BlogPilot

BlogPilot is a content strategy and autoblogging plugin for WordPress. It discovers keywords, groups them into topic clusters, writes full posts across 15 content genres using your own Anthropic (Claude) API key, and publishes them on a schedule. What it does Every screen and feature in this plugin is available on all plans; nothing is locked, hidden, or disabled locally. Features marked (Pro) are ones whose work is performed by the hosted BlogPilot API, and the API applies your plan's limits to them. When a request exceeds your plan the API declines it and the plugin displays that message.

• Keyword Discovery — finds keywords using DataForSEO search volume and difficulty data (optional), Google autocomplete suggestions, and an intent-aware genre classifier, then groups related keywords into topic clusters.
• AI Content Generation — writes full posts (title, body, meta description, featured image) across 15 content genres using your own Anthropic API key, and can publish on a recurring schedule.
• Multi-Niche Support — create and manage as many independent content niches on one WordPress install as you like, each with its own keywords, publishing queue, and schedule. Keyword discovery and content generation for a niche run through the BlogPilot API, and the free plan's API quota covers one niche (Pro removes that limit).
• Site Diagnostics — link health, technical checks, and content-gap analysis run locally and work on every plan; the AI-scored 12-point post SEO audit and one-click AI repairs run through the BlogPilot API (Pro).
• Accessibility Auditor — runs a live Google PageSpeed Insights accessibility scan from your browser and can inject a one-click CSS fix for common contrast issues, helping you work toward WCAG 2.1 AA conformance.
• Google Search Console Integration (Pro) — connects your own GSC property (via OAuth) and surfaces posts that are close to ranking, underperforming on click-through rate, or already ranking well. The scoring and classification run on the hosted BlogPilot API, so this needs the Pro plan or above (or an active trial). Connecting your property is free; the insights are not.
• Cerebro (Pro) — a conversational assistant inside the WordPress admin that reads your site's diagnostics and GSC data and suggests (and can execute) next actions.

How the AI features work Keyword research, clustering, content generation, and diagnostics scoring run through the BlogPilot API, a hosted service operated by this plugin's developer, using your own Anthropic API key for the actual writing. The plugin sends the data each feature needs (for example, a list of keywords, or post metadata for scoring) to the API and applies the result locally in WordPress. No keyword, cluster, niche, or post content is permanently stored by the API — only license, site registration, encrypted API key, and usage-count records are kept, for as long as your license or trial is active. See the "External services" section below for details. The free plan includes API quota for 1 content niche and 10,000 AI-generated words per month at no cost, with no time limit -- split across as many posts as you like. The quota is applied by the API, not by the plugin: you can create any number of niches locally, and the API reports the limit when you run discovery or generation for a niche beyond your plan. A paid Pro plan (billed via Paddle, a merchant-of-record payment provider) removes those limits and unlocks the remaining hosted features: Cerebro and the AI post SEO audit and repairs. A 14-day trial of the full Pro feature set starts when you click the Start Free Trial button shown on the plugin's admin pages.

2.0.237

• Added: RSS Inbox. Feed items from your niches are now listed in a new BlogPilot > RSS Inbox screen. Nothing is written, queued or published from them automatically and no AI tokens are used until you click Write about this on an item; the draft then waits in the Post Queue as pending.
• Changed: the daily news job now only collects feed items. The old News publish time and News posts per day settings are retired.
• Changed: when you write about a feed item, the server reads the full source page instead of the 30-word feed snippet, and will not write a post if the source cannot be read. Posts about someone else's project no longer pull in your own product details.
• Fixed: the readme described Google Search Console insights as available on every plan in one place and Pro in another. They are a Pro feature (the scoring runs on the hosted API); the readme now says so throughout.

2.0.236

• Fixed: editing a niche opened with the CTA pitch, offer line, authority basis, monthly ceiling and publish cadence blank, and saving then cleared them. The editor now loads and keeps all five.
• Changed: authority basis options now name the mode they set (First-party, Practitioner, Sourced, None).
• Fixed: the Lifecycle screen script now loads from an enqueued file instead of an inline tag.

2.0.235

• Fixed: sites upgrading from an earlier version saw Haiku 4.5 selected in the Settings model picker while actually running Sonnet, and saving Settings would silently switch them to Haiku. The picker and the "Model in use" label now always show the model the site is really using.
• Fixed: the daily Lifecycle GSC job could error if the Lifecycle module failed to load; it now skips cleanly instead.

2.0.234

• Added: Lifecycle Pruning -- daily GSC-driven detection of posts whose search impressions have gone quiet, moving them through active -> retarget queue -> noindexed. Never fully automatic: a post only reaches "awaiting confirm" on its own, and actually noindexing it always requires an explicit click from an admin. Posts marked as a pillar are permanently exempt.
• Changed: Settings' AI model picker now shows plain tier names (Sonnet 5, Haiku 4.5, Opus 5.5) instead of raw version strings, resolved to the current model server-side -- future model updates no longer require a plugin update to take effect.
• Fixed: WordPress.org Plugin Check flagged unescaped output on the Topic Map keyword-difficulty/search-volume badges; confirmed the badge markup was already fully escaped internally and annotated the call sites accordingly.
• Fixed: readme.txt's Stable tag had fallen out of sync with the plugin's Version header.

2.0.233

• Fixed: Settings' RSS Feed Distribution table read a niche's stored RSS feed list as raw newline-separated text, but it's actually stored as JSON. A configured niche's whole JSON blob was shown and counted as a single garbled feed, and a niche with no feeds configured (stored as "[]") counted as one phantom feed instead of zero. Now decodes it the same way every other reader in the plugin already does.

2.0.232

• Fixed: "Refresh All" on Keyword Pipeline defaulted to every keyword matching the current filter, including ones already published or generated -- on the unfiltered "All" tab this could mean 10,000+ DataForSEO calls for keywords whose posts are already live, where a fresh score can no longer change anything. It now defaults to pending/queued keywords only when no status tab is explicitly selected; picking a specific status tab (e.g. Published) still refreshes exactly that status if you want to.

2.0.231

• Added: "Refresh All" button on Keyword Pipeline -- unconditionally re-fetches KD + search volume from DataForSEO for every keyword matching the current filter (not just ones missing a score), in batches, so keywords stuck with a stale or wrong value from a past bug can be swept clean in one click. Warns how many keywords it will touch before running (uses your DataForSEO balance).
• Added: the Topic Map search-volume badge is now colour-tiered like keyword difficulty already was (green = healthy demand, yellow = low, red = very low, grey = no data yet), so a low-value keyword is visible at a glance. Purely visual -- nothing is auto-paused, skipped or excluded from queuing.

2.0.230

• Fixed: the DataForSEO call behind Topic Map / Keyword Pipeline scoring and the per-keyword refresh button was hitting a URL and request shape that don't exist in DataForSEO's API (a "keyword_info" endpoint with one task per keyword) -- every call failed with HTTP 404 "Not Found" and silently fell back to KD 30 / no volume for every manually-added or re-scored keyword, regardless of niche. Auto-discovered keywords were unaffected since they're scored by a separate, already-correct pipeline. Now calls the real "keyword_overview" endpoint with the request shape it expects.

2.0.229

• Fixed: Topic Map / Keyword Pipeline keyword difficulty was reading the wrong field from DataForSEO's response and silently fell back to a flat "KD 30" for every keyword regardless of the real score -- now reads the correct field, so KD reflects DataForSEO's actual data.
• Fixed: a keyword DataForSEO genuinely has no data for (too new or too narrow a term) is now reported as "no data" instead of being indistinguishable from a connection failure or a real zero.
• Fixed: the per-keyword Topic Map refresh button could clear a keyword's volume without writing back a new value on certain DataForSEO responses -- refresh now always leaves the keyword with either its real value or an explicit "no data", never blank.
• Fixed: admin CSS/JS asset version was stuck at 2.0.225 since that release, so browsers could keep serving a cached, out-of-date copy of admin scripts (including the Topic Map refresh button) across every update since -- asset version now tracks the plugin version on every release.

2.0.228

• Changed: removed the decorative icons from the Cerebro submenu label and the Settings > License / Legal tab labels -- plain text now, matching the other tabs.

2.0.227

• Added: a refresh icon next to any Topic Map keyword still missing KD or search volume -- rescans that one keyword against DataForSEO in place, without a trip to the Keyword Pipeline screen.
• Fixed: a DataForSEO failure (not configured, no account balance, timeout) at add-time is no longer silent -- "Score Unscored Keywords" and the new per-keyword refresh both now report why a keyword still shows no data instead of leaving an unexplained dash.

2.0.226

• Added: real DataForSEO search volume shown on every Topic Map keyword row (pillar, supporting, and unclustered), next to the existing KD badge -- previously Topic Map showed keyword difficulty only, with no volume anywhere.
• Fixed: manually-added keywords (single add, new-cluster add, and both Cerebro bulk-add paths) now fetch a real KD + search volume from DataForSEO at the moment they're added, instead of being stored with a fixed placeholder volume of 50 and a blank KD forever.
• Fixed: "Score Unscored Keywords" now backfills real search volume alongside KD for any keyword still missing both (covers manual keywords added before this update), and matches keywords case-insensitively so a capitalised manually-typed keyword is no longer silently skipped.
• Changed: a keyword with no DataForSEO volume data now stores 0 (shown as a dash) rather than a plausible-looking placeholder number, everywhere in the pipeline.

2.0.225

• Added: a tooltip on the Post Queue's Translate control explaining where the language list comes from (WP Admin -> Languages -> Languages, via Polylang). Previously the control simply disappeared with no explanation when no language was registered there -- it now shows a faint language icon with a tooltip spelling out what's needed, instead of vanishing silently.

2.0.222

• Fixed: the Niche filter on Post Queue only ever listed active niches -- there was no way to filter the queue down to a paused niche's posts at all. The dropdown now lists every niche regardless of status, with paused ones labelled so they're not mistaken for active.
• Added: "This week" and "This month" published counters on Post Queue, next to the filter bar. Both respect the current Niche/Genre filter (and fall back to the site-wide total when neither is set), and count by the calendar week (Monday start) and calendar month rather than a rolling 7/30-day window.

2.0.221

• Fixed: approving a translated post could fail outright with "Could not insert post into the database. (database said: Column 'post_content' cannot be null)". The Gutenberg cleanup step run just before publish used a per-character negative-lookahead regex to find orphan
• tags; on unusually large input that pattern could exceed PHP's regex backtrack limit, and preg_replace() returns NULL (not the original text) when that happens. That NULL then became the post's post_content, which the posts table rejects outright. Non-Latin-script translations run noticeably more bytes than the English source for the same word count, which is why this showed up on translated posts and not the post they were translated from. The regex is now a plain, far cheaper lazy match, and every cleanup step falls back to its pre-replace content instead of ever letting the post body go null.

2.0.220

• Fixed: approving a translated post could fail with the generic WordPress message "Could not insert post into the database." while giving no way to tell why. That message is WP core's own generic wrapper for any failed wp_posts insert -- the plugin was discarding the real reason (wpdb->last_error, e.g. a charset/encoding or oversized-content issue more likely to surface on non-English content) instead of showing or logging it. The actual database error is now appended to the on-screen message and written to the PHP error log for both Publish and Save as Draft.

2.0.219

• Changed: the Complete Pro and Complete Agency buy buttons (Settings -> License, "BlogPilot Complete" section) are now shown blurred and disabled with a "Coming Soon" badge, since those two bundle tiers aren't wired to live Paddle prices yet. Nothing else on the page changed -- Pro and Agency (non-bundle) buttons are unaffected.

2.0.218

• Fixed: the Buy button could 404 when a site's checkout URL (the BPV2_CHECKOUT_URL wp-config constant, or the License tab's saved value) still pointed at "blogpilot-checkout.html" / "blogpilot-checkout/" -- an early doc convention no released build has ever hosted a file at. That specific known-bad value is now treated as unset and the real checkout page is used instead; any other custom URL is untouched.

2.0.217

• Added: uninstall now releases this site's license seat automatically (deactivating does not -- only a deliberate uninstall does). Previously only the manual Disconnect button freed a seat, so removing the plugin any other way stranded it.
• Added: a site that goes fully silent (no successful check-in AND its ping unreachable) for 30 days has its seat automatically released so it can be used elsewhere; the site reclaims its own seat silently the next time it successfully reconnects. A warning is sent at ~21 days first.
• Added: "Sites: X of Y" now shows on the License tab, so a seat cap is visible before you hit it instead of only on a failed registration.
• Fixed: registering example.com and www.example.com as separate sites silently consumed two seats for what a customer considers one site.

2.0.214

• Fixed: running the scan on Diagnostics -> Scaled content reloaded the page onto the Overview tab, so the results you just generated looked like they had not appeared. The active tab is now kept in the URL and restored after a reload, across every Diagnostics tab.
• Added: step-by-step Polylang setup guidance under Settings -> Multi-Language Translation, shown when the Translate action is not available yet -- covers installing/activating Polylang, adding a non-default language, and the default-language-first order that avoids mis-tagging existing posts. A second, more specific message appears when Polylang is active but no translatable language is registered yet, matching exactly why the Translate button is missing.

2.0.213

• Added: Scaled content protection. BlogPilot now measures your site against the three conditions Google's scaled-content-abuse policy names -- volume, repeated intent, and low value -- and warns you when they line up. Each new post is compared against everything you have already published: word-shingle fingerprints catch a template with the keyword swapped, and intent-token overlap catches two posts chasing one query. A post only counts as high risk when all three conditions are elevated together, which is the policy's own test -- so a busy site of genuinely distinct, useful pages is never flagged for volume alone. High-risk posts are held in the Post Queue as drafts with the reason attached rather than published or discarded, and you can approve them anyway if you disagree. Site Diagnostics gained a "Scaled content" tab showing each condition with the numbers behind it and a list of your near-duplicate pairs. This does NOT predict a Google action -- no public signal for that exists -- and the UI says so.
• Added: Search Console page coverage is used, when connected, to measure how many of your older pages have never earned an impression. Deliberately a separate query from the existing signal fetch, because a page's absence from the signals table means "not an actionable signal", not "earned nothing" -- reading it the other way would have reported almost every page as dead.
• Added: a daily background job fingerprints the archive one batch at a time, so a large site catches up over a few days instead of timing out in one request. You can also run it on demand from the Scaled content tab.

2.0.212

• Fixed: translating a post could fail with "Operation timed out after 120002 milliseconds". The translate request allowed 120 seconds where the equivalent generation request allows 180; a full-length post needs the longer budget.

2.0.211

• Added: nine international languages for the Translate action -- Spanish, French, German, Portuguese, Italian, Chinese (Simplified), Japanese, Korean and Arabic -- alongside the ten Indian languages. The Post Queue dropdown now groups them, flags Arabic as right-to-left so you can check your theme, and all languages share the same translation caps.

2.0.210

• Added: multi-language translation. Any published post can be machine-translated into another language on your own Anthropic key, using the free Polylang plugin for the WordPress-side structure (language assignment, translation linking, hreflang, the language switcher). Translations always arrive in the Post Queue as drafts for review, never auto-published -- the automated quality checks are English-tuned and cannot meaningfully score a translation. Daily, 30-day and site-wide caps keep translation volume conservative; the site-wide cap scales as per-niche cap x the square root of your active niche count, so adding niches grows the allowance more slowly than one-for-one.
• Changed: the free tier is now a straight 10,000 AI-generated words per month instead of 15 posts per month, so it can be split across as many posts as you like.

2.0.209

• Fixed: the Pre-Existing Content panel (Diagnostics -> Content Gaps) gave no indication that a match requires a pipeline keyword to already exist for that post's topic -- a scan against untracked posts with no keywords yet silently reported "0 matches" with no next step. The panel now explains up front where to add the keyword (Topic Map -> + Add Keywords / Create Cluster) and reworded the post-scan "no matches" message so it points there instead of reading as "all clear."

2.0.208

• Added: Adopt Existing Post. Diagnostics -> Content Gaps gained a "Pre-Existing Content" scan (the backend and JS for it already existed but had no button anywhere in any view -- this wires it up) that finds published posts you wrote directly in WordPress whose title matches a pipeline keyword. Each match can be Adopted: the existing post is linked to that keyword instead of generating a new one, so Post Queue, Category Health and Heal all treat it as a normal cluster member. Run "Rebuild Links" on the cluster afterward to weave it into the hub-and-spoke internal linking. A post already tracked by BlogPilot cannot be adopted a second time.

2.0.201

• Added: every niche now declares an authority basis -- a product you built, work you actually do, research you can cite, or none. It steers the writing directly: first-party posts may describe a product's internals as fact, sourced posts must attribute every figure in the sentence and may never claim first-hand experience they do not have. "None" is a real answer, and choosing it produces plain reference writing instead of a confident voice nobody has earned.
• Added: an optional monthly publishing ceiling per niche. Posts-per-day controls throughput; this controls how much a niche is entitled to publish at all. Blank leaves it unlimited, 0 pauses the niche. A capped niche is skipped before a generation slot is chosen, so it never consumes one another niche could use.

2.0.200

• Fixed: the link checker reported working pages as broken. It checked internal links over HTTP, so a scan of 50 posts fired hundreds of rapid requests at your own server, which answered with HTTP 444 (connection closed without response) -- counted as "broken". Internal links are now resolved against the posts table, which is exact and cannot be rate limited. 444, 408, 503 and 999 join 403/406/429 as "unverified" rather than broken, and external requests are spaced per host.
• Fixed: stripping the year from a slug could strand the word that introduced it, leaving slugs ending in "-in" or "-for". Trailing connectives are now dropped.
• Fixed: on a single post the search bar and subscribe form were rendered twice -- once in the content, once inside the floating button's modal. The button now scrolls to the copy already on the page, and the duplicate markup is no longer emitted.
• Added: keyword discovery refuses queries it cannot serve with an article -- brand assets ("... logo"), version and download lookups, and academic-reference queries ("... impact factor", "... journal abbreviation").
• Added: a cap of three keywords sharing any two-word prefix per discovery run, so one head term can no longer spawn a dozen near-identical pages. The count of what was dropped is reported, never silent.
• Added: clustering skips a keyword whose intent substantially duplicates a published post, instead of queueing a page that would compete with your own. Skipped, not deleted -- reactivate it from the pipeline if the call was wrong.
• Changed: a factual-integrity failure now holds a post for human review instead of only warning. It does not spend a regeneration, because re-rolling the prompt does not fix an unsourced claim.

2.0.199

• Fixed: the "Key Takeaways" block appended to a low-density post could repeat the same sentence up to six times word for word. The sentence pool was cycled with a modulo, so once the block needed more sentences than the pool held, it wrapped and duplicated. The block is now drawn as a slice, which cannot repeat, and is capped at three sentences.
• Removed: two sentences from that pool asserted outcomes nobody measured, one of them inventing an expert consensus. Neither could be sourced, so neither ships.
• Changed: keyword density no longer blocks auto-publish. A regeneration does not reliably manufacture density, so blocking on it only spent generations and parked posts a human then approved anyway. Density is still measured and still scored; featured-image alt text is now the only blocking check, and it is the one a regeneration genuinely fixes.

2.0.198

• Changed: keyword discovery no longer runs for a niche whose topic clusters are all complete or paused. Those keywords had nowhere live to land, because posts are only ever generated from clusters that are still active. Discovery still runs normally for a niche that has at least one active cluster, and for a new niche that has no clusters yet.
• Added: when discovery is skipped for this reason, the Niches screen says so per niche instead of reporting "0 keywords saved", and the scheduled run records the reason in the log.

2.0.197

• Fixed: asking Cerebro to add keywords in your own words now opens the keyword importer. Phrases such as "add keywords", "I want to add keywords" or "add my own keywords" previously fell through to a chat reply asking which cluster and how many.
• Added: when a request could mean either thing, Cerebro offers a choice - upload a CSV you already have, or let it suggest keywords for you - instead of asking in prose.
• Added: the floating Cerebro chat bubble now recognises keyword-import requests and opens the importer on the full Cerebro screen. It previously had no importer at all.

2.0.196

• Changed: connecting Sociophile is now one field and one button. Settings - Social has a single Sociophile panel with a Pairing token box and Save & Connect; the old separate "Generate API Key" panel and the Sociophile URL/ingest-key pair are gone.
• Added: pairing tokens. Sociophile issues one token per workspace and the same token authenticates both directions - social derivatives pushed out, and Search Console topics read back in. Agencies can pair each client site to its own workspace; previously every site's derivatives landed in one shared account.
• Added: derivatives are now posted straight from this site to Sociophile when a pairing token is set, instead of relaying through the BlogPilot server.
• Added: GET /wp-json/bpv2/v1/topics returns this site's Google Search Console queries to a paired Sociophile workspace, powering its Discover feed. Requires Search Console connected in BlogPilot.
• Changed: Save & Connect verifies the token against Sociophile immediately, so a wrong or rotated token is reported on the spot rather than silently at the next publish. The panel shows when the connection was last accepted.
• Changed: the Sociophile URL now defaults to https://sociophile.app and is tucked under Advanced - only self-hosted installs need it.
• Fixed: a pasted token with surrounding whitespace or quotes no longer fails authentication.
• Fixed: clearing the pairing token field now actually unpairs the site; it previously left the stored token in place.
• Removed: an unused code path that called Sociophile with the retired shared ingest key.
• Note: existing per-site Sociophile API keys keep working, so an already-connected site survives the upgrade. Issue a pairing token to move off the shared account.

2.0.195

• Admin screens now use the standard light WordPress background by default; dark mode is opt-in via the toggle.
• Fixed low-contrast text on several admin panels in light mode.
• Factual-integrity findings are now advisory: posts are no longer held or regenerated for them, and carry a review warning instead.
• Post Queue content warnings are collapsed behind a one-line summary.
• Fixed the "HELD FROM AUTO-PUBLISH" notice remaining on a row after it was approved and published.

2.0.193

• Changed: Prioritised actions now lists every ranked opportunity on screen instead of the top 25.

2.0.192

• Added: Download CSV on GSC Insights - Prioritised actions. Exports the full ranked opportunity list with score, priority, query, URL, position, impressions, CTR, signal type, recommended action and reasoning.
• Changed: the opportunity ranking now scores up to 100 signals instead of 25.

2.0.191

• Added: a post held back from auto-publishing now says so in the Post Queue. The first quality flag names exactly which required check failed - featured image alt text, keyword density or factual integrity - so no held post is a mystery.
• Fixed: the keyword density flag quoted the per-genre target rather than the band actually enforced, so a rejected post could be shown a figure it had already met.
• Fixed: the featured image alt text flag described a condition the check no longer tests.

2.0.190

• Changed: in auto mode a post that fails the alt text, keyword density or factual integrity check is now regenerated (up to two attempts) before being held for review, so scheduled publishing keeps flowing instead of stalling.
• Fixed: a post held for review no longer consumes that day's post quota, so the posts-per-day setting delivers the rate you configured.
• Fixed: a held post now leaves the queued state, preventing the same keyword being picked again on the next run and creating duplicate queue entries.

2.0.189

• Changed: the enforced keyword-density band is now 1.5%-2.0% for every genre that uses density. The band is deliberately higher than the raw target because BlogPilot counts grammatical variants of the keyword while RankMath counts only the exact phrase, so RankMath reports a lower figure than BlogPilot measures. Genres set to 0 density are unchanged and remain exempt.
• Fixed: the density trimmer no longer rewrites text inside HTML tags, so image alt attributes, link titles and URLs are left intact.
• Fixed: the featured-image alt check now requires a real focus keyword. It previously fell back to the image keywords and then the post title, neither of which is ever empty, so it passed unconditionally.
• Added: auto-published posts are checked at publish time against the real image attachment. A missing alt text returns the post to the queue as a draft instead of publishing it. Manual approvals are never blocked.
• Added: a factual-integrity check that holds back auto-publishing when a post contains unsourced statistics, uncited attributions, unsupported product claims, software version numbers or unfalsifiable guarantees. News and RSS posts are exempt. The check never blocks the queue if the service is unavailable.

2.0.188

• Fixed: keyword density now has an enforced 1.5% ceiling. An over-optimised post is trimmed back under the ceiling before it is returned, instead of merely being flagged by the quality gate.
• Fixed: the featured image alt text is now always written from the post focus keyword (falling back to the title). Previously an empty focus keyword skipped the write entirely and the image kept the alt text built from the AI image search term.
• Fixed: auto-publish is now blocked when the alt text or keyword density check fails, no matter how high the overall quality score is. Such posts wait in the Post Queue for review. Checks that do not apply to a genre still count as passing.

2.0.187

• Security: no SQL statement anywhere in the plugin is built from a variable. Every table name is a bound %i identifier placeholder (88 statements across 13 files) and the last conditional WHERE fragments were replaced with neutral-value conditions.
• Security: SMTP password now sanitised with sanitize_text_field().
• Fixed: the REST tick endpoint no longer defines the global DOING_CRON constant; it uses a plugin-scoped BPV2_DOING_TICK marker instead.
• Narrowed 194 blanket PHPCS suppressions to 18, all on statements that build a %d placeholder list or run DDL.

2.0.184

• Fixed bulk keyword deletion.

2.0.183

• Fixed list filtering on the keyword pipeline and post queue screens.

2.0.182

• Cleared the remaining input-sanitisation and prepared-statement warnings.

2.0.181

• Admin JavaScript now ships as enqueued files, with values passed through wp_localize_script.
• List filters and the Search Console OAuth callback are nonce-verified.
• Removed the fal.ai image provider; AI images use OpenAI or Gemini.

2.0.178

• Search Console signals can now be scored and prioritised by the BlogPilot API.

2.0.177

• Cross-silo link placement is now performed by the BlogPilot API.

2.0.176

• Google Search Console insights and the Cerebro keyword-import tools are available on every plan.

2.0.175

• Corrected identifier placeholder usage in prepared statements.

2.0.174

• Cross-silo linking (niche pairs) is available on every plan.
• All database queries now use $wpdb->prepare(), including identifier placeholders for table names.
• Removed all output buffering from admin screens and all set_time_limit() calls.
• Minimum WordPress version is now 6.2.

2.0.173

• Plugin folder, main file and text domain aligned to the plugin slug.

2.0.172

• Corrected the plugin's home page URL.

2.0.171

• Corrected the plugin's home page URL and removed a donate link that pointed to a page that no longer exists.
• Documented the Internet Archive (Wayback Machine) lookup used by broken-link repair, plus the link-health and RSS requests that go to addresses you supply, in the External services section.

2.0.170

• Plugin author shown as SuperApps.

2.0.169

• Corrected a text domain that did not match the one declared in the plugin header.

2.0.168

• Fixed two code-quality annotations that were being printed on the Post Queue and Settings screens instead of staying in the source.
• Light mode: admin panels, key fields and code blocks that were written with fixed dark colours now switch to light backgrounds with readable text.

2.0.167

• Resolved every error reported by the WordPress Plugin Check plugin.
• The twenty-three repeated "add this column if missing" migrations in the database class were replaced by a single ensure_column() helper, so the schema upgrade path is now defined in one place instead of sixty lines of near-identical code.
• Database calls that build a statement around a table name are now annotated for the code sniffer at the exact lines it inspects, with a stated reason for each.
• Output escaping moved to the point of output in the cron notice, the theme-toggle icons, the queue pagination counter and the subscriber admin screen. Four upgrade prompts were being passed to echo although they print their own markup and return nothing; they are now called directly.
• date() replaced with gmdate() or wp_date(), strip_tags() with wp_strip_all_tags(), and unlink() with wp_delete_file().
• Every sanitised value read from a request now passes through wp_unslash() first. SMTP settings are read with explicit isset() guards.
• Read-only list filters on admin screens are annotated to record that they select what is displayed and change nothing.

2.0.166

• Niches are no longer restricted by plan in the plugin: the "Add Niche" button is available to everyone and any number of niches can be created and configured locally. Plan limits on keyword discovery and content generation are applied by the BlogPilot API.
• The accessibility contrast fix no longer accepts CSS. The scan result offers a colour picker, the plugin composes the rule from the validated element and colour, and the result is printed through wp_add_inline_style() instead of being written into the theme's Additional CSS. Applied fixes are listed on the Accessibility screen and can be removed individually.
• The Google Search Console OAuth callback now verifies a single-use state token issued when the connection is started, in addition to the capability check.
• Nonces printed into inline JavaScript are escaped with esc_js().
• All remaining inline CSS moved into enqueued stylesheets: admin/assets/bpv2-views.css, assets/css/bpv2-frontend.css and assets/css/bpv2-a11y-widget.css. No style or script tags are printed by the plugin.
• Expanded the Sociophile entry under External services to cover both transmissions, including the conversion-signal call, with its own terms and privacy links.
• Removed two unused files that were never loaded (an admin template and a superseded integration class), and the unused locked-overlay helpers.
• Rewrote the remaining database queries that built a WHERE clause and prepared it in one call: every value is now bound with $wpdb->prepare() at the point its fragment is appended. Queries whose only interpolation is a table name carry an explanatory phpcs:ignore.
• Escaping moved to the output position in the trial notices and the subscriber confirmation pages, rather than being applied when the variable was assigned.
• Superglobal reads that were passed straight to array or string functions now go through wp_unslash() and a sanitiser first.
• Upgrade prompts no longer describe features that are not plan-restricted; they name the hosted API quota instead. Removed an unreachable settings description referring to a checkbox retired in 2.0.121.

2.0.165

• All AI-assisted repair and analysis prompts now run on the BlogPilot API; the plugin no longer builds AI prompts locally.
• Free-plan usage limits are now enforced by the BlogPilot API service, not by code in the plugin; several locally-implemented features (genre filter, pillar toggle, link health, content gaps, accessibility scan, Telegram notifications, discovery settings, auto mode, voice/story tools) are available on every plan.
• Removed unused legacy licensing code; billing is via Paddle only.
• Security hardening: sanitised nonce handling, recursive sanitisation of decoded JSON payloads, wp_json_encode everywhere, escaped template output, sanitize_callback on all registered settings.
• All admin and front-end inline JavaScript now ships through wp_add_inline_script.
• Replaced deprecated get_page_by_title() with WP_Query.
• Expanded the External services disclosure in this readme.

2.0.164

• Front-end search, subscribe and modal scripts moved into an enqueued JavaScript file.
• Keyword pipeline queries rewritten as fully prepared statements.
• Text domain aligned with the plugin slug.

2.0.150

• Prior release.