Nexter Extension – Security, Performance, Code Snippets & Site Toolkit

Zapis promijena

View Complete Changelog at roadmap.nexterwp.com

V4.7.13

15 October 2026
– Improved : Nexter SEO : the Site Audit no longer checks Theme Builder templates (headers, footers, sections) or other builder and template types, so they stop appearing under Orphan pages and Thin content. Post types you exclude from the sitemap are skipped by the audit too, and developers can adjust the list with the nexter_seo_audit_excluded_post_types filter.
– Improved : Nexter SEO : the category base and WooCommerce base options now flush rewrite rules once per request instead of once per category or product term, so bulk imports no longer rebuild the rules for every term.
– Improved : SMTP Email : the mail server's certificate is now verified by default, so a server that only pretends to be your mail host can no longer receive your SMTP login and your mail. Sites that already had SMTP set up are kept as they were, with self-signed certificates still allowed, and see a notice explaining the change. A site that needs self-signed certificates can use the allow_self_signed setting, the NEXTER_SMTP_ALLOW_SELF_SIGNED constant or the nxt_smtp_allow_self_signed filter.
– Improved : Dashboard : keyboard users can now see which control has focus on buttons, switches and the upgrade and install pop-up buttons, focus rings and some borders have more contrast, and pop-up dialogs move focus into the dialog, keep Tab inside it and make the rest of the admin inert while it is open.
– Fixed : Theme Builder : importing a template no longer ends in a fatal error. Importing now needs the manage options permission, which the Editor role did not have by design, and a template can only be exported by someone who can edit it.
– Fixed : Theme Builder : a widget that throws an error no longer leaves the page's main query switched, a template with no post no longer causes an error, and the preview link for an Author Archive template now works.
– Fixed : Theme Builder : a template made for one specific page no longer loses to an All Pages template just because it is older, and templates saved without a logged-in user (WP-CLI, importer, cron) now refresh the cached template list.
– Fixed : Display Conditions : the Specific Pages and Archives pickers no longer crash on an empty request.
– Fixed : Display Conditions : the pickers no longer show other users’ private and draft posts, or the full user list, to Contributors.
– Fixed : Image Optimisation : converting an image now requires permission to edit that image, so an Author can no longer convert or overwrite someone else's.
– Fixed : Image Optimisation : deleting an image from the Media Library now also deletes its converted copies and backups. Before, they stayed downloadable from the optimizer folder and piled up on disk, and the delete check can no longer be tricked by a path containing …
– Fixed : SVG Upload : SVGs added through importers, demo kits and WP-CLI are no longer rejected as an invalid upload, and the PHP 8 deprecation notice shown on every upload is gone.
– Fixed : Captcha : Cloudflare Turnstile now refuses login, registration, password reset and comment forms that arrive without a token, not only the ones with a wrong token.
– Fixed : Local Google Fonts : only real fonts.googleapis.com links are downloaded, and the original link is kept, with a 15-minute pause, when a download fails instead of leaving the fonts missing.
– Fixed : WP Debug Mode : switching it on and off now edits wp-config.php safely. It no longer adds a second define on setups like Docker or Bedrock, sets WP_DEBUG_DISPLAY so visitors do not see PHP errors, finds a wp-config.php one folder above the site, and no longer ends in an error page when the file is not writable.
– Fixed : Code Snippets : the safety check no longer switches off ordinary snippets, such as loops that contain a break, code that calls get_permalink(), or file writes to a path built in the code.
– Fixed : Replace URL : now also replaces the JSON-escaped URLs that Elementor and other builders store, and handles serialized objects, so a domain change no longer leaves old images and links behind.
– Fixed : Nexter SEO : a post marked noindex is now dropped from the sitemap straight away instead of staying for up to 12 hours.
– Fixed : Advance Security : Remove Meta Generator now works on block themes such as Twenty Twenty-Five, and no longer closes another plugin's output buffer.
– Fixed : Disable Comments : the comments REST routes are now really closed, and existing comments are hidden on block themes too.
– Fixed : Post Revision Control : the revision limit and the post-type setting now take effect. Before, a post edited 8 times kept 8 revisions with the limit set to 3.
– Fixed : Content Post Order : reordering no longer empties caches shared with other sites on the server, and a visitor's own ?orderby= sort is respected.
– Fixed : Disable Admin Settings : sites that already define a remove_core_updates() function no longer get a Cannot redeclare error on every admin page.
– Fixed : Dashboard : the What's New feed is cleaned before it is shown.
– Fixed : Translations : the plugin's translation files are now loaded from the right folder.
– Fixed : Login Limiter : a wrong two-factor code is now counted against the visitor's IP address, so it counts toward the lockout.
– Fixed : Adobe Fonts : saving now changes only its own setting, checks the kit ID, and reports success when the kit is cleared. SMTP also no longer shows a warning when its saved values have no type.
– Fixed : Post Duplicator : the number of copies is capped at 50, adjustable with the nxt_duplicate_post_max_copies filter, and a user who cannot publish now gets a pending copy instead of a published one.

V4.7.12

15 October 2026
– Improved : internal security hardening from a full code audit: the Theme Builder visitor-IP display condition is documented as non-authoritative, a browser-detection header read is now sanitized, duplicating a post no longer unserializes its meta without restricting which classes may be instantiated, the plugin/theme installer's wordpress.org lookups try JSON before falling back to a restricted unserialize, and the SEO settings, import and post/term REST endpoints now validate and sanitize every parameter against its declared schema. No user-facing behaviour changes.
– Fixed : Nexter SEO : with the WooCommerce base removal on, product, product category and product tag links no longer return 404 on permalink structures other than Post name, nested categories included.
– Fixed : Theme Builder : editing a template's display conditions no longer drops saved Specific Pages/Posts; only the first 20 of each type were loaded, so the rest vanished and were lost on save.
– Fixed : Nexter SEO : the XML sitemap now lists every language on sites using Polylang. Only the default language was included, so posts and pages under /fr/ or /en/ were missing. All languages are now listed with their hreflang alternates, and the sitemap rebuilds as soon as the plugin is updated or a language is added.
– Fixed : View Admin Role Switcher : an account demoted through WordPress's bulk role change, the REST API or the single-user edit screen could regain its former Administrator role through the switcher's own restore link; the cleanup now runs on every role change, not only on a profile save.
– Fixed : Nexter SEO : llms.txt now lists posts and tags in every language on sites using Polylang, the same gap already fixed on the XML sitemap. Only the default language was included before; pages were unaffected since they're chosen by hand.

V4.7.11

05 October 2026
– Improved : Nexter SEO : Site Audit findings now list the pages they are about, each with a view and an edit link; the CSV and JSON exports carry the same per-item detail.
– Fixed : Custom Login URL : the hidden login address now works on Plain permalinks. The address the plugin generated opened the home page instead of the login form, leaving no way in.
– Fixed : View Admin Role Switcher : switching back to your own account no longer breaks when the feature is turned off or an unrelated profile save clears the stored role, and the Switch back button now also appears on the front end.
– Fixed : Nexter SEO : the post-import check no longer reports a correct import as failed; it now checks only the fields the import actually wrote, against the value that was stored.
– Fixed : Code Snippets : a PHP snippet could break admin screens and JSON replies, such as the Site Audit, by printing text into them. Snippet output is now discarded during REST and JSON requests, so snippets that register REST routes still work.
– Fixed : Image Optimisation : AVIF and WebP copies are now served through a picture element, so Safari on iPhone and iPad and search-engine crawlers no longer receive the original JPG or PNG.
– Fixed : Nexter SEO : No Index, No Follow, No Archive and Exclude from Sitemap now save for a post type that only exists in admin screens, such as Complianz's, and an unrelated save no longer erases them.
– Fixed : Translations : the translator notes on the SEO import check message and the Search & Replace result message now stay attached to their text in the built files.

V4.7.10

22 September 2026
– Added : Nexter SEO : the Yoast import now brings across your Organization name and logo into Nexter's Organization schema, so your site identity in search results survives the migration. Anything you had already set there is kept.
– Added : Nexter SEO : Rank Math's custom robots.txt rules are now imported, so paths you blocked from crawlers stay blocked after the migration. Your own robots.txt is never replaced.
– Added : Nexter SEO : WooCommerce URL bases can now be removed — separate toggles under Advanced shorten /product/, /product-category/ and /product-tag/ URLs, the old URLs are redirected, and a product or term whose slug is already used by a page or post keeps its original URL instead of taking one that is in use.
– Added : Nexter SEO : the Rank Math and AIOSEO import previews now list the source plugin's 404 log as “will be skipped” instead of dropping it with no notice.
– Added : Nexter SEO : an Advanced setting to strip the /category/ base from category URLs (e.g. /category/news/ → /news/).
– Added : Nexter SEO : an admin notice offering one-click migration when Yoast, Rank Math, SureRank or All in One SEO is detected active alongside Nexter SEO.
– Added : Nexter SEO : Import from Yoast SEO, Rank Math, SureRank and All in One SEO — a new “Migrate From Other SEO Plugins” tab detects your existing SEO data, previews exactly what would change, then imports it in resumable batches. Anything you already set in Nexter SEO is kept rather than replaced, and the other plugin's own data is never deleted.
– Added : Nexter SEO : Per-page schema type is now carried across during the import, and redirects keep their matching mode including regex.
– Added : Nexter SEO : Redirections now support a Regex match type, with $1 backreferences in the destination.
– Compatibility : Nexter SEO : All in One SEO (Lite and Pro) import reads its own database tables, respects per-post “use default” robots and Twitter-mirrors-Facebook settings, and brings across Pro term SEO and redirects — case- and slash-insensitive ones keep matching the same way.
– Compatibility : Nexter SEO : Rank Math PRO — when a post carries several schemas the one marked primary is imported, and schema templates, Local SEO locations and redirect categories are listed in the preview rather than silently dropped.
– Compatibility : Nexter SEO : SureRank Business redirects are now imported, with “Contains” and “Ends With” rules kept matching exactly as they do in SureRank.
– Improved : SMTP Email : the “SMTP Password” field now shows a tooltip explaining that, for providers like Brevo, SendGrid and Mailgun, this value is an API key rather than an account password.
– Improved : Nexter SEO : the migration preview now warns before you start if the redirects being imported contain a loop, and tells you how many are over the redirect-rule limit. The preview works this out by running the same import in a no-write mode, so it and the import can never disagree.
– Improved : Nexter SEO : importing categories and tags from Yoast is dramatically faster on large sites, and no longer slows down the further it gets. Picking the next batch used to check every term one at a time, and then still had to read back every term already imported, so a big catalogue crawled towards the end. Each batch now asks only about the terms it is about to take.
– Improved : Nexter SEO : the migration preview now names each setting in plain language instead of showing the raw database key, with the key kept underneath for developers.
– Improved : Nexter SEO : the migration preview now recommends a backup and states plainly that the import writes to your database and cannot be undone from that screen.
– Improved : Nexter SEO : the migration preview now warns about every value it would leave alone, not just titles and descriptions. Canonical URLs, social fields, schema type and your robots settings are all counted, with robots listed separately so a page you deliberately kept out of search is easy to spot.
– Improved : Nexter SEO : the migration preview now tells you when the other plugin has per-author SEO settings, which Nexter has no field for and does not import. Previously those were lost with nothing said.
– Improved : Nexter SEO : the migration preview now says when settings will be flattened rather than changing them silently — the per-post-type and per-taxonomy templates that become one site-wide pair, the per-language settings on a Polylang or WPML site, and Yoast's Organization name and logo.
– Improved : Nexter SEO : the “already running” message now says how long the lock has left and points to Reset markers, instead of only suggesting a page reload.
– Improved : Nexter SEO : each llms.txt number setting now explains what it does, including a warning on Freshness Window that any value above 0 leaves older content out.
– Improved : Nexter SEO : The import shows the current step, retries a batch that hits a temporary error, lists anything that did not finish, and checks the imported values afterwards.
– Improved : Nexter SEO : Importing another plugin's per-type noindex choices adds to the ones you already set instead of replacing them, and the preview shows the combined result.
– Improved : Translations : the translation template now points at the real source files instead of the compiled bundles, so translators can see where each string actually lives and the file no longer changes on every build.
– Fixed : SMTP Email : Custom SMTP no longer forces the From address to the SMTP username on providers like Brevo, SendGrid and Mailgun, where the username is an API-key-style value rather than a sendable address. The configured “From Email” is now used as long as it is set; the username is only used as the From address for Yandex, which requires the match, or as a last-resort fallback when no From Email was configured.
– Fixed : Nexter SEO : social cards on category and tag pages now use the archive title and description templates, the same ones the page's own title uses. They were using the post templates, so the card and the page disagreed on any site that had customised the two differently.
– Fixed : Nexter SEO : an “@” followed by a word is no longer deleted from titles and descriptions. Any @word was being treated as a template variable and then removed, so “Follow @posimyth for updates” rendered as “Follow for updates” and email addresses lost their domain. Only real variable names are expanded now, and never inside an email address.
– Fixed : Code Snippets : a snippet created or updated through the AI assistant can no longer be saved to a placement that never runs. A placement name the runtime did not recognise was stored as given, so the snippet saved cleanly and then did nothing; unrecognised names now fall back to the same default the dashboard uses, and spelling variants like “front_end” or “site-header” are understood.
– Fixed : dismissing an admin notice with the “x” now sticks. Four notices — the Nexter SEO suggestion, “Nexter Blocks installed”, and both Image Optimization notices — wrote their security token into the page in a way browsers read incorrectly, so the dismissal was rejected and the notice returned on every single admin page load.
– Fixed : Nexter SEO : a SureRank site that never changed its author or date archive setting no longer has those archives switched back on by the import. SureRank ships them off and Nexter ships them on, and only an explicitly saved value was being read.
– Fixed : Nexter SEO : importing from All in One SEO no longer redirects author or date archives away when they were only meant to be hidden from search engines. “Show in search results: off” now becomes a noindex, as it does in AIOSEO.
– Fixed : Nexter SEO : the Yoast import now reads social profiles from where Yoast has stored them since version 20, instead of only the older per-network fields. Profiles added recently were being dropped and ones removed years ago brought back.
– Fixed : Nexter SEO : the Yoast import now brings across the home page's social card. The title, description and image were read from the place Yoast kept them before version 14, so on any current Yoast site the home page card came over empty.
– Fixed : Nexter SEO : the imported Organization name and logo now land on a site that has no Organization schema row. The import wrote into an existing row only, so on those sites it quietly did nothing even though the preview said the identity would be brought across. The row is now created from the shipped default when there isn't one, and a name or logo you had already typed is still never replaced.
– Fixed : translators’ notes now reach the translation files correctly. Some notes sat too far from the text they described and were dropped during extraction, and a few phrases used in more than one place carried conflicting notes, so only one of them survived. Affected the theme builder display conditions, the SMTP PHP version notice, Image Optimization messages, the SEO schema fields and the template importer's invalid post type error.
– Fixed : Nexter SEO : the Pro white label now applies to the migration screen as well. Every message on it — the preview notes, the progress counts and the check afterwards — said “Nexter SEO” no matter what you had rebranded the plugin to, while the rest of the SEO screens used your own name.
– Fixed : Nexter SEO : the migration preview now tells you when a Yoast or Rank Math site has its own title and description templates for other post types and taxonomies. Nexter keeps one pair for posts and one for archives, so those templates are not brought across — the preview names each affected type instead of leaving you to discover it. All in One SEO already listed this.
– Fixed : Nexter SEO : a Yoast redirect whose response code Nexter cannot serve is now skipped and listed in the preview, instead of being quietly turned into a 301.
– Fixed : Regenerate Thumbnails : regeneration no longer stops with a fatal error. It called WordPress's metadata filter with one argument missing, which crashed any correctly written plugin listening on it — including Nexter's own SVG Upload — and took the whole batch down with it, for JPEG, PNG and WebP alike.
– Fixed : Image Optimization : thumbnails no longer 404 or show blank in the Media Library when an image's full size was optimised but its thumbnails were not. Each size is now resolved on its own: the optimised copy when there is one, otherwise the normal WordPress thumbnail. Image URLs that another plugin or a CDN has already changed are left alone.
– Fixed : Nexter SEO : “Reset markers” now also removes the values the import itself wrote, so re-running an import picks up anything that changed in the other plugin. Values you set yourself are kept. Previously the reset cleared only the markers, and the re-run found Nexter's fields already filled and changed nothing.
– Fixed : Nexter SEO : an import that is cut short no longer treats its own half-written values as yours when it resumes. It now records what it wrote, so it corrects its own work and still never overwrites a value you set.
– Fixed : Nexter SEO : two imports of the same source can no longer start at once and import the same batch twice. The lock now uses a database-level guarantee instead of one that could be defeated by a stale cache, which was most likely on sites with a persistent object cache.
– Fixed : Nexter SEO : the migration preview no longer shows a server error page when one row in the other plugin's data cannot be read. It now explains what happened and lets you continue, the same way the import itself already did.
– Fixed : Nexter SEO : starting an import on a site with no data from the chosen plugin now reports that clearly, instead of reporting a finished import that did nothing.
– Fixed : Nexter SEO : imported Regex redirects now match. A pattern anchored at the start, such as ^old-path/(.*)$, never matched the incoming request, so every one of them silently fell through to a 404.
– Fixed : Nexter SEO : redirects now work on a subdirectory Multisite subsite. The subsite's own path segment was part of every request, which no imported rule accounted for.
– Fixed : Nexter SEO : importing redirects now respects the 2,000-rule limit and reports how many rules were left out, instead of writing an unbounded list that the front end then walks on every request. The imported rules are also checked for redirect loops.
– Fixed : Security : Nexter SEO : data read from another SEO plugin's own database tables and options can no longer create PHP objects while it is being imported.
– Fixed : Nexter SEO : schema values in Hindi, Japanese, Arabic and other non-Latin scripts are now stored as readable text instead of escaped codes, so a site migration's search-replace and database searches find them.
– Fixed : activating any plugin through an older WP-CLI (before 2.12) no longer aborts the command while Nexter Extension is active. The plugin did activate, but the script stopped with a fatal type error and anything queued after it never ran.
– Fixed : Nexter SEO : the SureRank import now reads SureRank's grouped settings, so page title, meta description, canonical URL, the Facebook and X fields and the schema type all come across. Previously only the robots flags did.
– Fixed : Nexter SEO : text holding a literal percent sign, such as “Save 50%-70% today”, is no longer partly deleted when it is imported from Rank Math or SureRank.
– Fixed : Nexter SEO : canonical URLs and social image URLs with percent-encoded characters, such as /caf%C3%A9/, are now imported exactly as they are instead of being corrupted.
– Fixed : Nexter SEO : Rank Math sites that kept author or date archives switched on no longer lose them to the import. Rank Math stores “enabled” as the word “off”, which was being read as “disabled”.
– Fixed : Nexter SEO : a Rank Math date-archive noindex is now imported only when Rank Math was actually applying it, instead of every time its prefilled default was present.
– Fixed : Nexter SEO : Nexter now steps aside when SureRank is also active, so a page no longer renders two canonical tags and two conflicting og:title values.
– Fixed : Nexter SEO : the Yoast import reads the Pinterest verification code from the option Yoast actually stores it in, so the Pinterest domain claim survives the migration.
– Fixed : Nexter SEO : the Yoast import no longer counts a noindexed category or tag twice in its “fields written” total.
– Fixed : Nexter SEO : the post-import check now reports a failure when it could not read anything, covers categories and tags as well as posts, includes the robots settings, and compares the imported values rather than only checking that something is there.
– Fixed : Nexter SEO : the llms.txt Freshness Window now keeps content that was recently updated, not only recently published, so evergreen pages and maintained posts are no longer dropped from the file.
– Fixed : Nexter SEO : the “Settings that change” import preview no longer overflows the page when an “After import” value is a long JSON blob; it is now truncated with an ellipsis and the full value on hover, same as long text values.
– Fixed : Nexter SEO : title, description, canonical URL and social text copied in from Yoast, Rank Math, AIOSEO and SureRank are now sanitized at write time instead of relying only on output-side escaping.
– Fixed : Nexter SEO : No Index / No Follow / No Archive and “Exclude from Sitemap” now save for post types like Complianz's that aren't marked “public” but still have live front-end URLs.
– Fixed : Nexter SEO : the post editor's Social tab now previews the featured image when no image override is set, instead of always previewing the default social image.
– Fixed : Nexter SEO : removed the Advanced “Noindex Attachments” toggle, which never actually noindexed anything. Attachment pages are now noindexed by default through Robots Instructions, the setting that does work — turn it back on there if you'd rather have them indexed.
– Fixed : Nexter SEO : Rank Math redirects that match part of a URL now keep matching after import, and a Regex redirect no longer loses backslashes such as \d.
– Fixed : Security : Updated the bundled Guzzle (7.15.5), PSR-7 (2.13.1) and svg-sanitize (0.22.0) libraries to versions without known advisories, including CVE-2026-69246 and CVE-2025-55166.
– Fixed : Replace URL : a search and replace on a table whose primary key spans more than one column could overwrite rows that did not match the search at all. Each row is now updated by its full primary key, so only the row the change was found in is touched.
– Fixed : Replace URL : a blank or non-numeric “Limit” value no longer leaves the search and replace running until the request times out, and rows are now read in a fixed order so a large table cannot have some of its rows skipped.
– Fixed : Translations : the SEO import progress messages and the thumbnail regeneration counters now carry translator notes explaining what each number refers to, so a translated copy cannot describe the wrong thing.
– Fixed : Blocks : the Free / Freemium / Pro badge on the Blocks screen now translates. It was built from a value read at runtime, which the translation system cannot collect, so the badge stayed in English in every language.
– Fixed : Nexter SEO : a plugin you have already imported from is no longer a dead end on the migration screen. It said everything had been imported and greyed the button out, while the only control that clears the markers sat on the screen you reach after running an import — so there was no way to run it again, which is what people hit after deleting and reinstalling. Each already-imported source now offers “Import it again” on the spot.
– Fixed : Nexter SEO : deleting the plugin now also clears the migration's run state and any leftover import lock, so a reinstall does not begin with a stale lock or a half-finished run on record. Imported values and settings are left untouched.

V4.7.9

07 September 2026
– Improvement : Nexter SEO : The image ALT warning now names every image it flagged, including slider and images that carry no plain src attribute.
– Fixed : Code Snippets : snippets added through the AI assistant now run. They were saved with a placement name the runtime did not recognise, so PHP, CSS, JavaScript and HTML snippets were all stored correctly but never executed.
– Fixed : Code Snippets : a PHP snippet created by the AI assistant now runs everywhere by default, the same as one added from the dashboard.
– Fixed : SEO : the SEO screens are now fully translated. Roughly half their strings sit in separate bundle files that WordPress was never told to load a translation file for, so those stayed English in every language.
– Fixed : Theme Builder : blocks and panels that use WordPress’s built-in code editor now load on Theme Builder screens. The builder was unregistering WordPress’s CodeMirror handle, which silently dropped every script that depended on it.
– Fixed : Image Optimization : single and bulk optimisation no longer fail with a server error on large media libraries. Each image converted its original and every thumbnail size in one request; that work is now split into …