Apaxon Core

Apaxon Core is the plugin the other Apaxon plugins sit on. Install it once and it handles licensing, a shared settings framework, granular permissions and the security helpers every Apaxon plugin uses — so no two of our plugins ship their own copy of the same code. Encrypted secrets API keys, SMTP passwords and webhook secrets are sealed with libsodium before they reach the database. Most plugins store them in plaintext, which means any database dump, stray backup file or SQL injection elsewhere on the site hands over a working set of credentials. Email that actually sends WordPress sends email through your server by default, which on shared hosting often means it is quietly discarded. Pick your provider — Gmail, Microsoft 365, Brevo, SendGrid and others are preset — enter an app password, and press the test button. Passwords are encrypted before they are stored. If you already run WP Mail SMTP, FluentSMTP or Post SMTP, Apaxon leaves email alone entirely and tells you which plugin is in charge. Granular permissions Apaxon features use their own capabilities rather than manage_options. You can let a receptionist manage the booking calendar without making them an administrator who can install plugins and edit users. Site checks Core reports what it can see: licence state, whether scheduled tasks are actually running, PHP end-of-life, HTTPS, the file editor, debug mode. Findings appear in Apaxon Tools and in WordPress's own Site Health screen. Your site keeps working If our platform is unreachable, Core keeps your last known entitlements and carries on. Nothing switches off because of an outage on our side, and nothing switches off the moment a subscription lapses — plugins fall back to their free capabilities instead. No tracking Core reports your WordPress version, PHP version and plugin versions so we can warn you about vulnerabilities affecting your site. It does not collect visitor data, page views, or anything about the people using your website.

1. Install and activate Apaxon Core.
2. Go to Apaxon → Licence. If you don't have a key, follow the link to create a free account at wpapaxon.com and generate one.
3. Paste the key and press Activate.
4. Install the Apaxon modules your plan includes.

Core works without a licence. A key is what the paid Apaxon plugins check against.

0.18.3

• Fixed: any screen drawing a contact's initials was a fatal error on a host without the mbstring extension. WordPress fills in mb_substr when it is missing but not mb_strtoupper, and mbstring is recommended rather than required — so this was a white screen rather than a slightly wrong letter, on hosting nobody would think to check.
• New: breadcrumbs. A record inside a tab could not say where it was — the tab strip only names the section — and the way back was the browser button. Drawn only below a tab, because on a tab landing the strip already answers the question and a second navigation agreeing with the first is noise.
• New: a definition list variant for explanations rather than values. The existing one pushes a short value to the right, which is right for "PHP 8.3.33" and leaves a sentence ragged and a long way from its own label.
• New: a button style for destructive actions — outlined in the critical colour rather than filled with the brand one, so a confirmation screen does not make the irreversible choice the one the eye goes to.

0.18.2

• Fixed: every stat card on every dashboard overflowed its own container by 36px, so the row beneath was drawn across the bottom of it. The cards asked for the full height of their grid row and then had padding and a border added on top; nothing in the admin sets border-box, and Core never set it either.
• Fixed: Apaxon text fields and text areas rendered as stock WordPress fields — a glaring white box on the dark theme. WordPress styles inputs by attribute, which outranks a plain class, so its rules won every time. The dropdowns escaped only by accident of specificity, which is why they alone looked right.
• Fixed: a secondary button's label turned white on a near-white background when hovered, and disappeared. The rule set the text colour meant for a brand background and used it on a surface.
• Fixed: white text on a primary button was 3.74:1, below the 4.5 WCAG AA needs. Brand now has a separate, slightly darker value for use behind white text; the lighter one is still used for text and borders, where it is correct.
• Fixed: muted metadata text failed contrast in both themes — 3.86:1 on white and 4.13:1 on the dark panel.
• Fixed: plain links inside Apaxon panels inherited WordPress's blue, which is 3.57:1 on the dark surface. Core now sets its own link colour.
• Fixed: dropdowns kept the operating system's control chrome next to themed fields, and stayed light grey with near-black text on the dark theme.
• Changed: the gap between rows of panels was 5rem — four times the gap within a row — which read as the page having ended. Rows now share one vertical rhythm, and the space that separates one section from the next moved onto the section heading, where it belongs: a grid followed by another grid in the same section no longer gets a break it never wanted, and a section starting with something other than a grid now gets one it never had.
• Changed: an empty state inside a panel is no longer drawn at the size of a full-page one, with its own dashed outline 20px inside the card's border.

0.18.1

• Fixed: Apaxon screens that are WordPress post types — the dish and menu editors, their lists, the table and venue editors — loaded no stylesheet at all and rendered as bare markup. The page was marked as an Apaxon screen and the styling that goes with it was never sent.

0.18.0

• New: paid modules can tell somebody, on their own screen, that they are running unlicensed — and stay quiet unless Apaxon is certain. A site whose host blocks outbound requests knows nothing, and must not be told it is unlicensed.
• Changed: a product that is not on your licence now says what a licence brings, rather than only that you do not have one.
• Fixed: the no-free-seat message read "covers 1 sites and 1 are in use". Both counts are now pluralised separately, because they can differ.

0.17.0

• New: paid Apaxon plugins now ask the platform for updates through Core rather than each building the request themselves. Core holds the licence key, so it was always the only place the request had to be right — and every one of them was building it wrong.
• Fixed: the Amazon SES preset is documented as an SMTP submission endpoint rather than an asset host, for anyone reading the source or running Plugin Check.

0.16.2

• Fixed: a notice in the error log on WordPress 6.7 and newer. The plugin was preparing its wording before WordPress had settled which language to use, which on a non-English site could have shown English text.

0.16.1

• Fixed: five marks used by the new screens had never been drawn, so they appeared as blank spaces.

0.16.0

• Added: shared parts every Apaxon plugin draws with — figures, labels, initials, and a proper first-run screen that says what will be there rather than just that nothing is.
• Changed: lists have more room and respond to the pointer.

0.15.0

• Changed: a plugin can now put a tab in its own screen that leads to its settings, so you do not have to know they live elsewhere.

0.14.0

• Added: send email through Gmail, Outlook and Microsoft 365, Brevo, SendGrid, Mailgun, Amazon SES, Zoho, Fastmail or any other server. Choose the provider and the technical settings fill themselves in.
• Added: a test email button, so you can find out whether sending works before a customer does.
• Added: every email Apaxon sends is recorded — who it went to, what it was about, and whether it arrived. Subjects and addresses only; never the contents.
• Changed: if WP Mail SMTP, FluentSMTP, Post SMTP or Easy WP SMTP is active, Apaxon leaves email entirely alone and says so.

0.13.9

• Changed: the last few places that built an HTML attribute without an escaping call now use one, so every output in the plugin is escaped at the point it is written.

0.13.8

• Changed: tested against WordPress 7.1.

0.13.7

• Fixed: the Settings screen stopped loading in 0.13.5, so the colour scheme option could not be reached. Light and dark are back where they belong, under Settings → Appearance.
• Fixed: several screens still described Core as verifying update signatures, which it stopped doing in 0.10.0.

0.13.6

• Fixed: the plugin description and readme still advertised signed update delivery, which moved out of Core in 0.10.0. Core does not verify packages and no longer claims to.

0.13.5

• Changed: icons and form fields are now passed through WordPress's own filtering as they are output, so the security checks the review tooling looks for are visible where the output happens.
• Changed: the Contributors line now names the correct WordPress.org account.

0.13.4

• Fixed: when the daily task was missing, the site check told you to deactivate and reactivate the plugin. There has been a button that does it since 0.6.0, and the check now points at that instead.

0.13.3

• Fixed: two settings form values were read before being cleaned. They are now cleaned as they are read.

0.13.2

• Changed: form handling tidied so the security checks the review tooling looks for are all where it expects them.

0.13.1

• Fixed: the permissions grid listed every role on the site, so another plugin adding five of its own made the table unreadable. It now shows WordPress roles plus any role already holding an Apaxon permission, with the rest one click away.
• Fixed: the capability column now stays in place while the roles scroll.

0.13.0

• Added: a question mark beside a heading opens a short explanation of what that section is for. Available to every Apaxon plugin, and it needs no JavaScript.

0.12.0

• Added: a shared tab strip, so an Apaxon plugin adds one entry to the menu and keeps its own sections inside it rather than filling the sidebar.

0.11.0

• Added: light and dark colour schemes for Apaxon screens, under Settings → Appearance. The default follows whatever your computer or phone is set to.
• Changed: every colour now comes from one place, so both schemes stay in step and no screen is left behind.

0.10.1

• Fixed: a partly applied update could take the whole site down with a fatal error. Core now reports which files are missing and carries on with everything that still works.

0.10.0

• Changed: update delivery moved out of Core and into the paid plugins that need it. Each now brings its own, so Core can be hosted in the WordPress plugin directory.
• Changed: Core no longer carries a release signing key, because it no longer verifies packages. The plugins that do carry their own.
• Changed: the dashboard reports updates WordPress already knows about rather than fetching them itself.

0.9.0

• Changed: licensing is now per product. One key still covers everything you own, but each product carries its own renewal date and its own site allowance — so cancelling one leaves the others untouched.
• Added: clear reasons when a product cannot be used here — not purchased, renewal due, or every site allowance already in use — instead of a single unhelpful state.
• Changed: a product whose subscription has ended keeps working and keeps your data. It stops receiving updates and support, and says so.

0.8.1

• Changed: code now passes the WordPress Coding Standards checks used in plugin review, with no outstanding findings.

0.8.0

• Added: connected sources. Apaxon plugins can now receive contact details from the form plugin you already use, instead of asking you to replace it. WPForms is supported to begin with.
• Added: every source declares what it can and cannot carry across, so you can see exactly what is available before you rely on it.
• Changed: consent is recorded as unknown when a source does not report it, never assumed.

0.7.5

• Changed: code cleaned up against the WordPress plugin review tooling — output escaping, nonce annotations, hook prefixes and the uninstall routine.
• Fixed: the plugin header declared a translations folder that did not exist.

0.7.4

• Fixed: the external services notice claimed nothing was sent before a licence key was entered. The connection test added in 0.6.0 makes a request without one, and that is now described rather than omitted.
• Changed: readme now records the correct WordPress version it has been tested against.

0.7.3

• Fixed: site check results used the same word for opposite verdicts. "Enabled" meant good for HTTPS and bad for the file editor; "Disabled" meant bad for scheduled tasks and good for the file editor. Each result now reads correctly without relying on its colour.

0.7.2

• Fixed: no release signing key was compiled into the plugin, so every module update failed verification and none could install. The key is now present.

0.7.1

• Added: a site check reporting whether a release signing key is present, and its fingerprint, so a build shipped without one is obvious rather than only surfacing when an update fails.
• Added: the signing key fingerprint is included in the diagnostics export.

0.7.0

• Fixed: five of the six settings did nothing. The privacy switch did not stop version numbers being sent, the automatic update toggle was not connected, and the licence check interval was ignored — the check ran daily whatever the field said.
• Changed: every remaining setting now changes real behaviour. Turning off version reporting genuinely omits your WordPress, PHP and Core versions.
• Added: Permissions — a role-by-capability grid, so a receptionist can manage bookings without being made an administrator. Read from the roles themselves, so it always shows what is really in force.
• Added: activity log retention is now yours to set, from 1 to 365 days.
• Added: an option to keep your settings and permissions if the plugin is deleted.
• Removed: the update channel and alert email fields. Neither had anything behind it.

0.6.2

• Fixed: the Tools and Settings section links rendered as plain text with no tabs. They are now a proper set of tabs.
• Fixed: twenty-four components carried over from the previous design had lost their spacing, borders and sizing in the dark rebuild — tables, stamps, module cards, the activity ledger, callouts and the licence screen among them.

0.6.1

• Added: when a site is pointed at a platform other than the production one, every Apaxon screen says so, a site check reports it, and the diagnostics export records it. A staging setting left in a live site used to be completely invisible.
• Fixed: a link on the Licence screen was labelled wpapaxon.com regardless of which platform the site was actually configured to use.

0.6.0

• Added: Maintenance tab under Tools — test the connection to Apaxon, check the licence now, restore the daily task, re-apply permissions, clear the update cache, clear the activity log.
• Added: connection test, which separates "this host blocks outbound HTTPS" from "this key is invalid". They look identical on the dashboard and have completely different fixes.
• Added: Help tab, answering the questions people actually arrive with.
• Added: the WPApaxon mark now appears at the top of every Apaxon screen.
• Fixed: site checks reported a missing daily task and told you to deactivate the plugin to fix it. There is now a button that fixes it.
• Fixed: permissions removed from the administrator role by a role editor could never be restored — the automatic sync saw its own record and did nothing.

0.5.2

• Changed: Tools rebuilt to match the rest of the admin. It was still a plain list of headings.
• Added: check results now open with a score, three counts and the findings that need acting on, before the full list.
• Added: a copy button on the diagnostics export, so a support request no longer starts with selecting sixteen lines of text by hand.

0.5.1

• Fixed: the four status cards overflowed their row, closing the gap beneath them and leaving empty space under each button.
• Fixed: the database version showed the full distribution build string, forcing the system information labels into a narrow column.

0.5.0

• Changed: the Apaxon admin now has its own dark interface, matching wpapaxon.com. WordPress's sidebar and admin bar keep whatever colour scheme you have chosen.
• Added: dashboard rebuilt — licence, updates, site health and PHP across the top, then installed modules, a site health score with the checks behind it, system information, recent activity and shortcuts.
• Added: site health score, shown as passing checks over checks run, so the number can be verified rather than trusted.
• Added: system information panel — WordPress, PHP, database, web server, memory limit and execution time, read locally with no external requests.
• Added: unresolved findings are counted next to Help at the top of every Apaxon screen.
• Changed: shortcuts are named for what they do and only appear when Core can actually do them.

0.4.3

• Fixed: capabilities added by a module were never granted, so a newly installed module's screens could be invisible to administrators. Core now brings the capability set up to date on every admin request rather than only when Core's own version changes.
• Fixed: uninstalling left every module's settings behind in the options table, including Core's own — which is where encrypted secrets are stored. Uninstall now removes them, along with every capability the plugin granted.
• Fixed: uninstalling on a multisite network only cleaned the site it ran on. All sites are now cleaned.
• Changed: licence and capability maintenance no longer runs on front-end page loads.

0.4.2

• Changed: lighter, calmer admin layout — white header, grey page, white cards with rounded corners.
• Changed: status cards now use icons and a button for the action, so what to do about a finding looks like something to press.
• Added: inline SVG icons throughout. No icon font and no extra requests.

0.4.1

• Fixed: the dashboard rendered twice. The top-level menu and its first submenu each built their own page object, so WordPress registered two callbacks against the same page hook and ran both.
• Fixed: screens were capped to a fixed width and left large empty margins on wide monitors. Layouts now use the full width, with column counts adapting from phone to ultrawide.

0.4.0

• Added: redesigned dashboard — licence, updates, site checks and PHP status at a glance, with modules, recent activity and tools below.
• Added: Modules screen showing what is installed and what the rest of the Apaxon suite does.
• Changed: Apaxon screens now carry their own branded header rather than looking like a settings page.
• Changed: every screen states plainly what it is for.

0.3.0

• Added: event bus — modules publish what happened rather than calling each other. Event catalogue visible under Apaxon → Activity.
• Added: shared HTTP client with enforced TLS verification, capped timeouts, exponential backoff and credential redaction in logs.
• Added: scheduler backed by Action Scheduler where available, WP-Cron otherwise.
• Added: structured logging with channels and 30-day retention.
• Added: shared admin UI components, so every Apaxon screen looks and behaves the same.
• Added: modules can declare a minimum Core version and their own capabilities. A module needing a newer Core is refused with a clear message instead of causing a fatal error.

0.2.1

• Fixed: the Apaxon menu disappeared after updating from 0.1.0. Custom capabilities were only granted on activation, and activation hooks do not run on update.
• Added: upgrade routine that runs on the first admin request after an update, so capabilities and scheduled tasks are brought up to date without deactivating the plugin.
• Changed: menu items fall back to the manage_options capability if the Apaxon capability is missing, so the menu cannot disappear for an administrator.

0.2.0

• Added: settings framework — declarative registration, 17 field types, tabs, conditional fields, restore defaults
• Added: encrypted secret storage (libsodium) for API keys and passwords
• Added: granular capabilities, so Apaxon features no longer require manage_options
• Added: site checks for licence, scheduled tasks, PHP end-of-life, HTTPS, file editor and debug mode
• Added: WordPress Site Health integration
• Added: Tools screen with diagnostics export (excludes secrets and licence key)
• Changed: admin screens restructured around Dashboard, Licence, Settings, Tools, Activity

0.1.0

• First release: licensing, signed module updates, settings framework, encrypted secret storage, granular capabilities, site checks, diagnostics export, admin dashboard, activity log.