Megop SEO

Changelog

8.3.0

• Every table and column name that reaches a query now comes from one small class, Megop_SEO_Db, which builds the name itself from a literal list and hands back an empty string for anything it does not recognise. Nothing in the old code was reachable from a request – the names were already literals – but the claim that the interpolated part is only ever a table name was written in a comment, and a reader had to trace every call site to believe it. It is a property of one file now. The three table helpers in the linking, Search Console and analytics modules all delegate to it, and the CSV exporter’s column list and date column pass through the same check before they are used.
• Fixed a query shape that was safe and indefensible at the same time. The index-status screen built a WHERE clause with $wpdb->prepare() and then concatenated that prepared fragment into a string handed straight to get_results(). Each of the five cases is a whole statement now, prepared once, with its own bound values and a bound limit.
• An unknown key given to the Search Console table helper used to raise an undefined-index notice and return null, which then went into a query as an empty table name. It returns an empty string now and the caller stops before the query runs.
• The phpcs:ignore reasons are rewritten. There were 136 copies of one 300-character paragraph explaining why an interpolated table name was safe. That explanation lives in Megop_SEO_Db now, and each suppression carries one short reason. No suppression was removed and Plugin Check still reports no errors and no warnings.
• The donate link is removed. It pointed at the site’s front page rather than at a donation page, so it was a second URL to validate for no benefit.

8.0.2

• Fixed, and this is the one that made the scanner look like it was working: Link Nurse could only see links written as full URLs. The extractor collected every href and src on the page and then discarded anything that did not begin with http, one line later. A link written as /product/name/ – the form the editor produces when you pick a page from the link dialog – was gathered, thrown away, and never checked. On the site this plugin is developed against, 332 of the 1,373 links in published content were stored that way, across 188 of its 364 items: a quarter of every link and half of every page, invisible on every scan since the module was written. Ten of them were internal 301s that a crawler had listed and Link Nurse never had. Relative links are now resolved against the page they sit on, exactly as a browser resolves them, and checked like every other link.
• A repair now rewrites the link in the form the author wrote it. Both forms are kept for each finding: the absolute one, because that is what a status code belongs to, and the stored one, because that is what has to be found and replaced in the content. A redirect fixed on a site-relative link stays site-relative afterwards – absolute against relative is a house style, and a repair has no business changing it.
• Fragments (#section) and non-http targets (mailto:, tel:, javascript:) are recognised and skipped instead of being swept up. Protocol-relative links (//example.com/x) are resolved and checked.
• Fixed: the XLSX export always ended on a 404. The report was written into uploads/megop-seo/ while the browser was sent to uploads/megop-link-nurse/ – one folder apart, with the file correct on disk the whole time. Both sides read one constant now, and if the file is genuinely missing the screen says so instead of navigating away from the results.
• Report filenames carry a random suffix. A report holds the site’s own link data, and a timestamp-only name in a public uploads folder is guessable.

8.0.1

• Fixed, and this is the one worth reading: Link Nurse could not see a single redirected link. Redirect handling sat behind a setting whose own label reads “Rewrite 301/302 to final 200 destination” – a repair switch that had been wired as a detection gate. With it off, the scanner never resolved where a 301 went, the classifier had no destination to judge, and every redirected link on the site was recorded as healthy. A crawl of one real site listed twenty internal 301s inside published posts that Link Nurse had passed over on every previous scan. Detection now always runs, and the setting decides only whether the link is rewritten for you. A redirect found while rewriting is off is listed as Manual, with its destination and a note naming the checkbox that unlocks it.
• Fixed: a redirect that lands on an error page was reported as healthy. The old branch would only speak if the chain ended in 200, so a 301 into a deleted product – the exact shape WooCommerce leaves behind – fell through as though nothing were wrong. It is reported as broken now, with both codes, for example HTTP 301 to 404.
• Fixed: a redirect whose destination could not be established – a chain still redirecting after ten hops, a loop, or a follow request that failed – was treated as fine, and one fallback path assigned a 200 to a destination it had never reached. Those are reported as Manual with the reason stated, and no link is ever rewritten to a target the plugin did not verify.
• The results table shows the destination on every row that has one, not only on rows the plugin intends to rewrite.
• A finding is no longer dropped because the theme prints the link in a different form. Front-page verification now also matches on path and query, so a link rendered with a different scheme, without www., protocol-relative, or as a host-relative href is still recognised.
• Link Nurse’s heading no longer carries a version number of its own. The unified header was still appending it; only the standalone fallback header had been corrected in 8.0.0.

8.0.0

• Fixed, and this is the one that mattered: the Link Nurse settings form never saved anything. Two separate faults, one on each side. In the browser, the whole settings object was handed to URLSearchParams, which stringified it, so PHP received the literal text “[object Object]” where it expected an array, fell back to defaults for every key and answered “Settings saved” – true of nothing. And the module enqueued its own JavaScript with a frozen version constant instead of the file’s modification time, so the corrected file sat on the server while every browser kept running the copy it had cached months earlier. The first fault made saving impossible; the second made fixing it invisible. Both are gone.
• Saving settings now says so. A green tick on success, a red line with the reason on failure, and the form is repainted from what the server actually stored rather than from what was typed – so if a value was clamped, the field shows the stored one and the confirmation is telling the truth.
• Link Nurse can refresh the sitemap, and then follow it. Clearing a sitemap cache tells you nothing on its own, so the button does the second half too: every address the rebuilt sitemap lists is fetched with Link Nurse’s own checker, and anything that does not answer 200 is reported. This reaches a class of problem no content scan can find – a URL listed for search engines but linked from nowhere on the site, such as a category whose last post was deleted. On one real site it found nine dead category URLs and twenty-one redirects the first time it ran. On by default, switchable in the scan settings.
• Fixed: opening the Link Nurse settings panel pushed the progress bar and every counter a screenful down the page, exactly while a scan was running and they were the thing worth watching. The progress bar sits above the panel now.
• Link Nurse no longer prints a version number of its own in its heading. It was a plugin once and it is a module now; the only version that means anything is the plugin’s.
• Persian and Arabic catalogues cover the new strings, so the sitemap screens read in the site’s language from the first run rather than after the next translation round.
• Deactivating the previous internal-linking plugin, offered at the end of the migration, now requires the capability to manage plugins. It was reachable by anyone the keyword-editor setting allowed, which an administrator can widen to author level – correct for editing keywords, far too wide for switching a plugin off.
• The bulk duplicator’s find-and-replace pairs are sanitised before they reach a post title or body.
• Every remaining inline script tag is printed through WordPress rather than echoed by hand, including the tour’s JSON data block, so nothing that filters, defers or adds a nonce to script output is bypassed.
• The uninstaller now also removes Link Nurse’s own options. Its prefix differs from the plugin’s by one letter, so the existing sweep never reached them.
• The plugin page has been rewritten with a full FAQ covering internal linking, bulk editing, broken links and the sitemap check.

7.5.0

• New: Link Nurse can refresh the sitemap, and then follow it. Clearing a sitemap cache tells you nothing on its own, so the button does the second half too: every address the rebuilt sitemap lists is fetched with Link Nurse’s own checker, and anything that does not answer 200 is reported. This reaches a class of problem no content scan can find – a URL that is listed for search engines but linked from nowhere on the site, such as a category whose last post was deleted. On one real site this found nine dead category URLs and twenty-one redirects that every previous scan had passed over. It is on by default and can be switched off in the scan settings.
• Fixed: Link Nurse settings were never saved. The browser sent the whole settings object as one form value, so PHP received the text “[object Object]” where it expected an array, fell back to the defaults for every key, and answered “Settings saved” – which was true of nothing. Values are now sent in PHP’s own bracket notation and arrive as the array the sanitiser expects.
• Fixed: opening the Link Nurse settings panel pushed the progress bar and every counter a screenful down the page, exactly while a scan was running and they were the thing worth watching. The progress bar sits above the panel now.
• Deactivating the previous internal-linking plugin, offered at the end of the migration, now requires the capability to manage plugins. It was reachable by anyone the keyword-editor setting allowed, which can be widened to author level – correct for editing keywords, far too wide for switching a plugin off.
• The bulk duplicator’s find-and-replace pairs are sanitised before they reach a post title or body.
• Two remaining inline script tags are printed through WordPress instead of being echoed by hand, so anything that filters or defers script output can see them.
• The uninstaller now also removes Link Nurse’s own options. Its prefix differs from the plugin’s by one letter, so the existing sweep never reached them.

7.4.3

• Fixed: a fatal “cannot redeclare” error on the automatic-linking screen. The link statistics template declared a helper function at file level, and PHP registers a function declared in an included file globally even when the include runs inside a method – so any request that rendered that template twice stopped the whole screen. The helper is a static method on the report class now, templates declare no functions at all, and the sort links lost a double escaping along the way: the URL is built once and escaped at the point of output.

7.4.2

• New: a Refresh sitemap button on the bulk manager header. Publishing a post clears the sitemap cache on its own; bulk work does not, and the bulk editor is exactly where a hundred rows change without anyone pressing Publish. The button clears whatever the active generator caches – Rank Math, Yoast SEO, All in One SEO – and then reads the sitemap back over HTTP the way a crawler would, the index and every child file, so they are already rebuilt before a crawler asks for them. It reports how many sitemaps were rebuilt and how many URLs they list. It can be switched off under Settings, and it is hidden on a site with no sitemap at all.
• Dark mode is a saved preference now, and it is offered only where it is real. It used to live in the address bar, so it lasted exactly one click: opening the next module dropped the parameter and the screen snapped back to light. It is stored per person now and it stays. The toggle is printed on the bulk manager alone, because the analytics and broken-link modules declare their palettes on :root, where no wrapper class can reach them, and a switch that darkens the frame while every card inside stays white is worse than no switch at all. Those two modules need a stylesheet rewrite of their own, and that is its own release.
• The header no longer turns round when you change language. Direction is taken from the dashboard, so reading these screens in English on a Persian site translates the words and leaves the logo and the controls exactly where they were.
• The settings screen carried a second row of tabs above the form. The Internal Analytics settings are shown underneath the linking settings now, on the one page, with one navigation instead of two.
• The plugin page now describes all five modules in full, states plainly which parts use Rank Math’s fields and which do not, and names the author. Documentation only – no code changed.

7.4.1

• Fixed: Link Nurse and Internal Analytics both registered their admin page under the same slug. WordPress runs every callback registered on a slug, so opening Internal Analytics also printed the whole Link Nurse screen above it. Link Nurse has its own slug now, and each screen prints only its own content.
• Plugin Check reports nothing at all – no errors and no warnings. Input from the bulk editor, the keyword fields and the Search Console screens is unslashed and sanitized at the point it is read, and every remaining notice is a direct query against one of this plugin’s own tables that now carries a written reason a reviewer can check line by line.
• load_plugin_textdomain() is gone. WordPress has loaded the catalogue by itself since 4.6, and the per-user language switch is unaffected.

7.4.0

• Every string with a placeholder now carries a translators comment, so a translator can see what each one refers to before guessing.
• One message had its placeholders in a fixed order, which meant a translation that reordered them would swap the two numbers. Both are now positional.
• Output escaping reviewed at every point of output; inline scripts now go through wp_print_inline_script_tag().
• unlink(), is_writable() and parse_url() replaced with their WordPress equivalents.

7.3.0

• Every screen can now be read in English, Persian or Arabic, and each person chooses for themselves – the choice is stored per user and applies only to this plugin.
• The JavaScript is translated too. Confirmations, live counters and inline messages follow the same choice as the rest of the screen.
• The Link Nurse module folded into the plugin’s own text domain.
• The Analytics module is translatable for the first time; its screens were hard-coded in Persian.
• Catalogues rebuilt with the standard WordPress tooling, complete in Persian and Arabic.

7.2.0

• Index status: ask Google what it knows about each page, grouped by reason.
• A guided tour on every Search Console screen, switchable off per user.
• Every stylesheet rule now lives in one enqueued file.

7.1.0

• Search Console module: per-page keyword coverage, query-level effect measurement, control group and automatic freezing of pages that fall after an edit.
• Persian and Arabic-Indic digits are now folded during matching. On a mixed-script site this alone corrected about a third of the coverage verdicts.
• WooCommerce price is editable in the bulk manager, including variable products.
• Blacklists and whitelists are no longer cleared when settings are saved from an unrelated screen.