peptide-starter-theme/CHANGELOG.md

Peptide Starter Theme - Changelog

All notable changes to the Peptide Starter Theme are documented in this file.

[1.6.0] - 2026-04-23 — Mobile Performance Phase 1

Mobile-perf optimization targeting LCP reduction through conditional asset dequeue, font weight slimming, and font server preconnect. Measured baseline LCP on Moto G Power (Slow 4G): 5.4s; target after Phase 1: ~2.5s.

Added

• inc/perf-asset-policy.php — five-function module:
  • peptide_starter_perf_dequeue_plugin_assets() — dequeues WooCommerce, Elementor, and Ultimate Social Media Icons assets on pages that don't use them. Hook: wp_enqueue_scripts priority 100.
  • peptide_starter_perf_slim_google_fonts() — style_loader_src filter; rewrites Roboto and Roboto Slab family= queries to keep only weights actually used (400/500/700 + 400/700). Drops 72 font faces to 5.
  • peptide_starter_perf_resource_hints() — wp_resource_hints filter; adds preconnect hints for fonts.googleapis.com and fonts.gstatic.com.
  • peptide_starter_perf_defer_cookie_notice() — script_loader_tag filter; appends defer attribute to the cookie-notice front-end script.
  • peptide_starter_page_uses_elementor( int $post_id ) — helper.
• Kill-switch constant PEPTIDE_STARTER_PERF_DEQUEUE (default true). Define false in wp-config.php to disable all dequeues instantly.
• Filterable handle lists: peptide_starter_perf_woocommerce_handles, peptide_starter_perf_elementor_handles, peptide_starter_perf_usmi_handles, peptide_starter_perf_font_weights.
• tests/test-perf-asset-policy.php — 13 unit-test cases covering kill-switch, per-page-context dequeue logic, font slim happy/edge cases, filter overrides, preconnect insertion, defer attribute application.

Changed

• style.css Version header bumped 1.5.2 → 1.6.0.
• PEPTIDE_STARTER_VERSION constant bumped to 1.6.0.

Why

PageSpeed Insights mobile score on https://peptiderepo.com/ was 74 with LCP 5.4s, FCP 2.6s. Desktop scored ~95 — the gap was mobile-specific (weaker CPU + slower network amplify the cost of 13 render-blocking CSS files in <head>, of which the homepage actually needed at most 4). Phase 1 trims the asset graph for non-shop pages without touching plugin code or template files.

[1.5.2] - 2026-04-14 — Security

Same-day follow-up to v1.5.1. Closes four issues the v1.5.1 post-merge review flagged — two ship-blockers (PSEC-007 CF header spoof, PSEC-008 synchronous migration) and two mediums (PSEC-009 timing oracle, PSEC-010 test-coverage gap). All fixes stay within ADR-0001's decision envelope — no new ADR required.

Security fixes

• PSEC-007 — peptide_starter_get_client_ip() now only trusts HTTP_CF_CONNECTING_IP when REMOTE_ADDR itself is inside a published Cloudflare edge range. Direct-to-origin requests (which Hostinger allows) can no longer forge their source IP by sending a CF-Connecting-IP header. HTTP_X_FORWARDED_FOR is ignored unless explicitly opted in via the peptide_starter_trust_xff filter. New module inc/cloudflare-ips.php holds the range snapshot (dated 2026-04-14) + a CIDR matcher for both IPv4 and IPv6. Override the list via the peptide_starter_cloudflare_ip_ranges filter.
• PSEC-008 — Removed the v1.5.1 re-verification migration entirely (Option A). Existing subscribers are now grandfathered — treated as verified. Verification applies to accounts registered from v1.5.2 onward. The admin_init-driven synchronous wp_mail loop that blocked wp-admin is gone; its ps_verify_migration_version option is cleared on theme activation.
• PSEC-009 — Registration validation no longer short-circuits. Pattern / email / password / username_exists / email_exists all evaluate unconditionally before the combined rejection, closing the response-time enumeration oracle that distinguished microsecond-fast regex rejection from DB-round-trip rejection.

Tests

• test-rate-limiter.php — seven new cases covering CF-peer trust, spoofed-header rejection, invalid-value fallthrough, XFF default-off behaviour, XFF filter opt-in, filter override of the CF range list, IPv6 CIDR matching, and family-mismatch rejection.
• test-auth-handlers.php — test_register_runs_all_checks_even_when_early_one_fails asserts DB-backed user lookups still execute when a cheap validation check has already failed (PSEC-009).
• test-email-verification.php — test_valid_token_verifies_user_clears_meta_and_fires_hook covers the happy-path verify flow end-to-end including hook firing (PSEC-010).

Documentation

• ARCHITECTURE.md — CF IP trust model explained in the Security Summary; migration decision (grandfather) documented.
• CONVENTIONS.md — new "Trust model for request headers" note.

Rollback note

If v1.5.2 causes login or registration failures, roll back to v1.5.0 (not v1.5.1 — v1.5.1 carried the unresolved PSEC-007 hole and the blocking migration). Rate-limit transients auto-expire.

---

[1.5.1] - 2026-04-14 — Security

Security-only release hardening the frontend authentication surface introduced in v1.5.0. Governed by ADR-0001 (Frontend authentication and abuse-control strategy). No breaking changes to public routes, AJAX action names, or nonce action strings.

Security fixes

• PSEC-001 — Rate limiting on login (5/min per IP+email), registration (3/hour per IP), contact (5/hour per IP), newsletter (3/hour per IP), and verification resend (2/hour per IP+email). Transient-backed, auto-expiring. Storage never holds raw IPs — keys are truncated wp_hash digests.
• PSEC-002 — Unified error messages on login and registration. Removed separate "username exists" / "email exists" / "user not found" branches that enabled account enumeration via the error-message oracle. All login failures now return Invalid email or password.; all registration validation failures return Unable to create account. Please check your entries and try again.
• PSEC-003 — Removed auto-login from the registration handler. New registrations now go through an email verification flow: a 43-char random token (stored in user meta with a 24h TTL) is emailed via wp_mail and must be clicked to activate the account. Verification route is /verify. wp_mail deliverability can be validated any time via the new admin tool at Tools → Mail Test.
• PSEC-004 — peptide_starter_require_login() gate applied at the top of page-subject-log.php, page-tracker.php, page-protocol-builder.php. Unauthenticated users bounce to /auth?redirect_to=…; unverified users bounce to /profile?verify_required=1 which surfaces a resend button. page-calculator.php stays open — it holds no PII and does no writes.
• PSEC-005 — CSV injection fix in the newsletter admin export. Every cell passed to fputcsv routes through peptide_starter_csv_safe(), which prefixes values starting with =, +, -, @, \t, \r with a single quote so spreadsheet apps won't interpret them as formulas.
• PSEC-006 — Honeypot fields on all four public forms (login, register, contact, newsletter). Any non-empty value fakes a success response and drops the submission. No PII is ever logged — only a sha256-truncated IP hash so admins can correlate if they need to.

Added

• inc/config.php — single source of truth for every security threshold; filterable via peptide_starter_security_config.
• inc/rate-limiter.php — Peptide_Starter_Rate_Limiter class with check/record/reset lifecycle + peptide_starter_get_client_ip() helper (Cloudflare-aware).
• inc/email-verification.php — token generation, verification route handler, user-verified check, and rate-limited AJAX resend endpoint (ps_resend_verify).
• inc/mail-diagnostic.php — permanent admin tool under Tools → Mail Test that exercises wp_mail and surfaces duration + PHPMailer error.
• v1.5.0 user migration in inc/page-setup.php: existing subscribers are enrolled into the email verification flow on first admin load after the upgrade (guarded by ps_verify_migration_version option).
• Newsletter consent checkbox + privacy policy link on the signup form.
• Newsletter unsubscribe flow: every subscription now stores a token; /newsletter-unsubscribe?token=… flips the unsubscribed flag without requiring a login.
• Profile page verify-required banner with resend button (AJAX).
• peptide_starter_render_honeypot() and peptide_starter_csv_safe() helpers in inc/helpers.php.
• PHPUnit suites: test-rate-limiter.php, test-auth-handlers.php, test-email-verification.php, test-contact-handler.php, test-newsletter.php, test-auth-gate.php.

Changed

• functions.php loads the five new modules in dependency order.
• Newsletter handler stores entries with autoload=false so a large subscriber list no longer bloats every page load. Admin notice surfaces once subscribers exceed 1000 (threshold is configurable).
• Newsletter handler collapses success and duplicate response states into a single ok state — no longer leaks subscription status.
• Contact handler rejects sender names containing \r, \n, ,, <, > up front (header-injection defence) and tags mail failures with a request ID so admins can correlate without storing message content.
• Fallback primary-menu function moved from header.php into inc/helpers.php to eliminate redeclaration risk.
• Footer placeholder language links (href="#") replaced with a "Translations coming soon" note. Will render localized links once per-language blogs exist.
• Footer copyright now renders through peptide_starter_get_footer_copyright() so the customizer control is live (was dead before).
• Settings panel now implements a proper Tab / Shift+Tab focus trap and saves + restores document.body.style.overflow so nested overlays don't corrupt scroll state.
• Documentation heading IDs are slugified from heading text with a collision counter so deep links survive reorders.
• assets/js/auth.js, settings-panel.js, documentation.js, theme.js, navigation.js standardized on const / let.

Removed

• Auto-login on registration (see PSEC-003).
• Placeholder-link spam in the footer (see Changed).

Documentation

• ARCHITECTURE.md updated with the new inc/ module list, authentication data flow, security abuse-control overview, and verification route.
• CONVENTIONS.md documents the rate-limiter usage pattern, the honeypot pattern, the require_login gate, and CSV-safe export.
• ADR-0001 (Frontend authentication and abuse-control strategy) governs the trade-offs behind this release.

Known follow-ups (out of scope; tracked as future ADRs)

• ADR-0003 — consolidate the six duplicated tool templates.
• ADR-0004 — migrate newsletter storage from wp_options to a dedicated table once subscriber count exceeds ~1000.

---

[1.5.0] - 2026-04-14

Theme extension release: navigation dropdowns, 9 page templates, branded frontend auth UI, newsletter signup, contact/support panel, footer update, and Research Modules cards on the front page. Superseded by v1.5.1 on the same day — v1.5.0 shipped with the auth-surface issues captured in ADR-0001.

---

[1.3.2] - 2026-04-12

Security

• Newsletter form nonce: Added wp_nonce_field() and server-side nonce verification to the footer newsletter signup form (CSRF protection)
• Newsletter form handler: Added peptide_starter_handle_newsletter_signup() via admin_post action with email sanitization and validation
• Customizer sanitize callbacks: Added sanitize_callback to all five Customizer settings (hero_title, hero_subtitle, hero_search_placeholder, footer_copyright, dark_mode_default) — prevents unsanitized input from being saved
• Checkbox sanitizer: Added peptide_starter_sanitize_checkbox() helper for boolean Customizer values

Added

• PHPCS in CI: WordPress-Core coding standard check added to deploy pipeline (blocks deploy on violations)
• JS syntax check in CI: node --check validation on all JS files in assets/js/
• PHPUnit test scaffold: Bootstrap, config, and initial test suites covering theme helpers, setup, and sanitizers
• Composer dev dependencies: PHPUnit 9, PHPCS 3, WPCS 3 for local development
• PHPCS config: .phpcs.xml.dist with WordPress-Core standard, text domain, and PHP/WP version constraints

Changed

• Deploy safety: Added excludes for dev-only files in rsync (tests/, vendor/, composer.json, phpunit.xml, .phpcs.xml.dist) — prevents dev tooling from reaching production
• CI job name: Renamed from "Validate PHP Syntax" to "Validate PHP & JS" to reflect expanded checks

Documentation

• Updated ARCHITECTURE.md with testing infrastructure, security details, and CI/CD pipeline description
• Updated CHANGELOG.md with this release

---

[1.3.1] - 2026-04-10

Added

• PRAutoBlogger Integration: Added [prautoblogger_posts] shortcode widget to front page
  • Displays 6 auto-generated research articles in "Latest Research & Insights" section
  • Appears between hero section and Peptide News feed
  • Gracefully hides if PRAutoBlogger plugin is not active
  • Uses .prab-* namespace for plugin-specific styling

Changed

• Deploy Mechanism: Switched from GitHub Actions direct build to rsync SSH deployment
  • No longer requires build step or plugin compilation
  • Files deployed directly from repository to Hostinger via rsync over SSH
  • LiteSpeed cache purged automatically after deploy
  • Theme path on server: ~/domains/peptiderepo.com/public_html/wp-content/themes/peptide-starter/
  • Simpler CI/CD pipeline; no external build dependencies

Technical Details

• PRAutoBlogger integration uses shortcode_exists() for graceful degradation
• Deploy workflow (deploy.yml) now runs rsync directly without intermediate steps
• Maintains backward compatibility with all existing features

---

[1.3.0] - 2026-04-10

Added

• Dark Mode Toggle: Full dark mode support with persistent user preference

  • Toggle button in header (sun/moon icons)
  • Preference saved to localStorage as peptide-starter-theme
  • Respects system prefers-color-scheme preference
  • Customizer option to set dark mode as default on first visit
  • Inline script in wp_head prevents white flash on page load
  • Custom themechange event dispatched to plugins for dark mode coordination

• Plugin Coordination System: Dark mode and theme state broadcasting

  • Custom themechange DOM event with { theme: 'dark' | 'light' } payload
  • html[data-theme] attribute for CSS selectors
  • window.peptideStarterTheme API for plugin access (getCurrentTheme, setTheme, toggleDarkMode)
  • CSS custom properties swap automatically on dark mode toggle

• Full Plugin Integration Suite:

  • Peptide Search AI shortcode: [peptide_search] in hero section
  • Peptide News shortcode: [peptide_news] on front page
  • All plugins respect theme CSS variables and dark mode events
  • Graceful fallback for missing plugins (search form, empty sections)

• Customizer Settings:

  • Hero title, subtitle, search placeholder
  • Footer copyright text
  • Dark mode default toggle

• 4-Column Footer Widget Areas:

  • Registered: footer-1, footer-2, footer-3, footer-4
  • Default fallback content per column (About, Links, Resources, Connect)

• Template Hierarchy:

  • Front page with hero + plugin widgets
  • Generic page template with headers
  • CPT support: single-peptide.php, archive-peptide.php
  • 404 error page
  • Search template with fallback

• Accessibility (WCAG AA):

  • Skip-to-main-content link
  • Proper heading hierarchy (H1-H6)
  • Focus indicators (2px outline) on all interactive elements
  • 4.5:1+ contrast ratio on all text
  • Semantic HTML with proper landmarks
  • aria-label and aria-expanded attributes on buttons
  • Keyboard navigation support (Escape closes overlays, Tab through elements)

• Responsive Breakpoints:

  • Mobile: 320px - 479px
  • Tablet: 480px - 767px
  • Desktop: 768px - 1023px
  • Large: 1024px - 1439px
  • Extra Large: 1440px+

• Design System:

  • Typography: Inter font with 1.125x modular scale, 8px grid base
  • Colors: Blue primary (#0066CC light, #3B82F6 dark)
  • Component library: buttons, cards, forms, badges, alerts, pagination
  • CSS custom properties for all design tokens
  • No !important on global elements (plugin harmony)

• Navigation & Mobile Menu:

  • Primary navigation with active state detection
  • Mobile hamburger menu with overlay
  • Custom Nav Walker for WordPress theme integration
  • Keyboard navigation (Escape closes menu, arrow keys work)
  • Responsive: hides on desktop, appears on mobile (< 768px)

Technical Details

• Architecture: Classic WordPress theme (non-block/FSE)
• Styling: Single 44KB style.css with no build step
• JavaScript: Vanilla ES6+ in 2 files (navigation.js, theme.js)
• Plugin Namespaces: .pn-* (Peptide News), .psa-* (Peptide Search AI), .prab-* (PRAutoBlogger)
• Browser Support: Chrome, Firefox, Safari (latest 2), iOS Safari 12+
• Requires: WordPress 6.0+, PHP 7.4+

Initial Release

• All core features implemented and tested
• Full dark mode support with ecosystem coordination
• Production-ready for peptiderepo.com launch

---

Version Numbering

• Versions follow semantic versioning: MAJOR.MINOR.PATCH
• Current: v1.3.2
• Defined in: style.css header (line 7) and functions.php (line 14 constant)
• Update both locations when releasing a new version

---

Deployment

Push to main branch triggers automatic deployment to peptiderepo.com via GitHub Actions.

Process:

1. Push to main
2. GitHub Actions workflow deploy.yml runs
3. Files synced via rsync to Hostinger
4. LiteSpeed cache purged

No manual FTP uploads needed.