Draft2Live Connect

Journal

1.2.2

• Fix: changing only the featured image on the WordPress side now propagates back to Draft2Live. The post’s thumbnail id is part of the sync-loop hash, so a featured-image swap actually trips the on_post_save webhook (previously the unchanged title/content/status fooled the dedup into skipping the notification).

1.2.1

• Webhooks back to Draft2Live now also carry the post excerpt, the SEO meta description (Yoast / Rank Math / AIOSEO), the featured image URL, the post tags and the categories. Edits to any of these on the WordPress side now propagate back to the Draft2Live editor instead of getting silently dropped.

1.2.0

• Branded « update available » banner shown on every WordPress admin page (with the Draft2Live logo and an « Install update » button) so the admin spots the new version without going to Plugins → Updates.
• After WordPress finishes upgrading the plugin, the site sends a one-shot fire-and-forget notification to draft2live.ai so the platform admins can see the rollout reach real sites (used internally for monitoring; payload is just site URL + old/new version).

1.1.9

• Internal release pipeline test – no functional changes.

1.1.8

• Featured image can now be replaced (or removed) on the existing post via the update endpoint, not just at create time. Pass featured_image_url in the update payload — a non-empty URL replaces the thumbnail, an empty string clears it, omitting the key leaves the current thumbnail untouched.

1.1.7

• Fixed: status changes made in WordPress (e.g. publish → draft via Quick Edit) now reliably sync back to Draft2Live. Previously the first edit after a Draft2Live publish was swallowed by an over-eager sync-loop guard. The guard is now content-hash based and only suppresses WordPress’s own internal save during plugin-driven updates.

1.1.6

• Strengthened REST API permissions: /draft2live-posts now requires edit_others_posts, /posts/{id}/export uses per-post permission check.
• Removed load_plugin_textdomain() — WordPress.org handles translations automatically since 4.6.
• Updated plugin URL references.

1.1.5

• New GET /wp-json/draft2live/v1/draft2live-posts endpoint that returns every WP post which originated from Draft2Live (has the _draft2live_article_id postmeta). Used by the Draft2Live dashboard to re-link existing publications after a site has been disconnected and re-paired.

1.1.4

• Tidies the native WordPress Application Password approval screen when the application being authorized is Draft2Live: hides the long redirect-URL preview lines (which overflow on small windows) and puts the Approve / Deny buttons on a single row. Other plugins that use Application Passwords are not affected — the styles are gated to apps named « Draft2Live ».

1.1.3

• Cleaner settings page: removed the right-hand sidebar (Application Passwords / Help links) since the disconnect card and the rest of the page already cover everything important.

1.1.2

• New « Disconnect from Draft2Live » button on the plugin settings page so the user can clear the local pairing state without going to Draft2Live.
• Added a Settings link to the plugin row on the Plugins → Installed Plugins screen.

1.1.1

• Added /wp-json/draft2live/v1/disconnect REST endpoint so Draft2Live can clear the plugin’s local pairing state when the user removes the site from their Draft2Live account. Without this, the plugin kept showing as connected after the matching site was deleted on the Draft2Live side.

1.1.0

• First public release on WordPress.org.
• Security hardening: tightened REST API permission callbacks per-route (read / publish / edit_post / delete_post / admin), per-post capability checks for update, delete and restore endpoints.
• Security: SSRF guard on remote media downloads — non-HTTP schemes and private/reserved IP ranges are rejected via wp_http_validate_url().
• Security: post_status values are now whitelisted against draft, pending, publish, future, private.
• Security: Schema.org JSON-LD output re-encoded with JSON_HEX_* flags so stored content can’t break out of the <script> block.
• Bug fix: the two-way sync hooks were never firing because the post_type default was missing from the settings defaults. Sync now works out of the box.
• Yoast SEO meta fields are only written when Yoast is actually active.
• Added .pot file in /languages/ so the plugin is fully translatable.
• Replaced Unicode icon glyph with a Dashicon.
• Moved inline admin CSS into the enqueued stylesheet.
• Bumped Tested up to to 6.9.

1.0.3

• One-click pairing via the WordPress native Application Password authorize flow.
• New /setup REST endpoint that Draft2Live calls at the end of the pairing handshake to push the site_id and webhook_secret automatically.
• Hid the legacy Site ID / Webhook Secret / API URL form fields from the admin screen — these are now managed automatically by the pairing flow.
• Admin page now shows a single hero « Connect to Draft2Live » button.

1.0.0

• Initial version, distributed as a direct download from draft2live.ai.
• Publishing from Draft2Live to WordPress (title, content, featured image, categories, tags, FAQ).
• Two-way synchronization: edits in WordPress flow back to Draft2Live via signed webhooks.
• Settings page under Settings → Draft2Live.
• REST API endpoints under /wp-json/draft2live/v1/.