Qaiyo Admin Booster

Changelog

1.4.6

• Internal quality pass after an external code review — no behaviour changes, but the plugin is stricter about its own correctness.
• Fixed: the Free↔Pro “unlocked modules” filter was called with a different number of arguments in two places, which could crash an add-on that hooked it with two parameters. There is now a single source of truth for it.
• Fixed: uninstall left data behind — the update-protection log, the “could not verify” flag, the server-limit status and two caches are now removed, and on multisite every site in the network is cleaned instead of only the current one.
• Fixed: “Everything is on by default” on the Modules tab was not accurate — the Safe Mode link is deliberately off.
• All output now goes through an escaping function on its own line, with no suppression comments; inline card icons are filtered through an allowlist.
• Every module now registers its hooks in an explicit method instead of its constructor, so the classes can be created without side effects (testability).
• Parameter and return types added throughout. Hook callbacks deliberately keep untyped parameters: WordPress and other plugins pass those values, and a strict type would turn someone else’s sloppy value into a fatal error on your site.

1.4.5

• New module — Menu item visibility: every menu item on the Appearance → Menus screen gets a “Visibility” setting — Always, Mobile only, or Desktop only. The usual reason: a header button like “Request a quote” does not fit on mobile and belongs in the hamburger menu instead, which until now meant building and maintaining a second, mobile-only menu.
• The item is hidden with a CSS media query at 768px, never by leaving it out of the HTML, so the menu structure stays the same in every view and page caching is unaffected. (Pro can set the breakpoint to match your theme.)
• Works with classic menus rendered by wp_nav_menu() — the same menus Bricks, Elementor and classic themes use. The block-based Navigation block draws its own markup and is not affected.

1.4.4

• New module — Safe Mode link: a way back into wp-admin when a plugin or theme update breaks the site, without FTP or a hosting panel. WordPress’ own Recovery Mode only works through a link it emails once a day after the crash — and not at all on multisite — so if that email is lost you are locked out. Safe Mode gives you a link to save in advance instead.
• Opening the link and logging in as an administrator loads a recovery console with every plugin switched off and a default theme in place of yours. The Plugins screen still shows the real active plugins, so deactivating the broken one leaves every other plugin exactly as it was. Visitors keep seeing the normal site.
• It runs as a small, self-contained file in wp-content/mu-plugins, so it keeps working even when Admin Booster itself is the plugin that broke.
• Hardened as a master key: the key lives after the # and never reaches server, CDN or proxy logs; only a fingerprint keyed with the wp-config.php security keys is stored; only administrators can log in, always with a password, with a built-in 5-attempt lockout; the console blocks installing, uploading, file editing and user management; every use is emailed to all administrators and logged; a used link retires itself once the site works again; one-hour, browser-bound sessions; HTTPS-only key entry on HTTPS sites; optional IP restriction.
• The link is shown only once, when it is created. Off by default; turning it off, deactivating or deleting the plugin removes the file and the link.
• New module — Update crash protection: after every plugin or theme update — a manual click, a bulk update, WP-CLI, or a remote dashboard such as ManageWP or MainWP — the site is loaded once, and if the update caused a fatal error the previous version is restored automatically. WordPress does this only for its own background auto-updates.
• Only rolls back when the site worked right before the update and fails right after it; an update on an already broken site is left alone.
• Every intervention is logged under Admin Booster → Update crash protection and emailed to all administrators, including when an automatic restore did not succeed (with the next steps).
• If the server blocks loopback requests, the protection cannot check anything; it says so on the settings page instead of rolling back blindly.
• WordPress’ own background auto-updates are left to WordPress, which already runs the same check for them.

1.4.3

• New: raise the server upload limit from the admin, without cPanel, FTP or php.ini access. PHP’s upload_max_filesize / post_max_size cannot be changed at runtime (not even from wp-config.php), so the new “Raise the server limit too” option writes them into .user.ini on PHP-FPM / FastCGI hosts, into .htaccess on Apache mod_php, and into both on LiteSpeed / CloudLinux LSAPI hosts (common with DirectAdmin and cPanel), where it depends on the host which one is honoured. Existing lines in those files are kept, the .htaccess lines are wrapped so a later server change cannot take the site down, and switching the option off or uninstalling removes them again.
• The File handling tab now shows the limit PHP really applies and whether the raise took effect or is still pending. A host-locked limit (php_admin_value) is detected up front and reported instead of written, and if a host does not read the files at all, a “Server details” list shows exactly how PHP runs there, ready to send to the host.
• Fixed: setting an upload size larger than the server allowed made uploads fail with a confusing “Unexpected response from the server” error, because WordPress advertised the higher limit while PHP silently discarded the file. The WordPress-side limit is now never higher than what the server really accepts, so oversized files get WordPress’ clear “exceeds the maximum upload size” message instead.

1.4.2

• New module — Update notification emails. Every administrator gets an emailed summary of the plugin, theme and WordPress updates that are waiting, once a day or once a week. Choose which of the three you want to hear about.
• It is a real digest, not one email per update check: the module records which version of which item it has already announced, so the same release is never reported twice, and no email is sent at all when nothing has changed.
• Updates that were already installed before the summary went out are correctly left out, and when a plugin moves twice between two digests you are told about the version that is actually available now.
• Added a “Send test email” button, because WordPress can only hand mail over to your server or SMTP plugin and cannot guarantee delivery. If a summary could not be handed over, the settings page now says so.
• Delivery uses WordPress’ own wp_mail(), so an SMTP plugin or a host-configured mail setup is used automatically — there is nothing to configure here.
• Fixed: two strings (“Pending” in the comments widget, and the friendly “file type not allowed” upload message) were never included in the bundled translations and stayed English in every language.
• Developers: the whole notification pipeline is filterable — recipients, item list, subject, message, frequency choices and whether email is sent at all — so an add-on can retarget or reroute it. See the bundled HOOKS.md.

1.4.1

• New module — Separate table for pending updates. On the Plugins screen, plugins with an available update are pulled out of the alphabetical list into a table of their own at the top, under an “Updates” heading, with every other plugin in a separate table below it. Nothing changes when every plugin is already up to date — no empty heading or empty table is ever shown.
• The updates table is a real, working list table: each row keeps its update button and row actions, it stays inside the bulk-action form so “Update” and the other bulk actions apply to it, and it has its own select-all checkbox.
• Fixed: the update-center’s “check for updates” AJAX endpoint returned a hardcoded, untranslated “Forbidden” message when the current user lacked permission; it now uses a proper, translatable message.

1.4.0

• New — Qaiyo ecosystem. Other Qaiyo plugins can now report a summary card, and Admin Booster shows those cards in two places: a Qaiyo ecosystem tab on the settings page, and an optional dashboard widget that gathers them into one box instead of every plugin adding its own.
• The settings tab lists every Qaiyo plugin in one of three states: live data for the plugins you already run, a “More detail in … Pro” link where the richer version of a card is a Pro feature of that plugin, and a one-line description plus a WordPress.org link for the plugins you do not have.
• Cards for plugins you do not have carry no install button — only a “Details” link to the plugin’s WordPress.org page, opened in a new tab.
• The dashboard widget is only registered when an installed, active plugin actually reports a card, so it never appears empty.
• The whole integration is a single documented filter (qwab_ecosystem_widgets) — no shared library, no bundled package and no load-order requirement, so a sibling plugin can ship its side whether or not Admin Booster is installed. The contract is documented in the bundled HOOKS.md.
• A card that fails is contained: only that card is replaced with a short notice, and the rest of the page keeps working.

1.3.0

• New module — Add to menu from the editor. A “Menus” panel now appears in the editor sidebar for pages, posts and any other content type that supports navigation menus, so you no longer have to save your work, leave the editor and hunt for the page in Appearance → Menus.
• Choose the menu and the level: add the content at the top level, or nest it under an existing top-level item as a submenu entry.
• The level can be changed at any time afterwards. The panel preselects the menu and the level the content currently sits at, and the button becomes “Update level” — moving an entry between the top level and a submenu keeps its custom menu label, CSS classes, link target and description intact.
• If the site has no navigation menu at all yet, you can create the first one straight from the panel — with an optional theme display location — and the content is added to it in the same step.
• Menus the content is already in are listed with a one-click Remove. Removing an item that has children moves those children up a level instead of leaving them orphaned and invisible.
• Duplicates are prevented, and on block themes without registered menu locations the panel explains that classic menus will not show up on their own.
• Fixed: the bundled translation files could contain a duplicate entry, which made them invalid for tools such as Loco Translate or msgfmt. The translation build now collapses duplicates.
• Re-checked against the released WordPress 7.1: no further changes were needed. The new panel is a classic meta box, which renders outside the editor iframe and is unaffected by the 7.1 iframe change.

1.2.0

• WordPress 7.1 ready. The post editor is now always served inside an iframe in WordPress 7.1; the Gutenberg module was reviewed against this and needs no workaround, because it only talks to the editor data store and never touches the editor canvas.
• Fixed: opening the block inserter now uses the current editor store API. The previous call has been deprecated since WordPress 6.5 and printed a deprecation warning in the browser console on every editor load. Older WordPress versions keep working through a fallback.
• Tested up to WordPress 7.1.

1.1.0

• New: Dashboard greeting — a friendly personal greeting at the top of the main WordPress dashboard (toggleable module).
• Performance: the Update center widget now caches the available-update list, so the dashboard no longer re-scans plugin and theme files on every load.
• Performance: faster Page Collections auto-detection on large Pages/Posts lists.
• Security: the optional filename cleanup now only affects real media uploads (no longer touches other filename handling), and custom upload file types can no longer enable risky executable or script extensions (php, js, html, css, etc.).
• Added a SECURITY.md with a vulnerability disclosure policy and security contact.
• Housekeeping: removed unused code and moved inline styles into stylesheets.

1.0.0

• Initial release: Page Collections, Page Filter, 1-click plugin upload, Gutenberg UX, quick add menu, larger list views and full file handling.
• Plus: tidy admin notices tray, dashboard cleanup, scheduled-post countdown, sticky list-table headers, last-edited column and quick status switching.
• Plus: bulk page/post creation (with Tab-indented child hierarchy), an update-center dashboard widget, a comments dashboard widget and the Explore Qaiyo plugin directory with update notices.