EDH Restricted Site

Changelog

2.1.2

• Documentation only, no code changes: corrected a stale pre-2.0.0 shortcode in README.md and brought its feature and setup lists back in line with this file.

2.1.1

• Fixed a fatal error in wp-admin for any logged-in user without the manage_options capability — an Editor, Author or Subscriber opening the dashboard got a white screen. add_options_page() returns false for them, and assigning that to a string-typed property is a TypeError under strict types. Present since 1.5.x, not new in 2.1.0.
• Applied the same guard to the settings option read, which would otherwise fatal on every request rather than only in wp-admin if the option row were ever corrupted.
• Fixed an infinite redirect loop on an unconfigured install — with no unrestricted pages set, the access-denied redirect pointed at a page that was itself gated. The gate now fails closed with a 403 message instead of looping.

2.1.0

• Security: fixed a bypass that let anyone unlock the whole site by setting the access cookie to an arbitrary value — it was only ever checked for presence, never validated. Cookies are now signed with wp_salt('auth') and verified on every request.
• Verification links no longer carry the visitor’s email address, keeping it out of browser history, access logs and Referer headers. Requesting a second link no longer invalidates the first.
• Added configurable rate limiting on verification emails — per address and per IP address, either settable to 0 for no limit.
• The plugin is now fully translatable; previously no string used the declared text domain.
• The administrator bypass now checks the manage_options capability rather than the administrator role name, so multisite Super Admins are covered.
• Further plugin-review fixes: allowed-domain validation, output escaping in the form, no email address in the “failed to store token” error log, removed the empty Plugin URI: header.
• Expired options-table fallback tokens are now cleaned up by the existing daily cron event.

2.0.0

• Renamed every global identifier prefix from edh/edh_rs to edhrs (options, log table, cookie, shortcode, AJAX action, cron hook, classes, constants) per WordPress.org plugin review requirements. Breaking: existing installs lose their saved settings and log history when updating – reconfigure under Settings → Restricted Site.
• The shortcode is now [edhrs_verification_form].
• Removed the “If you get stuck, email…” line from the verification email.
• Added a “Button text colour” setting, controlling the text colour of both the frontend form’s submit button and the email’s “Verify Email Address” button. The “Button colour” setting now also applies to the email’s button.
• Verification email styles are now fully inline for better email-client compatibility.
• Additional input-sanitization and SQL-hardening changes from the WordPress.org plugin review.

1.5.5

• Fixed a “Text Domain” typo (edh-resticted-site → edh-restricted-site) and renamed the main plugin file to match.

1.5.4

• Added a “Back to Settings” button to the Logs page.

1.5.3

• Fixed the Logs page showing no heading above the table.

1.5.2

• Fixed two more Plugin Check warnings from 1.5.1’s log-viewer query fix.

1.5.1

• Fixed remaining Plugin Check warnings from 1.5.0’s log-viewer queries.
• “Restricted Site Logs” is no longer a separate entry in the Settings menu – use the “View Logs”/”Logs” links instead.

1.5.0

• Added a verification-request log (Settings → Restricted Site Logs): email address, requested date, Pending/Used/Expired status, and used date for every successful verification send.
• Added a “Log retention (days)” setting – old entries are purged automatically.
• Added “Settings”/”Logs” links on the Plugins screen and a “View Logs” link on the Settings page.
• Added uninstall cleanup for the new log table and its scheduled task.

1.4.0

• Replaced the fixed-palette button colour picker with WordPress’s native colour picker, accepting any valid hex colour.

1.3.0

• Fixed an edge case where the static front page or “posts page” couldn’t be correctly selected as an unrestricted page.
• Hardened the access check against caching plugins/CDNs serving a gated response to the wrong visitor.
• Added optional debug logging for diagnosing access-check behaviour.

1.2.2

• “Unrestricted pages” and “Access denied page” now only offer published pages.
• Renamed the “Default page” setting to “Access denied page” for clarity.

1.2.1

• Fixed a remaining Plugin Check input-sanitization warning on the verification link’s email parameter.

1.2.0

• Added an explicit “Access denied page” setting for where visitors without access are sent, replacing the previous implicit reliance on the first selected unrestricted page.
• Fixed several WordPress.org Plugin Check compliance issues (block API version, output escaping, input sanitization, packaging).

1.1.0

• Added a “Button colour” setting, chosen from WordPress’s default editor colour palette.
• Fixed the verification form’s stylesheet not loading in the block editor.

1.0.0

• Initial release.
• Email verification flow with a domain allow-list, shortcode and Gutenberg block, and cookie-based access passes.
• Admin settings page for allowed domains, unrestricted pages, redirect-after-verification page, sender email address, and cookie duration.
• Verification tokens stored as transients with an automatic options-table fallback for reliability.