Custom Recovery Mode Email

Changelog

2.0.0

• Feature: new “WPVulnerability Email” field below the Mail Sender Email, shown only when the WPVulnerability plugin is active. The plugin defines the WPVULNERABILITY_MAIL constant (only if not already defined elsewhere) using the configured value, or a fallback of wpvulnerability@ if the field is empty.
• Feature: new sidebar banner promoting the Dixitalmedia plugins on WordPress.org, dismissible independently from the FactuPress banner.
• Multisite: the new WPVulnerability email can be set network-wide and overridden per site, following the same pattern as the recovery email and the sender override.
• Major: full visual redesign of the admin settings page. Each section is now grouped into a card with its own icon, title and description, replacing the previous flat layout.
• Major: complete internal rewrite. The plugin now follows an OOP architecture with namespaces, autoloading via Composer, a service container, and dedicated classes for hooks, services, settings and lifecycle. The public behavior is unchanged; existing settings are preserved.
• New: hero header on top of the settings page summarising the plugin scope at a glance.
• New: dedicated card for the Notifications section, with refined toggle switches.
• New: callout component for Multisite-context notices (replaces the previous generic admin notice on per-site pages).
• New: action bar at the bottom of the form with a loading state and spinner when saving, plus aria-busy for assistive technologies.
• Improvement: admin assets reorganised into assets/css/ and assets/js/ for clarity. Inline <h2> styles removed and replaced with proper CSS classes.
• Improvement: focus states on inputs and switches now use :focus-visible to avoid showing outlines on mouse clicks.
• Improvement: prefers-reduced-motion is honoured for the save spinner animation.
• Compatibility: tested up to WordPress 6.9.4.

1.5.5

• Hardening: added direct file access protection (ABSPATH guard) to all PHP source files.
• Hardening: form action URL is now explicitly escaped on output in the Network Settings page.
• Hardening: $_SERVER[‘REQUEST_METHOD’] is now properly unslashed and sanitized before use.
• Hardening: exception messages in the service container are escaped before being passed to the runtime.
• Cleanup: removed legacy load_plugin_textdomain() call (WordPress loads translations automatically since 4.6).
• Cleanup: removed leftover error_log() debug call from the service container.
• Compatibility: tested up to WordPress 6.9.

1.5.3

• Fix: fatal error on boot caused by argument count mismatch in UserNotificationsHooks.
• Fix: cancelling auto-update emails no longer disables password change notifications as a side effect.
• Fix: WPVulnerability sender override is now scoped to emails actually sent by that plugin (no longer reformats every email site-wide).
• Fix: notification toggles are now evaluated at runtime instead of at plugin boot, which broke decisions in Multisite when the active site changed.
• Fix: From name was missing on overridden emails because the From filter reset the override flag before the From-name filter ran.
• Fix: Network Admin form now submits via admin-post.php (canonical pattern) and shows the success notice via redirect.
• Fix: settings page no longer bypasses the repository to read the network option directly.
• Fix: rate limit is clamped to a minimum of 60 seconds to prevent accidental disabling.
• Fix: ServiceContainer no longer calls a non-existent write_log() function.
• Cleanup: removed dead code (unused Notices class, unused repository implementations, no-op TextDomainLoader).
• Improvement: admin CSS moved to assets/admin.css and properly enqueued.
• Improvement: TextDomainLoader actually loads the textdomain on init for self-hosted installs.

1.5.2

• Refactor to OOP with vendor and autoload.
• Added compatibility with WordPress Multisite.

1.5.1

• Minor fixes.

1.5

• Security updates.
• Now the plugin also changes the recipient for password change and plugins and themes autoupdates emails.
• Updated last WordPress version tested.
• Added update email settings.
• Added password change email setting.
• Change sender for WPVulnerability plugin.

1.1

• Security updates.
• Now the plugin also changes the recipient for password change and plugins and themes autoupdates emails.
• Updated last WordPress version tested.

1.0.4

• Updated last WordPress version tested.

1.0.3

• Updated last WordPress version tested.

1.0.2

• Added class “regular-text” to input fields.

1.0.1

• Fix to prevent activation in WordPress Multisite to avoid site to crash.
• Fix wrong text domain.

1.0

• Initial Release.