Changelog

1.0.10 — 2026-08-12

Fixed WooCommerce Checkout Block draft updates being rejected with truesift_verification_required when WordPress transports a Store API PUT /checkout request as HTTP POST with X-HTTP-Method-Override: PUT.
Store API proof validation now follows WordPress REST method-override precedence and consumes a TrueSift proof only for the effective final POST /wc/store[/vN]/checkout request.
Preserved fail-closed proof validation for the actual Place order request; missing, invalid, expired, replayed, mismatched, reviewed, or blocked proofs are still rejected.

Updated the tracked official client SDK reference and browser bundle to @truesift/next@0.2.1.
Added explicit plugin, SDK, contract, browser-bundle, and asset-revision metadata through window.TrueSiftWordPressBuild.
Added browser diagnostics for the loaded SDK global, TrueSiftCheck export, loaded SDK version, and mounted admin previews.
Changed the SDK cache revision to the combined release key 1.0.9-0.2.1.
Preserved the verified WordPress login proof-consumption behavior and fallback preview gallery.

Added versioned, SDK-generated fallback previews for Checkbox, Banner, Inline, and Badge admin cards.
Added delayed/idempotent live-preview mounting for optimization plugins that defer JavaScript.
Changed the bundled SDK asset cache version to the WordPress plugin release version so corrected adapter bundles cannot remain stale behind page optimization caches.

Fixed server-side proof acceptance for the official TrueSift 0.2 contract.
Successful one-time proof consumption is now accepted when the API returns either consumed: true or a non-empty consumedAt timestamp.
Kept strict checks for allowed: true, decision: allow, challenge ID, action, path, and origin.
Extended safe debug diagnostics with the normalized consumption confirmation result.

Add a persistent, administrator-only TrueSift debug mode for challenge, verify, proof consumption, signed context, and integration outcomes.
Add a Tools debug log with UTC timestamps, request correlation IDs, safe response field inspection, HTTP status, duration, and proof-contract checks.
Add downloadable JSON diagnostic reports and a protected clear-log action.
Record token presence, length, and an irreversible short fingerprint without storing credentials or full tokens.

Debug records redact credentials, authorization material, cookies, nonces, site keys, secret keys, and complete challenge, context, or verification tokens.
Verification remains fail-closed; this diagnostic release does not weaken the proof contract or bypass server-side verification.

Persist the authoritative browser verificationToken separately from mutable login-form markup.
Recreate and synchronize the signed context and verification hidden fields when another login or security plugin mutates the form DOM.
Add a native formdata serialization bridge so WordPress login POST requests always carry the current TrueSift proof.
Keep the submit action blocked unless the current proof is both verified and serializable.

Render the TrueSift verification component inside woocommerce/checkout-actions-block before the Place order action.
Publish verificationToken and the signed WordPress contextToken through the truesift Checkout Store extension namespace.
Register Checkout Block validation through wc.blocksCheckoutEvents.onCheckoutValidation, including express-payment-triggered checkout validation.
Validate and atomically consume Checkout Block proofs through the Store API boundary before WooCommerce starts order processing.
Reset TrueSift and require a fresh proof after Checkout Block processing failures.
Declare cart_checkout_blocks compatibility through WooCommerce FeaturesUtil.

Rename the WooCommerce checkout administration option to clarify that one setting protects both classic and block checkout.

Enqueue the official TrueSift browser runtime before page output when the queried post contains the [truesift] shortcode.
Fix standalone shortcode pages where the mount markup was rendered but the late-enqueued SDK runtime and inline configuration were not reliably printed by the active theme or optimization stack.
Keep the existing shortcode-render enqueue as a fallback for dynamically generated shortcode content.

Correct the WordPress browser bundle entry so it loads the official TrueSiftCheck component without eagerly resolving optional SDK exports that are not part of the WordPress runtime bundle.
Load login-screen SDK and adapter assets in the document head.
Add resilient automatic mounts for #loginform, #registerform, and #lostpasswordform.
Allow a plain [truesift] shortcode to render the official visual check in standalone mode when it is not placed inside a form.
Keep PHP hook rendering as the primary form-integration path while preventing duplicate mounts.

All notable production changes to the TrueSift WordPress plugin are documented here.

Enqueue the TrueSift browser runtime, WordPress wp-element dependency, configuration, and stylesheet during login_enqueue_scripts before the login page head is printed.
Restore visible widget rendering and submit-button protection on the native WordPress login, registration, and password-reset-request screens.

WordPress-native TrueSift administration under Settings.
Encrypted site credential storage with wp-config.php constant support.
Live non-networked previews for checkbox, banner, inline, and badge layouts.
Global theme, locale, size, appearance, timeout, and availability-policy settings.
Secure local challenge and browser-verification REST bridges.
Server-side proof validation with action, path, and origin binding.
Atomic single-use token consumption and replay rejection.
WordPress login, registration, password reset, and comment integrations.
WooCommerce login, registration, classic checkout, and product-review integrations.
Contact Form 7, WPForms, Fluent Forms, and Elementor Pro Forms integrations.
Manual [truesift] shortcode and truesift_verify_request() PHP helper.
Settings import/export without secret credentials.
Connection diagnostics, privacy-policy guidance, safe logging, and uninstall controls.

Browser allowed, decision, score, status, failOpen, challengeId, action, path, and origin values never authorize a protected PHP action.
The TrueSift secret key remains server-side.
Normal proof acceptance requires allowed: true, decision: allow, and consumed: true.
Invalid, expired, replayed, mismatched, reviewed, and blocked proofs are denied.