SEO Fury

Changelog

1.1.1

Changed:

• 404 Monitor & Redirects — compact action buttons. The per-row actions (Find, Redirect, Resolve, Edit, Toggle, Delete) are now icon-only buttons with hover tooltips, so long URLs have more room and the tables no longer wrap awkwardly.

Fixed:

• Dark mode polish. Fixed a range of screens that didn’t fully adapt to dark mode — light cards/boxes that stayed white (Sitemap, Robots.txt, Page Speed, Search Console, and others) and faint hint text (.description) that blended into the dark background. Light mode is unchanged.
• Action button icons are now properly centered.

1.1.0

Added:

• Redesigned admin (2026) with dark mode — a refreshed “command center” interface: a new Dashboard landing screen with at-a-glance KPIs (average SEO score, active redirects, unresolved 404s, images without alt) plus Search Console performance and a site-health checklist, a modern grouped sidebar, and a light / dark / auto theme toggle that follows your system preference.
• Overall SEO Score — the three editor analysis panels (on-page SEO, readability, extra checks) are now combined into a single 0–100 score shown at the top of the SEO box, and surfaced as a sortable “SEO” column on the Posts and Pages list so you can see at a glance which content needs attention.
• Bulk Alt Text — a one-click tool (SEO Images tab) that scans your Media Library for images missing alt text and writes real, permanent alt text to each attachment using your template, in batches.
• Redirect Tester — enter any URL in the Redirects screen to see which rule (exact or regex) would fire and the exact target, without performing the redirect or counting a hit.
• Submit sitemap to IndexNow — one button submits every published URL from your sitemap post types to IndexNow in batches.
• SEO plugin conflict detector — a dismissible warning when another SEO plugin (Yoast, Rank Math, AIOSEO, SEOPress, The SEO Framework) is active alongside SEO Fury, which would cause duplicate meta tags.
• Duplicate meta detector — the editor warns when another post already uses the same custom SEO title or meta description (templates are ignored), linking to the conflicting posts.
• robots.txt preview & linter — preview the fully-composed robots.txt and get warnings for common mistakes (Disallow: / blocking the whole site, duplicate User-agent blocks, directives before any User-agent, missing Sitemap).
• Search Console: period comparison, CSV export & per-post stats — compare the current period with the previous one (with up/down deltas), export the Top Queries / Top Pages tables to CSV, and see clicks/impressions/CTR/position for the post you’re editing right in the SEO box.
• Six more schema types with full forms — Person, Organization, Course, Book, SoftwareApplication, and LocalBusiness now have proper generator fields and valid JSON-LD output (previously placeholders).

Security:

• Fixed stored XSS in the Redirects, 404 Monitor, and IndexNow admin tables. Visitor- and user-controlled values (redirect source/target URLs, 404 paths from request headers, submitted IndexNow URLs) are now HTML-escaped before being rendered in the dashboard.
• Hardened JSON-LD schema output with JSON_HEX_TAG / JSON_HEX_AMP so a custom schema value can no longer break out of the <script type="application/ld+json"> block.
• 404 Monitor now reads the client IP from REMOTE_ADDR by default and only trusts forwarded headers (X-Forwarded-For, CF-Connecting-IP) when the new “Behind a Proxy / CDN” option is enabled — prevents IP spoofing and log poisoning.
• CSV exports (Redirects and 404 Monitor) now neutralize spreadsheet formula injection (cells starting with =, +, -, @).
• The .htaccess editor now rejects directives that could enable PHP execution or proxy requests to an external server (AddHandler/SetHandler ...php, php_flag engine, Action, RewriteRule [P]), showing exactly which line was blocked instead of silently stripping it.
• Stored credentials (Google Search Console tokens) now use authenticated encryption (AES-256-CBC + HMAC, versioned). Decryption fails cleanly when the WordPress salt is rotated instead of emitting ciphertext as a credential — Google Search Console simply prompts to reconnect.
• Settings import now sanitizes every value before saving, so an import file cannot inject markup into an option that is later rendered.
• PageSpeed results received from the browser are now sanitized before storage, and audit titles from the API are escaped before display.
• Redirects: a regex rule whose target host is built from a back-reference (e.g. https://$1) is now confined to your site, closing an open-redirect vector. Static cross-domain redirects still work as intended.
• robots.txt Crawl-delay values are now validated as numeric, preventing extra directives from being injected via the field.

Fixed:

• Migration Wizard now correctly imports redirects from Yoast Premium, Rank Math, All in One SEO, and SEOPress. They were previously written to a non-existent table and silently lost.
• Front-end SEO title, meta description, Open Graph, and Twitter tags now resolve the full set of template variables (category, author, focus keyword, post type, WooCommerce fields, advanced date patterns, and more) instead of emitting literal %variable% text.
• Fixed mismatched variable names in the post editor insert menu (e.g. %seotitle% → %seo_title%, %wcshortdesc% → %wc_shortdesc%) so inserted variables resolve correctly. Templates saved with the old names remain compatible via automatic aliasing.
• Custom JSON-LD now resolves variables after the JSON is parsed, so values containing quotes no longer corrupt the markup and drop the schema.
• Rank Math posts that carried only robots directives (no title or description) are now included in migration.
• The .htaccess editor no longer falsely rolls back valid changes on hosts that block loopback self-requests; it saves the change and warns that the automatic safety check could not run.
• XML sitemaps now paginate beyond 1,000 URLs (sitemap-{type}-2.xml, etc.), so large sites no longer drop URLs from the sitemap. Existing single-file URLs are preserved as page 1.
• Removed the dead Google sitemap “ping” (the endpoint was retired in 2023 and only 404’d), saving an outbound request on every content save.
• Video sitemap now escapes a literal ]]> inside titles/descriptions so it can’t break the XML.
• Schema markup: fixed invalid @type casing for LocalBusiness, SoftwareApplication and other multi-word types; Recipe now includes the required image; Event uses your store currency instead of a hardcoded USD; WooCommerce back-ordered products map to BackOrder; JobPosting location is now a proper PostalAddress; the %org_name% variable reads the correct Local SEO option; the Organization node now has an @id so publisher/seller references resolve; and duplicate BreadcrumbList / Organization / WebSite nodes are de-duplicated.
• IndexNow key verification now works on subdirectory installs, and the previous key file is removed when you regenerate the key.
• IndexNow auto-submit is now debounced per URL, so a bulk edit or import no longer fires repeated blocking submissions for the same page.
• 404 Monitor caches its table-existence check, avoiding a database query on every 404 during bot/scanner traffic.
• 404 Monitor no longer logs non-page 404s emitted by REST, AJAX, cron, or feed sub-requests.
• Image SEO no longer adds a second alt attribute to images that already use a single-quoted alt (which produced invalid HTML).
• LLMs.txt now escapes special characters in titles and links, so a title containing ] or ) can no longer break or hijack the generated Markdown.
• Taxonomy sitemaps now paginate beyond 1,000 terms, matching post-type sitemaps.
• Google Search Console no longer dead-ends with a blank “Invalid OAuth state” screen when the connection session expires — it returns a friendly “please connect again” message, and the state token is now a stronger per-user random value.
• Schema: Recipe instructions given as multiple lines are emitted as structured HowToStep items; the breadcrumb generator omits item on the current page per Google’s guidance; and YASR star ratings no longer overwrite an aggregateRating already set by the schema generator.
• The canonical tag now also suppresses canonicals from Rank Math and SEOPress (in addition to Yoast and AIOSEO), preventing duplicate canonical tags when another SEO plugin is active.
• WordPress’s built-in sitemap is now reliably disabled when SEO Fury’s sitemap is enabled (the previous hook ran too late).
• 404 notification emails now build correct links on subdirectory installs instead of doubling the path.
• PageSpeed history now keeps the most recently checked results instead of pruning by insertion order.
• The Search Console dashboard widget no longer makes a blocking API request when disconnected, and backs off for a few minutes after a failure instead of retrying on every dashboard load.
• %randomword% now distributes evenly on 32-bit PHP.

Improved:

• The live SERP preview in the editor now resolves more variables (author, modified date, current date/year, SEO title/description), and uses the post’s publish date for %date%/%year% so the preview matches the actual front-end output.
• Keyword density now counts whole words only (so “art” no longer matches “start”).
• Russian passive-voice detection no longer flags ordinary reflexive verbs, removing a large source of false warnings.
• Transition-word detection now matches whole words only, so words like “then” inside “strengthen” no longer count.
• Readability and FAQ-import interface strings are now fully translatable (English source text).
• Added a composite database index for faster redirect matching on sites with many redirects.

1.0.3

Improved (admin UX — contextual help):

• Bulk URL Conversion (General settings) now lists every non-Latin URL detected, with Open / Edit buttons per row — you can see and act on the URLs that need transliteration, not just the count.
• Meta Titles → “Available variables” chips now show a tooltip on hover explaining what each variable outputs and where the value is sourced from. Descriptions for %sitename%, %sitedesc%, %sep%, %title%, %excerpt% clarified to mention the exact WP setting/field they pull from.
• Robots.txt → Crawl-delay block: added an info panel explaining what Crawl-delay does, which bots respect it (Bing/Yandex/Baidu/DuckDuckBot) vs. which ignore it (Googlebot), and when the field should be left empty.
• XML Sitemap → Priority / Changefreq: added an info panel describing what these values mean, typical ranges, and the reality check that Google ignores both. Tooltips added to every Priority / Changefreq label across post-type, taxonomy, and Additional URLs sections.
• 404 Monitor: tooltips added to the “Total Hits” stat card and the “Hits” table column, clarifying that a hit is one HTTP request (visitor, direct entry, bot or crawler) — not a mouse click. Same tooltip added to the Redirects “Hits” column.

Changed:

• PRO upsell admin notice (“Unlock 20+ Advanced SEO Features”) is now hidden when a PRO license is active — no more dangling upsell banner for paying users.
• “Changelog” tab removed from the settings menu (in both Free and PRO). Updates will be communicated through the WordPress updater and release notes.

Fixed:

• Bulk URL Conversion stats: regex used to detect non-Latin slugs contained a typo (Џ instead of Ї), which could mis-classify Ukrainian URLs as Latin. Now matches the same character set used at save time.

1.0.2

Security:

• Hardened redirect target sanitization — redirect rules now pass through esc_url_raw() to strip dangerous URL schemes (javascript:, data:, vbscript:) before wp_redirect() fires. Applies to both exact-match and regex-based redirects.

1.0.1

Added:

• Google Search Console moved to Free — connect GSC without PRO license
• Basic Image SEO — automatic alt text generation from post title and filename templates
• Flesch Reading Ease score — readability metric for English and Russian content
• Passive voice detection — warns when too many passive sentences
• Transition words check — ensures content uses connecting phrases
• Keyword synonym and morphological matching — detects plural, singular, and word form variations
• Schema Builder fully internationalized — all UI strings now translatable

Improved:

• Redirects and 404 monitoring now unlimited in Free plan
• Google Indexing API confirmed as Free feature
• 50+ new Russian translations for support tickets, hreflang, schema builder, and PRO upsells
• Elementor integration uses modern $e.hooks API instead of deprecated elementor.saver.on
• 404/Link Scanner tabs restyled with WordPress nav-tab-wrapper for consistency
• Support ticket module fully internationalized

Fixed:

• Fatal error in Elementor editor — null check added for AI Image Generator module
• 404 errors from missing AI scripts in free version — added file_exists() checks
• POST data sanitization in schema AJAX handlers
• Capability check ordering in AJAX handlers
• PHP warnings from undefined array keys
• Removed debug console.log statements from production JS
• PRO addon text domain corrected (seo-fury-pro)

1.0.0

• Initial release on ww.wp.xz.cn.
• Separated free and PRO functionality into standalone plugins.
• All core SEO features available for free without license requirements.