Muri Link Tracker

Changelog

2.0.0

• New (Affiliates): dedicated Affiliates tab with at-a-glance stats, prioritized action list (broken / missing rel=”sponsored” / missing FTC disclosure), and per-network breakdown. Each card pre-filters the Links tab on click.
• New (Affiliates): bulk add rel="sponsored" with dry-run preview — see exactly which URLs will be patched before confirming. Edits the live post_content silently (no revision, no post_modified change).
• New (External links): bulk add rel="nofollow" for external links, symmetric to the sponsored flow. Dry-run preview + silent post update + sample list of patched URLs.
• New (Links table): dedicated Rel column with NF / SP / UGC / DF badges aggregated per link, plus DataViews filter with positive (Has rel="nofollow") and negative (Missing rel="nofollow", Missing rel="sponsored") options — easily spot links you forgot to annotate.
• New (Bulk rel): “Add rel=sponsored” / “Add rel=nofollow” now apply to every link you explicitly select, even ones auto-detection did not flag as affiliate or external — so you can override a missed classification. The automated “Fix all missing rel” flows still target only detected affiliate/external links.
• Fix (Edit Link): manually editing a link’s Rel attribute now updates the plugin’s Rel column and filters immediately, instead of staying stale until the next scan (the post content was always updated correctly; only the in-plugin index lagged).
• New (REST): rel_missing query param on /links and /links/export (nofollow|sponsored|ugc). New endpoint GET /links/externals/missing-nofollow returns IDs of external links lacking rel="nofollow". GET /links/stats exposes a new externalsMissingNofollow counter.
• New (Affiliates): FTC disclosure alert — flags posts with N or more affiliate links missing any of the configured disclosure phrases (e.g. “As an Amazon Associate I earn from qualifying purchases”). Cache invalidated on scan complete.
• New (Edit Link): SelectControl to open links in a new tab (target="_blank"). Automatically adds noopener noreferrer to the rel for security and Google compliance.
• New (Multilingual): Polylang and WPML adapter pattern. /links and /links/export accept a language filter. New GET /languages endpoint. Filter chip in the Links table appears only when a multilingual plugin is active.
• New (Filters): Errors (401, 403, 5xx, network/SSL) and Timeout quick-filter buttons in the Links toolbar — these statuses were previously buried in “All”.
• New (Export): rebuilt export modal — choose CSV or JSON, pick exact columns, apply date range, and select between Full / AI Analysis / Minimal presets.
• New (Export): JSON export endpoint suitable for LLM ingestion — camelCase keys, decoded redirectChain, ISO 8601 datetimes, envelope with version and exported count.
• New (Export): 17 available export columns including created_at, languages and a decoded redirect_chain.
• New (REST): /links and /links/export now accept created_at_from/to, last_checked_from/to ISO 8601 ranges, language and affiliate_network filters. New GET /links/stats adds affiliateMissingSponsored counter and affiliate_broken_count in byCategory.
• New (Admin notice): SchemaNotice detects when a v1.x → v2.0 upgrade left the mltr_instances table without the new post_language column and offers a one-click “Retry migration” button. Prevents silent data loss on rescan.
• UX: in Settings, list-like fields (post types, excluded URLs, FTC disclosure phrases) now preserve spaces and trailing newlines while typing — parsing happens only on Save.
• UX: clearable banner above the Links table when navigation from the Affiliates tab applied a filter (“Show all links” resets to full inventory).
• Security: requested export columns are whitelisted against the schema — unknown column names are silently dropped. Bulk endpoint max-items raised to 500 to support the “Fix all rel=sponsored” flow.
• Security (SSRF): the link checker now re-validates every redirect hop and blocks redirects to private, loopback, link-local, or IPv6 unique-local addresses — including AAAA-only hosts and the cloud metadata endpoint — closing a gap where a public URL could redirect inward.
• Reliability: the recurring stale-link recheck and weekly orphan cleanup are now actually scheduled on activation (previously wired up but never registered, so both ran as no-ops).
• Internationalization: PHP and React admin translations now load from the bundled /languages catalogs (the text domain and script translations were not being registered).
• Performance: link checking scales to very large inventories without exhausting memory — pending and stale work is now queued by ID instead of materializing every link object — and a new composite (status_category, last_checked) index speeds up the pending lookup.
• Robustness: a single post that fatally crashes the scan worker (e.g. an out-of-memory parse) is now skipped after a few attempts instead of making Action Scheduler retry the same batch forever.
• UX: “Fix all” bulk actions are chunked under the 500-id REST cap so they complete on large sites; failed link loads now surface an error notice instead of an indistinguishable empty table; dates in the Links table are localized to the site locale.
• Backwards compatible: integrations calling /links/export without format or columns continue to receive the same CSV as v1.1.0. PUT /links/{id} without target keeps the attribute as-is.

1.1.0

• Tested with WordPress 7.0 (new “Modern” admin theme palette supported).
• Security: stricter URL scheme allowlist and DNS resolution cache to reduce DNS rebinding TOCTOU window during HTTP checks.
• Security: hardened REST validation on PUT /links/{id} (URL validated via wp_http_validate_url(), rel filtered against the allowed token list).
• Security: rate-limit added on CSV export endpoint (HTTP 429 if triggered more than once per 30 seconds).
• Performance: link and instance bulk inserts now use multi-VALUES batched statements (~90% I/O reduction on large scans).
• Performance: new composite index (post_id, link_id) on the instances table; existing installs get it automatically on next admin page load (no re-activation needed).
• Performance: cross-request lock on the in-poll Action Scheduler queue runner to avoid duplicate work when the dashboard is open in multiple tabs.
• UX: empty-state messaging on the Dashboard and Links table before the first scan.
• UX: bulk delete now asks for confirmation showing the count of links to remove.
• UX: scan-status polling backs off exponentially when the backend is unreachable instead of hammering the API.
• UX: completion message uses proper pluralization.
• UX: per-network affiliate labels (Amazon, ShareASale, CJ, etc.) are now internationalized.
• Accessibility: improved heading structure in the Dashboard, ARIA group on the quick filter bar, focus management in the Edit Link modal, and live-region announcements for snackbar notifications.
• Theming: admin styles now use CSS custom properties that pick up the active WordPress admin palette tokens.

1.0.0

• Initial release.
• Background link scanning via Action Scheduler with resume capability.
• Three scan modes: Full Scan, Delta Scan (modified posts only), and Reset Data.
• Parallel HTTP checking with HEAD/GET fallback.
• Affiliate link detection for 14+ networks, including cloaked internal redirects.
• Redirect chain and loop detection (single, chains of 2+, loops).
• Per-affiliate-network breakdown in the Dashboard.
• Modern React admin dashboard with real-time scan progress and cancel control.
• Link table with quick filter tabs (All / Broken / Redirects / OK / Pending), search, advanced filters, pagination, and bulk actions.
• Inline link editing with URL and rel attribute updates — silent (no post_modified bump, no revision).
• CSV export with active filters.
• Scan resume after interruption.
• Configurable post types, batch sizes, timeouts, request delays, and recheck intervals.
• Full internationalization support (i18n ready).