Every release.
Documented.
What shipped, what broke, what got fixed. Every release follows semver. Breaking changes get their own line and a migration note.
Raw HTML for trusted editors.
Content writes now mirror WordPress core: tokens mapped to a user with the unfiltered_html capability can save raw markup — including <style> and <script> for Custom HTML blocks — exactly like the block editor allows. Everyone else still goes through KSES.
- Fixed
wp_kses_post()was applied unconditionally on post/page content writes, stripping<style>/<script>even for administrator tokens — full-page Custom HTML layouts could not be deployed via the API - Security the capability gate is WordPress’ own: no new option, no bypass for non-admin tokens
Security hardening + complete remote File Explorer. Claude & ChatGPT.
Biggest release since launch: the plugin’s filesystem surface becomes a full remote file explorer, a deep security-hardening pass across the whole API, and first-class ChatGPT Desktop support alongside Claude.
- Added 6 new
/fs/*endpoints: mkdir, rename/move, delete (two-step confirmation + automatic pre-delete backup), base64 upload, download, recursive filename search — plugin now exposes 90 typed endpoints - Added 9 new
wp_fs_*MCP tools (claude-wp-mcp v1.1.0, 83 tools total): browse & manage the whole WP install from Claude or ChatGPT - Added Xaflo Desktop 1.2.0: full File Explorer UI (upload/download/rename/delete/search/breadcrumb) on every connected site
- Added Desktop “Setup instructions” button per site: ready-to-paste MCP config for Claude Code, Claude Desktop and ChatGPT Desktop, with copy buttons
- Security SSRF guard on remote downloads (media sideload, plugin zip install) — operator-controlled, on by default
- Security zip-slip fix in backup restore; DB restore now transactional (no more half-restored tables on failure)
- Security IP allowlists no longer spoofable via
X-Forwarded-For(new trusted-proxies option); audit log records the real client IP - Security confirmation token now required to change
siteurl/home/admin_email;db:writerate limit actually enforced - Security Desktop: connection tokens moved out of process argv (env-based), Electron hardening (navigation lockdown, validated external links), updater double-init fix
- Improved protected WP meta (
_wp_*) skipped on generic meta writes with audit signal; SqlGuard blocksSLEEP/BENCHMARK/@@probes - Note full DB + filesystem control stays by design: the scoped, expiring token is the trust boundary
Plugin Deployer hardening + binary upload sanitizer.
Patch release focused on the desktop Plugin Deployer flow and the marketing-site binary upload pipeline.
- Fixed
readEntryCreds()in desktop was called with a string name instead of an entry object, causingTypeError: creds.site.replacein Plugin Deployer - Fixed
make-plugin-zip.pywas nukingvendor/firebase/php-jwt/src/because it excludedsrc/at all depths; split intoEXCLUDE_ROOT_DIRSvsEXCLUDE_ANY_DIRS - Fixed WordPress
sanitize_file_name()was renaming.exe.blockmap→.exe_.blockmap; custom sanitizer inbinary-upload.phppreserves double-extension artifacts - Improved desktop sidebar i18n fallback (was showing keys like
nav.deployerwhen translation missing) - Improved selected-site persistence across desktop pages via
localStorage
License system + customer accounts + EU VAT.
Full e-commerce stack on the marketing site: account dashboard, PayPal checkout, OSS-compliant VAT for 27 EU countries, Italian regime forfettario support, B2B reverse charge with VIES validation, branded HTML emails, admin invoice backoffice. Coupon system with admin management.
- Added
xaflo-licenses/v1REST namespace: signup, signin,/me,/buy-pro,/tax/quote,/vies-check,/paypal/capture,/free-checkout,/coupon/check - Added Ed25519-signed license tokens (libsodium); embedded public key in desktop verifies locally with no phone-home
- Added customer account dashboard at
/account/: license cards with progress bars, order history, invoice downloads - Added PayPal Smart Buttons checkout with server-side capture verification (anti-tampering)
- Added EU OSS scheme: 27 country VAT rates, automatic country detection, VIES B2B validation, Italian forfettario toggle
- Added admin Tools → Xaflo Invoices: 6 stat cards, filter bar, CSV export, printable HTML invoice, OSS quarterly summary
- Added admin Tools → Xaflo Coupons: percent / fixed / FREE coupons, usage caps, validity window, scope (new vs renewal)
- Added branded HTML emails for license delivery + 30/7/1 day expiry warnings (daily cron)
- Added desktop License page with countdown, renew CTA, paste-token activation
Maintenance mode + remote control panel.
Take any connected site offline from Xaflo Desktop with a styled 503 page. New REST endpoints for plugin install / activate / deactivate, debug.log tailing and theme file read/write.
- Added
MaintenanceControllerwith GET/POST/DELETE/maintenanceendpoints + styled drop-in 503 page + IP bypass allow-list - Added server-rendered admin page Xaflo → Maintenance for one-click toggle (works even if the React bundle is broken)
- Added Desktop pages: Plugins (list/activate/deactivate), Files (theme file browser + editor), Maintenance (remote toggle)
- Added Desktop sidebar grouping (Remote · Workshop · System) for cleaner navigation
- Added
/debug/logREST endpoint with severity filtering and clear action - Added Console page in Desktop with debug.log tailing, auto-refresh, severity filter
- Improved sanitize for double-extension artifact filenames (preserves
.exe.blockmap)
Self-hosted auto-update.
The plugin now polls https://wpconnect.xaflo.com/updates/v1/wp-claude-bridge.json every 12h and surfaces upgrades through WordPress’ standard update UI. No more wp.org dependency.
- Added
XafloWpConnectServicesUpdaterwithpre_set_site_transient_update_plugins,plugins_api,upgrader_pre_downloadhooks - Added SHA-256 integrity verification before unpacking
- Added
Xaflo Update Servercompanion plugin serving plugin + desktop manifests - Added Desktop Plugin Deployer: push a .zip from your machine to N sites with one click
- Added Allowlist host check on update URL (only
*.xaflo.comtrusted) - Added
Check for updatesaction link on the WP plugins.php row
The Xaflo launch.
First stable release. 74 WordPress tools, 23 JWT scopes, auto-backups, audit log, Windows / macOS / Linux desktop builds. Rebranded from wp-claude-bridge internal codename to Xaflo WP Connect.
- Added Pricing, Changelog, Press & Brand pages
- Added JSON-LD schema.org @graph + security.txt + sitemap robot directives
- Added Custom NSIS installer with upgrade detection (preserves settings/tokens on in-place update)
- Added Auto-update on the .exe via electron-updater + differential blockmap
- Fixed pre-built React bundle compatibility (kept legacy
wpcb/v1namespace)
Multilingual + analytics.
WPML + Polylang adapters. 10 analytics endpoints (top posts, no-traffic, keywords, referrers, period comparison, category trends).
Backup + audit system.
Automatic snapshots before destructive writes. Full audit log with payload & actor tracking. wp_backup_restore rollback in one call.
First public preview.
Bridge between Claude Code and WordPress over MCP. 40 tools. JWT auth. Read-only by default.
Update now — plugin 1.4.1 · desktop 1.2.0
Connected sites pick up plugin updates automatically through WordPress’ standard update UI. Xaflo Desktop updates itself. Or grab the latest builds directly.