13 versions
Smart Admin Assistant Pro history.
Every release of Smart Admin Assistant Pro is archived here with its changelog, file size, and security scan result. Use the archive to roll back to a stable release or audit what changed between updates.
12 of 13 releases scanned clean
v2.4.0Latest
September 14, 2026545.0 KBScanned
Added
- The Custom Code snippet manager now ships in this add-on. Snippet storage, insertion points, the editor screen and CSS/JavaScript/HTML rendering moved here from the free plugin, which can no longer include them — WordPress.org does not permit a directory-hosted plugin to save and run arbitrary code. PHP snippets, display conditions, scheduling, minification and import/export are unchanged
Improved
- Existing snippets are picked up automatically. They stay in the same database table, which this plugin now creates and removes
- The licence card no longer shows the "Modules in use" meter — the same figure is still available in the licence details dialog
- Requires Smart Admin Assistant 2.4.0 or newer — update the free plugin first
August 24, 2026515.3 KBScanned
Added
- Site health email reports — scheduled weekly or daily delivery, "email after each scan", and the manual send from Settings and the scan report modal. Moved here from the free plugin; settings saved there are picked up automatically
- All premium features now ship in this add-on instead of being unlocked inside the free plugin — SEO, SMTP, redirects, code snippets, admin menu design, login page builder, 2FA, CAPTCHA, magic login, activity log, session monitor, cron manager, developer tools and server health
- Pro React admin bundle that plugs its tabs and pages into the free dashboard
Improved
- A failed report now says why (the mailer's own reason, e.g. a refused SMTP login) instead of only "check your mail configuration"
- Requires Smart Admin Assistant 2.3.0 or newer — update the free plugin first
- License page moved to Smart Admin Assistant → License, and is reachable before a key is activated
- Pro options, CAPTCHA fields and script handles renamed to a `bdtsaapro_` prefix (existing values migrate automatically)
- Uninstall now removes everything this add-on owns — its tables, options, post meta, crons and licence data
Fixed
- Deactivation now clears every scheduled event this plugin owns
- The media replacement screen no longer requests a stylesheet that does not exist
v1.6.2Unavailable
August 9, 2026235.6 KBScanned
Added
- REST API for the new WP-Cron Manager tab (requires free version 2.2.0)
Fixed
- Magic Login links showed the login page instead of signing the user in while the Custom Login URL feature was enabled
- Magic Login emails could go out with an empty subject or body when the saved template fields were blank; the defaults are now used instead
- Magic Login email templates support HTML such as links and line breaks (requires free version 2.2.0)
v1.6.1Unavailable
July 31, 2026223.1 KBScanned
Other
- Security: Hardened Magic Login form handling
Fixed
- Scripts and styles now load only on the screens where they are used
- Renamed several AJAX actions to avoid conflicts with other plugins (requires free version 2.1.1)
- Disabling all pro modules re-enabled them, and the dependency notice would not stay dismissed
- Failed database operations (broken links, IP blocklist, optimizer) now report accurate errors
Improved
- Lighter server metrics, batched activity-log cleanup, and less frequent cron checks
- REST endpoints now validate their query parameters
July 26, 2026190.5 KBScanned
Other
- Security: Fixed a two-factor authentication bypass. The 2FA setup flow could be used to complete login without verifying a second factor — either by posting directly to the final "complete" step, or by re-running setup against an already-enrolled account. Setup completion now requires a second factor to be verified within the same pending-login session, and already-enrolled users are routed to verification instead of setup.
- Security: The Developer Tools "manage WP debug log" feature no longer writes a plaintext `wp-config.php.bdtsaa-bak` backup next to wp-config.php (web-accessible on most installs, exposing database credentials and secret keys). The config is now updated via an atomic replace with no on-disk backup, and any backup left by a previous version is removed automatically.
- Security: The 2FA verification screen now enforces the account lockout at entry, so the "maximum attempts" limit can no longer be bypassed to brute-force verification codes.
- Security: Magic Login email codes are now generated with a cryptographically secure random source instead of str_shuffle().
- Security: Magic Login token authentication is now throttled per account after repeated invalid attempts.
- Security: Magic Login now derives the client IP from REMOTE_ADDR only, ignoring spoofable forwarding headers unless the site opts in via the `bdtsaa_trust_proxy_headers` filter.
- Security: The Performance module no longer leaves predictable, web-accessible ".htaccess" backup copies (".htaccess.bdtsaa-backup-*") in the site root when toggling browser-caching rules. Writes now use a random temporary file with an in-memory restore, and any backups left by earlier versions are removed automatically.
- Security: Two-factor recovery codes are now compared in constant time (hash_equals) to remove a theoretical timing side channel.
- Security: The Magic Login form no longer reveals whether an account exists for a submitted username or email; it always shows the same "check your inbox" response, preventing username/email enumeration.
- Security: The dependency admin notice can no longer be dismissed via a forged GET request; dismissal now always requires a valid nonce and capability.
Fixed
- The stored license state is now loaded on plugins_loaded, before any plugin's init hooks run — previously the free plugin could query the license before it was bootstrapped and treat the whole request as unlicensed, making premium features intermittently appear locked.
- The debug-log REST endpoint always returned an empty log (it called a method that did not exist); it now returns the actual log lines for the React dashboard.
- Clearing the debug log via REST reported success even when the file was missing or not writable; it now reports an accurate result and surfaces a clear error when the file cannot be written. Both endpoints now resolve the log path through the viewer's containment-checked helper.
- Clearing the activity log (REST and AJAX) and clearing all IP blocks now report an accurate error when the underlying database operation fails, instead of always reporting success.
- The spam-comment cleanup now reports an error when the deletion query fails rather than reporting success with a count of zero.
- Removed a stray "1" that was rendered above the license activation form.
- Plugin activations were logged in the Activity Log even when "Log plugin changes" was disabled; activation logging now respects the toggle, matching deactivation and update logging.
- Login template builder event handling and template switching in React admin context
Improved
- Aligned the Singleton trait with the free plugin (added the direct-access guard) and centralized license-key display masking. No functional change.
- Activity log with individual entry deletion, cleaner option tracking, and improved CSV export
- Login page customization compatibility with the React admin dashboard
- License activation and deactivation flow with clearer error feedback
Added
- Compatibility with WordPress 7.0.1
- REST API endpoints for Activity Log and Debug Log (React dashboard integration)
- Pro React admin integration with license data for the new dashboard UI
- Performance module support for removing .htaccess browser caching rules when disabled
v1.4.0Unavailable
June 12, 2026151.8 KBScanned
Added
- Debug Log Viewer with live refresh, clear, and download capabilities (Developer Tools)
- Auto Update Delay option to defer plugin and theme auto-updates by 5–7 days (Developer Tools)
- URL Redirect Manager and Smart 404 Redirect runtime support (Utilities)
- Login page template builder with layout templates and advanced style settings (Pro)
v1.3.1Unavailable
May 13, 2026137.8 KBScanned
Fixed
- Resolved CAPTCHA validation issue preventing successful authentication on login forms
v1.3.0Unavailable
May 11, 2026137.4 KBScanned
Added
- Compatibility with WordPress 7.0
- 2FA (Two-Factor Authentication) support to the Security module
Improved
- Updated codebase for the latest WordPress core APIs and standards
v1.2.2Unavailable
April 2, 2026112.2 KBScanned
Added
- Disable Emojis option in Performance Module to reduce unnecessary script loading and improve page load times
Improved
- Code quality and overall plugin stability
Fixed
- Various minor bugs and edge case issues
Why archive
Sometimes the latest release isn't the one you need. The archive lets you pin Smart Admin Assistant Pro to a known-good version, or roll back while a bug is investigated. Every release stays scanned and reachable.