Rankfluent AI – SEO Content & Translations

Changelog

3.7.7

• Security: the cost-estimate AJAX endpoint now also requires the edit_posts capability (it had a nonce check only), so the configured model and pricing are only disclosed to users who can edit content.
• Security: the WPML-proxy callback route validates its token in the REST permission_callback instead of inside the handler, and declares its argument types.
• Security: the redirect to Stripe Checkout now goes through wp_safe_redirect() with checkout.stripe.com temporarily allowed for that one redirect, and the URL returned by the Rankfluent AI service is validated (HTTPS, expected host) before redirecting. Any other host falls back to the Account page.
• Added: uninstall.php. Deleting the plugin now removes its options and stored keys, transients, plugin post meta, the queue table, scheduled tasks (WP-Cron and Action Scheduler) and its roles and capabilities, on every site of a multisite network. Deactivating still keeps all data.
• Added: the queue processing interval (2 minutes by default) can be changed with the f4y_seo_queue_interval filter (minimum 60 seconds).
• Added: the “External services” section now also describes the Stripe Checkout redirect used for payments, and the FAQ explains what deactivating and deleting do.
• Developer: every remaining PHPCS suppression carries a written justification; dead json_encode fallbacks were replaced with wp_json_encode(); strict in_array() comparisons; the WordPress integration test now verifies that deactivating keeps data and that deleting removes everything.

3.7.6

• Fixed: with WooCommerce active, every page load with WP_DEBUG enabled logged “as_has_scheduled_action() was called before the Action Scheduler data store was initialized”. The plugin re-checked its cron schedule on plugins_loaded, before Action Scheduler had set up its data store on init. The check now runs on init, and every Action Scheduler call first verifies the data store is ready.
• Developer: the WordPress integration test now installs WooCommerce, enables WP_DEBUG logging, loads the front end and admin, and fails on any notice from the plugin.

3.7.5

• Fixed: the Open Icecat terms link in the source list pointed at a page that no longer exists. It now points to Icecat’s User Terms of Service, with the Open Content License — the licence Open Icecat data is actually distributed under — listed separately, matching how the other sources are described.

3.7.4

• Security: the queue list table built its ORDER BY clause by interpolating the orderby and order request parameters straight into the SQL string. The queries are now written out in full, one literal statement per combination of status filter and sort direction, so no variable appears in the SQL string at all. The sort column is looked up in a fixed allowlist and passed to $wpdb->prepare() as an %i identifier placeholder, the status filter as %s and the paging as %d — in a single prepared statement instead of a prepared fragment nested inside another query.
• Security: every remaining query in the plugin was reviewed and rewritten the same way — table names are %i identifiers and all values are placeholders, so no query interpolates a variable into its SQL any more.
• Changed: Tested up to WordPress 7.1.
• Developer: the test suite now runs the list table with hostile orderby, order and status values and asserts they never reach the SQL, and checks every queue query for a placeholder/argument mismatch.

3.7.3

• Fixed: the Account & Credit page died with a fatal error on every site not running in Dutch. Two translations were transposed in the English, German, French and Spanish language files, leaving one of them a placeholder short, so printf() threw. The page loads again in all five languages.
• Developer: the translation build now compares the placeholder count of every translation against its source string and fails on a mismatch, so a transposition cannot ship again.

3.7.2

• Changed: completed translation jobs are assigned to WPML’s classic translation editor again, also on ATE sites. Assigning them to the Advanced Translation Editor (3.7.1) produced exactly what WPML’s architecture dictates: the ATE builds its cloud job from the source text and can only show translations created inside the ATE itself — externally made translations appear as untranslated, with at most translation-memory suggestions, and completing such a half-empty session would overwrite the finished translation on the site. WPML support confirms this is by design (“do not mix translation methods”). The classic editor shows every segment filled at 100% and is the safe place to review. Assigning jobs to the ATE anyway (memory suggestions only) is possible with add_filter( 'f4y_seo_wpml_open_jobs_in_ate', '__return_true' ).
• Changed: the WPML admin page now explains this WPML limitation honestly, including the warning not to complete Rankfluent translations inside the ATE.

3.7.1

• Fixed: completed translation jobs opened in the Classic Translation Editor instead of the Advanced Translation Editor. Completing a job assigned it to WPML’s own editor (the v3.6.0 workaround that let WPML clone the job to the ATE cloud on opening) — but WPML also respects that assignment when opening, so on an ATE site the pencil icon went to the classic editor and the clone step was never reached. On sites where the ATE is the configured editor, a completed job is now assigned to the ATE (after clearing the stale reference to the empty cloud copy), so opening it lets WPML create the cloud copy including the translated segments. Sites using the classic editor keep the previous behaviour. Opt out with add_filter( 'f4y_seo_wpml_open_jobs_in_ate', '__return_false' ).

3.7.0

• New: translations now run through a WPML-style translation service (Translation Proxy, option 1 of the ATE integration research). The segments of the WPML translation job are sent as an XLIFF package to the Rankfluent translation service, translated in the background and automatically written back as a completed WPML job — so the Advanced Translation Editor shows the translation at 100% and large pages or many languages no longer strain your site.
• New: a completion callback from the translation service starts the queue immediately, with the regular queue polling as fallback — a missed callback can never lose a translation.
• New: on the “WPML AI translations” page you can see the service status and switch the translation-service route on or off; when it is off (or unavailable) translations are processed directly, exactly as before.
• Changed: the queue shows “Waiting for the WPML translation service” while a translation is being processed remotely, and gives up with a clear message after 12 hours.

3.6.0

• Fixed: the Advanced Translation Editor still showed 0% even though the translation was correct on the site. The Advanced Translation Editor is a cloud service (ate.wpml.org) and shows its own copy of a job, not the one stored on your site — so filling a job locally could never appear there. Completed jobs are now handed to WPML’s own translation editor, and when you open such a job in the Advanced Translation Editor, WPML copies it — translations included — to the cloud at that moment. The translation is visible either way.
• New: when the translation-job route is skipped, the debug log states why (WPML not active, Translation Management not loaded in this context, a missing hook, or switched off by filter). A silently skipped route was indistinguishable from one that ran.

3.5.3

• Fixed: a segment whose stored data could not be decoded was written back empty, which would have wiped that field instead of leaving it untranslated. The raw value is now kept.
• Tests: the whole translation route is now exercised end to end against a simulated WPML — job lookup, segment reading, batching, prompt, reply parsing and delivery — including a renumbered reply, a truncated reply and a middleware error. Both failure cases are asserted to save nothing at all.
• Tests: the classic (non-job) response parser is covered again; it had been rewritten onto a shared decoder without any test guarding it.

3.5.2

• Fixed: a page could still fail to translate even when every segment came back. The AI sometimes renumbered the segment keys from 0-based to 1-based; the count then matched, but the first key was missing and the whole batch was rejected. The reply is now accepted in any sensible key form, while an incomplete reply is still refused.
• Changed: segment keys are prefixed (“s0”, “s1”) so they are far less likely to be renumbered in the first place.
• Changed: the error now names what actually went wrong — truncated, unexpected keys, or unusable JSON — instead of assuming truncation. Those need different fixes, so it should not be a guess.

3.5.1

• Fixed: long pages failed to translate. All segments of a page went to the AI in a single request, so a long page-builder page produced a reply that ran into the model’s output limit and came back truncated. The whole page then failed, in every language, every retry. Segments are now sent in batches, so a large page translates normally.
• Changed: when a reply is unusable, the error states how many of the requested segments came back and which batch it was — a truncated reply is recognisable at a glance instead of only “invalid JSON”.
• Changed: the cost of AI calls already made is recorded on the queue item even when a later batch fails.

3.5.0

• New: translations now run through WPML’s own translation jobs. Rankfluent asks WPML for the segments it extracted from the page — title, text, page-builder strings, media names, SEO fields — translates exactly those, and writes them back as a completed job. The Advanced Translation Editor therefore shows the translation filled in at 100%, and you can open and refine it there like any other translation.
• Changed: WPML builds the translated page itself from the completed job, using its own integrations for page builders, media and SEO. The plugin no longer has to reassemble page-builder layouts by hand.
• Changed: because such items belong in the translation editor again, the preference for the WordPress editor (added in 3.4.0) is cleared for them.
• Compatibility: the route only activates when WPML’s translation-job API is present; on other setups the plugin falls back to the previous behaviour unchanged. It uses only WPML’s published hooks (wpml_tm_load_job_factory, wpml_translation_job_id, wpml_get_translation_job, wpml_save_translation_data) and never writes to WPML’s tables directly.
• Developer note: the route can be switched off with add_filter( 'f4y_seo_wpml_use_job_route', '__return_false' );.

3.4.0

• Fixed: opening a Rankfluent translation in WPML’s Advanced Translation Editor showed empty segments and 0%, even though the translation was live on the site. Rankfluent saves a translation as a full translated post; the Advanced Translation Editor works from translation jobs made of separate segments, and no such job exists. Translated items are now set to the regular WordPress editor, which opens the translation with its text in it.
• Fixed: saving such an item in the Advanced Translation Editor wrote those empty segments over the existing translation. That no longer happens by accident, because the item opens in the WordPress editor.
• New: the WPML page explains how Rankfluent stores translations and which editor to use, and shows which translation editor WPML is set to.
• New: the debug report includes the WPML version and the configured translation editor — the first question in any translation issue.
• Developer note: the editor preference can be switched off with add_filter( 'f4y_seo_wpml_force_native_editor', '__return_false' );.

3.3.2

• Fixed: translations were paid for and then thrown away. When WPML had no translation group (trid) for the source post, the plugin only discovered this after the AI had already translated the item — the result could not be stored and the item ended in error. The check now runs before the AI call, so nothing is spent on work that cannot be saved.
• Fixed: content that WPML never registered (imported posts, WP-CLI, content predating the WPML install) now gets its translation group created on the spot, exactly as saving the post in the admin would. Those items translate normally again instead of failing.
• Fixed: the debug log did not record AI calls at all. Generation and translation requests bypassed the logging wrapper, so a report full of queue errors showed no matching request — the slowest and most expensive calls were the only invisible ones. All middleware requests are now logged.
• Changed: “Cannot determine the WPML translation group of the source post” is replaced by an explanation that names the post type and says what to do — either set the post type to translatable in WPML, or open and save the post once so WPML registers its language.
• Changed: WPML problems (post type not translatable, no translation group, save failure) are no longer retried automatically; retrying does not help until the setting is changed.

3.3.1

• Changed: a job that Rankfluent AI has cancelled is now treated as final. The queue shows the reason for the cancellation as the error message and does not retry on its own — you decide whether to offer the item again. Cancelled jobs are never charged.

3.3.0

• New: when you start a translation job — a single item or a combined one — a dialog asks how it should be processed, with both prices and both lead times side by side: direct (starts right away, full rate) or bundled (one batch to the AI provider, 50% cheaper, up to 24 hours). The choice is made per job; there is no silent default.
• New: the cost estimate now returns both prices, so the difference and the saving are visible before you commit. If your credit does not cover direct processing but does cover bundled processing, the estimate says so instead of only refusing.
• New: the queue shows per row which processing route was chosen, so a translation that is still pending after an hour explains itself.
• New: automatic translation on publish or update has its own processing setting per post type, defaulting to direct — content that goes live now should not wait a day for its translations.
• Changed: asking for direct processing on an item that is already queued as bundled moves it out of the batch route; the reverse never happens.

3.2.3

• Changed: when batch processing yields no result within 26 hours, the queue message now explains what to do (an administrator can switch off batch mode for the site, after which translations are processed immediately) instead of only stating the timeout.
• Fixed: the queue hid the “Error message” column at all times, so a list full of failures explained nothing. The column now appears as soon as any item on the page has a message.
• New: the most common error message is shown above the queue with the number of items sharing it — the answer to “why did everything fail?” without paging through the list.
• New: translation jobs show their target language next to the title, so the same post queued for several languages is no longer a row of identical entries.

3.2.2

• Fixed: on sites with many target languages the debug log filled up with translation diagnostics, pushing out the HTTP calls and error messages that matter. The per-translation line is now only logged for page-builder content, and the log keeps 500 entries instead of 150.
• New: the debug report now opens with the queue counts, the cron status and the ten most recent queue error messages, so a shared report explains itself without digging through the queue.

3.2.1

• Fixed: the dashboard reported “Cron not scheduled” even when queue processing was scheduled through Action Scheduler — the check only looked at WP-Cron. All screens (dashboard, dashboard widget, queue page) now recognise both schedulers.
• Fixed: when Action Scheduler was available, the queue hook was scheduled there instead of WP-Cron. An external cron job calling wp-cron.php then had nothing to do and the queue stalled. The hook is now always scheduled in WP-Cron, with Action Scheduler as an extra engine.
• New: the queue records when processing actually ran, so the diagnostics can tell a scheduled-but-never-executed cron apart from a healthy one — including a hint about DISABLE_WP_CRON and external cron jobs.
• New: “Reschedule cron” button in the dashboard diagnostics; it clears a broken schedule and registers it again, and reports the resulting state.

3.2.0

• Improved: centrally revoked Product Intelligence rights now take effect within minutes — the deny list is refreshed on every rights check (with a short lock so at most one refresh per minute), not only when the admin page is visited.
• Security: fail-closed rights — if a centrally managed site cannot verify its rights status with the middleware for more than six hours, mutating Product Intelligence rights are suspended until verification succeeds; viewing stays available.
• Fixed: applying a proposal could overwrite text that a shop manager typed into a field that was still empty when the proposal was created. The approval form now shows the real current value of every field and sends a fingerprint of what the reviewer saw; any change between review and apply counts as a conflict and the field is skipped.
• Fixed: field decisions are reported to the middleware only after the local apply step, so a field that hits a concurrency conflict is registered centrally as rejected — never as approved while it was not applied locally.
• Improved: the “analyzed” marker is now sensitive to brand, category and variant identifier changes (besides EAN/MPN), expires when critical facts pass their TTL, and the backfill re-detects products whose central research has been updated since (newer research version), using the free quote endpoint.

3.1.1

• Changed: the automatic-translation option is now labelled “Translate automatically on publish or update” and its description clarifies who does what: Rankfluent AI performs the translation (using your AI profile and protected terms) and stores the result as a native WPML translation — WPML itself does not translate anything and no WPML translation credits are used.

3.1.0

• New: WordPress dashboard widget — connection status and balance, clickable queue statistics (pending/failures/completed), the next scheduled offering, and quick links to the queue and settings.
• New: automatic translation with WPML — enable per post type in Settings → Post types; publishing or updating a source item automatically queues translation jobs into all WPML target languages (existing translations are updated with the new source content).
• Fixed: usage costs showed as 0.0000 — a missing format specifier caused the stored price to be truncated to a whole number; costs of completed items are stored correctly again from now on.
• New: bulk actions in the queue — select multiple rows and requeue or delete them in one go (checkboxes with the standard WordPress bulk-action dropdown).
• New: one-click sweep buttons above the queue — “Requeue all failures (n)” and “Clean up completed items (n)” (the generated content itself is never touched).
• New: the queue shows when the next scheduled offering happens — how many items are waiting for a retry or batch result and when the first one becomes available, next to the existing cron countdown.
• Fixed: row actions (resume, pause, delete) are now handled before any admin output, so their redirects work reliably on every hosting configuration.

3.0.3

• Fixed: bulk translations no longer fail permanently on “too many requests” — the real middleware error code (such as rate_limited) now reaches the queue’s retry classification for translations and generations alike.
• Improved: when the rate limit is hit, the queue puts the current item back without counting an attempt, pauses the run briefly and continues automatically — instead of pushing the remaining items into the same limit.
• Improved: batch submissions (asynchronous, discounted processing) get four times the request budget on the Rankfluent AI service, since submitting a batch job does not perform any AI work yet.

3.0.2

• Fixed: the “Save settings” button on the Integrations tab did nothing — the Google Search Console card rendered its own form inside the main settings form, and browsers drop nested forms, leaving the save button outside any form. The Google card now renders after the main form.

3.0.1

• Fixed: enabling debug mode (and submitting any form on the Support page) resulted in a blank screen — form handling now runs before any admin output, so the redirect works reliably.
• Fixed: the plugin interface language setting had no effect — the bundled translations (en/de/fr/es) are now loaded explicitly, and switching language applies immediately.
• Fixed: the site name is now always protected in AI translations as a brand name, in addition to the manual protected-terms glossary.
• Improved: “Start queue now” explains why nothing was processed — items waiting for a scheduled retry or batch result (with the next availability moment and last message) or a database problem with the queue table, in the button feedback and the debug log.
• Improved: Elementor translations are transparent — the debug log records the detected builder and the number of text segments per translation, and a completed queue item shows a warning when the translated segments could not be placed back.
• Fixed: the subscription card on “Account & Credits” is now also hidden for SEO customers (everything included, pay per use); the Rankfluent AI service also refuses the checkout for those accounts.

3.0.0

• New: Product Intelligence for WooCommerce — research products by EAN/GTIN (or brand + MPN, or brand + model) in public product sources and enrich them with verifiable product facts. The feature is enabled per site by Rankfluent AI and requires an explicit acceptance by an administrator before first use.
• New: data sources, consulted through the Rankfluent AI service — Open Icecat (specifications, brand data, images), Open Food/Beauty/Pet Food/Products Facts (ODbL), EU Safety Gate (recalls and safety notices), optionally TecDoc/TecAlliance for automotive parts, and — when an administrator configures them — official manufacturer pages and Verified by GS1. Sources can be switched on and off per site.
• New: central product database — neutral, verifiable product facts (GTIN/EAN, brand, product name, specifications, category) are stored across customers, so a product researched once is a cheaper “database hit” for everyone. Your own texts, prices, stock and internal data are never part of it.
• New: product credits with a quote up front — per product you see whether it is new research or a database hit, credits are reserved when a job starts and settled on completion, and a monthly budget per site blocks jobs that would exceed it.
• New: proposals with approval, per-field before/after and full rollback — approved fields are written to the product, the previous values (including tags, categories and brand terms) are kept as a changeset, and one click restores them. Optimistic concurrency skips fields that were edited by hand after the proposal was made.
• New: critical fields need a separate permission, and a product with an unreviewed EU Safety Gate notice is blocked from applying any field until someone with that permission has reviewed the notice.
• New: catalogue scan — upload your entire catalogue for a free report (database hits, new research, products without an identifier, invalid EANs, duplicates) with a quote and a CSV export; processing only starts after you agree, and the scan can be paused, resumed or cancelled.
• New: image import with rights check and attribution — images are only offered when the source licence allows publication, are imported after explicit selection (with optional alt text), are deduplicated on their source URL, and keep their attribution (“Specs Icecat”, ODbL) which is shown on the product page. Imported images can be removed again in one action.
• New: NL/EN content — the applied product content follows the language of your shop; all configured languages are kept centrally, and available translations are shown with the proposal.
• New: product-oriented roles and capabilities — Product manager, Content manager, Reviewer and Read-only, with the capabilities view, run, approve, approve critical, rollback and settings. Capabilities revoked centrally in the portal are also blocked locally, administrators included.
• New: Product Intelligence metabox on the WooCommerce product screen — identifier (GTIN or MPN fallback), analysis status, stale detection when the EAN/MPN changed after the analysis, sources used and the number of applied changesets, without any API call while loading the editor.
• New: live progress via SSE with a polling fallback, an idempotency key per start (a network retry never starts a second job or a second reservation), and backfill in rounds of at most 500 products.
• New: GPSR fields (manufacturer, responsible person, safety information and warnings) are proposed and stored per product for EU product-safety compliance.
• New: findings are written as native WooCommerce data — product attributes in _product_attributes, the product_brand taxonomy for brand (with a product attribute as fallback), real product tags and existing product categories; new categories are never created blindly.
• New: WordPress privacy exporter and eraser cover Product Intelligence — the acceptance record and the decision-maker entries in the local version history are exported for the requested user and anonymised on erasure; the suggested privacy policy text explains what is sent to the service and what is stored centrally.
• Compatibility: WordPress 6.4 or newer (tested up to 7.0), PHP 8.2 or newer, and WooCommerce for Product Intelligence — the “Global Unique ID” field requires WooCommerce 9.2 or newer, with the common EAN/GTIN plugins and brand + MPN as fallbacks.

2.18.0

• Changed: all admin JavaScript is now loaded via wp_enqueue_script() (no inline <script> blocks left).
• Changed: AJAX actions, admin-post actions, cron interval name, script/style handles and cache keys now consistently use the f4y_seo prefix to avoid naming collisions.
• Changed: translation loading now relies on WordPress.org language packs; bundled .po/.mo files and the load_plugin_textdomain() call were removed from the WordPress.org build.
• Fixed: the Terms of Service and Privacy Policy links now point to the correct pages (https://www.rankfluent.online/legal/terms/ and /legal/privacy/).

2.17.5

• Fixed: no more “translation loading was triggered too early” notice on WordPress 6.7 and newer. Translations are now loaded at the very start of init, and the cron interval label is only translated once translations are available.

2.17.4

• Changed: the plugin text domain is now rankfluent-ai-seo-content-translations, matching the WordPress.org plugin slug. Translations are unaffected; all language files were renamed accordingly.

2.17.3

• Security: secret storage is now fully fail-closed — if the server has neither Sodium nor OpenSSL, secrets are never written in plaintext; saving is refused with a clear message and Site Health reports the missing crypto backend.
• Developer: the release workflow now writes provenance with an exact per-artifact digest (full and lite ZIP as separate subjects, validated JSON).

2.17.2

• New: staged monthly-budget warnings on the dashboard at 50/75/90/100% of your spend cap, powered by live usage data from the service.

2.17.1

• Security: secrets (site key, account and refresh tokens) now fall back to OpenSSL AES-256-GCM encryption when the PHP Sodium extension is missing — never plaintext. Without any crypto backend the refresh token is not stored at all and Site Health reports a critical issue.
• Security: the release workflow now refuses to publish unsigned builds (fail-closed signing).
• Changed: minimum WordPress version raised to 6.4 (the oldest version covered by our test matrix).
• Developer: CI now also tests against MariaDB 10.11 and runs the full test suite without Sodium; the auto-committed ZIP was removed from the repository (releases are built reproducibly by the release workflow).

2.17.0

• New: setup step 3 now first asks whether you use the plugin privately or as a business — private users no longer need to enter a company name or VAT number.
• New: every new account starts with a one-time welcome credit so you can try the plugin straight away (granted once per website, server-side).
• New: the plugin now shows its own icon in the WordPress plugin list, on the updates screen and in the plugin details dialog.
• Improved: dashboard refreshed — colourful “What do you want to do?” action tiles with short descriptions and subtle hover effects on the stat cards.
• Improved: setup wizard polish — step 1 cards are now aligned and centred, and in step 2 the site URL appears on its own line under the button.
• Changed: complete rebrand to Rankfluent AI — all contact details now point to info@rankfluent.online and www.rankfluent.online.

2.16.2

• Improved: refreshed look and feel across every admin page — orange accent on page headers, calmer cards, modern tables, consistent form fields with an orange focus ring, and subtle button/alert polish. All pages remain in the menu and fully accessible.
• Developer: a menu regression test now guarantees that every admin page registers with and without WPML, so the 2.16.0 menu bug can never silently return.

2.16.1

• Fix: menu items after “Translations (WPML)” (Account & Credit, Usage, Settings, Support) were hidden on sites without WPML due to a misplaced condition in 2.16.0 — all menu items are visible again.
• New: existing sites with a standalone site key (from before the account system) can now migrate — the Account page offers sign-in/registration and a one-click “Link site to my account” button; the site keeps working throughout.

2.16.0

• New: guided onboarding — after activation you are taken straight to a friendly four-step setup wizard (sign in or register, connect this site, company/billing details, preferences). A gentle reminder appears on every Rankfluent page until setup is complete.
• New: company/billing details collected during onboarding are stored with your Rankfluent account for invoicing.
• New: redesigned dashboard with a personal welcome, a getting-started checklist that ticks itself off, and a clear next-best action.
• Improved: menu reorganised into a logical order …