the theme-integrity check also watches wp-config.php, the .htaccess and .user.ini at your site's root — the files malware edits so it comes back after a clean-up. It reports each file's fingerprint and the names of any malware patterns found in them and in mu-plugins (code that evaluates a decoded string, a file run before every request, images run as PHP, visitors from search engines sent elsewhere). Never the contents: wp-config.php holds your database password.
- New: the file-integrity check lists PHP files in wp-admin and wp-includes that WordPress doesn't ship. Nothing but WordPress belongs there, so a file planted beside core's own no longer goes unseen.
- New: the admin-roster check lists the application passwords on administrator accounts (name and dates only — never the password). One signs in without the login form, so two-factor login and login limits never see it, and it survives a password change. Creating one re-runs the check straight away.
- New: the dashboard's Overview shows the same charts as your site's Overview in the Relvato app — site health (now, or the last 30 days), health over time (daily or weekly; 28 days, 90 days or 6 months) and, with real-user Web Vitals on, how LCP, INP and CLS have moved for real visitors (28 or 90 days). Switching views needs no new request.
- Change: the dashboard uses the same menu as your site in the Relvato app. A side menu lists Overview, then seven groups of checks — User flows, Security, Design, Performance, SEO / AEO, Domain lifecycle and Other — each with how many findings it has (or a status dot), and links to Runs, Journeys and Settings in the app. Overview shows every group as a card and opens first.
- New: Relvato sees the plugin updates WordPress is offering, including for plugins that aren't on wordpress.org (paid and vendor plugins), and whether their download is actually provided. The vulnerability scan lists them, and "Update and verify" now works for vendor plugins too.
- New: before any update of a plugin that isn't on wordpress.org — by Relvato, by WordPress's auto-updater, or by you — Relvato zips the current version into wp-content/relvato-backups (blocked from the web, at most two per plugin, removed after 60 days). If the update breaks a check, rolling back restores that backup.
- New: updates that don't take are recorded — a failed download, or a vendor serving the version already installed (usually a licence that isn't active) — so the scan can say why a plugin stays behind.