Skip to main content
WP HealthKit
Changelog

What's new in WP HealthKit

Recent updates to the audit engine, platform features, and marketing pages. Updated as work ships.

  1. July 2026

    The trust layer

    Provenance receipts

    • Every completed audit mints an HMAC-SHA256-signed provenance receipt attesting that a specific artifact (ZIP sha256) passed — public verification page at /receipts/[id], machine check at /api/v1/receipts/[id]/verify
    • Newer audits of the same plugin supersede older receipts so verification always tells the truth over time

    Open benchmark

    • Monthly frontier-model evaluation against a fixed known-flaw corpus, published live at /models and /api/v1/benchmark
    • Current ladder: DeepSeek v4 Flash, Kimi K3, Claude Sonnet 4.6, Claude Opus 4.7 — recall, false positives, latency and cost per model

    Playground exploit probes

    • AJAX exploit probe: every wp_ajax_nopriv_* handler executed unauthenticated in the sandbox — executed probes report HIGH with a live proof-of-concept
    • Dynamic REST auth probe: unauthenticated rest_do_request against every non-core write route — proof, not patterns

    Premium refactor plans

    • Premium engine tier clusters related findings into systemic refactor plans — one root-cause fix that eliminates a whole class of bug
    • Refactor plans ship in the Fix Plan API, Markdown export, dashboard, and MCP get_fix_plan tool

    AI agent skill

    • wphk-audit skill for Claude Code, Cursor and other agents — audit your own WordPress code before shipping (/features/agents)

  2. June 2026

    Pricing restructure + model tiers

    Pricing

    • GBP pricing restructure: Studio tier added (£69/mo, 30 audits + 3 sites), Agency repriced £149 → £299/mo
    • Free tier split: unlimited deterministic scans + 1 AI audit/month
    • Non-expiring token packs (25/100) — draw after your monthly allotment, FIFO

    Model tiers

    • Standard (DeepSeek v4 Flash, ×1 token), Advanced (Kimi K3, ×2), Premium (triple-validated security: K3 + Claude Opus 4.7 + DeepSeek v4 Flash, ×5)
    • Tier membership gated on the open benchmark — models earn their multiplier

  3. May 2026

    WordPress 7 ready

    WordPress 7 support

    • Activation matrix now benchmarks against WordPress 7.0 (released 2026-05-20) and 6.8 — every audit reflects the latest stable
    • WP compatibility scanner emits a dedicated WordPress 7 clarification finding so reports state exactly which version they were tested against
    • wp_specialchars() flagged as removed in WP 7.0 (after a decade of deprecation) — replace with esc_html() for escaping
    • Context7 doc-cache integration — AI engines pull current WordPress 7 deprecation notes live rather than relying on training-cutoff knowledge
    • Tested up to validation now compares against 7.0 by default; set LATEST_WP_VERSION env var to override per environment

  4. April 2026

    Major Update

    Scan engine (62 verification layers)

    • REST API authorization scanner — detects missing permission_callback (the #1 exploited WordPress vulnerability class)
    • GDPR compliance scanner — flags external data transmission without consent, missing data erasure hooks
    • npm/JS dependency scanner — OSV.dev batch CVE check on bundled JavaScript packages
    • Gutenberg block scanner — render_callback escaping, block.json attribute type safety
    • Host compatibility scanner — WP Engine, Kinsta, Flywheel compatibility scoring with affiliate disclosure
    • CRA compliance scanner — SECURITY.md presence, VDP contact, changelog security tagging (EU Cyber Resilience Act)
    • Multisite compatibility scanner — manage_options vs manage_network_options, $wpdb->prefix in multi-blog loops
    • GPL/license compatibility scanner — Composer + npm production deps against GPL compatibility list
    • CodeCanyon/Envato submission scanner — inline JS, debug code, hardcoded URLs, missing docs, compressed PHP
    • Theme scanner (themes only) — style.css headers, FSE/block readiness, customizer sanitization, WooCommerce template overrides
    • WordPress Playground activation matrix — optional engine testing WP 7.0/6.8 × PHP 8.1/8.2/8.3 + WooCommerce conflict check
    • SBOM generation — CycloneDX 1.6 and SPDX 2.3 from Composer + npm dependencies

    Token pricing (superseded — see June 2026)

    • This token model was retired in the June 2026 restructure: Free is now unlimited deterministic + 1 AI audit/mo, Agency £299/mo, and token packs never expire. Studio was retired July 2026.

    New features

    • wp.org pre-flight mode — frames audit for WordPress.org submission review, always private
    • Supply chain ownership monitoring — alerts when a monitored plugin changes author on WordPress.org
    • Email drip series — CRA countdown (4 emails) and AI plugin security (3 emails) sequences
    • Performance regression tracking — Playground engine tracks memory/query deltas across plugin versions
    • Monthly findings log — aggregate findings analytics powering the /reports infographic dashboard
    • MCP v0.5.2 — generate_sbom and get_telemetry_stats tools; 6 reference resources; 3 prompt templates

    New marketing pages

    • /features/playground, /features/sbom, /features/supply-chain, /features/host-compatibility
    • /cra-compliance — CRA September 2026 deadline guide
    • /for/ai-plugin-development, /for/ai-generated-plugins, /for/envato-authors

Want to see what shipped before this?

Browse community updates from verified plugin developers, or read the latest from the WP HealthKit blog.

Community updatesVisit the blog