Changelog
What’s new in Pellio for WordPress
The WordPress plugin: every release, plus what’s new around it.
- Plugin release
Pellio for WordPress 1.0.4
- Updates now come from WordPress.org. Sites that installed Pellio from pellio.io move over with this update; nothing to do.
- The Pellio icons in the admin menu and the block inserter have their play button centred.
- Plugin release
Pellio for WordPress 1.0.3
- First release on WordPress.org.
- Connecting to Pellio checks a WordPress nonce on the way back, as well as the one-time state.
- The migration scan needs a nonce-protected link.
- Plugin release
Pellio for WordPress 1.0.2
- YouTube's title bar and logo now show in the Pellio player, as YouTube's terms require. Hiding them is an opt-in setting (Pellio → Settings → Player), off by default.
- Your server sends nothing to Pellio until you connect: pasted Pellio links are only turned into players on connected sites.
- Uploads can only be finished by the person who started them (or someone who manages Pellio videos). The LifterLMS lesson progress box lists only that course's students.
- The player's control labels, admin messages and errors can be translated.
- Output is escaped where it's printed; fields sent to Pellio are sanitized by type; report attachments use the WordPress filesystem API; deactivating the plugin clears its scheduled tasks.
- The readme's External services section lists every request the plugin makes.
- "Open Pellio" opens the connected workspace, not just the Pellio app.
- Plugin release
Pellio for WordPress 1.0.1
- Prepared for the WordPress.org plugin directory.
- Security: the player scripts only ever open Pellio's own player, whatever markup a post contains.
- Security: users who can't add Pellio videos (contributors, by default) can't get a signed embed for a non-public video through the block editor's preview, and only see public videos in page-builder pickers.
- Security: cached pages refresh their embeds with a signed ticket from the page, so a video shown only to members can't be signed for anyone else by its id. Pages cached before this update refresh once their cache is renewed.
- Security: the video structured data (and the Yoast / Rank Math merge) is plain text, and leaves out password-protected videos and videos on members-only pages or course content.
- Security: Tutor LMS and Sensei LMS can't complete a lesson whose video must be watched by any of their other paths (Tutor's video sync, Sensei's "Mark as Complete" on a course). Auto-complete goes through LifterLMS's, Tutor's and Sensei's own rules, so a lesson's quiz is still required.
- Security: watch checks are limited to one every 3 seconds per lesson, the password attestation locks for 15 minutes after five wrong passwords, and progress report attachments are written to a private temporary folder.
- "Started watching" automations fire once a day per user and video. The site URL sync runs only for administrators. Viewer emails in a video's analytics are shown only to people who can list users.
- Plugin release
Pellio for WordPress 1.0.0
- Fixed: the lesson video and signature dropdowns in the LifterLMS and attestation boxes no longer spill out of the editor sidebar.
- New feature
The Pellio plugin for WordPress
Upload from the editor, embed private videos and migrate old embeds.
- A Pellio block with drag-and-drop uploads straight to Pellio, a library picker, a classic-editor button and a
[pellio]shortcode. - Signed embeds, so private and domain-locked videos play only on your site.
- A lightweight thumbnail until play, plus VideoObject structured data.
- Tools → Pellio swaps Vimeo and Wistia embeds site-wide with undo, and offloads Media Library videos. Everything is also available in WP-CLI.
- LifterLMS: require watching before completion, checked against the seconds actually watched, plus seek lock, resume and reporting.
- A Pellio block with drag-and-drop uploads straight to Pellio, a library picker, a classic-editor button and a