Changelog
Was ist neu in Relvato
Jedes Update der Relvato-App und des WordPress-Plugins, neueste zuerst.
- Change: the Relvato plugin graduates to its 1.x line — the same continuous-verification plugin, now out of its 0.x phase.
- Change: the plugin-inventory endpoint now also reports installed themes (slug + version), so Relvato's vulnerability scan checks your themes for known CVEs (via the Wordfence Intelligence feed / WPScan) and for themes closed or abandoned on wp.org — not just plugins. Read-only and token-gated, shared only when you run the vulnerability journey.
- Change: the background-jobs (Action Scheduler) health endpoint now also reports how many pending actions are meaningfully past due and when the scheduler last ran anything. Relvato uses this to tell a genuinely stalled queue (nothing draining) from a single wedged/orphaned action left behind by a removed or updated plugin — the latter is now surfaced as a warning to clean up rather than a hard failure.
- Add: two more one-click fixes for Relvato's "Relvato can fix this" flow — Re-enable search-engine indexing (turns off WordPress's "Discourage search engines" setting when an accidental site-wide noindex is detected; records the previous value for Undo) and Clear the stuck maintenance page (deletes a leftover .maintenance file from an interrupted update that walls the whole site). The plugin also now reports the site's search-engine-visibility setting (blog_public) so the indexing fix is only offered when it will actually help.
- Change: the plugin now reports whether the Real-user Web Vitals beacon is enabled to Relvato, so the dashboard can tell "still collecting data" apart from "collection is turned off" and prompt accordingly.
- Change: the Real-user Core Web Vitals beacon is now ON by default (still anonymous, cookieless, no page URLs or personal data, ~15% sampled). Uncheck "Real-user Web Vitals" under Settings → Relvato to stop collecting.
- Add: optional Real-user Core Web Vitals beacon (off by default). When enabled, a tiny cookieless script measures real visitors' LCP/INP/CLS/FCP/TTFB and sends anonymous, aggregated timings to Relvato (no page URLs, no personal data, ~15% sampled) so the new field-vitals journey can catch an update that slows the site for actual users. Toggle under Settings → Relvato.
- Add: two endpoints for Relvato's new monitoring journeys — plugin-inventory (installed plugin slugs/versions, for the vulnerability & abandoned-plugin scan; shared only when you add that journey) and order-stats (this hour's order count + the expected rate for this hour-of-week, for order-anomaly detection). Both token-gated and read-only.
- Add: three update-safety health endpoints for Relvato's new monitoring journeys — background-jobs (Action Scheduler queue depth / stalled jobs), email delivery (a real wp_mail test send), and file integrity (core + wp.org-plugin checksum verification, the supply-chain tripwire). All token-gated, read-only, and bounded.
- Add: cleanup-entries endpoint — Relvato's form-submit monitor auto-deletes the synthetic test entries it creates (recent + marker-matched + capped, so real submissions are never touched). Supports Formidable, Gravity Forms, and Flamingo/Contact Form 7.
- Add: two more one-click fixes — turn off WooCommerce "Coming soon" mode, and Undo the last applied fix (restores the previous value Relvato recorded). Applying a fix now also re-runs the check so you can watch it go green.
- Add: token-gated "apply-fix" endpoint so Relvato can apply a small, fixed set of safe, reversible fixes for you (flush permalinks, enable guest checkout, clear the cache) when a check fails — one click in the app, with your confirmation. It only ever runs these known actions (never arbitrary code), records the previous state, and logs each change.
- Add: the Dashboard now features the same analytics Relvato shows in the app — an overall pass-rate ring, a "recent runs across all checks" history strip, and a per-journey run-history strip alongside each check's status and pass rate.
- Change: "Send change events to Relvato" is now ON by default on a new install (it's what makes verification run when risk is introduced). Turning it off now shows a warning explaining that verification will then only run on schedule or manually.
- Change: the "Test orders" option is disabled on sites without WooCommerce — it only governs WooCommerce verification checkouts, so there's nothing for it to do there.
- Fix: the new Relvato Dashboard page fataled ("call to undefined method is_connected()") on 0.2.24.
- Add: the plugin now announces its connection to Relvato outbound (a signed "hello" on connect), so setup detects it within seconds even on sites whose REST API isn't reachable from Relvato (plain permalinks, a security plugin, or a host catch-all). Relvato also now reaches your plugin's endpoints via the permalink-independent form automatically, so a store on plain permalinks connects without any configuration change.
- Add: Relvato now has its own top-level admin menu (instead of living under Settings), with two pages: Dashboard — a read-only overview of this site's checks (journeys, statuses, pass rates, recent runs, mirrored from your Relvato dashboard) plus a prominent link to the full app — and
- *Settings** (unchanged).