Agentic SEO for Visibility

Changelog

0.7.5

• Polished the top-level Agentic SEO menu icon (now a globe) and
  updated the in-readme setup steps to point at the new
  Agentic SEO → Connection location.

0.7.3

• All plugin screens now live under a single top-level Agentic SEO
  menu in the sidebar (its own icon), with three clearly-labelled
  sub-items: Connection, Approvals (with a pending-count
  badge), and Activity. Previously these were three lookalike
  entries buried under Settings.
• Coding-standards pass for the ww.wp.xz.cn review: added a
  translators comment to a placeholder string and made the AJAX nonce
  verification visible to static analysis (the nonce was always
  checked — this just satisfies the scanner).

0.7.2

• Fixed: Text domain now matches the plugin slug (agentic-seo-visibility)
  so translations load correctly and the ww.wp.xz.cn plugin scanner
  passes. The plugin’s display name is unchanged.
• Bumped “Tested up to” to WordPress 7.0.

0.7.1

• Added: Real-time event-receiver endpoints under
  /wp-json/visibility/v1/events/*. The Visibility server pushes
  approved actions straight here (with their full payload), so
  changes show up in WordPress within seconds of approval instead
  of waiting on the 5-minute WP-Cron tick.
  • events/action-approved — executes a single approved action.
  • events/drain-inbox — bulk catch-up.
  • events/site-config-changed — mirrors the allow_publish /
    disabled flags so admin banners stay accurate without polling.

0.7.0

• Added: Approval inbox for every AI write action. Two new submenu
  pages appear under Settings — Approvals (pending) and Activity
  (history). Every post, page, media upload, taxonomy edit, SEO
  metadata change, or redirect that the Visibility AI requests now
  shows up as a card you review and approve (or reject with a note
  the AI sees in its next run).
• Added: Auto-approval rules so trusted action types (e.g. drafts,
  alt-text edits) can flow through automatically with optional time
  and usage limits. High-risk actions never auto-approve unless you
  explicitly opt in with a separate checkbox.
• Added: Background cron (every 5 minutes) that executes
  auto-approved actions even when no admin is logged in.
• Tightened: Action payloads are validated server-side against a
  canonical action-type registry and a hard deny list (plugin/theme
  ops, user changes, permalink structure, custom CSS, arbitrary
  options/queries) so no AI request can bypass the approval gate.
• Removed: Application Password connection mode. Plugin pairing is
  now the only supported transport. Existing app-password sites
  must be re-paired with the plugin.

0.6.3

• Split the Plugin URI and Author URI headers — they were both
  pointing at https://app.visibility.so which the ww.wp.xz.cn
  Plugin Checker flags (the two URIs must describe different things:
  the plugin product vs. the publisher). Plugin URI stays at the
  product page; Author URI now points at the publisher site at
  https://visibility.so.

0.6.2

• Trim the short description from 196 to 131 characters so the ww.wp.xz.cn
  Plugin Checker stops flagging it for truncation in plugin-directory cards.
• Rewrite the long description for clarity, with a “Why use this plugin”
  bullet list and a tighter “How it works” sequence.
• Expand the FAQ from 3 to 12 entries answering the most common questions
  about AI publishing workflows, draft-only mode, SEO-plugin compatibility,
  performance, multisite, privacy, and uninstall behaviour.
• Refresh the Tags line with more specific search terms
  (agentic seo, ai content, ai writer, content automation, seo).

0.6.1

• Security & WP-coding-standards pass on the settings page and REST handler
  ahead of the ww.wp.xz.cn re-review:
  • Status-redirect query args (?visibility_status=...&visibility_msg=...)
    are now nonce-protected, so a crafted URL can no longer inject a spoofed
    admin notice into the Settings page.
  • wp_die(__(...)) upgraded to wp_die(esc_html__(...)) on the
    permission-denied paths.
  • URL output in the settings template now escapes at echo time with
    esc_url() (variables were already escape-on-assign — this is the
    belt-and-braces “escape late” pattern WP coding standards prefer).
  • Media-upload route: parse_url() → wp_parse_url() and
    @unlink($tmp) → wp_delete_file($tmp) (use the WordPress wrappers
    so filter hooks run and the filesystem op doesn’t silent-fail).
• readme.txt Tested up to: 6.9.

0.6.0

• Rebrand to Agentic SEO for Visibility — display name, slug
  (agentic-seo-for-visibility), text domain, and Settings submenu
  (“Agentic SEO”) updated to follow ww.wp.xz.cn plugin-directory naming
  guidance for plugins that integrate with a named external service.
  Internal REST namespace, option keys, and cron action names are
  unchanged so pre-release test installs continue to work after update.
• readme.txt now includes an External services section listing
  every outbound network call the plugin makes (pair, heartbeat,
  disconnect), what is sent, and explaining that a Visibility account is
  required.

0.4.3

• Icon polish — the bundled brand icon (Settings → Visibility, and the
  wp.org listing assets) now uses a shifted viewBox so the sonar C-shape
  sits visually centred in the square canvas. Previous renders looked
  like the icon was cropped on the right because the dot was at the
  geometric centre but the C’s visual mass extends only leftward.

0.4.2

• Inline paste button in the pairing-code input — one click pulls the code
  from your clipboard so you don’t have to right-click → paste. Falls back
  to focusing the input when the browser blocks clipboard reads.

0.4.1

• Disconnect now actually disconnects on both sides. The Disconnect button
  on Settings → Visibility used to wipe the local options only, leaving the
  Visibility project still marked “Connected via plugin” until the next
  failed publish reverified it. The plugin now calls a new server endpoint
  (POST /api/wordpress/plugin/disconnect) before wiping local state, so
  Visibility removes the project’s site row immediately. Local teardown
  still completes even if Visibility is unreachable.

0.4.0

• Expanded REST surface — agents can now manage everything end-to-end through
  the plugin instead of hitting wp-json directly:
  • GET /posts (list with search, status filter, pagination)
  • DELETE /posts/{id} (trash or force-delete)
  • GET /categories + POST /categories
  • GET /tags + POST /tags
  • GET /media + POST /media (upload from a remote source_url)
  • Post create/update now accept categories[], tags[], featured_media, date
• Post responses now include categories[], tags[], featured media, full content
  • excerpt — no need to call out to wp-json/wp/v2 for the same data.
• /health response now includes adminUrl, timezone, and post counts (publish,
  draft, pending, future, private, trash).
• Security fix: explicit Cache-Control: private, no-store, no-cache headers
  on every /visibility/v1/* response so page caches (LiteSpeed, WP Rocket,
  Cloudflare, etc.) can’t serve a stale unauthenticated body to a different
  caller. Earlier versions relied on WP’s default headers, which LiteSpeed
  was overriding.

0.3.1

• Fix modified field returning a zero date (“-001-11-30T00:00:00+00:00”)
  for freshly created posts where post_modified_gmt hadn’t been normalised
  yet. Falls back to current GMT time when the stored value is empty/zero.

0.3.0

• Settings page now shows the connected company and project names (not just
  the UUID). Names are returned from the pair endpoint and refreshed on each
  daily heartbeat, so renames in Visibility surface here automatically.
• New “Last seen” row showing when the daily heartbeat last reached Visibility.

0.2.0

• Settings page links to root of Visibility instead of /integrations.
• Plugin REST: added GET /wp-json/visibility/v1/posts/{id} for verification.
• Post create/update responses now include editUrl (wp-admin link) so the
  agent + user have something they can open even when the post is a draft
  (drafts return 404 to anonymous visitors, which is normal WP behaviour).

0.1.0

• Initial release: pairing flow, REST endpoints for post create/update.