WP Debug Toolkit’s version 1.1.0 Beta 1 is our biggest update yet, bringing a full Query Logger, a new email notification system, and a major round of security hardening for the standalone viewer.

Highlights

• Query Logger (real-time monitoring) – Log database queries with slow query detection, performance metrics, and component attribution.
• Query Statistics Dashboard – Visual breakdowns of query performance, including N+1 detection and aggregate reporting.
• Export + smarter filtering – Export queries to CSV/JSON/TSV and see statistics recalculate dynamically as you filter.
• Email Notifications (fail-safe) – MU-plugin based alerts designed to still send during fatal crashes, with rate limiting to prevent inbox floods.
• Out-of-Memory protection – Reserves emergency memory so “Allowed memory size exhausted” crashes can still trigger an email notification.
• Enhanced WP Recovery – Improves WordPress Recovery Mode emails to help you regain access after a crash.
• Maintenance controls – Automatic log cleanup with delete/archive/truncate modes, plus PHP memory limit management and upload limit controls.
• Viewer reliability – New permissions health check + repair in Site Health, improved crash recovery UX, and better installs on “WP in a subfolder” setups.
• Security upgrades – Mandatory viewer password (min 8 chars), SQLite-backed progressive rate limiting, tighter sessions, stronger path validation, and more.

What’s New

Query Viewer: logging, dashboards, and N+1 detection

• Query Logger for real-time database query monitoring, including slow query detection and performance metrics
• Database query error logging with detailed error messages and filtering
• N+1 Query Detection that highlights repeated queries and aggregates the results
• Query export to CSV, JSON, and TSV formats with accurate component attribution
• Dynamic query statistics that recalculate based on active filters

Email alerts + licensing updates

• Email notification system for error alerts with customizable templates
• MU-plugin architecture for early loading + better reliability during crash scenarios
• Reserved emergency memory for out-of-memory fatal errors
• Enhanced WordPress Recovery Mode emails to help regain access after a crash
• Modular licensing system with grandfathered benefits for early adopters

Viewer + site stability improvements

• Viewer permissions health check with repair button in Site Health
• Directory permission fixes on restrictive servers (umask handling)
• Redesigned crash recovery with cleaner UI and granular plugin/theme controls
• Viewer installer wizard improvements and better installs when WordPress lives in subfolders

Security hardening (viewer)

• Password protection is now mandatory for the viewer
• SQLite-based rate limiting with progressive lockouts (5s > 30s > 5min > 30min > 1hr > 24hr)
• Enhanced session security (30-minute timeout + IP binding)
• Strengthened path traversal prevention with an expanded blocklist
• Replaced exec() with token_get_all() for PHP syntax validation
• Fixed a wp-config.php case-sensitivity bypass vulnerability
• Added protection for secure-debug.php (GridPane compatibility)
• Scoped CORS headers to plugin endpoints only

Full Changelog (1.1.0-beta-1)

• New: Viewer permissions health check with repair button in Site Health
• Fix: Directory permission issues on restrictive servers (umask handling)
• New: Query Logger – Real-time database query monitoring with slow query detection and performance metrics
• New: Database query error logging with detailed error messages and filtering
• New: N+1 Query Detection – Automatically identifies and highlights repeated queries with aggregate statistics
• New: Query export to CSV, JSON, and TSV formats with accurate component attribution
• New: Dynamic query statistics that recalculate based on active filters
• New: PHP memory limit management (writes to wp-config.php)
• New: Upload limit controls via WordPress filters
• New: Automatic log cleanup with delete/archive/truncate methods, size limits, and age-based rotation
• New: Settings UI redesign
• Security: Password protection now mandatory for viewer
• Security: SQLite-based rate limiting with progressive brute-force protection (5s > 30s > 5min > 30min > 1hr > 24hr lockout)
• Security: Enhanced session security with 30-minute timeout and IP binding
• Security: Strengthened path traversal prevention with expanded blocklist
• Security: Replaced exec() command with token_get_all() for PHP syntax validation
• Security: Fixed wp-config.php case-sensitivity bypass vulnerability in viewer
• Security: Added protection for secure-debug.php (GridPane compatibility)
• Improved: Redesigned crash recovery system with cleaner UI and granular plugin/theme controls
• Improved: License management moved to Settings page
• Improved: Enhanced output buffer management
• Added: Custom file paths configuration
• Added: Error level selection in Settings
• Added: Cache busting mechanisms in Admin and Viewer App
• Added: WordPress internationalization (wp-i18n) support
• Added: Partner discounts page
• Added: Psalm static analysis with type hints throughout the codebase
• Improved: Better type safety and code quality across PHP and React code
• Fixed: Viewer installation on hosts where WordPress files are in subfolders
• Fixed: Path validation now supports relative paths securely
• Fixed: Health check now properly loads WordPress admin functions
• Fixed: Admin CSS isolation prevents conflicts with other plugins
• Fixed: Compatibility with UiPress Lite and WP Dark Mode
• New: Email notification system for error alerts with customizable templates
• New: Modular licensing system with grandfathered benefits for early adopters
• Improved: Viewer installer wizard with step-by-step guidance
• Improved: Targeted cache clearing (only clears plugin-specific transients instead of full cache flush)
• Security: Scoped CORS headers to plugin endpoints only
• Fixed: wp-config.php duplicate constants when reinstalling viewer

Upgrade Notes

• Viewer password required: You’ll be prompted to set/update the viewer password after upgrading.
• Permissions issues: If the viewer can’t write where it needs to, use the new Site Health > Viewer Permissions repair button.
• Redeploy the viewer app to update it