Dragon Redirect Manager

Security fix: every rule the Quick Page/Post Redirect importer creates now comes in disabled, for you to review before it redirects anyone.

What changed in 1.0.22

• Quick Page/Post Redirect Plugin matched addresses in ways that exact rules cannot copy faithfully. It tried several spellings of each request, let quick redirects win over per-post ones, ignored letter case by default and added the visitor's query string. Reviews of 1.0.19 to 1.0.21 found stored data, including data its own forms saved, that the importer turned into a live redirect to somewhere the old plugin did not send visitors, sometimes another site.
• Now no imported rule is active. Search the Redirects list for "Quick Page/Post Redirect" to find them. Each note says where the rule came from, whether it was switched off in the old plugin, and anything else to check. Enable the ones you want.
• Two old entries for the same address are no longer both imported. Old addresses holding spaces, markup or a "#" fragment are skipped. The old plugin's "all redirects off" switch, override URL and "active" values are read exactly as it read them. The result also says that it added the visitor's query string to quick redirect targets.

If you imported with 1.0.19, 1.0.20 or 1.0.21: search Redirects for "Quick Page/Post Redirect" and review every rule found, especially any whose target is another site. Disable or delete any you do not recognise. Rules you already imported are not changed by this update.

Dragon Redirect Manager 1.0.21 is prepared for WordPress.org and drops the pointer to the Pro add-on, which is no longer sold.

• Readme and code tidied to WordPress.org's plugin guidelines ahead of a directory listing.
• The "Upgrade to Pro" link on the Plugins screen, the footer line on the plugin's screens and the one-time note are gone.
• Redirects, the 404 Monitor, imports, exports, typo correction and WP-CLI work exactly as before. Your rules, 404 log and settings are unchanged.

Security fix for the Quick Page/Post Redirect importer added in 1.0.19: a redirect the old plugin kept on your site can no longer be imported as a redirect to another site.

What's fixed in 1.0.20

• Values the old plugin's own forms never saved (markup, control characters, surrounding spaces) are now skipped with a reason instead of being cleaned and reinterpreted. Cleaning such a value could turn a destination on your site into one on another site.
• Per-post targets are read exactly as the old plugin read them. A target written as "HTTP://..." or with a leading space went to a path on your site there, and now does here too.
• A final check skips any imported redirect that the old plugin kept on your site but that would, as stored, send visitors to another site. The preview and the result say how many.
• If the old plugin sent every redirect to one override URL, the imported rules come in disabled, since their own targets were never live. Check each one before you enable it.
• The "meta refresh after N seconds" note can now be translated.

If you imported with 1.0.19: open Redirects and review any rule whose note starts with "Quick Page/Post Redirect" and whose target is another site. Rules you already imported are not changed by this update.

Import from the closed Quick Page/Post Redirect Plugin, and preview any import before it writes a rule.

What's new in 1.0.19

• Import from Quick Page/Post Redirect Plugin. That plugin was closed on WordPress.org on 14 April 2026 and its redirects stay in your database after it is deleted. Choose it under Import and both kinds come across: the quick redirects list (as 301 rules) and the per-post redirects set on edit screens (with each post's own code, or the global override if one was set). Redirects that were not active, or that were all switched off by the global switch, come in disabled rather than lost. A source on another site, one that only matched with a query string, or a redirect on an unpublished post is skipped, and the result says why. The old plugin's own data is never changed.
• Settings that have no equal here are kept in plain sight. New window, no follow and rewrite links changed how links were rendered, not where visitors went, and a meta refresh waited and showed a message. Each is written into the rule's note and listed in the preview; a meta refresh becomes a 302.
• Preview first, for every import format. The box is ticked by default: the import runs without writing anything and shows each row with what would happen and why it would be skipped (no target, a condition this plugin cannot apply, a duplicate, a loop with an existing rule). One click then imports the rows marked "Will be created".
• Safe to run twice. A row whose source already has a rule is left unchanged, and the result now says how many rows were duplicates or were refused as loops with existing rules.

Regex redirects with a captured group right after the target host can no longer send visitors to a site of their choosing, and the Redirection importer now reads real Redirection export files.

What's new in 1.0.18

• Security: a regex redirect whose target puts a captured group straight after the host (for example https://shop.example.com$1) only ever sends visitors to the host the rule names. If a request would turn it into another host, the visitor stays on your site.
• Changing a post's slug to a path that already has your own redirect, or an imported one, no longer switches that redirect off. Only redirects created by slug tracking itself (note "auto: slug change") are switched off when a post moves back to an earlier address, and that now also works after several renames (a, then b, then c, then back to a), which used to loop.
• A regex target with a captured group inside the host name (for example https://$1.example.com/) no longer redirects off site; such requests stay on your site. The FAQ explains how to write a rule that redirects into another site.
• The Redirection importer reads the JSON file from Redirection's Import/Export screen. Redirect and 410 rules are imported; pass-through and random rules are skipped and counted, and a file with no redirects gets a clear error instead of "0 imported".
• Regex sources keep named groups and lookbehinds such as (?<slug>...) and (?<!draft-). They used to be cut off and refused as invalid.
• A redirect whose target differs from its source only by a query string (/shop to /shop?orderby=date) is refused as a loop instead of looping for visitors.
• Toggling a redirect that someone else has deleted, or ignoring a 404 that is already ignored, now tells you so.
• A target with a nested query value such as ?filter[cat][]=3 saves without a PHP warning.
• The Source field and the FAQ explain what a regex is matched against: the path without its trailing slash or query string, percent-encoded.
• Every admin form is handled by its own handler, which checks the form's security token and your permission before reading anything. Nothing changes in how the forms work.

Uninstalling the plugin now deletes its data only when the "Delete all data on uninstall" opt-in is clearly switched on.

What's new in 1.0.17

• Fixed: uninstall deletes data only when the opt-in is clearly on (1, true, yes or on). An opt-in option set by hand to "false", "no" or "off" used to count as on and the data was deleted; it is now kept.

404s record where visitors came from, and typo correction handles non-Latin addresses.

What's new in 1.0.16

• 404s from other sites and search engines record the referring page.
• Typo correction compares non-Latin addresses letter by letter, so it no longer redirects to an unrelated page, and its cost stays small.
• 410 rules no longer need a target, Redirection's 410 rules import, and conditional Redirection rules are skipped with a reason instead of becoming site-wide.
• Prefix redirects keep a trailing slash, rows without a target are counted as skipped, and a delete that removed nothing says so.
• Referrer, browser and address details on old Fixed 404 rows are cleared after the retention period, following Pro's retention settings when Pro is active.
• Uninstall follows each site's own choice on multisite.

Redirect fixes for renamed pages and imports.

What's new in 1.0.15

• Fixed: renaming a page back and forth keeps a working redirect.
• Prefix and regex rules count hits and work with Pro schedules.
• Imports honour regex and enabled flags, exports keep the active state and note, and a failed save keeps what you typed.

Translation-ready throughout.

What's new in 1.0.14

• Every screen, email and alert is now translatable, and translations bundled in the plugin's languages folder now load. Counts use proper plural forms, and numbers and dates follow your site's language.
• Regex and loop warnings are translatable, and match types show readable labels.

A quiet pointer to the Pro add-on: an Upgrade to Pro link on the Plugins screen, a one-line note at the foot of the plugin's screens, and a single dismissible notice once the plugin has done its job. Nothing in the free plugin is locked or changed, and all three disappear when Pro is active.

Nine matching and save-path fixes: prefix rules respect segment boundaries, percent-encoded URLs and duplicate exact rules are handled correctly, and a failed save is reported as one.

What's fixed in 1.0.12

• Prefix rules match whole segments. A /news rule no longer catches /newsletter/signup, and the carried-over path is joined to the target with exactly one slash: /old -> /new/ now sends /old/page to /new/page rather than /new//page.
• Percent-encoded URLs stay as typed. A 404 for /foo%3Fx=1 used to be logged as /foo?x=1; creating a redirect from it produced a rule that matched every /foo request and never the real one, and the 404 never left the inbox. Encoded characters are now preserved end to end, /a%2Fb no longer collides with /a/b, and existing rules are re-indexed automatically on update.
• //host/path is a path. A request to //example.org/old no longer matches a rule for /old, and the 404 Monitor no longer merges it onto /old.
• Cross-site redirects to the same path are allowed. /pricing -> https://shop.example.net/pricing was refused as "Source and target resolve to the same URL". Loop detection now compares the host as well.
• One exact rule per path. Exact rules match the path without its query string, so /page?id=1 and /page?id=2 were the same rule and whichever the database returned first won. A second rule for the same path is now refused with a pointer to the existing one. Duplicates already saved are disabled during the update (the one that was actually serving is kept) and listed in an admin notice.
• A failed save is reported as a failure. If the database refuses to write a redirect, you no longer see "Redirect created", the 404 stays in the inbox, and imports count the row as skipped.
• Slug-change auto-redirects on non-slug permalinks. On Plain permalinks or structures like /%year%/%post_id%/ a rename silently attempted a self-redirect; it is now skipped cleanly, and any failed auto-redirect is logged.
• Fuzzy typo correction on subdirectory installs. On example.com/blog a typo such as /blog/abot-us was scored against /about-us including the /blog prefix and never reached the confidence threshold. Request and candidate paths are now compared in the same form.
• Schema creation is verified. The database version is only recorded once the tables are confirmed to exist, so a failed table creation is retried instead of being forgotten.

Updating re-indexes your existing rules once; no settings change.

Housekeeping release: code comments tidied and a stale coding-standards exclusion removed. No functional change.

= 1.0.11 =

• Housekeeping: code comments tidied and a stale coding-standards exclusion removed. No functional change.

Redirect hit-counting is now far lighter on busy sites: a burst of traffic to a redirect no longer means a database write on every single hit.

= 1.0.10 =

• Performance: on sites with a persistent object cache, redirect hit counts are buffered and written in batches instead of one database write per hit, so high-traffic redirects put much less load on the database. Low-traffic redirects still update promptly, and sites without an object cache behave exactly as before.

Hardening: bounds regex-rule matching against catastrophic backtracking and rate-limits 404 logging under bot traffic.

= 1.0.9 =

• Security: regex redirect rules are validated against nested-quantifier patterns and matching is bounded at runtime, so a bad pattern cannot hang requests (ReDoS).
• Reliability: 404 logging is rate-limited per IP so a bot storm cannot grow the log table without bound.

Tested and verified on WordPress 7.1.

• Compatibility: tested up to WordPress 7.1.

Deleting a redirect now asks for confirmation, and the redirect list is paginated with search so it stays fast with thousands of rules.

Your data now survives uninstall by default.

Uninstalling no longer deletes the plugin's data unless you explicitly opt in first, so removing it to debug — or coming back later — keeps everything intact. Where the plugin has a settings screen you'll find a new "Delete all data on uninstall" option; leave it off to keep your data.

Design-system polish: sharper spacing, clearer filters.

A refinement pass on the new look: better breathing room under the admin bar, clearer segmented filters, and small table fixes. Purely visual.

A cleaner, faster-to-scan interface: the new Dragon design system arrives.

Every screen now wears Dragon Core's design system. The 404 Monitor gets a denser, log-style table that fits more on screen; rule patterns and status codes are monospace for easy reading; and the header is now consistent across every Dragon plugin. Purely visual — redirects and the 404 inbox behave exactly as before.

Fuzzy typo correction is now free: confidently-matched typo'd URLs can 301 straight to the right page.

Previously a Pro feature, fuzzy typo auto-correction is now part of the free plugin — enable it under Redirects → Settings. When a visitor hits a 404 whose URL is a confident close match to one of your published posts or pages, they are redirected there instead of seeing an error. Uncertain 404s are always left to stand, and nothing is ever redirected to the homepage. If you had this enabled in Pro, your settings carry over automatically.