Tornevall Networks DNSBL Implementation

Changelog

3.1.3

• Tested with WP7.

3.1.2

• Fixed the public removal-form Turnstile lifecycle so the widget waits for Cloudflare’s API before rendering, keeps the returned widget id, and uses that widget id for reset/response handling.
• Fixed stale or empty Turnstile response handling by clearing tokens on expiration, timeout or error and recovering the current widget response before submit when the hidden token field is empty.
• Released the Tools-backed site identity metadata and bumped the plugin release metadata to 3.1.2.

3.1.1

• Added an explicit admin checkbox for Turnstile on the public delisting/removal page.
• The public delist flow no longer inherits Turnstile automatically just because comment or registration Turnstile is configured.
• Site owners can now disable only the removal-page challenge when Cloudflare Turnstile has temporary problems, while keeping comment and registration protection enabled.

3.1.0

• Added the plugin-side DNSBL write integration (add, delete, update, bulk) around one visible Write token field, bulk queueing, and optional dry-run acknowledgement through the Tools DNSBL endpoints.
• Added the shortcode-based removal form ([dnsbl_removal_form]) with AJAX backend proxy support, built-in main removal-page templating, and live delisting-page permission gating.
• Added the Tools-backed checker/removal follow-up via POST /api/dnsbl/check-ip, together with the checker-style public delist flow and dashboard/settings warnings when live delete / delist access is still missing.
• Added advanced optional CIDR removal flow for permitted tokens, including safe /24../32 validation, plugin-local scan progress, a visible hit list of listed addresses, listed-hit-only delete targeting, sequential per-IP delete requests, and Cloudflare Turnstile verification for live removal-form submissions.
• The plugin UI now uses one visible DNSBL / Tools API token field, and the Check token permissions tool now always asks Tools for a live answer and reports effective DNSBL access more clearly.
• Preferred resolver hosts now cover all four canonical DNSBL/FraudBL zones, and migrations merge any missing defaults into existing installs without removing custom hosts.
• Shortcode/custom removal pages now expose only the operations allowed by the current token, while the plugin-managed main removal page stays delete-focused.
• Token status panels, delisting-page controls, and checker submits now better reflect real delete capability, including explicit IP reposting when the checker has locked the field before submit.
• Checker follow-up failures now report clearer backend/API errors for remote 419 cases, and write/check diagnostics now distinguish true invalid DNSBL tokens from wrong-token-type or inactive admin-key cases.
• Checker-mode Turnstile stays hidden during pre-check/background steps, is enforced on actual write submissions, the Delist button now carries the in-flight submit state itself, and checker/delist requests now also show a dedicated busy spinner row.
• CIDR scanning now stays inside WordPress in small local batches so the resolver side is not flooded, while the final delete still goes through the DNSBL write endpoint after the block scan has found at least one listed address and only for the IPs the local scan actually marked as listed, one IP at a time.
• If the user clicks Check if listed while a valid CIDR is still entered in the first checker IP field, the plugin now opens Advanced automatically, moves the CIDR there, and keeps that Advanced CIDR value as the authoritative range for the later scan/delete flow instead of requiring a separate single-IP anchor.
• The admin UI now also shows a dismissible reminder that links directly to the WordPress.org review form for quick feedback.