SeoVision Publisher

Changelog

0.8.5

• A new post goes live only once it is complete. It is written as a draft, and switched to published or scheduled after its images, featured image and SEO fields are in place. Plugins that act the moment a post is published, such as Blog2Social, Jetpack Social and email notifiers, now see the finished post instead of one without its featured image and SEO description.
• Category: SeoVision can file a new post under a category you choose in SeoVision. A post that already exists keeps its categories. A chosen category that no longer exists is skipped and the post goes to your default category.
• New authenticated read, GET /wp-json/seovision/v1/categories. It lists your post categories with their post counts, how many of those posts you published yourself, your default category and the category SeoVision suggests. It is authorized by the same integration token as publishing.

0.8.4

• SeoVision now updates only a post it published itself, recognized by the SeoVision article id stored with the post. Until now, when no post carried that id, the plugin took any post at the same address (slug), so one of your own posts that happened to share the address of a new SeoVision article was overwritten by it. Such an article is now published as a new post, and WordPress gives it a unique address (for example -2 at the end). Your own post is not touched.
• The JSON-LD of a post whose address WordPress suffixed that way points at the post’s real permalink, like every other SeoVision post.

0.8.3

• New authenticated read, GET /wp-json/seovision/v1/articles/<article id>/modified. It answers the ID, status and last-modified date (GMT) of the post SeoVision published for that article, found by the SeoVision article id stored with the post, and nothing about any other post. SeoVision asks it before it updates the text of a live article for a search query, so it can leave a post you changed in WordPress alone, even on a site that blocks the public REST API. The FAQ says exactly when. It is authorized by the same integration token as publishing, and its answer is never cached.

0.8.2

• A picture whose address is a web page (a link the writer formatted as an image) no longer fails the whole publish. The plugin refuses it before download, skips any image it cannot add to the Media Library, keeps the post as written, and reports the skipped addresses under warnings in the response.
• The article’s SeoVision id is stored the moment the post is created, before its images are processed, so a publish that fails in the media step is found by its id on the next attempt instead of being rewritten by slug every hour.

0.8.1

• SEO tags: the article’s SEO title replaces the post title in <title>, and the meta description, Open Graph and Twitter card tags are printed on SeoVision articles when no SEO plugin is active. Jetpack’s own Open Graph output is respected.
• Yoast SEO and Rank Math: the SEO title, meta description and focus keyword are written into their fields on every publish, so they print the tags.
• Stores the article’s focus keyword (_seovision_focus_keyword).
• The JSON-LD now uses the post’s real permalink instead of the address SeoVision assumed before publishing (/blog/<slug>), and the “Blog” breadcrumb points at the site’s posts page, or is left out when posts are shown on the front page. An address set on purpose in SeoVision is kept.

0.8.0

• Removed WordPress user creation. Posts are now attributed to an existing user selected in SeoVision; the plugin never calls wp_insert_user.
• Authorization is now the integration token only. The previous fallback that also accepted any logged-in user with edit_posts is gone — it let a Contributor publish immediately and set an arbitrary post author, bypassing their normal capabilities.
• Article CSS is delivered through wp_enqueue_style() + wp_add_inline_style() instead of a <style> tag echoed into wp_head.
• Hosts that move the Authorization header to REDIRECT_HTTP_AUTHORIZATION (Apache with PHP as CGI/FastCGI) now work without an .htaccess change. Where the header is still missing, the plugin answers with a distinct error so SeoVision can name the real cause instead of blaming the token.
• The settings page no longer prints the saved token into the input. It shows the last characters instead, and an empty field on save keeps the existing token — pasting a new token on top of the old one used to concatenate them, after which no request could ever authenticate.

0.7.7

• Removed the Plugin URI header. It pointed at seovision.io, the same address as Author URI, which the WordPress.org submission form rejects; seovision.io describes the author, not this specific plugin.

0.7.6

• Fixes the Plugin Check findings from the 0.7.5 review run: prefixed the two global variables in uninstall.php, and annotated the intentional single-row meta lookup that makes publishing idempotent (it never runs on page views).
• Brand name consistently written “SeoVision” across the plugin UI, readme, and headers. All technical identifiers (text domain, option names, REST namespace, meta prefix) are unchanged, so updates and stored data are unaffected.

0.7.5

• WordPress.org submission readiness. Tested up to WordPress 7.1.
• Hardened the /users endpoint: it now lists only users who can edit posts and no longer returns login names (usernames), closing a username-enumeration aid. The SeoVision dashboard only needs display names for its “Post author” dropdown.
• Replaced @unlink() with wp_delete_file() in the image sideloader and sanitized the raw Authorization header reads.
• error_log() diagnostics now only run when WP_DEBUG is enabled; the same warning still reaches SeoVision in the REST response.
• readme: added an “External services” disclosure section (data in/out, terms, privacy policy) and documented exactly when the plugin creates an Author-role WordPress user.

0.7.4

• Adds uninstall cleanup: deleting the plugin now removes the stored integration token (seovision_integration_token) and the activation-redirect flag. Previously these options survived a delete, so reinstalling on the same site showed “A token is configured” with the old token pre-filled. Deactivating (without deleting) still keeps the token.

0.6.1

• Security/correctness: the JSON-LD printed into the page head now escapes <, >, and & (JSON_HEX_TAG | JSON_HEX_AMP). Previously a value containing the literal </script> could close the schema script tag early and break the page or inject markup. Slashes stay unescaped so embedded URLs remain readable.

0.6.0

• Draft, scheduled, and immediate publish modes with media sideloading and JSON-LD head injection (see prior internal releases for details).

0.5.2

• Keeps already-published posts published when repeated schedule requests are sent.
• Prevents accidental unpublishing of indexed WordPress posts during bulk schedule operations.
• Restores the safer default after 0.5.1: schedule requests never unpublish existing live posts.

0.5.1

• Allows a published post to be moved back to scheduled status when the requested schedule date is still in the future.
• Keeps already-published posts live when repeated schedule requests refer to dates that have already passed.

0.5.0

• Added support for draft, scheduled, and immediate publish modes.
• Scheduled posts use post.status future with the supplied WordPress local post.date.
• Idempotent lookup now includes published posts to avoid duplicate articles on repeat requests.

0.4.0

• Moved article image sideloading into the plugin endpoint.
• Added media URL rewriting for article HTML and JSON-LD before draft meta is stored.
• The plugin endpoint now returns the generated media map and featured media ID.

0.3.1

• Centralized plugin contract naming constants for pre-release rename readiness.
• Added WordPress.org-ready license metadata and readme scaffold.

0.3.0

• Added authenticated plugin REST endpoint for idempotent article draft create/update.
• Added media map meta storage.