PerfLocale

location ~* /wp-content/uploads/perflocale/exports/ { deny all; return 404; }

@perflocale_exports path /wp-content/uploads/perflocale/exports/*
respond @perflocale_exports 404

Changelog

1.0.4

Adds translation for the site title and tagline, synced patterns and block-theme navigation menus, and a PHP API for translating from your own code. Fixes a case where a translated site title could overwrite the original, a multisite call returning the wrong blog’s name, and scheduled rendering windows resolving the wrong language. Full detail at https://perflocale.com/changelog/

Site title and tagline. Both are now translatable, and appear on the Strings screen as “Site Title” and “Tagline” rather than as raw option names. Nothing to switch on and no scan to run – they are registered when the plugin is activated or updated. Your stored title is never modified: the translation is served on the front end only, and a write-side guard refuses any attempt to save a translated value back over the original.

Synced patterns and block-theme menus. A synced pattern is stored once and referenced by every page that uses it, so translating the page could never reach its text. Enable “Patterns” under Advanced content types at Settings > Translation and each pattern becomes translatable, including patterns nested inside a Group. Block-theme navigation menus work the same way: link addresses were already translated, and enabling “Navigation Menus” translates the visible labels too. If a translation is missing or still a draft the original renders – WordPress renders nothing at all for a reference it will not accept, and a blank space is worse than untranslated text.

A translated site title could overwrite the original. WordPress sanitises an option value before the filter that guards the write, so a title containing an apostrophe or ampersand arrived in a different form than the one the guard compared against – “Alex’s Bakery” as “Alex's Bakery” – and the guard let the round trip through. The comparison now happens at WordPress’s own sanitisation boundary.

The site-title strings were not registered when updating from wp-admin. The class was only loaded on front-end requests, so an operator whose first request after updating was a wp-admin page – the normal case – never got the strings registered at all, on that request or any later one. It now loads in every context.

Multisite: another blog’s name. On a translated request, get_site() and get_blog_details() could return the calling blog’s title for a different blog. The site-details filter now checks which blog it was handed.

Imposed rendering windows. Order emails and other internal rendering windows impose a language for part of a request. String translations, the site title and the helper’s own accessors kept answering with the language the request arrived in, so an email could carry the wrong site title and a right-to-left order could render left-to-right. All of them now follow the imposed language.

Also fixed. Deleting a string through the plugin’s own delete path left its translation links behind. A site installed below a directory named test, build or dist was skipped entirely by the string scanner, which reported nothing found – exclusions are now measured from the directory being scanned. Exchange-rate sync errors are recorded once per condition instead of on every scheduled run. An open Export/Import panel on the Strings screen no longer sits behind the navigation tabs.

For developers. perflocale()->with_language( $lang, $callback ) runs a callback with another language imposed and restores it afterwards, even if the callback throws – the general primitive for rendering part of a request in another language. perflocale()->translate( $text, $lang, $args ) translates one registered string without touching request state. perflocale_t() takes an optional third $language argument. New filters: perflocale/settings/non_public_post_types and perflocale/strings/context_label.

Translation of block template and template part content (full site editing) is not included in this release.

1.0.3

Fixes WooCommerce order emails going out in the wrong language, percent signs deleted from translated titles, exports publishing unreadable bytes, Site Health checks that never reached the dashboard, and the admin on phones and tablets. Full detail at https://perflocale.com/changelog/

WooCommerce order emails. Four faults. WordPress declines to switch language – recording nothing – when the target has no language pack or is already active; PerfLocale restored anyway, leaving the request in a language nobody chose. The restore also ran when the body finished, before WooCommerce builds the headers, attachments and plain-text half, so those came out wrong. The three notifications that go to the SHOP – new order, cancelled, failed – were rendered in the customer’s language; they now follow the shop language. Renaming a language now also moves the order’s language tag in the table High Performance Order Storage keeps it in.

Percent signs are no longer deleted from translated titles. WordPress’s plain-text sanitiser strips every %XX sequence – right for a URL, wrong for a title: “100%25 off” was stored as “100 off”. It applied wherever a translated title or excerpt was written: XLIFF import, the translation editor, machine translation and the TranslatePress migration, and it also stripped every HTML tag from imported excerpts.

Exports refuse to publish unreadable bytes. The JSON encoder replaced any byte it could not read as UTF-8 with a question mark – the worst option in a backup, because the damaged file encodes cleanly, passes every check and replaces the previous good one. It now stops and leaves the existing file alone. PO exports additionally report which strings will not survive a round trip.

Site Health checks never reached the dashboard. All 25 were registered for admin screens only, so WordPress’s weekly site-health run – which happens on cron, where no admin screen exists – never saw one, and it overwrote the counts a manual visit had left. A site with missing tables, no default language, or exports readable over the web showed an issue count of zero. They now run in that pass; the three making a network request opt out, and none runs on the front end.

Several also reported the wrong thing. The export-exposure check filed “could not be checked” as a passed test, worst on the hosts where exposure is most likely. The tables check looked at one table of nine, so a partial restore still read “healthy”. Machine translation with no API key produced three green cards while every translation failed. The cron check called the recommended production setup a critical failure.

Webhooks. A delivery whose host could not be resolved was dropped with no retry and no trace; it is now retried like a failed request. The failure log had never been read by anything in the plugin – a new Site Health card reports deliveries abandoned in the last 24 hours. Registration now refuses URLs WordPress itself refuses at send time, and names the actual reason. On multisite, registering a webhook now requires network-administrator permissions, because a site administrator has manage_options without being able to install plugins. Listing and deleting are unchanged. If your network delegates registration to site administrators this is a breaking change; the perflocale/webhooks/register_capability filter restores the old rule.

Domain matching and number formatting. A Host header cased differently from the stored domain fell through to the default language, and a domain with non-ASCII characters never matched at all; both are now canonicalised using the encoder WordPress itself ships rather than an optional PHP extension. Separately, two languages the plugin ships are not recognised by the number formatter PHP 8.4 uses and the error was not caught – it now falls back, and the fallback stopped discarding decimals.

An empty switcher no longer draws an empty box. With “hide current language” on and untranslated languages hidden, an untranslated page has nothing to show – but the floating switcher still drew a blank panel over the page corner. Present since 1.0.0.

The admin was not usable on a touchscreen. Languages could only be reordered by drag-and-drop, which does not exist on touch; below 782px each row now has up and down buttons. The Translations list broke into unlabelled fragments on a phone; rows are rows again, with the checkbox and title pinned while the language columns scroll.

An integration could silently stop loading. PerfLocale remembered which integrations to load for twelve hours at a time. If that list was built while one of the plugins it integrates with had not finished loading, that integration stayed off until the note expired – and the Addons screen still called it active, because it only checks whether the other plugin is installed. The list is now worked out fresh each time.

Also: creating a language now validates its slug, as editing did.

1.0.2

Fixes translated content served in the wrong language on sites whose slugs are not Latin script, permanently corrupted slugs for long non-Latin names, fatal errors on servers built without an optional PHP extension, a PO import that could delete a language’s translations, and a group of settings that could not be reached or were silently cleared. Full detail at https://perflocale.com/changelog/

Non-Latin slugs. WordPress stores a slug percent-encoded for every non-Latin script, and PerfLocale compared its lookups against that stored form. Two request shapes deliver the slug decoded and matched nothing: a query-string request such as ?category_name=ニュース, which is what a plain-permalink site issues for every archive and page, and a URL carrying raw UTF-8 in the path. On those the visitor got the source language. Japanese, Chinese, Korean, Arabic, Hebrew, Russian, Greek, Thai and Hindi were affected, and so was any accented Latin slug such as the German “Über uns”. Pretty-permalink sites were unaffected on the normal path. A pure-ASCII slug is returned unchanged, so nothing about an English or French site changes. Present since 1.0.0.

Corrupted slugs for long non-Latin names. Shortening a translated term slug cut by byte position and landed inside a percent-escape, so the slug became different characters rather than fewer, permanently. Japanese, Chinese and Korean names from about 24 characters, and Arabic, Hebrew and Russian from about 45, were affected every time, and the damaged slug is what hreflang, the sitemap and the switcher emitted.

Fatal errors on servers missing an optional PHP extension. Building the language tag for the Content-Language header and the hreflang tags called a function WordPress ships no replacement for, on every request, so a server compiled without the ctype extension returned a fatal error instead of a page. XLIFF export and import reached for the XML extensions without checking. All now work without those extensions, or stop with a message naming the package to install. Site Health previously reported a critical failure for extensions nothing needed; it now lists only extensions that gate a real feature.

Machine Translation could not be switched on. Its settings tab was listed only once the feature was already enabled, and the checkbox that enables it lives inside that tab. On a default install there was no route to turn it on. Present since 1.0.0.

Three settings were silently cleared by unrelated saves. A tab only submits the controls it draws, but every key was read whether drawn or not, so a hidden control read as one the operator had unticked.

A PO import could delete a language’s translations and put nothing back. Gettext parsing drops entries it cannot decode without raising an error, so a file saved as ISO-8859-1 read as valid but empty; in Replace mode that deleted everything and imported nothing. Non-UTF-8 files are now refused before anything is deleted. Exports were affected too: a carriage return made the whole file unparseable.

Excluded paths never matched a non-Latin path, and the two places that checked them disagreed, so an excluded /api also excluded /apifoo in one of them.

A refused settings save reported success. The database declines a value it cannot store rather than shortening it, so nothing changed and the screen still said it saved.

Language prefixes outside plain ASCII could not be read back. A locale such as sr_RS@latin, or one written in Cyrillic, was written into the URL correctly and then stripped by the reader.

WPForms confirmation messages are now translated, and XLIFF imports write once per post instead of once per field — an import of 40 posts went from 120 post writes to 40, byte-for-byte identical.

Behaviour changes worth knowing. An XLIFF import now creates one revision per post rather than one per field, and the save hooks fire once per post. If a plugin vetoes the write for a post, none of that post’s fields are stored. libretranslate.com no longer skips the outbound-URL safety check. Machine-translation length caps now count characters rather than bytes, so the real limit matches the stated one for CJK, Arabic, Hebrew and Russian.

1.0.1

Security and reliability release. Updating is recommended for every site, and required for any site that uses the Translator role or Contact Form 7.

Security. A user holding the Translator role could publish, privatise or trash any post or page they were able to edit. Translation status changes were gated only on the edit capability, so the publish and delete capabilities that role deliberately withholds were bypassed. Status changes are now mapped to the target post type’s own capabilities, exactly as WordPress core does. Drafting is unchanged.

Security. Translated Contact Form 7 forms rendered the form’s stored configuration into the public page — recipient addresses, mail templates and headers included — because Contact Form 7 keeps a flattened copy of every property in the post content. Translated forms now read Contact Form 7’s own form property instead. Note that a machine-translated form reverts to the source form markup until it is re-saved in Contact Form 7’s editor.

Security. A new Site Health check reports whether your server actually protects the export directory. The plugin writes a Deny from all .htaccess beside every export, but nginx and Caddy ignore .htaccess entirely, and PHP cannot tell which server it is behind. Rather than assume, PerfLocale now places a temporary random file there, requests it over HTTP, and raises a critical result — with the exact nginx and Caddy snippet — if the file comes back. See the installation notes.

Security. Data exports are no longer guessable by URL: filenames now carry 32 characters of entropy instead of six. Exports are also published atomically, so a partially written file can never be served, and an export’s filesystem path is hidden from REST callers who lack the import/export capability. Nested credentials and URL user-info are now stripped recursively from exports rather than only at the top level.

Security. The same translation endpoint also accepted WordPress’s internal post statuses. Setting a translation — or, for the site’s default language, a source post — to auto-draft handed it to the WordPress routine that permanently deletes abandoned drafts, so a role deliberately denied the delete capability could still have content destroyed. Internal statuses are now refused. Draft, pending and workflow statuses added by other plugins are unaffected, and custom post types are judged by their own capabilities rather than by the built-in post ones.

Security. Machine translation requested through the plugin’s Abilities integration bypassed the hourly per-user and site-wide translation limits, and the contention guard, that the REST endpoints enforce. On a site with Abilities enabled this meant a single account could spend translation credit without limit. All three entry points now share one admission check.

Security. The WordPress AI Client provider called the SDK’s generateText() directly. WordPress applies wp_supports_ai() and the site-wide wp_ai_client_prevent_prompt policy filter only to the snake_case form, so a site that had globally blocked AI prompts was still being prompted by this plugin. The call now goes through the policy layer.

Security. Machine-translation rate limiting now validates the shape of its stored counter rather than only its presence. A corrupted counter — from an object-cache collision or another plugin writing the same key — could previously slip past the hourly cap entirely, or turn a translation request into a fatal error.

Reliability. When the scheduler refuses a webhook retry, that refusal is now recorded as a delivery failure instead of being discarded. Previously the retry vanished with no second attempt and no entry in the failure log. Failure-log lock contention is also reported rather than silently skipped.

Reliability. A post list containing an entry that is not a post object — WordPress can hand one to its the_posts filters when a post is permanently deleted during a page load — caused a fatal error in the front-end translated-slug preload and in the translations column of the admin post list. Both now skip such entries and behave exactly as before for every real post.

Performance. Saving a post no longer rewrites its translations when nothing that is actually synced has changed. Every save used to issue one full update per translation regardless, which bumped each translation’s modified date, fired the save hooks other plugins listen to, and cost a full set of database writes per translation. Translations are now written only when a synced field really differs. Nothing about what gets synced has changed.

WooCommerce. Block Cart and Block Checkout work again on subdirectory multisite children. A shopper browsing in a non-default language made every Store API request return a 404 there, which broke the cart. Store API messages on those sites now come back in the site’s default language; single sites, subdomain networks and per-domain networks are unaffected.

Background jobs. Deleting a job created before 1.0.1 no longer removes whatever file happens to sit at that job’s old export path. Those records predate the file-identity check, so they can no longer prove they own the file; the artifact is left to the age sweep instead. The failure log also no longer records the export path, filename or download token — only the job ID and a short hash.

REST API. A status that WordPress refuses for a post type now returns 400 translation_status_rejected instead of 500. Nothing is written either way; the previous response told clients the server had broken when the request was at fault.

Caching. New perflocale/cache/purge_urls action fires when a post’s public visibility changes, carrying every affected front-end URL including each translation’s. A translated page is a separate URL that a full-page cache usually does not know about, so one that had been public could stay readable in the cache after being made private. PerfLocale now names the URLs; wiring them to your cache is a three-line filter. See the hooks reference.

Security. Draft, pending, private and trashed translations no longer leak through Yoast breadcrumb structured data or the WooCommerce cart. Custom machine-translation endpoints are checked against IPv6 addresses as well as IPv4, and translation responses are size-capped. Credential masking in provider errors no longer depends on the credential containing a digit.

WooCommerce. Simultaneous purchases across language versions of the same product no longer lose a stock decrement. Each sale is now applied to the sibling languages as a relative change that the database performs atomically, so three shoppers buying three language versions of a stock-10 product at the same instant leave every version at 7. Previously two of those three sales could be lost, and the loss grew with the number of simultaneous orders. Stock status and the product lookup table WooCommerce uses for shop queries are now derived in the same operation that reads the quantity, so a translated product can no longer display a figure that a concurrent sale has already superseded. Exchange-rate syncing now merges the provider’s response instead of replacing the whole stored set, so a partial response no longer wipes the currencies it omitted, and a response that fails validation now counts as a failure for the circuit breaker rather than resetting it. Bulgaria’s suggested currency is now EUR.

Content. Protected nested blocks keep their inner blocks. XLIFF export no longer strips emoji, rare CJK and other supplementary-plane characters. A failed table read during export now fails loudly instead of producing a valid-looking, silently incomplete backup.

Reliability. A failed string-translation move no longer deletes the source rows. A transient database error while building the link map is no longer cached as an authoritative empty result. Job locks can no longer be released or garbage-collected by a previous owner. Data import no longer flushes the entire object cache every 500 rows, which on sites with Redis or Memcached evicted every other plugin’s cached data. The Action Scheduler integration — including the bridge that marks a job failed when its worker is killed — now actually registers; it previously never did.

Background jobs. Deleting a job now also removes the export file it produced, instead of leaving it in the uploads folder with no record identifying it. That cleanup no longer follows a symbolic link, so it cannot remove a file belonging to a different job, and it now verifies that the file at the recorded location is still the one the job created. If the file cannot be removed, the job is still deleted and the leftover is logged rather than disappearing silently.

Background jobs. The “is this event already scheduled?” check was a no-op under Action Scheduler, because an async action has no next-run timestamp for it to find — so scheduling guards that relied on it could queue duplicate work. It now asks Action Scheduler directly. Recurring maintenance events now report whether the scheduler actually accepted them, and a refusal is logged with its reason instead of being indistinguishable from success. Site Health also now lists the machine-translation usage cleanup among the recurring events it checks, so all four are covered. A long-running command or worker no longer reuses a stale answer about whether one of the plugin’s jobs is in flight; on multisite that stale answer could come from a different site and delay Action Scheduler’s recovery of other plugins’ stuck tasks. An export whose post-write hook throws is no longer orphaned: the export succeeded, so the job keeps its result and reports the hook failure separately. When a scheduler refuses an event — a filter veto, a duplicate, or a queue error — that refusal is now reported and logged rather than silently producing no work. On multisite, a job lookup can no longer return another site’s job when one process handles more than one site.

Routing. Query-parameter URL mode now honours the URL Prefix Format setting: a site set to locale form serves ?lang=en-us rather than ?lang=en, everywhere the plugin writes a URL — including the search form’s hidden field and the WooCommerce AJAX endpoint. Requests using the other form are permanently redirected to the canonical one, so a language keeps exactly one indexable URL instead of two that both answer 200.

Routing. A language could be made unreachable by its own slug. Language locales are also matched in their URL form, and a single-pass lookup let a later language’s locale form overwrite an earlier language’s real slug — give one language the slug de-de and another the locale de_DE, and /de-de/ served the second one. Real slugs now always win, whatever order the languages were created in.

REST API. Creating a language with a slug or locale that already exists returned HTTP 500 with a raw database error. It now returns 409 with slug_exists or locale_exists, so a client can tell “already there” from “something broke”.

New filter. perflocale/url/query_var renames the query variable used by query-parameter URL mode, for sites where another plugin already owns lang. Register it from an mu-plugin and flush permalinks afterwards. See the hooks reference for details.

New filters. perflocale/jobs/deduplicate_admission controls whether an identical in-flight job blocks a new dispatch (default on). perflocale/breaker/probe_lease_seconds sets how long a single circuit-breaker probe holds its turn before another request may try. See the hooks reference for both.

Backup and restore. A replace-mode import is now all-or-nothing. If the database refuses even one row, the whole import rolls back and your existing data is left exactly as it was; previously the import deleted the old rows, committed everything that did land, and reported success with the failure listed among the notices. The same is true of a PO import run with replace: a refused translation now rolls the language back instead of leaving it part-replaced with an entry marked translated but empty. Settings, add-on settings, the disabled-add-on list and role grants carried in an import bundle are also undone when the tables roll back — they used to stay applied over data that had reverted.

Backup and restore. Every write to an export file is now checked. A disk that fills up, a quota that runs out, or a network share that drops a write partway through no longer produces a file that ends correctly and is corrupt in the middle — the export is abandoned and your previous backup is left in place. A row that cannot be encoded also aborts the export instead of being written as nothing.

Background jobs. A worker that cannot record itself as running no longer runs the job anyway. Previously a failed status write left the job listed as queued while its work went ahead — translations created, provider credit spent, the completion hook fired — and the queued row stayed eligible to be picked up and run a second time. A job cancelled at the moment its worker starts is now caught too.

Background jobs. Dispatching the same job twice — a double-clicked button, a retried request, the same --async command run again — now returns the job already in flight instead of queueing a second one. Only an identical operation is folded in: different arguments, a different job type and the chunked site-translation chain all keep running in parallel as before.

Machine translation. The circuit breaker now counts a provider that answers with something unreadable. A proxy or captive portal returning HTTP 200 with an error page used to clear the failure count on every call, so the breaker could never trip no matter how long the outage lasted. When the breaker does open and its cooldown expires, exactly one request is now let through to test the provider rather than every request that arrives at once. A late failure can no longer republish a stale “closed” state over a breaker that just tripped, and corrupted breaker state cached by another plugin no longer causes a fatal error. The DeepL and Google providers also refuse a batch reply that does not have one translation per text sent, which otherwise shifted every later translation onto the wrong source string.

Privacy. Error text from the HTTP layer is now credential-masked before it is stored or shown, in both the provider error path and the webhook failure log. Only a site-local HTTP filter, custom transport or proxy could put a secret there, but the code no longer assumes none does.

WP-CLI. wp perflocale import, po-import and network-import now exit non-zero when the import reports errors. A malformed file previously printed a warning and then Success: with exit code 0, so a restore script could record a restore that never happened. wp perflocale translate no longer prints ten “invalid synopsis part” warnings on every successful run.

REST API. Malformed XLIFF — an empty body, XML that does not parse, a document declaring entities, or a target language the site does not have — now returns 400 invalid_xliff instead of 500. Genuine server faults still return 500. An XLIFF file that repeats the same unit identifier is also applied once instead of once per repeat; the result is identical and the import is far quicker.

Routing. Translated permalinks on non-Latin sites could be generated broken. WordPress percent-encodes non-ASCII slugs, so one Japanese character costs nine slug characters and an ordinary 26-character title becomes a 198-character slug. When two such slugs collided, PerfLocale trimmed one to make room for a -2 suffix and the cut landed in the middle of a percent-escape — leaving a slug ending in something like %e3%81%8. Apache and nginx both reject a malformed escape in a URL path with a 400 error before WordPress runs, so that translation’s permalink, and its entry in the language switcher, hreflang tags and sitemap, could not be opened at all. The trim is now character-aware, exactly as WordPress does it for post slugs. Existing slugs are untouched; re-save the affected translation to regenerate one.

Multisite. The notice explaining that PerfLocale cannot run alongside WPML, Polylang or TranslatePress now also appears in Network Admin. When the other plugin was network-activated, the person who activated it worked in Network Admin — where WordPress does not fire the hook the notice used — so they saw nothing at all, and the wp perflocale migrate command does not exist in that state either. The notice also now says that their existing translations stay in the database and can be imported after deactivating.

Add-ons. A failed add-on boot no longer leaves a permanent warning. WordPress replaces plugin files in place during an update, so a page request landing mid-write can see a half-written file and report a parse error — a problem that fixes itself on the very next request. PerfLocale recorded that permanently and showed it to every administrator until someone ran a WP-CLI command. The record is now retired as soon as the add-on boots successfully, and clearing an add-on’s quarantine from the Add-ons screen clears its boot errors too. A failed migration or uninstall is still kept, because a successful boot says nothing about those. The recorded message also no longer contains the server’s absolute file paths.

Behaviour changes worth knowing. On a site using query-parameter URLs with locale-form prefixes, the query value changes on upgrade and the old form now issues a permanent redirect — expect search engines and browsers to cache that redirect. If two of your languages collide on a slug-versus-locale form, the URL that was serving the wrong language starts serving the right one. Exports now fail rather than silently omit a table that cannot be read. Per-status translation counts may read higher on sites whose stored status had drifted. The perflocale/mt/pre_translate and perflocale/machine_translation/after hooks now carry the source object’s own language rather than the site default. A save that changes none of the synced fields no longer writes to the translations, so save_post, post_updated and transition_post_status no longer fire for them on …