Improvements to hosting badge and My Sites icon detection.

• Hosting badge: validates its source and re-checks itself over time, so a wrong or missing badge corrects itself. (#115, #122, thanks @wprashed)
• My Sites: falls back to a site's favicon when no Site Icon is set. (#116, thanks @wprashed and @i-am-chitti)
• Dependency updates. (#119, #120)

Downloads

• Chrome zip: load unpacked.
• Safari zip: ad-hoc signed app; expect a Gatekeeper warning on first launch.

Full changelog: v1.0.4...v1.0.5

Security

Fixes a cross-origin disclosure of the WordPress REST nonce in the popup, and a related same-tab navigation race. A malicious page could otherwise cause the extension to read and leak a logged-in administrator's REST nonce from another WordPress site.

Advisory: GHSA-8h3m-hf57-9rj4. Affected: 0.8.0 through 1.0.3; patched in 1.0.4. Reported responsibly through HackerOne by Muhamad Arga Reksapati (nobcoder).

Detection and reliability

• Broader WordPress detection across more site configurations, including front-controller REST roots and additional detection signals.
• More reliable logged-in detection on cached sites, redirect-target validation on fresh detection, and detection performance improvements.

Install

• Chrome Web Store: https://chromewebstore.google.com/detail/wordpress-browser-extensi/apaakgfongbkeecchhhjocpgjchbdenl
• Mac App Store: https://apps.apple.com/app/id6794460913

Both stores auto-update. The attached zip is for manual (unpacked) installation.

Full changelog: v1.0.3...v1.0.4

Bug fixes

• My Sites now records sites managed entirely through wp-admin. In 1.0.2, a site at the domain root only appeared after visiting one of its front-end pages while logged in (#103)
• Trust hardening around how a site's install location is confirmed, including REST API discovery links written without a trailing slash or with percent-encoded paths (#104)

Thanks to @eliquame for the report and @itzmekhokan for the diagnosis and the fix.

First maintenance release since launch.

Fixed

• Visit Site and admin links now work properly on subdirectory installs like example.com/blog (#88)
• The Safari popup follows macOS dark mode (#86)
• My Sites keeps a separate entry for each install when several share one domain (#94)

Changed

• Removing a site from My Sites is now permanent. A Restore option is planned.
• Popup polish: cleaner corners, panels scroll into view when opened near the bottom, smoother toggles, and other minor layout refinements.

Added

• Bulgarian and Japanese translations (#89, #91)

Internal

• Dependencies refreshed to React 19 and current WordPress packages (#90, #92)

Thanks to @SirJadeja for the exceptional #94 report, @stein2nd for the dependency refresh and the Japanese translation, and @georgi-vdimitrov for the Bulgarian translation.

The WordPress Browser Extension is now officially available in the stores, published by the WordPress Foundation:

• Chrome Web Store (Chrome and Chromium browsers): https://chromewebstore.google.com/detail/wordpress-browser-extensi/apaakgfongbkeecchhhjocpgjchbdenl
• Mac App Store (Safari on macOS): https://apps.apple.com/app/id6794460913

The stores are now the recommended install path: one click, automatic updates, and store-verified builds.

About the version number

v1.0.1 is the coordinated launch version everywhere. Its content is v1.0.0-rc2 plus a hardening fix (#81) for a Chrome 151 popup sizing regression that could balloon the popup to double width, along with a slimmer floating scrollbar in long popup views. A v1.0.0 build predating the final release-candidate fixes was approved and quietly released on the Mac App Store as a launch safeguard; v1.0.0 has no GitHub release.

Changes since v0.11.2

• Mobile Preview keeps one window per site, reused and navigated on repeat clicks (#66, #67, #69 — shipped in the release candidates).
• Safari bundle identifiers moved to org.wordpress.browserextension under the WordPress Foundation Apple Developer account (#72). Previous Safari installs appear as a separate leftover extension; see SAFARI.md.
• Community QA pass over the release candidate (#76, thanks to Khokan Sardar): full-width empty states in dark mode, consistent preference defaults for the block inspector, macOS-native shortcut glyphs on Safari, dead CSS removal.
• Popup hardening against Chrome's popup re-measure, with a slim overlay scrollbar (#81).
• App Store submission metadata in the Safari app (#74, #75) and build number bump (#80). Development dependency updates (#64, #68, #71).

Manual installs

The attached zips remain available for development and testing:

• Chrome / Chromium: unzip wordpress-browser-extension-1.0.1-chrome.zip and load it unpacked at chrome://extensions.
• Safari (macOS): unzip wordpress-browser-extension-1.0.1-safari.zip and move the app to Applications. It is ad-hoc signed, so Gatekeeper shows a warning on first launch; the Mac App Store build carries full signing.

1.0 has shipped: v1.0.1 is the final release, available on the Chrome Web Store and Mac App Store.

Second release candidate for 1.0, superseding v1.0.0-rc1. This is the candidate 1.0.0 final ships from, barring further findings.

Changes since rc1, most from a community QA pass over the first candidate (#76, thanks to Khokan Sardar):

• Empty-state popup views span the full popup width; previously a background band showed at the edges in dark mode.
• The block inspector honours an options-level default the same way the admin bar does, keeping the popup toggle and the page in agreement (with regression coverage added in #78).
• The Edit shortcut hint renders in macOS glyph notation on Safari instead of Windows-style Alt+Shift+E.
• Unused CSS removed; README and ROADMAP status copy brought up to the release-candidate state (#76, #78).
• App Store submission metadata in the Safari app's Info.plist: export compliance declaration (#74) and LSApplicationCategoryType (#75). No runtime effect.
• Development dependency update: axios 1.18.1 (#71). No shipped-code impact.

Install

• Chrome / Chromium: unzip wordpress-browser-extension-1.0.0-rc2-chrome.zip and load it unpacked at chrome://extensions.
• Safari (macOS): unzip wordpress-browser-extension-1.0.0-rc2-safari.zip and move the app to Applications. It is ad-hoc signed, so Gatekeeper shows a warning on first launch. See SAFARI.md.

Both packages report version 1.0.0; the release-candidate status lives in this tag.

1.0 has shipped: v1.0.1 is the final release.

A newer release candidate is available: v1.0.0-rc2. It folds in the QA-pass fixes from #76; test that build instead.

Release candidate for 1.0. Functionally identical to v0.11.2: the only change is internal preparation for Apple App Store distribution — the Safari app and extension bundle identifiers moved from the original developer's namespace to org.wordpress.browserextension, under the WordPress Foundation Apple Developer account (#72). No behavior, permission, or Chrome-side changes.

Anyone who installed a previous Safari build will see the old extension listed alongside the new one, since macOS treats the new identifier as a new extension. Deleting the previously built app removes the leftover; see SAFARI.md.

Barring further issues found in this candidate, 1.0.0 final ships from this build plus one addition found while preparing the App Store submission: an export compliance declaration in the Safari app's Info.plist (#74). That key is submission metadata for App Store Connect and has no runtime effect, so the builds below remain accurate for testing.

Install

• Chrome / Chromium: unzip wordpress-browser-extension-1.0.0-chrome.zip and load it unpacked at chrome://extensions.
• Safari (macOS): unzip wordpress-browser-extension-1.0.0-safari.zip and move the app to Applications. It is ad-hoc signed, so Gatekeeper shows a warning on first launch. See SAFARI.md.

1.0 has shipped: v1.0.1 is the latest release, available on the Chrome Web Store and Mac App Store.

Mobile Preview now keeps one preview window per site. Clicking the action again for any page on that site reuses the window already open, pointing it at the requested page and bringing it to front, instead of stacking a duplicate on every click (#66, #67, #69). Distinct sites still open distinct windows, so two sites can be compared side by side in mobile size.

Also includes development dependency security updates (ws 7.5.11, websocket-driver 0.7.5) with no impact on shipped code.

Install

• Chrome / Chromium: unzip wordpress-browser-extension-0.11.2-chrome.zip and load it unpacked at chrome://extensions.
• Safari (macOS): unzip wordpress-browser-extension-0.11.2-safari.zip and move the app to Applications. It is ad-hoc signed, so Gatekeeper shows a warning on first launch. See SAFARI.md.

A one-string follow-up to v0.11.0, with no code changes. The Chrome Web Store reads the listing summary from the package manifest, so the summary written for the store listing now ships in the extension's description: "Quick access to your WordPress sites, content editing, and developer tools. Tuck away the admin bar." This build replaces v0.11.0 as the Chrome Web Store submission package.

Install

• Chrome / Chromium: unzip wordpress-browser-extension-0.11.1-chrome.zip and load it unpacked at chrome://extensions.
• Safari (macOS): unzip wordpress-browser-extension-0.11.1-safari.zip and move the app to Applications. It is ad-hoc signed, so Gatekeeper shows a warning on first launch. See SAFARI.md.

The Chrome store-readiness release ahead of 1.0. No new features. This build is the basis of the extension's first Chrome Web Store submission; the store listing starts unlisted during the release-candidate phase. Safari store-readiness work (App Store publisher account, bundle identifier rename) follows in a future release; the Safari build continues to ship here in the meantime.

Store readiness

• The packaged Chrome build now ships with the narrowest permission set: the redundant activeTab permission is removed at packaging time (#61). The repository manifest and the Safari build keep it for now, pending the Safari store-readiness pass.
• SECURITY.md documents the full rationale for every permission the extension requests.
• A privacy policy is published at https://wordpress.github.io/browser-extension/privacy-policy/
• The roadmap now tracks Chrome and Safari store readiness as separate phases so neither gates the other.

Fixes

• The keyboard shortcut hint in the popup now shows the actual current binding, with correct Mac glyphs (the previous hint hardcoded "Alt" on Mac, where the key is Option, and ignored rebinds).

Under the hood

• Linting added to the toolchain and CI (correctness rules; the first pass removed dead code in the REST helpers).

Install

• Chrome / Chromium: unzip wordpress-browser-extension-0.11.0-chrome.zip and load it unpacked at chrome://extensions.
• Safari (macOS): unzip wordpress-browser-extension-0.11.0-safari.zip and move the app to Applications. It is ad-hoc signed, so Gatekeeper shows a warning on first launch. See SAFARI.md.