The latest documented release is 8.0.2. Free and available now. WordPress.org listing awaiting approval.

8.0.2

Enforce producer byte budgets before Markdown, JSON and link allocations; preserve completeness evidence and avoid caching partial publications.
Clean up worker-owned native cache entries during discovery scans; use supported runtime-only flushes for external caches.
Restore bounded post and metadata cache priming for uncached publications without caching failed database reads as empty results.
Move static ownership to per-path rows with resumable legacy migration, fenced writes and bounded reconciliation and lifecycle cleanup.
Validate identity and imported configuration independently from partial settings forms; use exact-byte conflict detection and rollback only owned changes.
Preserve concurrent settings saves and explicit choices during retired MCP cleanup, static-mode normalization and automatic translation defaults.
Preserve origin response headers and native REST serialization; reject incomplete Cloudflare rule responses and isolate concurrent authorization transactions.
Correct RSS UTC dates, XML character handling, multisite sitemap output, query aliases, canonical decisions and old-permalink notifications.
Report incomplete sitemap and audit scans explicitly; preserve queued edge invalidations and surface backpressure or scheduling failures.
Bound browser delivery checks, fence stale page-search responses and preserve disabled controls during overlapping operations.
Extend local release checks and retain exact candidate, runtime, website and review evidence.

8.0.1

Replace retired MCP mode configuration with an explicit read-only adapter switch.
Delete obsolete settings, migration notices and the unused OAuth upgrade placeholder.
Preserve 8.0 adapter consent and retain deletion-only cleanup for direct 7.x upgrades.
Guard against reintroducing legacy runtime configuration; update setup and migration docs.

8.0.0

Optional WordPress MCP Adapter replaces the custom transport and OAuth stack.
Read-only public discovery/search; removed remote operations and generic ability execution.
Guided setup, explicit migration, remote-capability release gates and matching website guides.

7.5.4

Make public sitemap attribution optional and off by default, including upgrades.
Require frozen candidate validation and evidence-backed policy review before release.
Harden Plugin Check parsing and preserve failed-validation evidence.

7.5.3

Sanitize Quick Setup fields at the request boundary and reject excessive proxy chains.
Escape admin HTML at output while preserving native accessible tooltip controls.
Separate HTML and JSON sinks from reviewed non-HTML protocol emission.
Publish editable asset source links and verify real WordPress input/output behavior.
Include clearer setup icons and the canonical local release/install workflow.

7.5.2

Hardened action authorization and setup survey validation before payload use.
Centralized contextual output, enqueued report CSS, bounded IP hook context, and prepared every IndexNow list value.
Removed reserved transient-option access and added fail-closed source, Plugin Check, artifact, and runtime release validation.
Restored and validated the WordPress 7.1 / PHP 8.2 runtime baseline, including native Cybermaps ability registration.

7.5.1

Added a bounded local internal-link graph using stored published content, assigned classic menus, and active-theme block navigation.
Added potential-orphan, unreachable-from-homepage, and three-plus-click-depth findings with evidence, focused action reports, and exports.
Suppressed link findings when coverage is incomplete and limited trend comparisons to reports with matching complete analysis contracts.
Preserved safe links and headings in Markdown alternates, full LLMS output, and RAG chunks through shared stored-content analysis.

7.5.0

Replaced Guided Setup with a three-step Quick Setup survey covering website type, AI discovery, activity logging versus lightweight delivery, and basic public identity.
Apply bounded site-wide presets and show a settings receipt while preserving advanced configuration outside the setup fields.
Fixed stale setup assets in same-version testing builds, adopted modern React mounting, and removed the placeholder brand mark.
Added generated publication limits and route inventories plus a documentation handoff checked against the exact release commit.

7.4.2

Counted raw candidates before SEO evaluation: briefings share a 250-candidate budget across pinned and ordinary posts; summaries examine at most 1,000 candidates and disclose incomplete coverage.
Fetched inventory batches as complete post rows, retained hydrated objects through URL/title and SEO helpers, primed pinned metadata, and stopped flushing unrelated runtime cache entries between batches.
Serialized cached, forced, full, and localized LLMS generation with durable ownership leases and MySQL session fences where supported; cache invalidation and eviction cannot authorize another owner.
Added a cooperative 20-second generation deadline, early pagination-progress checks, and uncached HTTP 503 responses with Retry-After when a build cannot complete. Failed builds never populate caches or replace static publications.
Corrected candidate-scan reporting when SEO exclusions exhaust the inventory, and isolated localized publication caches.

7.4.1

Improved sanitization of request flags, headers, OAuth callback values, and request paths.
Prepared database column identifiers for OAuth lookups and documented bounded database queries.
Clarified Cloudflare OAuth and specification links flagged by older WordPress Plugin Check versions.

7.4.0

Added opt-in managed .htaccess delivery with ownership-safe removal and routing diagnostics.
Added per-publication server-side evidence and manual public inspection links.
Corrected Cloudflare media types and root publication coverage.
Fixed report comparison SQL parameters and exception handling.
Fixed LLMS inventory pagination and expanded bounded full-corpus publication.

7.3.4

Fixed cross-site origin caching for /ai-discovery without changing its public URL.

7.3.3

Added an ownership-safe /ai-discovery fallback for origins with unpurgeable path caches.

7.3.2

Isolated APCu and shared object-cache entries across independent WordPress installations.

7.3.1

Fixed the Advanced Cloudflare eligibility control fatal and confirmation-row visibility.

7.3.0

Added opt-in, expiring redacted diagnostics/support bundles; renamed System Status to Debugging.

7.2.2

Disabled Cloudflare mutations when proxy traffic is not detected, with an exact-host, page-scoped manual confirmation for advanced deployments.

7.2.1

Fixed recoverable OAuth completion, canonical rule paths, and automatic browser-visible verification with per-resource diagnostics.
Added Cloudflare execution proof and complete OAuth metadata cache bypass.

7.2.0

Added public Cloudflare OAuth with PKCE, account consent, automatic combined rule installation, immediate token revocation, and no stored credential.
Added a bounded open-source callback relay, ambiguity-safe zone selection, OAuth lifecycle status, and a one-time-token fallback.
Added self-managed Cloudflare OAuth for organizations that want the callback, PKCE transaction, code exchange, and token revocation to remain on WordPress.

7.1.0

Added System Status with stack detection and explicit optimization-utilization evidence.
Added one-time-token Cloudflare header and cache-safety automation plus default-on LiteSpeed and APCu controls.
Unified edge diagnostics with the static publication header contract and added scoped Cybermaps-only cache invalidation.

7.0.1

Added ownership-safe .well-known fallbacks with explicit conformance status.
Unified OAuth metadata, bounded LLMS scans, and fixed duplicate-header diagnostics.

7.0.0

Raised the minimum to WordPress 7.1 and added a native public Ability kernel shared by MCP, WebMCP, API Catalog, OpenAPI, and ARD discovery.
Replaced nested well-known configuration with exact WordPress global rewrite rules, removed physical well-known defaults, and retained ownership-safe cleanup and public verification.

6.6.1

Added automatic ownership-safe /.well-known/ routing for header-sensitive discovery endpoints on compatible Apache and LiteSpeed servers.
Added public GET/HEAD verification and explicit blocked-before-WordPress diagnostics without substituting wrong-MIME static files.

6.6.0

Added enriched per-API RFC 9727/RFC 9264 Linksets and a public REST health endpoint.
Added OAuth metadata, optional RFC 8628 device approval, and opt-in Auth.md without unsupported OIDC or fabricated JWKS claims.
Added the experimental current MCP Server Card, draft ARD AI Catalog, and opt-in read-only WebMCP with explicit maturity guidance.
Added server/cache/CDN rules and Configured, Advertised, Publicly verified, and canonical-interception diagnostics.

Read the complete plugin release history for earlier versions.