GoUltra Auth

Журнал змяненняў

0.33.0

• Moved all inline CSS and JavaScript on the two-factor login screen, the step-up screen and the
  WooCommerce checkout verification field into properly enqueued asset files.
• Hardened the step-up (protected action) screen with a nonce and a capability check before it processes
  a request or sends a code.
• Setting or resetting another user’s WhatsApp number now also requires permission to edit that user.
• Small code-quality and internationalization cleanups for the plugin directory guidelines.

0.32.3

• The “authentication service is turned off for this number” message now matches the exact signal the
  GoUltra service sends, so it always shows the right guidance.
• Translations: the new plan-limit, cooldown and plan-usage messages are now translated to Hebrew,
  Arabic, Spanish and French.

0.32.2

• Plan usage: the settings screen now shows how many authentication messages your GoUltra plan has
  used this cycle (“X of Y”), and if the plan allowance is reached the login screen says so clearly.
  If the WhatsApp authentication service is turned off for a number, that is now explained too.

0.32.1

• Clearer messages: when a code cannot be sent, the login and sign-in screens now show the specific
  reason (for example, the plan’s message allowance was reached, or a short cooldown between sends)
  instead of a generic notice, and always point to the recovery-code fallback.

0.32.0

• Cost protection: fresh installs now ship with safe sending limits ON by default (per destination
  number per hour, a minimum interval between sends to the same number, and a site-wide daily cap), so
  the WhatsApp send volume cannot be run up before an admin tunes anything.
• Reliability: a recovery (backup) code can now always be entered at the login challenge, even during the
  “too many attempts” cooldown or when another user shares the same IP, so a locked-out admin is never
  stopped from using a backup code.
• Robustness: the setup-enforcement redirect no longer runs on REST, cron or CLI requests; uninstall now
  clears the daily cleanup schedule; a checkout-verified number is never auto-attached to an admin account.

0.31.0

• Pre-submission hardening from a full four-angle audit (wp.org compliance, security, correctness, i18n).
  No behavior changes for store owners or customers; the plugin is now cleaner and stricter.
• Security: added a cross-attempt rate limit (per number and per IP) to the guest one-time-code checks
  used by new-customer signup, order-received setup and checkout verification, so codes cannot be guessed
  across many requests. Rotating a user’s devices now also clears their admin two-factor “remembered
  device”. The account-created email path sanitizes any unexpected upstream text.
• wp.org / Plugin Check: sanitized a server value, annotated the one-time uninstall/deactivate database
  cleanup and the CSV export stream, and hardened the activity CSV export against spreadsheet formula
  injection. Removed one unused internal option and a stale code comment.

0.30.0

• New: create your account with WhatsApp on the checkout (no password). On the classic checkout, when a
  guest chooses to create an account, they can verify their WhatsApp number with a code instead of
  choosing a password. The account is created with no password and they sign in with a WhatsApp code
  next time. Fully additive: the normal password option is untouched, and if the number is not verified
  nothing changes. New setting under Customer sign-in (on by default). Translated to all five languages.
• Improved: the admin-login alert email was redesigned to be cleaner and to nest correctly inside sites
  that wrap outgoing emails in their own branded template (no more double header). It now uses a light
  card with a green accent instead of a dark banner.

0.29.0

• New: “Remember this device” for admin two-factor login. After a correct code, the login screen
  offers to trust that device for 30 days (7/14/30, configurable), so admins are not asked for a code
  every time. This saves WhatsApp messages and cost while a new or unknown device still needs a fresh
  code, so a leaked password alone is not enough to sign in.
• New: “Reset all remembered devices” button in Login Protection. It forgets every trusted device at
  once (admin and customer), so everyone is asked for a fresh code on the next login. Use it if a
  device was lost, sold or shared.
• New: admin-login email alerts. A clean, well-designed security email (like Wordfence, but tidier) is
  sent by your own WordPress site whenever an administrator signs in, showing the username, IP address,
  hostname, device and time, with a “was this you?” prompt. Toggle it and set the recipient in settings.
• All new screens and the alert email are translated to English, Hebrew, Arabic, Spanish and French,
  with right-to-left support and phone/IP shown left-to-right.

0.28.0

• New: on the order-received page after checkout, customers can set up WhatsApp sign-in. A guest who
  ordered without an account can create one with WhatsApp (no password), and a signed-in customer who
  has no WhatsApp number can switch it on. This closes the gap where customers who registered the normal
  way at checkout never got WhatsApp sign-in.
• The customer verifies the order’s own number with a one-time code first, so nothing is set up without
  proof, and the guest’s order is linked to the new account automatically.
• Works on every checkout (classic and the block-based order confirmation). New setting under Customer
  sign-in: “On the order-received page, offer customers to set up WhatsApp sign-in” (on by default).
• Phone numbers in the new card always display left-to-right, even on right-to-left (Hebrew, Arabic)
  stores. Card text is translated to all five supported languages.

0.27.0

• The plugin description and admin texts now appear in your store’s language: when WordPress is set to
  Hebrew, Arabic, Spanish or French, the plugins-list description and the settings show that language.
• Customer Verification: the “Checkout phone verification” option moved to the bottom of the tab, and it
  now honestly shows it runs on the classic checkout (not the block checkout).
• “Login protection is off” no longer shows when only passwordless WhatsApp login is turned on.
• Removed the “Change number” button from the customer WhatsApp-login area for a cleaner verified state.
• Hardening from a full code review: closed a timing side-channel on the sign-in endpoint, tightened
  output escaping in two places, standardized “WhatsApp number” wording at checkout, and added a tip for
  placing the sign-in panel in a theme’s header/popup login.

0.26.1

• Fixed (Hebrew/Arabic): the verified WhatsApp number shown in the admin “Your verification number”
  card and in the My Account “WhatsApp login is on for …” line could read right-to-left. Numbers are
  now bidi-isolated so a phone number always reads left-to-right wherever it is displayed.
• “Use WhatsApp instead” is now “Sign in or sign up fast with WhatsApp”, so customers understand the
  WhatsApp option is for both signing in and creating an account.
• The “Change number” action is now a quiet link (instead of a prominent button) once a number is
  verified, so the verified state stays clean.

0.26.0

• New customers can now sign up with WhatsApp in one simple flow. There is no longer a “I have an
  account / I am new” choice to make: the customer enters their WhatsApp number and a code. If they
  already have an account they are signed in; if they are new, they are asked for an email and the
  account is created in the same step. This matches how modern stores (and Shopify, Clerk, Stytch)
  handle passwordless sign-up, and it is account-enumeration safe (whether the number already has an
  account is only revealed after the code is verified, never before).
• The email is requested only after the number is verified, and only for brand-new customers, so
  returning customers sign in with just their number and a code.
• New-customer sign-up is now on by default (it still respects your store’s own “allow customers to
  create an account” setting, so nothing changes unless your store already allows registration).
• At account creation the panel shows a clear line that signing in with WhatsApp is not consent to
  receive marketing messages, with a link to your Privacy Policy.

0.25.1

• Fixed: on Hebrew and Arabic (right-to-left) stores, phone numbers and codes could display
  reversed in several places (your verification number in Settings, the 2FA login code field, the
  My Account “verify my number” fields, the step-up code, and the checkout code). All phone, code
  and key fields are now forced left-to-right everywhere, so a number always reads correctly.

0.25.0

• Block-based checkout: returning customers can now sign in with WhatsApp right from the new
  WooCommerce block checkout. Turn on “Show the WhatsApp sign-in panel on the block-based checkout”
  and the panel appears above the checkout form for logged-out customers, with no setup. It signs
  them in without leaving the page, then disappears once they are logged in.
• The panel is rendered outside the checkout app and bound by the same reliable script used on the
  My Account page, so it works across themes and is not affected by checkout updates.

0.24.0

• Per-user control: every WordPress user-edit screen now shows the user’s WhatsApp sign-in status
  (verified number and the date it was last verified). An administrator can revoke it with one click,
  which clears the verified number and signs the user out of all remembered devices. The password
  login is never affected, so this can never lock anyone out.
• Clear consent wording: in the admin, on the user profile and in the suggested privacy-policy text we
  state that signing in with WhatsApp verifies the number only and is not consent to receive WhatsApp
  marketing messages. The number is not used for marketing through this plugin.
• The block-based checkout button stays clearly marked “Coming soon” / experimental: this release does
  not claim full block-checkout support.
• A WooCommerce billing phone is never used to sign anyone in. Only a number the user has verified
  through WhatsApp can be used for passwordless login.

0.23.0

• Appearance options for the WhatsApp sign-in panel: choose Modern panel (the full card), Compact
  (smaller, good for popups and sidebars), or Button first (shows a single “Continue with WhatsApp”
  button that opens the panel when clicked). Set it under WhatsApp sign-in – Advanced.
• Accessibility: each field is now linked to its label, the status line is announced to screen
  readers, and keyboard focus is clearly visible on every button and link. With JavaScript turned
  off the panel stays open so nothing is lost.

0.22.0

• Manual placement for any theme or page builder. Put the WhatsApp sign-in panel exactly where you
  want with the shortcode [goultra_auth_customer_login], the new “GoUltra WhatsApp Login” block, or
  the template tag goultra_auth_customer_login() – so it works even on custom login pages where
  automatic placement is not perfect.
• New “Placement on the My Account page” setting: Automatic (above the forms), Inside the login
  form, or Manual only (use the shortcode or block).

0.21.0

• Reliability (from a professional review): the WhatsApp sign-in now talks to the server over a
  dedicated, never-cached endpoint and no longer depends on a security token baked into the page.
  On heavily cached sites (WP Rocket, LiteSpeed, Cloudflare) this removes a cause of the button
  occasionally not responding.
• Added a small developer API for custom themes and page builders:
  GoUltraAuth.mount(), GoUltraAuth.refresh() and GoUltraAuth.reset(), so a custom login popup can
  initialize or reset the panel reliably.
• Login popups that reopen now reset to the WhatsApp view automatically, unless you are in the
  middle of entering a code (then it is preserved).

0.20.1

• Phone, code and email fields are now always left-to-right, even on Hebrew and Arabic stores (a
  phone number should never read right-to-left).
• “Sign in with a password instead” is now a clean, reversible switch: it shows only the password
  form (never both panels at once) and a “Use WhatsApp instead” link to switch back, with no page
  refresh needed. This fixes the stuck state where reopening the login could show only the password
  screen.

0.20.0

• Fixed: the “Continue with WhatsApp” button could do nothing on some live sites. The widget no
  longer depends on a script that themes/caching could delay or strip; it now loads reliably
  everywhere the login or register form appears (account page, header login popup, and under
  optimization plugins such as WP Rocket and LiteSpeed).
• Redesigned the customer sign-in as one clean, branded WhatsApp panel: enter your number, get a
  code, done. New customers can sign up the same way. The password login/registration is tucked
  behind a “Sign in with a password instead” link, and always stays available.
• The panel adapts to the page direction, so it looks right in right-to-left languages (Hebrew,
  Arabic) as well as left-to-right.
• Simpler settings: the where-it-appears and allowed-roles options moved under an “Advanced”
  section, so the common setup is just one switch.
• Verified end to end in a real browser: enter number, receive code, verify, and you are signed in.

0.19.0

• Clearer customer area. The “Continue with WhatsApp” option now appears above both the sign-in and
  the create-account columns on My Account, so new customers can also sign up with WhatsApp (it is no
  longer hidden inside the sign-in box). Your password forms stay exactly as they were.
• Renamed the two customer options so the difference is obvious:
  “Customer login protection (password + WhatsApp code)” = password first, then a code; and
  “Passwordless WhatsApp login (sign in without a password)” = a code instead of a password.
• Added a short intro at the top of Customer Verification explaining the three modes.
• Made it explicit that WhatsApp login is a sign-in method, not consent to WhatsApp marketing, and
  that administrators and shop managers always use password + 2FA even on the WordPress login screen.

0.18.1

• Setting the default code language is more reliable: if a save does not reach the server (a slow
  host or a cache or optimization layer can drop an admin request), it now retries automatically.
• Admin actions now show a clear “Your session expired. Refresh the page and try again.” message
  when a security token has gone stale, instead of a generic “That did not work.”

0.18.0

• Passwordless customer login is now a complete flow. Four additions, all admin-controlled:
• Remember this device: customers can choose to stay signed in on a device they trust and skip the
  code next time. A password change or a “sign out of all devices” button (on My Account) cancels it.
• New-customer registration: a new visitor can open an account with just an email and a WhatsApp
  code (no password). Requires user registration to be enabled for your site.
• Checkout account creation: when a customer verifies their phone at checkout and an account is
  created, WhatsApp login is turned on for them automatically.
• Block checkout (experimental): optionally show “Continue with WhatsApp” on the block-based
  checkout. Confirm the button placement on your live store.
• Account protection: registration can never take over an existing account whose WhatsApp number
  you do not control, and remembered devices are bound to the password so a reset clears them.
• All new screens and messages are translated to English, Hebrew, Arabic, Spanish and French (RTL).

0.17.0

• New: Passwordless customer login with WhatsApp. Customers can sign in with a one-time WhatsApp
  code instead of a password they keep forgetting. Off by default; the store owner turns it on and
  chooses where it appears (the WooCommerce account page and/or the WordPress login form).
• Customers and subscribers only. Administrators and shop managers can never sign in passwordless;
  they always keep their password and second factor. Sign-in with a password is always kept too.
• Customers add and confirm their own WhatsApp number from My Account before they can use it.
• Privacy by design: no way to tell from the screen whether a number has an account, single-use
  codes, the same rate limits and audit log as the rest of the plugin.
• Available in English, Hebrew, Arabic, Spanish and French, with full right-to-left support.

0.16.0

• Team numbers moved to My Number & Recovery (one logical place for all number management), right
  under your own number.
• The team list now shows all staff / privileged users (administrators, shop managers, editors and
  so on), not just protected-role users and never regular customers, and flags any whose role is
  not protected at login.

0.15.0

• Team: an admin can now set a WhatsApp number directly for any user (e.g. a shop manager) from
  the “Your team” panel, in addition to each user verifying their own. Setting a number is recorded
  in the activity log; Reset and Send-reminder remain available.

0.14.1

• Fix: after saving Login Protection (or Customer Verification), the page now refreshes so the
  banners and status update immediately – the “Login protection is off” notice clears as soon as
  you turn it on, without a manual refresh.

0.14.0

• Protected actions (step-up): optionally require a fresh WhatsApp code before sensitive admin
  screens – Plugins, Users and roles, Themes, General settings, Permalinks, and WooCommerce
  Payments / Advanced (REST API, webhooks). It protects both viewing the screen and saving on it,
  so a hijacked session cannot change a sensitive setting without a new code. Configurable code
  lifetime (5 / 15 / 30 / 60 minutes). Opt-in; recovery codes and the emergency switch always work,
  and a user without a verified number is never blocked.
• Fix: on connect, existing templates (for example a previously-approved Arabic one) now appear
  immediately, without needing a manual refresh.
• New “Login protection is off” notice when you are connected and ready but have not turned on a
  code at login yet, so it is clear the plugin is not protecting anyone.
• New text translated to English, Spanish, French, Arabic and Hebrew.

0.13.0

• Header badge changed to “Login security” (clearer, and avoids implying a WhatsApp-branded product).
• Slightly smaller, more refined header logo.
• Templates: a short summary line (how many languages are approved, which is the default).
• Customer Verification: quick-setup presets (Basic, Store, High-risk) to configure protection fast.
• New text translated to English, Spanish, French, Arabic and Hebrew.

0.12.0

• New “Your team” panel (Login Protection): see every user in a protected role, whether each has
  verified a WhatsApp number, send a setup reminder to anyone who has not, or reset a user’s setup.
• Each user still verifies their own number from their own account, which keeps it secure.
• Team panel fully translated (English, Spanish, French, Arabic, Hebrew) and RTL-aware.

0.11.0

• Clear “GoUltra Auth is not active yet” banner until you connect GoUltra and approve a template,
  with one-click next steps and a plain note about what is included in your plan.
• Honest billing wording: AUTH verification sends are included in your GoUltra plan; the monthly
  number is a safety limit (not a billing cap), and any Meta / WhatsApp fees are noted separately.
• Faster verification: the code box now appears instantly while the code is sent.
• New “Change number” button to update your own verification number after it is set.
• Screens that need a connection are locked until you connect, with a hint.
• Checklist split into Required setup vs Recommended security (fewer alarming warnings during setup).
• Login screen polish: cleaner card and a “Use a recovery code instead” toggle.
• Translations updated for all the new text (English, Spanish, French, Arabic, Hebrew).

0.10.0

• Full translations: the whole admin and the login screen are now available in English, Spanish,
  French, Arabic and Hebrew, following your WordPress language automatically.
• Right-to-left layout for Arabic and Hebrew (the screens flip correctly).

0.9.2

• Brand logo in the admin header and on the login screen.
• Security hardening (from a full audit): guest checkout no longer shares one global rate-limit
  bucket (each phone is limited on its own); trusted-device cookies are now tied to your password,
  so changing your password ends them everywhere; pending login codes are cleared on a password
  change. No issues affected existing logins.

0.9.1

• Much simpler Templates screen: one “Code language” card. Pick the default with a radio button
  next to each language – it saves instantly, no separate Save button.
• Removed the confusing “Language coverage” section.
• Enrollment button now says “Verify my number” (instead of “Send code”).
• Fixed: recovery codes shown after verifying your number are no longer wiped by an auto-refresh;
  they stay on screen with Download/Print until you click Done.
• The plugin logo is used in the header automatically if present in assets/images.

0.9.0

• Premium redesign pass across every screen (from the public-readiness review).
• Dashboard: each status card is now actionable (Verify now, Manage templates, Generate codes),
  and the GoUltra sending number is clearly separated from your own verification number.
• Setup wizard with a progress bar and a Continue button that takes you to the next step.
• Login Protection: recommended/advanced role policy cards, and a live “1 of 2 verified” count
  per role so you can see who is actually protected.
• Optional enforcement: ask protected users who have not verified a number to finish setup after
  a grace period (never a hard lockout; recovery and the emergency switch always work).
• Templates: a Language coverage view showing which of your site languages are Approved, Active,
  the Default, or Missing, with one-click Create for the missing ones.
• Customer Verification: clearer wording, Classic/Block/HPOS compatibility badges, and a direct
  “Customer account login” toggle (no more jumping to another tab).
• Cost control: daily and per-phone limits in addition to monthly, plus a sent today / this month
  usage meter.
• Recovery kit: status, unused-code count, last-generated date, and an emergency-access warning.
• Activity log: a Where (context) column and quick filters (Successful, Failed, Rate limited).

0.8.1

• The “Default template” language selector now appears reliably once you have two or more approved
  templates, so you can switch the default (for example from English to Arabic) in one click.
• After you create a template, or one is approved, the page refreshes itself so the language list and
  the default selector stay correct – a language you already added is never offered again.
• More robust template-status matching (case-insensitive) so an approved template is always recognized.

0.8.0

• Templates: around 50 world languages to choose from.
• The create list now hides languages you have already added, so you cannot create a duplicate.
• A clear “Default template” selector (the language used when a customer has no template of their own).
• Enrollment wording is now “verify your number” / “Send code” (no more “test code”).

0.7.0

• Trusted devices: optionally skip 2FA on a device you trust for 7, 14 or 30 days
  (signed, expiring cookie). A “Trust this device” option appears on the login screen.
• Recovery codes: Download and Print buttons.
• Templates: show the WordPress locale (e.g. en_US) next to the language.
• Activity log: Export to CSV, plus automatic 30-day retention cleanup.
• Cost control: email the site admin at 80% and 100% of the monthly message cap.

0.6.0

• Phase 2 – WooCommerce: risk-based checkout phone verification (first order, Cash on Delivery,
  order over an amount, guest checkout). Opt-in and fail-open – it never blocks an order if
  GoUltra is unavailable. Classic checkout. New “Customer Verification” tab.
• Phase 3 – Sudo mode: optionally require a fresh WhatsApp code before opening the GoUltra Auth
  settings, so a hijacked admin session cannot weaken or disable 2FA without a code.

0.5.0

• Rebuilt the admin into a professional tabbed product: Dashboard, Login Protection,
  Templates, My Number & Recovery, and Activity.
• New Dashboard with a protection banner and status cards (protection level, your number,
  templates, recovery codes, monthly usage) plus a clear protection checklist.

0.4.0

• Redesigned the login challenge into a branded, mobile-friendly, RTL-aware card with a
  shield, a clean code input, a resend countdown and clear recovery/cancel actions.
• Security score is now an honest “Protection level (N of M checks passed)” instead of a
  bare percentage, and includes an XML-RPC / REST protection check.
• Wording: “approved by Meta” instead of “official”; clearer “Fallback language”.

0.3.0

• Fixed codes not arriving: the send language is now matched to an actually approved template
  (e.g. en_US), instead of a bare “en” that the backend could not match.
• Template language labels display correctly (en_US shows as English).
• Added a Default language choice when more than one template is approved, and clarified that
  each user gets the code in their own language when available.
• Enrollment: a “wrong number?” link to go back and change the number.
• Added a full mocked-backend flow test (connect, template, enrollment, login, fallback).

0.2.0

• Setup wizard: a guided “Getting started” panel that shows the exact steps in order.
• Connection now shows the WhatsApp display name (matches the GoUltra dashboard).
• Loading states on every action button; live template status (auto-refresh, no page reload).
• Longer network timeout for template creation (fixes a cURL timeout on slower approvals).
• Clearer enrollment (Step 1 / Step 2) and admin notice wording.

0.1.0

• Initial development version: admin/role login 2FA over WhatsApp (local verification),
  self-enrollment, recovery codes, emergency disable (wp-config + WP-CLI), rate limits and cost
  caps, security score, audit log, and GDPR export/erase.