== Changelog == = 1.2.0 = _Release date: 2026-08-10_ **Added** * Per-term Open Graph metadata for Categories and Tags on the term edit page (`term.php`): custom OG title, OG image URL, and OG description, exposed on term archives. * Manual `og:image:alt` override (per-post meta box and per-term), emitted as `og:image:alt` and `twitter:image:alt`. * Per-post `og:type` override (Default / `website` / `article`); `article:*` sub-tags now emit on the resolved article type. * Twitter/X: emit `twitter:url` (canonical) and per-post `twitter:creator` (author handle); handles normalised with a leading `@`. * Platform integration tags (global settings): Facebook `fb:app_id`/`admins`/`pages`, Pinterest `p:domain_verify` + disable-pinning toggle, Telegram `telegram:channel`, Slack `slack-app-id`. * Mobile / Web App tags (global settings): `theme-color`, web-app name, PWA standalone toggle, iOS status bar style, `format-detection`; Open Graph namespace added to `` via `language_attributes`. * Uninstall cleanup extended to remove the per-term OG meta and `_og_image_alt` / `_og_type` / `_twitter_creator` (opt-in only). **Changed** * Minimum supported WordPress lowered from 6.8 to 4.9.8 (verified by WP-Compat; bound by register_post_meta/register_term_meta at 4.9.8). * Minimum supported PHP lowered from 8.2 to 8.0 (verified by the PHPCompatibility scan; the code uses 8.0 features only). = 1.1.0 = _Release date: 2026-03-28_ **Fixed** * Fatal `TypeError` in `handle_thumbnail_change()`: the `deleted_post_meta` action passes an array of meta IDs as its first argument (unlike `updated_post_meta`, which passes a single `int`). The method signature now accepts `int|array` to handle both actions correctly. **Security** * Added SSRF protection in `Robotstxt_OG_Image_Resolver::is_safe_url()`: all outbound HTTP HEAD requests now validate that the target host resolves to a public IP address. Private (RFC 1918), loopback, link-local, and reserved ranges are blocked. * Replaced deprecated `FILTER_SANITIZE_SPECIAL_CHARS` with `FILTER_SANITIZE_FULL_SPECIAL_CHARS` in nonce and input handling throughout admin and meta box classes. **Added** * GDPR Privacy API: registered `wp_privacy_personal_data_exporters` and `wp_privacy_personal_data_erasers` filters. Custom `_og_title` and `_og_description` post meta are now included in WordPress personal data export and erase requests. * PHPUnit 10 test suite using Brain\Monkey for WordPress function mocking. Covers SSRF IP validation, image format detection (`ensure_compatible_format()`), external URL detection, and cache clearing. No WordPress installation required to run tests (`vendor/bin/phpunit`). **Changed** * Settings page and REST API permission check changed from `manage_options` to `edit_others_posts`. Editors and above can now access OG settings and trigger fallback image resolution. The WordPress Settings API form is unlocked via the `option_page_capability_robotstxt_og_settings` filter. * REST API `check_permission()` now also verifies `edit_post` for the specific post ID requested. * Minimum supported WordPress version raised from 6.7 to 6.8 (two previous major versions back from WordPress 7.0). * Added `Network: true` plugin header, formally documenting Multisite compatibility. **Tests** * WordPress: 6.8, 6.9, 7.0 * PHP: 8.2, 8.5 * PHP_CodeSniffer: 3.13.5 * WordPress Coding Standards: 3.3.0 * PHPCompatibility: 9.3.5 * PHPStan: level 9 * PHPUnit: 10.5 = 1.0.0 = _Release date: 2026-02-18_ **Highlights** * Initial stable release of OpenGraph (by ROBOTSTXT). * Outputs a complete set of Open Graph and Twitter Card meta tags, with automatic detection of incompatible image formats (AVIF, WebP, GIF, BMP, SVG, TIFF) and HTTP-based resolution of JPEG/PNG alternatives. **Added** * Full Open Graph meta tag output: `og:title`, `og:type`, `og:url`, `og:description`, `og:site_name`, `og:locale`, `og:image`, `og:image:width`, `og:image:height`, `og:image:type`, `og:image:alt`. * Article-specific tags for singular posts: `article:published_time`, `article:modified_time`, `article:section`, `article:tag`. * Twitter Card meta tag output: `twitter:card`, `twitter:site`, `twitter:image`. * Direct tag injection via `wp_head` when no SEO plugin is active. * Yoast SEO integration via `wpseo_opengraph_image` filter. * RankMath integration via `rank_math/opengraph/facebook/og_image` filter. * Automatic format detection for AVIF, WebP, GIF, BMP, SVG, and TIFF featured images. * HTTP HEAD-based resolution of compatible JPEG/PNG alternatives. * Postmeta caching (`_og_image_fallback_url`) with automatic invalidation when the featured image is changed or removed. * Negative caching via transients (1-hour TTL) to avoid repeated failed HEAD requests. * Global fallback image URL setting (Settings > OpenGraph). * Homepage-specific image URL setting (Settings > OpenGraph). * Image URL validation at save time: incompatible formats are auto-resolved to JPEG/PNG; invalid or unresolvable URLs are rejected with an admin notice. * Twitter/X site handle setting for the `twitter:site` meta tag. * Per-post Open Graph overrides: custom title and description via meta box in the post editor. * Taxonomy archive image support via `robotstxt_og_taxonomy_image` filter. * Admin settings page (Settings > OpenGraph) with three tabs: Settings, Tools, Diagnostics. * Tools tab: Clear All Caches, Re-resolve All Images, Plugin Information. * Diagnostics tab: statistics (cached count, coverage), URL tester with HTTP header display, paginated cached entries table with per-row clear action. * WP-CLI command `wp og-fallback resolve` with `--all`, `--dry-run`, `--post-type` options. * WP-CLI command `wp og-fallback clear-cache` with `--all` and `--dry-run` options. * REST API: `POST /wp-json/robotstxt-og/v1/resolve/{post_id}` and `GET /wp-json/robotstxt-og/v1/status/{post_id}`. * Developer filters: `robotstxt_og_external_image_enabled`, `robotstxt_og_external_image_timeout`, `robotstxt_og_taxonomy_image`, `robotstxt_og_enable_logging`. * Auto-updater integration via Gitea (`robotstxt-updater.php`). * Full internationalization (text domain: `robotstxt-og`, POT file included). Spanish (es_ES) translation included. * `uninstall.php` with optional data deletion on plugin removal (opt-in, off by default). * Multisite compatible with per-site configuration. **Security** * Nonce verification on all forms and state-changing GET actions. * `manage_options` capability check on all admin pages, REST endpoints, and WP-CLI commands. * Input sanitization via WordPress APIs (`sanitize_key`, `sanitize_text_field`, `esc_url_raw`, `filter_input`) throughout. * Output escaping on all dynamic HTML (`esc_html`, `esc_attr`, `esc_url`, `absint`). * Prepared statements (`$wpdb->prepare()`) for all raw database queries; no direct SQL writes. * CSRF protection on all state-changing actions via `wp_nonce_url` / `wp_verify_nonce`. * HTTP requests use `wp_remote_head()` with configurable timeout — no `file_get_contents` or `curl` directly. **Compatibility** * WordPress: 6.7 - 6.9 * PHP: 8.2 - 8.5 * WP-CLI: 2.x * MariaDB: 10.6+ **Tests** * PHP_CodeSniffer: 3.13.5 * WordPress Coding Standards: 3.3.0 * PHPCompatibility: 9.3.5