BoltAudit – Site Speed Audit and Performance Insights

Registro de cambios

1.0.1 – 2026-09-02

Fixed

• Fixed: A fatal error on sites where another plugin registers its Site Health test as a closure, which returned a server error for the backend layer of every AI Audit. The test’s method name was built by interpolating the registered value, which holds for WordPress core’s own string-named tests and nothing else. The registered value is now resolved to a callable first, so a plugin’s own function or an [ $object, 'method' ] pair runs too — where before it was silently skipped.
• Fixed: The AI credit chip in the top bar drew its icon and the words “AI credits” but never the number, on every install and at every balance. A balance that has not loaded still shows nothing rather than a misleading zero.

Improved

• Improved: Activating BoltAudit now opens the Local Audit instead of the AI Audit’s connect screen. A new install landed on a setup checklist with no score on it; it now lands on the audit that needs no account and shows the site’s real numbers straight away.
• Improved: The Dashboard says what the plugin actually does. “Apply this fix” is now “Show me how” and opens the finding’s own instructions, “Apply optimization fixes” is “See the fix plan”, the Optimization gauge is “Fix readiness”, and each finding carries an effort line built from its own difficulty and time estimate. The apply and rollback wording was left over from the fix actions withdrawn in 1.0.0.
• Improved: Your plan is named as the platform reports it, rather than every paid plan reading “PRO”.
• Improved: The plugin’s screens now end where the browser viewport ends. The page was measured against the largest viewport rather than the visible one, which left the app ending above the bottom of its own scroll.
• Improved: The sidebar is scaled down slightly, so more of each screen is the screen.

Removed

• Removed: The Fix History card on the Dashboard, the last surface still pointing at the withdrawn fix actions. Rollback of anything applied under an earlier version still works, as in 1.0.0.

1.0.0 – 2026-08-31

BoltAudit rebuilt. New admin screens, a Local Audit that runs entirely on your own server without an account, an AI Audit you can start and read without leaving WordPress. The guided fix actions from 0.1.0–0.4.0 are withdrawn in this release — BoltAudit now finds and explains the work rather than performing it. See Removed.

The new admin experience

• New: Rebuilt admin interface with seven screens — Dashboard, Local Audit, Audit Report, Trends, PRO, Settings and the SEO & AEO placeholder. It is the same design as the BoltAudit web dashboard, so the two surfaces are one product rather than two that resemble each other.
• New: Dark mode across the whole plugin, on one toggle, remembered per browser.
• New: Command palette on Ctrl F / ⌘ F, a keyboard shortcut reference, mobile navigation and inline notifications.
• New: A Dashboard widget and a health score in the admin bar. Both are on by default and switched off in Settings, and both show the last stored result — neither runs an audit, so opening wp-admin never triggers a scan.
• New: Every string is translatable.
• Improved: The sidebar is grouped into Overview, Audits and General, with the connected BoltAudit account shown at the foot of it.

Local Audit

• New: The Local Audit replaces the Quick Audit. It runs in PHP on your own server, needs no BoltAudit account, and makes no outbound request — the plugin enforces that with a request filter rather than promising it in the copy.
• New: The Local Audit has its own page, rebuilt so that every claim shows the measurement behind it.
• New: Run a Local Audit in one click from either the top bar or the page itself.
• New: Your site’s own score over time, kept in a table in your own database and shown on Trends.
• New: Export every result as JSON.
• Improved: Per-image weights the scanner already measured are now reported instead of discarded.
• Improved: When a check cannot complete, the report says what went wrong rather than only that something did.

AI Audit

• New: Start an AI Audit, follow its progress, read the report and see your remaining credits without leaving WordPress. Your account credential stays on the server and is never handed to the browser.
• New: Sites that nothing can reach from the outside — behind Cloudflare, a WAF, a stripped authorization header, a staging password or a private network — now collect their own data and send it out. This was previously impossible.
• New: The outbound run sends one layer at a time. Sending all four in a single request is how a shared host hits its execution limit with nothing delivered.
• Improved: An audit blocked in one direction continues in the other instead of stopping at an error.
• Improved: The Audit Report ranks findings by estimated visitors recovered and gives each one a Show me how panel: what is happening, the measured evidence in copyable rows, the ordered steps, and the estimated improvement.
• Improved: The AI Audit is no longer labelled PRO. Every plan reloads AI credits weekly, including the free one, so the upgrade prompt was interrupting people on their way to something they already had.
• Improved: Paid-only cards are now gated on your actual plan, and controls that lead nowhere are no longer drawn.

Connecting your site

• New: Connect by sending your browser to the BoltAudit dashboard and letting your server collect the keys on the way back. The previous flow required the platform to call into your site, which any firewall answers with a challenge page instead — connecting simply failed, and the account was rolled back each time.
• New: Create a BoltAudit account from wp-admin in one click.
• New: A reachability check that tells you whether the platform can reach your site before an audit depends on it.
• New: When a firewall is in the way, the plugin shows that firewall’s own instructions in wp-admin, and lets you re-check when you are done. The notice stays until you dismiss it.
• Improved: Connection failures name the specific obstacle instead of reporting “could not connect” for all of them.
• Improved: One Connection card in Settings, replacing two competing flows.
• Improved: Plugin preferences and a settings export, both of which work whether or not you have an account.
• Improved: Uninstalling keeps your audit history by default. People uninstall to troubleshoot, to migrate, or by accident, and destroying months of measurements on the way out is not a decision a plugin should make. Opting in to a full purge also deletes the stored credential.

Fixed

• Fixed: A fatal error on activation under PHP 8 that took the site down. A missing configuration key meant the database migration list was read as a boolean instead of an array.
• Fixed: Every Local Audit on a WooCommerce site returned a server error. One WooCommerce check was still being called with the old number of arguments after the signature changed, and the failure brought the whole summary down with it.
• Fixed: A fatal error when the asset loader was included twice.
• Fixed: Blank rows on the Local Audit page’s Post Types, Database and Plugin cards.
• Fixed: A crash on the dashboard for connected accounts, caused by a missing field in the credits data.
• Fixed: Two AI Audit contract errors between plugin and platform. The contract is now tested against the live API rather than a fixture.
• Fixed: Only half the site credential was being sent on some requests.
• Fixed: Three layout defects, along with the browser test harness that found them.
• Fixed: The row you clicked no longer jumps when a panel above it collapses.

Removed

• Removed: Applying fixes. The guided fix actions added in 0.1.0 through 0.4.0 — the cache, compression, revision, transient, Action Scheduler and debug-log actions — no longer run. This is enforced on the server, not merely hidden: hiding a button leaves the route behind it live. They are being rebuilt into an apply engine with a preview, an automatic backup and a one-click revert on every change.
• Removed: Fix History, withdrawn alongside the actions it logged.
• Note: Rollback of anything already applied still works. Revert, snapshot and verification are deliberately left running. Every fix applied under an earlier version was promised a way back, and withdrawing the feature is not a reason to strand a site that was already changed.
• Removed: The Quick Audit, replaced by the Local Audit.
• Removed: The older connection flow, and the browser message that carried account keys through the page.
• Removed: Surfaces with no data behind them — the notification feed, the industry benchmark comparison, the site switcher, pausing a running audit, and the per-device optimization toggle. Each is switched off rather than deleted.

Security

• Hardened: The connect handshake uses PKCE. The secret never leaves your server, so a code seen in browser history, a proxy log or a referrer header cannot be used by whoever saw it.
• Hardened: The platform refuses to issue a code for any address that is not your own wp-admin, so it can only ever be delivered to the site being connected.
• Hardened: Your BoltAudit credential stays in PHP. No admin screen and no browser request ever holds it.
• Hardened: Redacted findings are kept out of the admin screens.
• Hardened: Every action that writes requires the manage_options capability, and an unrecognised feature flag fails closed rather than open.
• Hardened: A full uninstall now deletes the stored API secret along with everything else. A live key left in a database nobody is watching is the part that matters most.

Compatibility

• Tested up to WordPress 7.1. Requires WordPress 6.0 and PHP 7.4.

0.4.0 – 2026-06-14

• New: One-click fix for orphaned post metadata, removing database rows left behind by deleted posts.
• Improved: The fix action layer reorganised into smaller, focused files, with no change in behaviour.
• Tested up to WordPress 7.0.

0.3.0 – 2026-05-11

• New: Three cleanup actions for the guided-fix pipeline — post revisions, failed Action Scheduler jobs older than 30 days, and the WordPress debug log.
• New: Partial completion on those actions. Each call processes a bounded batch inside a 25-second budget, so it never overruns PHP’s execution limit on shared hosting.
• New: A collector signal for failed Action Scheduler records older than 30 days.
• Hardened: Expired-transient cleanup switched to batched SQL, removing the cost spike on sites with tens of thousands of them.
• Hardened: Strict end-state verification on every cleanup, so a partial run can never report as a completed one.
• Hardened: A path check on the debug-log action refuses any log file outside the WordPress install.
• Hardened: Action Scheduler cleanup now confirms both of its tables exist before touching either.

0.2.0 – 2026-05-08

• New: A public capability manifest so the dashboard can discover what a site supports.
• New: The Local Audit summary redesigned as five previews — frontend, backend, database, infrastructure and environment.
• New: Backend collectors expanded, giving the AI Audit more evidence to work from.
• Improved: Collectors are multisite-aware and no longer cap administrator enumeration early.
• Improved: The TTFB endpoint accepts a URL parameter for single-page measurement.
• Fixed: Namespaced collector edge cases.

0.1.0 – 2026-05-02

• New: Guided fix endpoints covering all ten action keys.
• New: Batch data collectors for the backend check registry.
• New: Active plugin summaries in the baseline.
• Improved: The Local Audit and AI Audit screens redesigned.
• Improved: JWT replaces HMAC on authenticated endpoints, which firewalls handle better.
• Improved: Request and response logging for easier diagnosis.
• Fixed: Site Health class lookup in the namespaced collector.
• Fixed: Local Audit status pills now reflect actual state.
• Fixed: Performance-budget labels, the HTTPS check, relative asset URLs and lazy-load behaviour.

0.0.9 – 2026-04-23

• New: The AI Audit workflow inside BoltAudit.
• New: A bottleneck-focused report model with evidence-backed findings.
• New: Connection and Deep Scan controls for AI Audit setup.

0.0.8 – 2025-09-05

• New: Database Details page.
• New: WooCommerce Details page.
• Fixed: An uncaught error.

0.0.7 – 2025-08-08

• New: Post Details page, with orphaned metadata and orphaned post record reports.
• Fixed: Environment user lookup, so the username reported is the right one.

0.0.6 – 2025-07-30

• New: WooCommerce Performance Insights.
• New: A Settings link on the Plugins screen.
• Fixed: A plugin fetch error.

0.0.5 – 2025-07-25

• New: Asset impact metrics — script and style file size and load duration.
• Improved: Repository caching, for faster repeated audits.
• Improved: The metrics breakdown UI.

0.0.4 – 2025-07-16

• New: Site Details section.
• Fixed: Plugin Audit on sites with a large number of plugins.
• Improved: Table UI.

0.0.3 – 2025-07-13

• New: Plugin Audit, detecting inactive, outdated and abandoned plugins.
• New: Warnings for unused or risky plugins.
• Improved: Environment and database reporting.

0.0.2 – 2025-07-05

• New: Database Overview — table sizes, row counts, autoloaded options, transients and bloat detection.
• Improved: Post type detection and metadata analysis.

0.0.1 – 2025-07-03

• Initial beta release: post-type analyzer and environment report.