—System status
Documentation

Changelog

1.1.0 - 2026-10-12

SDK and Behavioral Signals v2

  • Updated the WordPress React (wp-element) client adapter to @truesift/next@0.4.0, retaining the existing WordPress REST bridge and server-side proof validation.
  • Added optional aggregate Behavioral Signals v2: sampled pointer movements and scrolls, pointer presses, touch, keyboard event counts, focus/blur, visibility changes, challenge interaction counts and timing. Raw keys, coordinates, and form content are never recorded.
  • Adopted the SDK's cancellation-safe 2,500 ms observation window, per-check collector reset, and event-listener cleanup on success, error, retry and unmount.
  • Updated the PHP clientSignals allowlist to relay permitted numeric v2 fields and telemetryVersion: 2, while retaining legacy v1 field support and excluding unknown or non-numeric data.

WordPress integration and packaging

  • Release detached React roots when WooCommerce/AJAX form fragments are removed, so in-flight checks are aborted and listeners are released without clearing existing valid proofs or interrupting still-connected mounts.
  • Preserved public WordPress password reset protection and administrative reset compatibility (1.0.20), Fluent Forms AJAX verification (1.0.21), and the established WordPress, WooCommerce, Contact Form 7, WPForms and Elementor integrations.
  • Preserved the static SVG visual fallback and removed unused dotLottie runtime/animation modules from the WordPress-only bundle.
  • Updated the WordPress Privacy Policy Guide wording and bundled SDK license notice for the Behavioral Signals v2 release.
  • Kept the established server-side challenge/verify/proof endpoints and contract version 0.2; no Backend or SDK package was changed.
  • Set SDK asset revision to 1.1.0-0.4.0, with WordPress plugin version 1.1.0.

1.0.21 - 2026-10-03

Fixed

  • Fixed Fluent Forms AJAX submissions being rejected with truesift_verification_required after browser verification had already succeeded.
  • The Fluent Forms validation bridge now reads the verification token and signed context from Fluent Forms' original AJAX form payload before Fluent filters unregistered fields, then passes them to the existing server-side verifier.
  • Kept missing, invalid, expired, replayed, mismatched, reviewed, and blocked proofs fail-closed.

Packaging

  • Removed the internal docs/TESTING.md release checklist from the distributable WordPress plugin package.

Compatibility

  • No change to the shared verifier, TrueSift API, proof contract, browser SDK behavior, or the request handling used by Contact Form 7, WPForms, Elementor Pro Forms, WordPress core forms, or WooCommerce integrations.
  • The official SDK remains @truesift/next@0.3.0; the WordPress cache/asset revision advances to 1.0.21-0.3.0.

1.0.20 - 2026-09-28

Fixed

  • Fixed WordPress password recovery integration scope so the public Forgot Password form remains protected while legitimate WordPress administrative recovery actions can complete normally.
  • Kept public password recovery fail-closed: valid TrueSift verification allows the request to continue, while missing or invalid verification still blocks it.
  • Preserved the existing WordPress recovery pipeline after verification, including reset-key creation and recovery email delivery.

Compatibility

  • No TrueSift API, proof contract, or SDK behavior change.
  • The official SDK remains @truesift/next@0.3.0; the WordPress cache/asset revision advances to 1.0.20-0.3.0.

1.0.19 - 2026-09-22

Fixed

  • Fixed a WooCommerce Checkout Blocks bridge-state desynchronization where Woo could rebuild its extension store after TrueSift had already published a valid proof, causing the final Store API checkout request to omit extensions.truesift and fail with truesift_verification_required.
  • Removed proof-publication success assumptions based only on the bridge's cached token/context values. Each synchronization attempt now republishes the complete proof pair through WooCommerce setExtensionData(...).
  • Added a final checkout guard that requires a successful extension-data publish immediately before Checkout Block validation returns success.
  • Allowed transient DOM/remount gaps to republish the last complete cached proof pair only when any current token/context values are compatible with that same cached pair.
  • Prevented a cached verification token from being restored when the current context differs from the cached context; a changed context requires a new proof.

Security

  • Server-side Verifier::verifyRequest() and fail-closed Store API behavior are unchanged. Missing or invalid Checkout Block proofs are still rejected.
  • The Woo Store API registration-boundary fix introduced in 1.0.18 is unchanged.
  • The official SDK remains @truesift/next@0.3.0; the WordPress cache/asset revision advances to 1.0.19-0.3.0.

1.0.18 — 2026-09-05

Fixed

  • Fixed a WooCommerce Checkout Blocks conflict where account creation during Store API checkout could trigger a second registration verification and incorrectly return truesift_verification_required.
  • Excluded Store API checkout account creation from the woo_register verification boundary because the same checkout request is already protected by the dedicated Checkout Block integration.
  • Kept WooCommerce My Account registration and classic WooCommerce checkout verification behavior unchanged.

Security

  • The fix does not relax checkout verification: Checkout Blocks still require their dedicated Store API proof, while real WooCommerce registration requests remain protected when woo_register is enabled.
  • A valid Checkout Block proof is still single-use and is not consumed a second time by woocommerce_registration_errors.
  • The bundled official SDK remains @truesift/next@0.3.0; the WordPress SDK asset revision advances to 1.0.18-0.3.0.

1.0.17 — 2026-08-25

Fixed

  • Fixed WooCommerce Checkout Block final Store API requests being verified a second time by the classic woocommerce_after_checkout_validation integration after the block proof had already been atomically consumed.
  • Kept the classic shortcode checkout validator out of /wc/store[/vN]/checkout requests so a successful block checkout cannot be turned into a missing-proof failure later in the same PHP request.
  • Made the Checkout Block rest_authentication_errors boundary idempotent for the lifetime of the current PHP request so repeated filter evaluation cannot consume the same one-time proof twice.
  • Prevented the resulting retry chain where a checkout that had already consumed its proof could resend the same token and be correctly rejected by Core as replayed.

Security

  • Single-use proof consumption and replay rejection remain unchanged. The fix removes duplicate WordPress integration verification; it does not weaken Core proof validation or fail-closed behavior.
  • Classic checkout and Checkout Block now have mutually exclusive server-side verification boundaries: classic checkout verifies through WooCommerce validation hooks, while Checkout Block verifies at the final Store API authentication boundary.
  • The bundled official SDK remains @truesift/next@0.3.0; the WordPress SDK asset revision advances to 1.0.17-0.3.0.

1.0.16 — 2026-08-25

Fixed

  • Fixed a WooCommerce Checkout Block lifecycle race where DOM fragment replacement could start a second browser challenge while the form already had a verification in progress or a fresh one-time proof.
  • Preserved a fresh form proof across replacement TrueSift mounts without launching a redundant challenge/verify sequence.
  • Synchronized replacement mounts back to the preserved verified state when an in-flight verification completes on a mount WooCommerce has already replaced.
  • Prevented stale callbacks from superseded verification generations from overwriting the current form proof state.
  • Prevented transient Checkout Block DOM detachments from clearing already published TrueSift Checkout Store extension data.
  • Kept Checkout Store proof data intact when a replacement mount emits a technical error but the form still owns a fresh authoritative proof.
  • Made the Checkout Block bridge resolve the active checkout form first and prefer the current verified mount instead of relying on the first matching mount in the document.

Security

  • Server-side verification remains fail-closed and still requires a fresh, single-use, action/path/origin-bound allow proof.
  • Explicit expiry, deny, reset, and checkout-failure paths still invalidate and clear the proof; only transient DOM replacement is prevented from erasing valid proof state.
  • The bundled official SDK remains @truesift/next@0.3.0; this release changes only the WordPress integration lifecycle and cache revision to 1.0.16-0.3.0.

1.0.15 — 2026-08-19

Changed

  • Removed the customer-facing Refresh check step from the normal proof-expiry lifecycle. Proof/context renewal now runs automatically in the background for protected forms.
  • The normal form action is now the only customer interaction. If a user submits while the proof is missing, stale, or being renewed, TrueSift pauses that submission, obtains a fresh authoritative allow proof, and resumes the same submit action automatically.
  • Extended proof-expiry scheduling from WooCommerce checkout to all form-backed WordPress integrations.
  • Added localized protected-state copy, including “Your order is protected by TrueSift.”, “Ihre Bestellung ist mit TrueSift geschützt.”, and “Поръчката е защитена с TrueSift.”
  • Removed the SDK retry control from the WordPress integration UI; technical failures use short automatic retries and can be retried through the form's normal action instead of a second security button.
  • WooCommerce Checkout Block validation now awaits the automatic TrueSift renewal promise before allowing checkout processing to continue.

Security

  • Server-side verification remains fail-closed and still requires a valid, single-use, action/path/origin-bound allow proof.
  • Authoritative block or review results are not automatically retried and keep the protected action disabled.
  • Technical renewal failures never bypass proof verification; the original submit remains stopped until a fresh proof is available.

1.0.14 — 2026-08-19

  • Fixes front-end locale handling so the language selected in Settings → TrueSift is authoritative for the public widget and checkout renewal flow.
  • Stops WordPress gettext fallbacks from overriding the SDK's built-in en, de, and bg widget translations.
  • Adds localized renewal/refresh copy for English, German, and Bulgarian, including WooCommerce Checkout Block validation.
  • Localizes server-side TrueSift verification/context errors with the same configured front-end locale.

1.0.13 — 2026-08-19

Added

  • Added WooCommerce proof-expiry awareness using the server-issued verificationTokenExpiresAt value instead of an arbitrary client timeout.
  • Added a neutral inline renewal control below the TrueSift widget when a checkout proof is about to expire. The customer can refresh only TrueSift without reloading the checkout page or losing entered order data.
  • Added a local /wp-json/truesift/v1/context refresh route that renews only an already valid signed form context and preserves its original action, path, and origin.

Changed

  • WooCommerce Place order is locked a few seconds before proof expiry so an expired one-time proof is not sent to the server.
  • The TrueSift component is restarted in place after the customer chooses Refresh check; the checkout form itself is never reloaded.
  • Expired and invalid proof fallback messages no longer instruct customers to reload the entire page.
  • Checkout Block validation copy now directs the customer to refresh the inline TrueSift check.

Security

  • Server-side proof validation remains fail-closed. The renewal layer refreshes browser proof state only and does not bypass proof consumption, action/path/origin matching, or deny decisions.
  • The context refresh endpoint cannot mint an arbitrary context: it accepts an existing valid signed context and reissues the same action, path, and origin only.

1.0.12 — 2026-08-19

Fixed

  • Fixed WooCommerce classic checkout losing an already verified TrueSift proof during routine updated_checkout AJAX recalculations.
  • Preserved the current one-time proof when WooCommerce replaces the checkout payment/review fragment and the TrueSift mount is recreated.
  • Kept proof synchronization in the hidden fields and formdata serialization while the checkout DOM changes.
  • Kept fail-closed verification and explicit proof reset after a real checkout_error, form reset, or failed initial verification.

1.0.11 — 2026-08-16

Added

  • Updated the embedded official browser adapter to @truesift/next@0.3.0 with privacy-friendly Behavioral Signals v1.
  • Added aggregate-only, in-memory interaction counters for the current verification window so independent weak behavioral signals can contribute to explainable risk classification.
  • Added official product and credential-access links for https://truesift.de/ and https://truesift.de/#zugang.

Changed

  • Changed the official server-to-server API base from the legacy host to https://api.truesift.de.
  • Updated compatibility metadata and the embedded SDK cache revision to 1.0.11-0.3.0.
  • Hardened WordPress.org Plugin Check compliance for request sanitization, output-escaping annotations, translation placeholders, admin variable prefixes, and production package contents without changing verification behavior.

Privacy

  • Behavioral Signals v1 does not collect or transmit raw pointer coordinates, actual pressed keys, form contents, device fingerprints, or persistent visitor identifiers.
  • Missing or insufficient behavioral telemetry remains neutral and does not add risk by itself.

Compatibility

  • Preserved the WooCommerce Checkout Block REST method-override handling from 1.0.10; draft checkout updates still do not consume the one-time proof.

1.0.10 — 2026-08-12

Fixed

  • Fixed WooCommerce Checkout Block draft updates being rejected with truesift_verification_required when WordPress transports a Store API PUT /checkout request as HTTP POST with X-HTTP-Method-Override: PUT.
  • Store API proof validation now follows WordPress REST method-override precedence and consumes a TrueSift proof only for the effective final POST /wc/store[/vN]/checkout request.
  • Preserved fail-closed proof validation for the actual Place order request; missing, invalid, expired, replayed, mismatched, reviewed, or blocked proofs are still rejected.

1.0.9 — 2026-08-02

  • Updated the tracked official client SDK reference and browser bundle to @truesift/next@0.2.1.
  • Added explicit plugin, SDK, contract, browser-bundle, and asset-revision metadata through window.TrueSiftWordPressBuild.
  • Added browser diagnostics for the loaded SDK global, TrueSiftCheck export, loaded SDK version, and mounted admin previews.
  • Changed the SDK cache revision to the combined release key 1.0.9-0.2.1.
  • Preserved the verified WordPress login proof-consumption behavior and fallback preview gallery.

1.0.8 — 2026-08-02

  • Added versioned, SDK-generated fallback previews for Checkbox, Banner, Inline, and Badge admin cards.
  • Added delayed/idempotent live-preview mounting for optimization plugins that defer JavaScript.
  • Changed the bundled SDK asset cache version to the WordPress plugin release version so corrected adapter bundles cannot remain stale behind page optimization caches.

1.0.7 — 2026-08-02

  • Fixed server-side proof acceptance for the official TrueSift 0.2 contract.
  • Successful one-time proof consumption is now accepted when the API returns either consumed: true or a non-empty consumedAt timestamp.
  • Kept strict checks for allowed: true, decision: allow, challenge ID, action, path, and origin.
  • Extended safe debug diagnostics with the normalized consumption confirmation result.

1.0.6 — 2026-08-02

Added

  • Add a persistent, administrator-only TrueSift debug mode for challenge, verify, proof consumption, signed context, and integration outcomes.
  • Add a Tools debug log with UTC timestamps, request correlation IDs, safe response field inspection, HTTP status, duration, and proof-contract checks.
  • Add downloadable JSON diagnostic reports and a protected clear-log action.
  • Record token presence, length, and an irreversible short fingerprint without storing credentials or full tokens.

Security

  • Debug records redact credentials, authorization material, cookies, nonces, site keys, secret keys, and complete challenge, context, or verification tokens.
  • Verification remains fail-closed; this diagnostic release does not weaken the proof contract or bypass server-side verification.

1.0.5 — 2026-08-02

Fixed

  • Persist the authoritative browser verificationToken separately from mutable login-form markup.
  • Recreate and synchronize the signed context and verification hidden fields when another login or security plugin mutates the form DOM.
  • Add a native formdata serialization bridge so WordPress login POST requests always carry the current TrueSift proof.
  • Keep the submit action blocked unless the current proof is both verified and serializable.

1.0.4 — 2026-08-01

Added

  • Render the TrueSift verification component inside woocommerce/checkout-actions-block before the Place order action.
  • Publish verificationToken and the signed WordPress contextToken through the truesift Checkout Store extension namespace.
  • Register Checkout Block validation through wc.blocksCheckoutEvents.onCheckoutValidation, including express-payment-triggered checkout validation.
  • Validate and atomically consume Checkout Block proofs through the Store API boundary before WooCommerce starts order processing.
  • Reset TrueSift and require a fresh proof after Checkout Block processing failures.
  • Declare cart_checkout_blocks compatibility through WooCommerce FeaturesUtil.

Changed

  • Rename the WooCommerce checkout administration option to clarify that one setting protects both classic and block checkout.

1.0.3 — 2026-08-01

  • Enqueue the official TrueSift browser runtime before page output when the queried post contains the [truesift] shortcode.
  • Fix standalone shortcode pages where the mount markup was rendered but the late-enqueued SDK runtime and inline configuration were not reliably printed by the active theme or optimization stack.
  • Keep the existing shortcode-render enqueue as a fallback for dynamically generated shortcode content.

1.0.2 — 2026-08-01

Fixed

  • Correct the WordPress browser bundle entry so it loads the official TrueSiftCheck component without eagerly resolving optional SDK exports that are not part of the WordPress runtime bundle.
  • Load login-screen SDK and adapter assets in the document head.
  • Add resilient automatic mounts for #loginform, #registerform, and #lostpasswordform.
  • Allow a plain [truesift] shortcode to render the official visual check in standalone mode when it is not placed inside a form.
  • Keep PHP hook rendering as the primary form-integration path while preventing duplicate mounts.

All notable production changes to the TrueSift WordPress plugin are documented here.

1.0.1 — 2026-08-01

Fixed

  • Enqueue the TrueSift browser runtime, WordPress wp-element dependency, configuration, and stylesheet during login_enqueue_scripts before the login page head is printed.
  • Restore visible widget rendering and submit-button protection on the native WordPress login, registration, and password-reset-request screens.

1.0.0 — 2026-07-31

Added

  • WordPress-native TrueSift administration under Settings.
  • Encrypted site credential storage with wp-config.php constant support.
  • Live non-networked previews for checkbox, banner, inline, and badge layouts.
  • Global theme, locale, size, appearance, timeout, and availability-policy settings.
  • Secure local challenge and browser-verification REST bridges.
  • Server-side proof validation with action, path, and origin binding.
  • Atomic single-use token consumption and replay rejection.
  • WordPress login, registration, password reset, and comment integrations.
  • WooCommerce login, registration, classic checkout, and product-review integrations.
  • Contact Form 7, WPForms, Fluent Forms, and Elementor Pro Forms integrations.
  • Manual [truesift] shortcode and truesift_verify_request() PHP helper.
  • Settings import/export without secret credentials.
  • Connection diagnostics, privacy-policy guidance, safe logging, and uninstall controls.

Security

  • Browser allowed, decision, score, status, failOpen, challengeId, action, path, and origin values never authorize a protected PHP action.
  • The TrueSift secret key remains server-side.
  • Normal proof acceptance requires allowed: true, decision: allow, and consumed: true.
  • Invalid, expired, replayed, mismatched, reviewed, and blocked proofs are denied.