Uninstalling left your site listed forever

Our plugin can list your site in a small public directory of websites that disclose their AI images. It is off until you switch it on. When you do, the plugin keeps a token, a long random string, and the directory checks once that your site really holds it. From then on that token is the only proof that the listing is yours, and the only key that can take it down.

Switching the listing off from the dashboard always worked. The plugin sent the token, the directory took the listing down, and the plugin forgot the token. Uninstalling the plugin did the last of those three steps and skipped the other two.

A site that had joined the directory and later uninstalled the plugin therefore stayed listed as verified, permanently. Its owner had no way to remove it. Only we could, by editing the database by hand, and only if somebody wrote in to ask.

How big this was, and why that is not the point

The directory is quiet, as we admitted when we wrote about what we are building next. The only site that has ever left it did so through the dashboard switch, which worked.

That is luck rather than design. A plugin whose whole job is disclosure and control should not leave a public listing up after you have removed it, and should not make you write to us to undo something you switched on yourself.

The awkward part is that we knew. We wrote it down in August, in the same notes we keep for everything else, and then left it there for a month. Writing everything down only helps if somebody reads it back.

What 2.2.3 changes

Uninstalling now asks the directory to take the listing down first, and only then deletes the token. It sends the same request the dashboard switch sends, from the same place in the code: one way out, written once. We have learned more than once what happens when the same rule lives in two places, and the badge preview was the most recent lesson.

On a network of sites, every site that joined asks for itself, with its own address and its own token. If the directory cannot be reached, the uninstall still finishes. It waits a few seconds and carries on.

The request carries two things: your site’s address and the token. Nothing else leaves your site.

The directory was not keeping its word either

While fixing the plugin we read our own description of the directory again. It says that removing your listing deletes the stored data. The server did not do that. It hid the listing and cleared the contact email, and kept everything else: the address, the site name, the count of labelled images, the version numbers and the consent record.

It deletes the whole record now, and the one record that had been hidden the old way is gone as well. The plugin promised something and the server quietly did less, which is the same mistake as the uninstall, one floor down.

How we checked it this time

The first version of this fix was tested with its last step switched off, so that the test would not delete the very plugin it was testing. That is a sensible precaution and a weak test. This time we built a throwaway WordPress from the exact file that went to WordPress.org, joined the directory, and uninstalled for real: on a single site, on a network of three sites, after upgrading from the previous version, and with the directory switched off or out of reach. A stand-in played the part of the directory, so nothing real was touched. Then we changed the directory itself and checked it live, with test records labelled as test records.

2.2.3 is on WordPress.org. If you never switched the directory on, nothing changes for you. If you did, you can now leave it the way you joined it: from your own site, without asking anyone.