Dragon Auto Alt

You can now remove a saved API key, and with Overwrite Existing off, alt text you type is no longer overwritten by a generation that was already running.

What's new in 1.0.16

• New: empty the API key field and save to remove that provider's saved key. The masked key still means "keep it".
• Fixed: alt text you type while an image is being described is kept when Overwrite Existing is off.
• Fixed: alt text "0" counts as alt text everywhere, so it is no longer replaced or offered a Generate button.
• Fixed: an image that already has alt text is reported as kept, not generated, in the bulk log.
• Fixed: with auto-generate on, images uploaded in the block editor on WordPress 7.1 wait until their sizes are ready, so the large size is sent rather than the full original.
• Privacy: requests to your AI provider no longer carry your site address in the User-Agent header.
• Hardening: images that are not on this server are downloaded only from public addresses, and only up to the provider's size limit.
• Hardening: admin requests read each field through a WordPress sanitizer, and API keys are checked exactly as typed.

Uninstalling now deletes your data only when the delete-on-uninstall opt-in is clearly switched on.

What's new in 1.0.15

• Fixed: uninstall deletes data only when the opt-in is clearly on (1, true, yes or on). A value set by hand to "false", "no" or "off" used to count as a yes and now keeps your data.

Bulk runs keep their place when paused and never send an image twice.

What's new in 1.0.14

• Pause keeps the queue, Start carries on, and a run paused on its last batch finishes.
• An image is never sent to the provider twice at once.
• Starting from a Media Library selection processes only the selected images.
• The bulk action is offered to administrators only, and Load More no longer skips images.
• Uninstall runs per site on multisite.

Updated AI models, and bulk runs now process every image.

What's new in 1.0.13

• Updated to current models from OpenAI, Anthropic and Google. If your saved model has been retired, it moves to the current default and you'll see a one-time notice.
• API keys are checked against the provider's model list, stored per provider and encrypted once.
• Fixed: bulk runs page through the whole library, and a Media Library selection processes every selected image.
• Images are sent at the right proportions from your server, and cut-off answers from a provider are reported instead of saved.
• Auto-generate on upload waits until WordPress has made the image sizes.
• A bulk run with no images shows a notice.

Alt text is now written in your site's language.

What's new in 1.0.12

• The default prompt asks the AI provider to write alt text in your site's language. A prompt you have customised is sent exactly as you saved it.
• Every screen, email and alert is now translatable, and translations bundled in the plugin's languages folder now load. Counts use proper plural forms, and numbers and dates follow your site's language.
• Starting a bulk run with no images to process now shows a notice.

Quieter debug logs: scheduled tasks now wait until WordPress has finished loading.

• Fixed: when one of Dragon Auto Alt's scheduled tasks needed re-creating, it was scheduled before WordPress had finished loading. WordPress then logged "translation loading was triggered too early" notices that named other plugins, which could send you looking in the wrong place. Scheduling now waits until WordPress is ready.

The notices only appeared with debug logging switched on. Nothing else changes: no settings, no stored data, nothing to do after updating.

Generation and manual edits now report a failure when the alt text is not actually saved, and an empty AI reply is no longer counted as a success.

What's fixed in 1.0.10

• A failed save is reported as a failure. If WordPress refuses to write the alt text (a meta-caching or access-control plugin, or a database error), single and bulk generation no longer show "updated" for an image that still has no alt text. The bulk counter records it as failed, and the image keeps its place in the "without alt text" list.
• Empty AI replies are errors, not results. When a provider returns a 200 response with no description (a refusal, a safety block or an unexpected response shape), the image is reported as failed instead of being saved with empty alt text and counted as done. This applies to OpenAI, Anthropic Claude and Google Gemini.
• Manual updates report save failures. The plugin's manual alt-text update endpoint now returns an error when the save does not go through, instead of "Alt text updated!".
• Backslashes survive the save. Alt text containing a backslash (a file path, say) is now stored exactly as generated or typed. Previously the backslash was stripped on the way into the database.
• Non-JSON provider responses are handled. A 200 response whose body is not JSON (an HTML page from a proxy or gateway, or an empty body) now reports a clear error for that image instead of stopping generation with a fatal error.
• No fatal error on an unrecognised provider setting. Generation now returns a clear error if the configured provider is not one of the supported three.
• Alt text is confirmed in the media library before it counts as saved. A plugin or filter can intercept the save and report success without storing anything, so a run could report images updated while the alt text fields stayed empty (with the AI tokens already spent). The stored value is now read back and compared every time, for both bulk generation and editing a single image.

No settings, data or behaviour changes otherwise.

Housekeeping release: the readme changelog now covers 1.0.8. No functional change.

= 1.0.9 =

• Readme: changelog now covers 1.0.8, which shipped without an entry. No functional change.

Security & reliability: fixes a bulk-screen script-injection risk, tightens who can edit alt text, and makes generation work on staging/localhost.

= 1.0.8 =

• Security: AI responses and titles are now escaped in the bulk processor UI (prevents script injection); generating/editing alt text now requires edit rights on that specific image.
• Reliability: auto-generation on upload no longer blocks the upload and now runs in the background correctly; OpenAI images are sent inline so generation works on localhost, staging and password-protected sites.
• Hardening: the Google API key is sent as a header (not in the URL); API keys use authenticated encryption at rest.

Tested and verified on WordPress 7.1.

• Compatibility: tested up to WordPress 7.1.
• Fix: the first-run guidance panel now shows its intended styling.

Adds a full disclosure of what is sent to your chosen AI provider and when, a Delete-data-on-uninstall setting, and a server-side cap on bulk scan size.

Data safety: uninstalling the plugin now keeps your settings (including your API key) and generation history unless you explicitly opt in to deletion first — a reinstall picks up exactly where you left off. Your images' generated alt text is site content and is never removed either way. Opt in with wp option update dragonautoalt_delete_data_on_uninstall 1 before deleting if you want everything removed.

A guided first run, plus safer uninstall.

A new get-started panel walks the first-time setup end to end. Uninstalling also no longer deletes your settings unless you explicitly opt in.

The Auto Alt screens are back, wearing the new Dragon design system.

This release fixes a bug where the settings and bulk pages under Media could be unreachable ("Sorry, you are not allowed to access this page") because the menu registered too late. It also brings Dragon Core's design system: a consistent header, cleaner tables, and unified status colours.