← All changes | src/Settings.php +15 -0 2.0.2 → 2.0.4 View file →

		@@ -133,8 +133,23 @@
133	133	return $key;
134	134	}
135	135
136	136	/**
	137	+ * Cache-safe token authorising the public beacon endpoints.
	138	+ *
	139	+ * REST nonces expire (~24h), so a nonce baked into a page-cached HTML copy
	140	+ * eventually 403s every beacon on exactly the cached, high-traffic sites
	141	+ * this plugin targets. This site-secret-derived token doesn't expire, so
	142	+ * cached pages keep reporting. It grants only what the endpoints already
	143	+ * allowed anonymously (throttled, capped measurement ingest) — no more.
	144	+ *
	145	+ * @return string
	146	+ */
	147	+ public static function beacon_token(): string {
	148	+ return hash_hmac( 'sha256', 'easyfonts-beacon-v1', wp_salt( 'nonce' ) );
	149	+ }
	150	+
	151	+ /**
137	152	* Bump the cache-buster (after re-optimisation / purge).
138	153	*/
139	154	public static function bump_buster(): void {
140	155	update_option( 'easyfonts_cache_buster', time(), false );