IndiaTVDNA Performance Monitor

IndiaTVDNA Performance Monitor helps WordPress site owners and administrators understand performance bottlenecks with on-demand diagnostics and optional monitoring. The Free edition includes 27 usable diagnostic screens and a searchable dashboard. Explore the free monitoring toolkit

• Overview and incident investigation: Inspect request timing, memory, query counts and other available server signals. Investigate recent incidents and plugin impact.
• Frontend performance: Review PageSpeed / CrUX, Browser / LCP, RUM, cache delivery, asset diagnostics, component timing, slow hooks, and external HTTP / API activity where supported.
• Developer and configuration diagnostics: Access Complete Doctor, Developer Debug, Request / Template, Loaded Files and Native Profiler tools (host requirements may apply).
• Database and WordPress internals: Examine DB Workload, Object Cache, Cron / Jobs, transactions and related diagnostic findings.
• Monitoring and reports: Explore Unified Timeline, Budget / SLO, runtime insights, report export, and configurable opt-in tools.

Free edition and optional add-ons All 27 Free diagnostic screens are available without a plugin license, account or purchase. Nine additional Advanced Tools menu pages are informational previews only; they do not run Premium features. See the Optional Pro add-on section for separate product links. Optional integrations such as AI and Google PageSpeed may require separate provider accounts, credentials or provider charges. Optional Pro functionality is distributed separately; its implementations are not included in this Free release. Some investigations require a supported server extension, network access, or separately installed utilities. Missing server capabilities are reported rather than imitated. Advanced encrypted backup/restore and WooCommerce order-event capture are separate PRO functionality; the Free ZIP contains no recovery engine, order journal writer or Python CLI scripts. All nine advanced-tool previews contain only static explanatory dashboard illustrations and a link to the IndiaTVDNA website. They do not execute or simulate real functionality. They are not license-gated features and are not a promise of paid product availability. Informational advanced-tool previews The Advanced Tools navigation section contains static preview pages for Deep Profiler, Specialist Max, Regression Lab, Change Impact, Production Lab, Intelligence Hub, Self Healing, Repair Center and Advanced Backup & Recovery. These are NOT usable diagnostics, trials, mock results, sandbox versions or restricted executable features. The preview screens are explicitly labeled as illustrations and contain no real sample metrics, background jobs, data collection, execution actions or paid processing source. Working diagnostic features in the 27 Free sections are independent of the separately sold add-on. Only the plugin's own admin pages show upgrade information, without site-wide nags. Optional Pro add-on information The 27 Free diagnostic tools described above work without payment or an account. A separately distributed Pro add-on may be offered independently from this WordPress.org package. For optional product and availability information, visit either official store:

• IndiaTVDNA - Performance Monitor Pro
• AajTakDNA - Performance Monitor Pro

Neither store nor the Pro add-on is required to install or use the Free edition. Features and license terms of any separately distributed add-on are determined by its own product listing.

1.0.28

• Plugin Check warning fix: sanitize and unslash the administrator-issued diagnostic token read from a dynamically selected HTTP request header in the optional MU loader stub, before its strict alphanumeric format and short-lived server-side ticket validation.
• Keep the v1.0.27 SAVEQUERIES global-behavior fix and early diagnostics authentication unchanged; no Free diagnostic tools or static premium previews are removed.

1.0.27

• WordPress.org manual-review fix: remove all plugin-controlled SAVEQUERIES definitions, including the MU loader's automatic diagnostic-header and sampled-request paths. Unauthenticated HTTP headers can no longer force global SQL query recording or load the full MU diagnostics without a valid temporary ticket.
• Keep detailed SQL evidence read-only, available only when the site owner independently enables WordPress SAVEQUERIES for a short debugging session. Basic query counts and other existing Free diagnostics remain available without it.
• DB workload sample-rate settings now limit only this plugin's own normalized fingerprint processing and daily writes, when SQL history is available; they do not claim to reduce WordPress's global SAVEQUERIES overhead.
• Do not load the early MU code solely for DB workload sampling; clarify the same behavior in the settings interface. No Premium recovery implementation is included.
• WordPress.org review, official Plugin Check and clean WordPress installation tests remain required before approval claims.

1.0.26

• Remove the last legacy code path deriving a custom decryption key from WordPress authentication salts. All new plugin encryption continues to use a dedicated random site-local key.
• Existing enc:v1 credentials are not decrypted, deleted, downgraded or automatically overwritten. Administrators with those old values must re-enter their API credentials and webhook/telemetry settings; connected integrations are unavailable until replaced. The plugin admin shows a scoped warning listing only affected service labels, never the secret values.
• Update configuration checks and AI credential status so unreadable v1 ciphertext is flagged explicitly; retain the Free diagnostic modules and the nine informational Premium preview pages.
• WordPress.org manual review, a clean installation/upgrade test and the official Plugin Check on this exact release are still required before claiming approval.

1.0.25

• Separate per-site random plugin cryptographic key for new locally encrypted API credentials and signed diagnostic journals; existing encrypted v1 credentials migrate automatically when read, using a compatibility-only local decrypt path.
• External uptime token storage uses SHA-256 of a long random token, not WordPress authentication secrets. Regenerate tokens originally issued before 1.0.25 in the Diagnostics screen and update your external uptime service.
• Local AI Guard pause/rollback remains a Free safety tool and is distinct from the separately distributed paid full-site Recovery Agent.
• Limited redundant purchase prompts on advanced-tool illustration pages. Paid implementation is not included.

1.0.24

• Make all nine Advanced Tools sidebar entries open separate in-plugin informational preview screens with the existing dashboard styling. Remove inline PRO badges and external navigation from these menu items.
• Preview screens explain each workflow and display nonfunctional visual elements labeled as illustrations. Buy Pro Version links go only to the configured owner site; no premium source code, live results, locked features or simulation controls are included.
• Preserve the 27 existing Free diagnostic sections, JavaScript and non-admin PHP code unchanged. Runtime and WordPress Plugin Check validation are still required before submission.

1.0.23

• Replace the remaining direct WordPress logged-in cookie identifier/read in the optional front-end admin overlay with the WordPress-authenticated is_user_logged_in() check. This requires WordPress to validate login status and avoids depending on authentication cookie names or raw values.
• Preserve all other Free modules and the separated Premium Recovery functionality from 1.0.22.

1.0.22

• Move the active WooCommerce encrypted order-event writer out of Free into a separately distributed Pro add-on. Remove the Free plugin's WooCommerce order-event boot hook and its PHP implementation without modifying unrelated Free monitoring modules.
• Replace the extensive server Python CLI backup/restore command screen with a simple, explicit PRO information page. No recovery actions, unlock gates, Python scripts or missing-CLI placeholders ship in Free.
• Keep the familiar sidebar, add Advanced Backup & Recovery to the nine informational Pro destinations, and link to the site owner's HTTPS purchase site from a single in-plugin PRO card. The other 27 functional Free screens and their scripts remain unchanged.
• No automatic live restore, offsite replication or zero-loss WooCommerce recovery is asserted. Real WordPress installations and the official Plugin Check remain to be completed.

1.0.21

• Remove unused MU troubleshooting-cookie authentication-key/salt derivation and the old cookie bootstrap trigger. Existing independently authorized early monitoring probes remain in place.
• Distribute five advanced Python recovery scripts as a separate standalone administrator-managed companion, not inside the WordPress.org plugin ZIP. Keep the Free backup guidance UI, but explicitly disclose the separate installation requirement and use private example paths.
• Replace reported hardcoded plugin, MU-plugin and theme folder checks with WordPress-aware helpers. Centralize intentional core/content drop-in access for configurations with customized WordPress directories.
• Local PHP syntax, basic custom-directory path smoke tests and ZIP integrity are not a substitute for official Plugin Check or a clean WordPress installation test with WP_DEBUG.

1.0.20

• Address Plugin Check InputNotSanitized warning for the administrator hook-profiler completion tokens: WordPress-unslash and sanitize the submitted JSON text before decoding, cap its length, and retain strict per-token format, permission, nonce, ownership, expiry and one-use validation.
• Keep the existing v1.0.19 authenticated browser-only profiling flow, 28 Free diagnostics, 8 Pro informational links and stored settings unchanged.
• Local code and mock tests do not replace an official Plugin Check re-scan and live WordPress administrator workflow test.

1.0.19

• Replace PHP auth-cookie forwarding during administrator hook profiling with authenticated, same-origin browser probes plus one-use signed tickets and per-user capability checks.
• Move browser probe and footer status JavaScript out of PHP inline tags to enqueued WordPress script files; distinguish literal scanner test fixtures from executable scripts.
• Confine temporary loaded-file I/O benchmarks to the plugin-specific uploads subdirectory and remove temporary benchmark files after each test.
• Include accessible, editable JavaScript source equivalents for monitor.js and admin.js, explain reproduction steps, and expand optional external-service disclosures with terms/privacy links and transmitted data.
• Preserve the Free dashboard, 28 Free tools, 8 informational Pro destinations and direct API integrations; WordPress 7.0+ AI Client remains an optional path.
• Offline checks do not guarantee a successful live WordPress.org plugin review, activation, network/cookie tests or completion of owner DNS verification.

1.0.18

• Use the actual WordPress admin screen ID, rather than untrusted page query parameters, to scope passive diagnostics and compatibility notices to the Performance Monitor dashboard. Existing settings repair POST requests retain their original nonce and capability checks.
• Replace the MU loader installer's var_export() call with a correctly escaped, single-quoted PHP path literal, preserving arbitrary quote and backslash characters in filesystem paths and the opt-in loader's security checks.
• Keep all 28 Free tools, eight Pro information links, saved data, AI providers, JS/CSS assets and every prior security fix. The reported four warning sites have been removed; run official Plugin Check again to verify its result.

1.0.17

• Fix the optional MU loader's stale v1.0.5 source stamp: the installer now emits the active plugin version when installing the opt-in stub, so the status check and refresh logic agree after upgrades.
• Require an explicit opt-in on every MU-stub request; a left-behind stub no longer loads early diagnostics if host filesystem permissions prevent its removal after opt-out.
• Replace the Self-Test upload-directory direct PHP file write with WordPress Filesystem API's direct transport, a random temporary file, verified readback, and cleanup. Unsupported transports report a safe test skip rather than modifying plugin or third-party files.
• Scope Query Monitor compatibility and historic safety notices to Performance Monitor's own admin screen, avoiding site-wide admin notices.
• Preserve 28 Free tools, eight separately sold Pro informational links, existing integrations, database schema, stored keys and previously configured values.
• Local automated checks do not replace the official Plugin Check, real site-level testing, or the WordPress.org manual review.

1.0.16

• Centralize five legacy AI-provider endpoints in a fixed HTTPS host/route allowlist and reject unsupported providers before sending HTTP requests. Preserve existing OpenAI/Claude/Gemini/Grok/DeepSeek payloads, authorization headers, stored-key handling, parsers and security flags.
• Keep the first-party WordPress AI Client / Connectors option and WordPress 6.2+ legacy compatibility. This refactor changes how direct integration URLs are represented but does not migrate legacy connections to the WordPress AI Client; the recommendation underlying the five original Plugin Check advisories remains relevant.
• Offline PHPUnit-style mocks verify exact endpoints, request payload shape, HTTP protections, responses and errors. Real WordPress Plugin Check, provider accounts and WordPress admin click tests must still be run before publishing.

1.0.15

• Sanitize and unslash the Settings saved-notice GET flag; reject non-string values without changing settings-save behavior.
• Add a genuinely provider-agnostic, opt-in WordPress AI Client mode (WordPress 7.0+, Settings > Connectors). It uses Core's AI Client without copying Connector credentials, with explicit capability checks and a live exact-response test.
• Keep all five existing directly configured AI providers, encrypted saved keys, budgets, fallback and Free tools functional for WordPress 6.2+. Their five advisory Plugin Check warnings are not concealed by URL obfuscation or disabling functionality; the legacy direct HTTP paths remain intentionally.
• All WordPress-connected browser/network behavior and official Plugin Check remain to be validated on staging; local checks alone cannot establish zero warnings or approval.

1.0.14

• Correct remaining Database/SchemaChange PHPCS directive collisions so intentionally prepared diagnostics and plugin-specific uninstall cleanup have ONE accurately scoped, documented exception each.
• Fix the Settings save notice: a scanner annotation in v1.0.13 was accidentally printed as visible HTML; the read-only success flag now stays inside PHP.
• Preserve all 28 Free tools, eight informational Pro links, existing API-key integrations, and database write/read behavior. AI direct-provider recommendations may still appear in Plugin Check; removing working provider compatibility to conceal warnings is intentionally avoided.
• PHP, JavaScript, ZIP, and offline regression tests are not a substitute for real WordPress Plugin Check and per-option click/HTTP tests.

1.0.13

• Add WordPress nonce verification to the public RUM beacon while retaining its existing signed route tickets, same-site validation and rate limiting.
• Document narrowly scoped coding-standard exceptions for live database diagnostics, read-only GET routing, named WordPress core hooks, runtime profilers and optional installer serialization.
• Preserve all Free modules and the optional direct AI Error Doctor integration for WordPress 6.2+ compatibility. The AI-provider advisory remains until a safely tested WordPress AI Client fallback is provided.
• PHP/JS static checks do not certify real WordPress runtime or WordPress.org approval. Re-run Plugin Check on a staging WordPress install before submission.

1.0.12

• Remove the paid automatic recovery/quarantine implementation and stale Pro dependencies from Free.
• Fix sparse-history sampling, use inline prepared SQL templates, and limit EXPLAIN to a prepared safe SELECT subset.
• Harden input validation and nonce checks; register custom cron recurrences on runtime requests.
• Keep all 28 Free screens and eight Pro information links. Real WordPress/MariaDB tests and outstanding host-specific checks are documented separately.

1.0.8

• Compile historical sampling queries exclusively from allowed columns, bounded predicates and separately prepared SQL identifiers; reject non-plugin tables and arbitrary SQL fragments.
• Harden native profiler, benchmark, and overhead probe input shapes; preserve administrator authorization and all Free tool entry points.
• Protect AutoFix JSON size validation after WordPress unslashing; add a documented security/diagnostic scanner review.
• Local lint/mock tests do not replace a new Plugin Check scan or live WordPress, PHP and MySQL verification.

1.0.7

• Replace dynamic fingerprint INSERT SQL with a fixed set of prepared multi-row templates and bounded batches; bind every row value and table identifier.
• Keep batch efficiency (three queries for an 80-row sample) without concatenating SQL placeholders or passing prepared SQL variables to the query API.
• Add input-shape and unslashing checks to scheduled jobs, administrator settings, benchmark paths, signed diagnostic tokens and monitoring requests.
• Preserve the existing Free dashboard and opt-in workflows. Verify in Plugin Check and on staging before submission.

1.0.6

• Fix PHP error reporting checks and strengthen optional collector/input protection.
• Tighten sampling and AI setting request validation; retain existing diagnostic options.

1.0.5

• Validate SQL sampler table, columns, sort and allow-listed predicates; reject unexpected clauses instead of stripping SQL punctuation.
• Prepare transient inventory SQL safely with %i identifier and escaped LIKE arguments.
• Reject array-shaped settings and cron repair inputs before sanitization, and fail closed on malformed repair JSON.
• Keep 28 Free tools and eight informational Pro links; no feature removal or new license restriction.
• PHP lint, local mocked SQL sampler tests and ZIP integrity validated. Real WordPress Plugin Check and live behavior still need verification.

1.0.4

• Replace direct MU PHP writes/renames with a WordPress Filesystem-based staged installer; direct transport is required for safer same-directory updates.
• Use wp_is_writable() in the self-test and validate RUM and manual-repair request input shapes more defensively.
• Retain all 28 Free diagnostics and eight informational Pro links. No paid gate or automated premium installer is included.
• Static lint/regression testing completed; live WordPress Plugin Check, activation, multisite, and actual database testing remain to be verified before submitting.

1.0.3

• Fix administrator SQL identifier handling, guard arbitrary EXPLAIN functions, and tighten JSON request handling.
• Protect global variable prefixes and use WordPress Filesystem for manual debug-log rotation.
• Document audited exceptions for precise native file benchmarks and encrypted atomic journals.
• Keep 28 Free tools, eight external Pro informational links, the activation-safe MU loader and the prior diagnostic safeguards.

1.0.2

• Improve SQL preparation, WordPress-managed script loading and upload-directory temporary cleanup.
• Maintain the Free interface and its standalone Pro information links.

1.0.1

• Fix Free UI wiring audit reporting 14 stale premium controls and a disabled recovery setting.
• Display eight optional Pro add-on modules as informational links within the Performance Monitor sidebar and link to the IndiaTVDNA store. No Free functionality requires a purchase.
• Keep the Pro code separate from the WordPress.org Free package; do not introduce license gates or dashboard-wide notices.

1.0.0

• First standalone WordPress.org Free edition with 28 functional dashboard tools.
• Separate eight commercial-only modules into an independent future add-on; remove their exclusive PHP implementations, routes and unreachable JavaScript handlers from this Free package; retain shared callback monitoring as a completely Free tool.
• Prevent automatic premium recovery actions after migrating from internal builds.
• Preserve activation isolation, opt-in MU diagnostics, error-handling improvements, and the diagnostic dashboard.
• Publish GPLv2-or-later licensing, external-service disclosures and WordPress.org-compatible readme headers.