Site-Check Accessibility

Changelog

1.0.2

• Fixed: a fix that was already written into the delivered HTML was applied a
  second time by the client runtime. Because the two run against differently
  shaped documents — the served page on one side, the page after the site’s own
  JavaScript on the other — the second write could land on a different element
  than the first. On sliders that clone their slides this produced labels on the
  wrong slide. The server half now tells the runtime which fixes it already
  applied, and the runtime skips them.

1.0.1

• Front-end scripts and styles are now added through the WordPress enqueue API
  (wp_enqueue_script / wp_enqueue_style + wp_add_inline_script /
  wp_add_inline_style) instead of being written into the page HTML. The client
  apply runtime ships as a real enqueued file (assets/js/sc-acc-apply.js) with
  the per-page data attached inline. Server-side fixes are unchanged.
• REST: /connect-status and /webapp-status now require authorization
  (manage_options or the connector bearer token) instead of being public.
• Themes that do not call wp_head()/wp_footer() fall back to an output-buffer
  injection so the overlay + client runtime still work there; standards-compliant
  themes use the enqueue path only (assets injected once, never duplicated).

1.0.0

(2026-07-23)
* Store release under the new name Site-Check Accessibility (renamed from
“sw-acc-connector”). Relicensed to GPLv2-or-later. The plugin folder, text
domain, classes, admin menu and upload directory were renamed; the REST wire
(namespace, option keys, signing key) is unchanged, so existing pairings keep
working after re-installing — the pairing token stays in wp_options and the
upload directory is migrated automatically on first load.
* Added: fail-open output buffering — a mutation error can never blank the page;
the original response is served instead.
* Version reset to 1.0.0 (continuation of the 2.6.0 line; same feature set).
* Requires re-installing the renamed plugin on customer sites.

2.6.0

(2026-07-22)
* Fix: fixes are now removed on the frontend when the site is disconnected or
the subscription lapses — not only when the admin plugin page is opened. The
injector serves from the signed cache (24h grace); the only frontend
revalidation (try_refresh_signed_cache) previously acted on HTTP 200/304 only
and ignored 401/403, so disconnected/unsubscribed sites kept serving cached
fixes for up to 24h. Now it reconciles like the admin healthcheck:
– 401 (token revoked — site disconnected/deleted) -> clear_stored_api_token()
drops the token AND the signed cache; fixes disappear on the next pageload
and the status shows “disconnected” immediately.
– 403 (entitlement_inactive — subscription lapsed) -> drop the signed cache
only, keep the pairing; delivery resumes automatically on re-subscribe.
Guarantees fixes are delivered only with an active connection + valid
subscription. The webapp /clear-cache push on disconnect remains the immediate
path; this is the fail-safe reconciliation.
* Requires re-deployment of the plugin on customer sites.

2.5.0

(2026-07-22)
* Fix: the accessibility overlay would not load on WordPress sites. The
hard-coded webapp base URL pointed at the www host
(https://www.site-check.de) while the Grav connector uses the canonical apex
(https://site-check.de). Post-EU-cutover www 301-redirects to the apex, and
the overlay runtime’s config fetch (GET /api/overlay/config, CORS
origin-bound) plus the heartbeat POST (Authorization bearer -> preflighted)
do not follow a cross-origin 301 cleanly -> the overlay panel never mounted.
Base URL corrected to the apex, identical to the Grav connector.
* Requires re-deployment of the plugin on customer sites for the overlay to be
delivered again.

2.4.0

(2026-07-22)
* Added: label_append server-side render path (WCAG 3.3.2 required indicator).
label_append overrides were persisted but never rendered — the output loop
had no handler. ServerHtmlMutator::applyLabelAppend now resolves the field’s
(explicit label[for], then nearest wrapping <label>, then an
unambiguous unassociated sibling <label> in the field’s parent) and appends a
visible ” *”; inject_label_append_bootstrap runs it server-side first with a
client fallback for post-JS/SPA fields. Idempotent (data-sc-acc-required-marked);
a safe no-op when the field has no label (the paired aria-required write still
lands). The marker span is aria-hidden so it reinforces visually only. New
healthcheck feature: label-append.
* Powers the reworked missing-required-indicator fix: aria-required="true" +
a visible ” *” on the field’s label, instead of a “Pflichtfeld” text node after
the input. Re-deployment required for the visible marker to render.
* Fixed: label_append was dropped before render — the cache normaliser
(index_override_items_by_id) had no branch for it, so the attribute-required
catch-all silently discarded it. Added the branch; the leading space of ” *”
is preserved (was trimmed).
* Fixed: disconnect left fixes live. clear_stored_api_token() now also unlinks
the signed cache, so the webapp-status reconciler (401 / DISCONNECTED) removes
the fixes instead of leaving them until the 24h grace expired. Combined with
the webapp calling /clear-cache on delete/disconnect, fixes are removed
immediately from both sides.

2.3.3

• Hotfix on top of 2.3.2: tag_replace runtime now remembers per-item which
  items have already been applied (appliedIndex map inside the IIFE). Without
  this, the MutationObserver re-ran apply() after the first replacement and
  the originally-second <h2> became the new “first match” of a positional
  selector like div.bp-container h2:nth-of-type(1) — and got promoted too.
  Per-item idempotency makes apply() safe across the entire page lifecycle.

2.3.2

• Bugfix: tag_replace runtime applies the transformation to the first
  eligible match only (previously: all matches). This alone was not enough
  — see 2.3.3 for the actual fix.

2.3.1

• Schema bump to pipeline version 1.0.1 (additive, backward-compatible).
• sibling_text_insert carries an optional wrapTag (whitelisted to
  h1–h6/p/span/legend) so the runtime can render an <h1> (and not a
  ) where the fix is meant to add a real heading.
• tag_replace carries an optional inlineStyle — a compact CSS string the
  runtime merges onto the replaced element’s style attribute. Prevents
  theme styling from breaking when promoting e.g. <h2> to <h1>.
• Disconnect (admin button + REST endpoint) now removes cache.json and the
  cached state option, so a previously paired site stops shipping fixes
  immediately after disconnect. Plugin deactivation stays a no-op.

2.3.0

• Initial WordPress release. Feature-parity with the Grav plugin v2.3.0
  on the apply pipeline (alt-text, aria-label, attribute-override,
  contrast-adjustment, css-declaration-set, sibling-text-insert,
  label-append, placeholder-append, html-insert-before, text-content-override,
  document-override, tag_replace, element_replace, element_remove).

2.0.0

(2026-07-08)
* Breaking (delivery model): fixes are now written server-side into the
delivered HTML (raw HTTP response, no client JS required); only post-JS/SPA
elements fall back to a client bootstrap (data-sc-acc-fallback="1"). Same
target elements, same result, same reversibility, same subscription binding —
only the mutation site changes (server HTML instead of browser DOM).
* Vendored HTML5-spec serializer (masterminds/html5) + a CMS-agnostic
ServerHtmlMutator engine. Adds server-side-apply to the healthcheck feature
list so the webapp can verify fixes statically.
* Security: the retained client-fallback scripts keep the 1.1.1 JSON escaping
(JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT) on all sinks.
* Requires re-deployment of the plugin on customer sites.

1.1.1

(2026-07-06)
* Security: extends the 1.0.6 XSS-hardening (JSON_HEX_TAG | JSON_HEX_AMP |
JSON_HEX_APOS | JSON_HEX_QUOT) to every inline-<script> JSON sink added
since — the client-side alt injector and the Phase-0 bootstraps
sr_only_text_insert / css_rule_inject / element_insert.
* Requires re-deployment of the plugin on customer sites.

1.1.0

(2026-07-04)
* Parity with Grav plugin 1.3.0: new fix type attribute_remove — pure
client-side attribute deletion via the selector-overrides bootstrap
(operation: "remove"), verify anchor data-sc-acc-managed-removed.
Includes the optional removeAttributes piggyback field on
alt_text_override / aria_label_set / attribute_override /
text_content_override items (removal applied after the value write).
* Three new WCAG-Phase-0 fix types (shared-decisions §1.1) — 1:1 port of
Grav plugin 1.4.0 (identical validators, id derivation and bootstrap JS),
all applied strictly client-side via bootstraps (no DOM
re-serialization):
* sr_only_text_insert — visually-hidden screenreader text
(<span class="sc-acc-sr-only" data-sc-acc-sr-only-id="<item-id>">,
text via createTextNode, </> rejected; the class is defined once
via <style data-sc-acc-sr-only-style>).
* css_rule_inject — fail-closed validated CSS rules collected into a
single <style data-sc-acc-css-inject> tag (no at-rules, no
url()/expression()/javascript:, no {}/<>/;/@/backslash in
values; re-validated on the render path).
* element_insert — whitelisted HTML (a/span/p/button/div only; no
script/style/iframe, no event handlers, no javascript:/vbscript:/
data:text/html URLs, no &#/: entities, no comments/doctype)
inserted via template + insertAdjacentElement, de-dup via
data-sc-acc-insert-id=””.
* Apply dispatcher hardened: unknown fix types are now rejected with
unsupported_fix_type: instead of being silently treated as
alt_text_override. Every webapp-sent type has an explicit case; a
missing/empty type still means alt_text_override (legacy alt payloads).
* Cache-store id normalization: explicit branches for attribute_remove,
text_content_override (Grav 2.3.2 parity — id-less items were silently
dropped), sr_only_text_insert, css_rule_inject and element_insert.
* Healthcheck features list extended: attribute-remove, sr-only-insert,
css-rule-inject, element-insert.
* Requires re-deployment of the plugin on customer sites.

1.0.6

• Security: XSS-hardening of the inline <script> bootstrap injectors. All JSON
  embedded in an inline script (selector-overrides, sibling-inserts,
  document-overrides, tag_replace / element_replace / element_remove, overlay
  bootstrap) now also uses JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS |
JSON_HEX_QUOT, so a fix value / overlay label containing </script>… can no
  longer break out of the inline script.
• Fix: default webapp base URL corrected from https://www.site-check.de to the
  canonical apex https://site-check.de — post-EU-cutover www 301-redirects and
  the plugin’s POST callbacks (sync/register) must target the apex.
• Requires re-deployment of the plugin on customer sites.

1.0.4

• Bootstrap-Payload for the overlay runtime now ships apiToken so the
  browser-side overlay can authenticate the new POST /api/overlay/heartbeat
  call against the webapp. Without the token the runtime simply skips the
  heartbeat — overlay itself keeps working.
• New WP-admin toggle “Overlay-Runtime auf der Website laden” (default ON)
  acts as a local kill-switch independent of the webapp-driven enabled flag.
• sync-status response now reports the real overlayRuntimeEnabled value
  instead of a hard-coded true.
• Requires re-deployment of the plugin on customer sites so the heartbeat
  appears in the dashboard health view.