Asset CleanUp Pro history.

* **New:** Added "Alternative Assets" to the CSS/JS Manager. Create and edit lighter alternatives for CSS and JavaScript assets that still need to load, choose where the alternatives are used, and compare their sizes without modifying the original source. * **Improvement:** Reduced redundant processing during Combine CSS/JS cache validation and avoided unnecessary cache rebuilds when separate inline JavaScript, JSON content, or CSP nonce values change. * **Improvement:** Import/Export preserves Pro settings and rules when transferred through Lite, ready for use after upgrading to Pro. * **Fix:** Improved Combine CSS/JS reliability, including asset ordering, cache invalidation, regeneration of missing combined files, and homepage cache cleanup. * **Fix:** Improved JavaScript combining and BODY defer handling to preserve script execution order and existing defer behavior while safely applying defer to eligible BODY scripts.

* **Added:** Roll back Asset CleanUp Pro to an eligible previous version from "Tools" (plugin's menu) - "Rollback", with version selection and confirmation before installation. Existing settings are preserved. * **Security — Admin Bar:** Fixed a reflected cross-site scripting (XSS) vulnerability in the admin bar by validating asset unload parameters and escaping dynamic output (CVE-2026-92236). Reported by 'Huseyn (mekhatai) Gadashov' via Wordfence. * **Security — Comment Content XSS:** Completed the fix for the stored cross-site scripting via comment content (follow-up to CVE-2026-13354). The final cleanup of the plugin's temporary `data-wpacu-*` attributes on ` ` tags — previously two whole-document replacements — is now scoped to each ` ` tag and uses bounded, quote-aware patterns. Reported by 'crow' via Wordfence. * **Security — Front-end HTML Cleanup:** Removed the last remaining whole-document replacement from the HTML cleanup step (it stripped `data-wpacu-style-handle` from ` ` tags); that cleanup now runs through the same tag-scoped methods. Found during the internal review that followed the report above. Every temporary-attribute cleanup is now confined to the tag it belongs to and cannot touch any other part of the page, including user-submitted content.

* **New:** Admin Bar transfer savings estimates for unloaded CSS/JS files and removed inline code, with AJAX-based measurements and Brotli/GZIP indicators. * **Improvement:** Separate effective asset unloads from rules that had no effect on the current page, with inactive rules grouped by asset type. * **Improvement — Rule Management:** "Overview" is now the recommended place to review and manage bulk rules, including dormant rules left behind by deleted pages or deactivated plugins. Removed "Bulk Changes" from the top navigation, WordPress sidebar, and Admin Bar. The legacy page remains accessible through its direct URL and existing bookmarks: /wp-admin/admin.php?page=wpassetcleanup_bulk_unloads * **Improvement:** The "CSS/JS Manager" and Admin Bar now explain when "Page Options" disable optimizations, including CSS/JS unload rules. Admin Bar warnings identify disabled features, while clearer descriptions, dimmed overridden options, and quick links make these settings easier to understand. * **Improvement — Debugging "/?wpacu_debug":** Added temporary "Page Options" overrides without changing saved settings. Debugging controls now update their availability and distinguish global restrictions, Page Options overrides, and missing rules. * **Improvement — Debugging "/?wpacu_debug":** Added per-file CSS/JS optimization details explaining content changes, unchanged results, exclusions, failures, and cache decisions. Multiple optimization reasons can be shown for the same file. * **Improvement — Overview:** Added navigation entries for "Page Options" and "Special Settings", clarified page overrides, and dimmed redundant options. * **Fixed — Interface:** Corrected "Overview" horizontal overflow and alignment * **Fixed — CSS Optimization:** When an optimized stylesheet has a matching ` ` fallback, the fallback now uses the same optimized cache URL instead of retaining the original unminified URL. * **Fixed — CSS/JS Manager:** Selecting “Remove bulk rule” or "Remove site-wide rule" now correctly removes the unload rules when saving changes. * **Fixed — Page Options:** Fixed an issue where CSS/JS processing could still run on pages with "Disable all front-end optimizations" enabled. The plugin now checks the current page’s options before retaining the decision to allow optimizations, preventing unnecessary processing on excluded pages.

* **Improvement:** Reduced Google Fonts browser discovery traffic by running the collector for approximately 2% of public browsers while preserving duplicate protection for known configurations. * **Improvement:** Made the Google Fonts discovery REST endpoint compatible with sites where WordPress pretty permalinks or REST rewrite rules are unavailable. * **Fixed:** Browser discovery is now disabled by default, preventing discovery REST traffic on new or previously unsaved configurations until the feature is enabled.

* **Added — Google Fonts:** Added local hosting for Google Fonts, allowing detected stylesheets and font files to be downloaded, validated and served from the local cache. * **Added — Google Fonts:** Added granular font removal, allowing specific Google Font families, weights and styles to be removed while keeping the remaining fonts unchanged.

* **Added — Font Preload Audit:** Added a browser-assisted audit for manually preloaded Local and Google Fonts. The audit checks representative pages in desktop and mobile viewports, identifies duplicate, invalid or unnecessary site-wide preloads and provides conservative cleanup recommendations without removing the fonts themselves. * **Added — Critical CSS:** Added a global control directly in the Critical CSS Manager to temporarily pause or resume all Critical CSS output while preserving the existing rules. * **Added — Tools / Storage:** Added a read-only Database Map showing where Asset CleanUp stores settings, optimization rules, metadata, transients and Pro-specific data. * **Added — Tools / Uninstall:** Added a dedicated, explicitly confirmed action for removing all Asset CleanUp data before uninstalling the plugin, including settings, optimization rules, metadata, transients, license data and generated cache files. * **Improved — JavaScript Optimization:** Improved handling of modern JavaScript, including module/nomodule scripts and scripts using integrity, nonce, crossorigin or referrerpolicy attributes, preventing unsafe combine, inline or Match Media transformations. * **Improved — Resource Loading:** Hardened image attribute and lazy-loading rule validation, improved compatibility with rules saved by older versions and fixed edge cases where attributes such as `src` could be confused with `data-src`. * **Improved — CSS/JS Manager Settings:** Redesigned the manager preferences area with clearer navigation and explanations, better-organized controls for management locations, access, list appearance and optimized-file cache settings. * **Improved — Settings and CSS/JS Manager:** Added unsaved-change counters and persistent save areas, making modified settings and asset rules easier to review before saving. * **Improved — Dashboard Reliability:** Improved AJAX validation, authorization and failure recovery across several Dashboard actions, including safer handling of invalid, expired or interrupted requests. * **Improved — Tools / Storage:** Added a detailed overview of generated CSS/JavaScript storage, including directory paths, file counts, disk usage, write status and filtering between optimized assets and supporting files. * **Improved — Tools / Debugging:** Redesigned the troubleshooting area with clearer diagnostic modes, copyable test URLs and protected PHP error-log downloads. * **Improved — Tools / Reset:** Added more granular reset options for Critical CSS and front-end or Dashboard Plugins Manager rules, with clearer confirmation, deletion summaries and partial-failure reporting. * **Improved — Tools / Uninstall:** Cleanup results are shown on the Plugins page and partial filesystem failures are reported instead of returning a false success. Plugin settings are not recreated after cleanup. * **Improved — Multisite Uninstall:** Network-shared user access data and the Pro MU-plugin loader are preserved while Asset CleanUp Pro remains active on another site in the network. * **Fixed — Plugin Rules:** Fixed request-context detection on sites using plain permalinks, preventing homepage, search, author, date and taxonomy requests from being incorrectly treated as the same context. * **Fixed — Multisite Plugins Manager:** Improved detection and handling of network-active plugins across Plugins Manager rules and WPACU internal requests. * **Fixed — Dashboard CSS/JS Manager:** No longer reports a false external redirect or fails to fetch assets when WordPress runs on a non-standard port (e.g. localhost:8888) * **Fixed — Usage Data Settings:** Fixed an undefined variable warning in the usage-data disclosure panel. * **Fixed — CSS and JavaScript:**: Combining now works when minification is disabled. * **Fixed — Upgrade Compatibility:** Recently introduced access-control settings now receive their correct disabled or empty-list defaults when upgrading from older versions, preventing blank fields or unexpectedly enabled checkboxes. * **Privacy — Dashboard Announcements:** Remote announcements are now disabled by default and require an explicit administrator opt-in. * **Security — Remote Asset Handling:** Further hardened remote asset retrieval and redirect validation, including safer handling of dynamically loaded resources and restricted redirect behavior. * **Security — License Administration:** Removed an unsafe legacy GET-based license-status workaround and retained the protected POST-based recovery action. * **Security — Plugin Updater:** Replaced remote PHP deserialization with native JSON collection validation. * **Security — License Server Output:** Added strict allowlist sanitization for promotional HTML returned by the license server.