Every TTSWP release with what changed, improved, and fixed.
IMPROVED
Security: The shortcode audio generator now requires an editor account. It was reachable by logged-out visitors, who could have generated audio from any text on the site's credits.
Security (PRO): Generate on click and Generate on first visit now reserve each post's estimated cost against the daily credit cap when the job is queued, and the worker checks the cap again before generating. Each visitor is also limited to ten triggered generations per hour. Previously a burst of requests could queue far more than the cap allowed.
Security: Password-protected posts are no longer offered to visitors for generation, and their player, audio URL and structured data stay hidden until the password is entered.
Security: Debug logging for a directly connected ElevenLabs key no longer writes the key itself. Credential values are masked in every log line.
Performance: Frontend pages load all plugin settings in one query instead of one query per setting. On sites without an object cache this removes about 36 database queries per page view.
Performance: Player statistics no longer run a cache-clearing query on the options table for every tracked event, and the 30-second playback progress events, which were never used in reports, are no longer sent.
Performance: The plugin no longer tells WP Rocket to leave jQuery undeferred on every page of the site. Our own scripts wait for jQuery when a cache plugin delays it.
Performance: The Overview page reuses the account data it already has instead of making two live requests to the TTSWP service on every view. Add ?refresh=1 to the URL to force a fresh fetch.
Performance: Publishing from the classic editor now hands audio generation to the background queue, the same way the block editor already did, instead of holding the publish request until the audio is finished.