ROBOTSTXT Software

Secret

Share sensitive text via self-destructing, end-to-end encrypted one-time links. Zero-knowledge: the server never sees the decryption key.

Information

Author:

ROBOTSTXT

Download

Price:

€0.00
Log in to download

A free ROBOTSTXT account is required. Log in, then install the Manager (by ROBOTSTXT) plugin on your site and connect it with your API key to install this plugin and receive updates — at no cost.

Requirements

Version:

1.0.1

WordPress:

4.9.6

–

7.1

PHP >=

8.0

Changelog

1.0.1

Release date: 2026-08-24

Highlights

  • Manager (by ROBOTSTXT) detection via the ecosystem presence constant, translation template refreshed.

Changed

  • Manager (by ROBOTSTXT) detection now checks the ecosystem presence constant (ROBOTSTXT_MANAGER_NOTICED, Manager 1.6.2+) and falls back to a plugin-list scan for older Manager versions; differently named main files inside the robotstxt-manager folder are detected too.
  • Translation template languages/robotstxt-secret.pot regenerated with WP-CLI, now covering all shipped strings (27 strings added in the 0.4.x series were missing).
  • bin/preflight.sh PHPCompatibility range now matches the declared minimum PHP (8.0-8.5).

Compatibility

  • WordPress: 4.9.6 – 7.1
  • PHP: 8.0 – 8.5

Tests

  • PHP Coding Standards: 3.13.6
  • WordPress Coding Standards: 3.4.1
  • Plugin Check (PCP): pending

1.0.0

Release date: 2026-08-20

Highlights

  • First stable release.

Security

  • Creator IP hashes are now keyed with the site salt (hash_hmac), so an isolated database dump cannot reveal the original addresses.

Compatibility

  • WordPress: 4.9.6 – 7.1
  • PHP: 8.0 – 8.5

Tests

  • PHP Coding Standards: 3.13.6
  • WordPress Coding Standards: 3.4.1
  • Plugin Check (PCP): pending

0.4.2

Release date: 2026-08-20

Highlights

  • Manager (by ROBOTSTXT) integration and verified compatibility floors.

Added

  • Manager (by ROBOTSTXT) integration for automatic updates: when the manager plugin is not active, a dismissible notice appears on the plugins list and a permanent panel appears on the settings page, both linking to the manager plugin page.
  • Storage statistics (active and awaiting-cleanup counts) now also appear at the top of the settings page, next to the dashboard widget and WP-CLI.
  • Appearance setting “Horizontal separator”: optionally draw a horizontal bar before or after the reveal block, to separate it from the creation form when both shortcodes share a page. The bar renders inside the reveal container, so it only appears when a reveal is actually taking place.

Changed

  • Plugin identity: Plugin URI and Update URI now point to https://www.robotstxt.software/plugins/robotstxt-secret/ and the author URL to https://www.robotstxt.software/.
  • Declared compatibility floors now reflect the real lowest versions established by scan: WordPress 4.9.6 (wp-compat static verification) and PHP 8.0 (language features: mixed and union types).

Fixed

  • Frontend configuration now travels as a data-config JSON attribute on each shortcode’s root element instead of a wp_localize_script global. On some setups the localized data never reached the page, making the create button POST to undefinedsecrets. The new mechanism is bound to the markup itself and immune to script-loader timing.
  • The reveal container no longer shows the “incomplete link” warning on plain page visits: it stays completely hidden unless the URL carries a token. The warning now appears only when a token exists but its key fragment was stripped.
  • Frontend buttons use the WordPress block styles (wp-block-button / wp-block-button__link) and form fields use theme-adaptive styling, so the forms blend with the active theme.

Security

  • Zero-knowledge storage model: the server stores only ciphertext and IV; the decryption key never reaches the server in any form. Revealed secrets are rendered via textContent, never parsed as HTML.

Compatibility

  • WordPress: 4.9.6 – 7.1
  • PHP: 8.0 – 8.5

Tests

  • PHP Coding Standards: 3.13.6
  • WordPress Coding Standards: 3.4.1
  • Plugin Check (PCP): pending

0.4.0

Release date: 2026-08-20

Highlights

  • Release hardening: translation template, API documentation, compatibility scan.

Added

  • Usage documentation panel below the settings form: shortcode instructions (including reveal_url), share link anatomy and the anti-shortening warning, WP-CLI commands, REST endpoint list, and privacy notes.
  • Appearance setting “Horizontal separator”: optionally draw a horizontal bar before or after the reveal block, to separate it from the creation form when both shortcodes share a page.

Fixed

  • Frontend configuration now travels as a data-config JSON attribute on each shortcode’s root element instead of a wp_localize_script global. On some setups the localized data never reached the page, making the create button POST to undefinedsecrets. The new mechanism is bound to the markup itself and immune to script-loader timing.
  • The reveal container no longer shows the “incomplete link” warning on plain page visits: it stays completely hidden unless the URL carries a token. The warning now appears only when a token exists but its key fragment was stripped.
  • Frontend buttons use the WordPress block styles: the plugin CSS now depends on the core wp-block-library styles and the button markup follows the standard wp-block-button / wp-block-button__link classes, so themes style them natively.
  • Translation template languages/robotstxt-secret.pot covering all translatable strings, including translators comments for placeholder strings.
  • Internal REST API documentation (docs/rest-api.md): request/response contracts, error codes, rate limits, and security notes.
  • Full-range PHPCompatibility scan (5.6-8.5) documented; the declared minimum stays PHP 8.2 (the tested floor), see CLAUDE.md for the false-negative note.

Compatibility

  • WordPress: 6.9 – 7.1
  • PHP: 8.2 – 8.5

Tests

  • PHP Coding Standards: 3.13.6
  • WordPress Coding Standards: 3.4.1
  • Plugin Check (PCP): pending

0.3.0

Release date: 2026-08-20

Highlights

  • Admin and abuse protection layer: settings, rate limiting, WP-CLI.

Added

  • Settings page (Settings > Secret (by ROBOTSTXT)) via the Settings API: maximum and default lifetime, maximum and default views, creation access control (anyone, logged-in users, administrators), per-hour rate limits for creation and reveals, and a delete-data-on-uninstall switch (data is preserved by default).
  • Rate limiting on the creation and reveal REST endpoints, counted per hashed IP and hour via the Transients API (object-cache aware). Defaults: 10 creations and 30 reveals per hour.
  • Creation access control: when a capability is configured, the create endpoint enforces it with current_user_can().
  • Dashboard widget with active and awaiting-cleanup counters.
  • Privacy policy suggestion via wp_add_privacy_policy_content() disclosing the ciphertext-only storage, the token’s presence in access logs, and the hashed IP retention while rate limiting is enabled.
  • HTTPS requirement notice in the admin when the site is not served over SSL.
  • WP-CLI commands: wp secret-share purge and wp secret-share stats.
  • The daily purge now reports the number of removed rows.

Compatibility

  • WordPress: 6.9 – 7.1
  • PHP: 8.2 – 8.5

Tests

  • PHP Coding Standards: 3.13.6
  • WordPress Coding Standards: 3.4.1
  • Plugin Check (PCP): pending

0.2.0

Release date: 2026-08-20

Highlights

  • Encrypted frontend: share secrets end to end without the server ever seeing the key.

Added

  • [secret_share] shortcode: creation form with secret text, optional passphrase, expiration and view limits bounded by the admin settings, one-click link copy with an anti-shortening warning.
  • [secret_reveal] shortcode: two-step reveal flow — metadata-only check on load (scanners cannot burn the secret), explicit trusted click required to consume it, output rendered via textContent.
  • Client-side encryption: AES-256-GCM via the Web Crypto API, key generated in-browser and delivered only through the link’s URL fragment; optional passphrase combined via PBKDF2 (250,000 iterations, SHA-256).
  • REST API namespace robotstxt-secret/v1: POST /secrets (create), GET /secrets/{token}/meta (metadata), GET /secrets/{token} (consume). All endpoints require the REST nonce and are served Cache-Control: no-store.
  • Shortcode pages define DONOTCACHEPAGE so page caches skip them.

Security

  • REST nonce verification on every endpoint blocks cross-origin token probing and CSRF-style forced consumption.
  • Payload validation: ciphertext and IV are validated as size-limited base64 blobs before storage; garbage input never reaches the database.

Compatibility

  • WordPress: 6.9 – 7.1
  • PHP: 8.2 – 8.5

Tests

  • PHP Coding Standards: 3.13.6
  • WordPress Coding Standards: 3.4.1
  • Plugin Check (PCP): pending

0.1.0

Release date: 2026-08-20

Highlights

  • Initial development release (Phase 0: foundation).

Added

  • Plugin scaffolding: main plugin file robotstxt-secret.php, matching the plugin directory name, with full plugin headers.
  • Custom database table {prefix}robotstxt_secret_share created on activation via dbDelta(), with schema versioning through the robotstxt_secret_db_version option.
  • Core engine: secret creation with server-side clamping of expiration and view limits against admin-configured maximums, CSPRNG tokens (random_bytes(32)), metadata lookups without consumption, and atomic view consumption with self-destruction on exhaustion.
  • Query-level expiry and view enforcement: expired or exhausted secrets are never served, even before the daily cron purge runs.
  • Daily cron purge of expired and exhausted secrets, scheduled on activation and cleared on deactivation.
  • Uninstall routine that preserves plugin data by default and only removes it when the site owner explicitly opts in.
  • Development tooling: PHPCS (WordPress-Core, WordPress-Docs, WordPress-Extra), PHPStan level 9, PHPCompatibility, PHPUnit with plugin header tests, bin/preflight.sh, bin/deploy.sh.

Security

  • Zero-knowledge storage model: the server stores only ciphertext and IV; the decryption key never reaches the server in any form.

Compatibility

  • WordPress: 6.9 – 7.1
  • PHP: 8.2 – 8.5

Tests

  • PHP Coding Standards: 3.13.6
  • WordPress Coding Standards: 3.4.1
  • Plugin Check (PCP): pending