What's changed

All notable changes to Stuxs.Tools are documented here. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and since v26.10.22 this project uses [Date Versioning](https://datevers.ing) (YY.MM.DD, the UTC release date, with -1, -2… for later releases the same day); earlier releases used Semantic Versioning.

• The privacy policy now says what's really logged and for how long. It promised server logs were kept for at most 7 days, but our host, Stuxedo, keeps weekly archives that currently go back about seven weeks, with visitors' real IP addresses (Cloudflare doesn't hide them there). It also now names Cloudflare, which every request passes through, and says how long Stuxs.Tools' own records last: rate-limit counters at most two hours, the PHP error log 7 days

• Rate-limit counters, which are named after a hashed form of the visitor's IP address, and old link-preview images were never deleted on the live site, because the cache-prune cron job wasn't set up there. Stuxs.Tools now clears them itself as it runs (at most once an hour), so this no longer depends on the cron job, which still works and now does the same thing

• PHP's error log now goes to storage/logs/, which can't be reached from the web, instead of error_log files next to the scripts, which nothing blocked; any error_log file the host writes is now blocked too, and entries older than 7 days are removed

• The privacy policy now says that IP Information sends the address being looked up to ip-api.com (your own, if you look yourself up). It previously said no third-party service processed personal data

• The HTTP Status Checker and Redirect Checker now refuse private and internal addresses (such as 127.0.0.1, the server's own network or 169.254.169.254), as the other network tools already did. Previously they could be used to make the server request those addresses. The Redirect Checker checks every hop, so a public site redirecting to an internal address is stopped there, and both connect only to the address that was checked, so a second DNS lookup can't swap in an internal one
• The page smoke test now checks that every network tool refuses a private address. It sent the wrong kind of request before, so it never actually tested this

• When a server-side tool (the network tools and image tools) fails because of a fault on our side, visitors now see one plain message, "Sorry, something went wrong on our side while running this tool…", instead of a raw technical error or an empty response, and the real error is emailed to the admin alert address (Admin → Config). The email says which tool failed, what was entered into it, where in the code it happened, the version and the time. It never includes an uploaded image or its file name, the visitor's own IP address when they look it up, or anything else about the visitor. The same fault is emailed at most once an hour with a count of how often it happened in between, and at most 10 error emails go out an hour
• An Error reports section in the privacy policy explaining exactly what those emails contain

• Failures caused by the site being checked are now explained in plain English instead of raw technical errors: the HTTP Status Checker and Redirect Checker say when a site can't be found, refuses the connection, takes too long, closes the connection or can't make a secure connection; the SSL Checker no longer adds the raw connection error to its message; and IP Information explains that private and reserved addresses have nothing public to look up
• The image tools say when an upload didn't finish, instead of "Upload failed. Code: 3"

• Discord link previews would have shown a literal $1 in place of any Markdown character in a tool or category's name or description (*, _, ~, ` `, |, [, ], or #, > or -` at the start of a line), instead of showing the character. No current name or description contains one, so no live preview was affected yet. Backslashes are now escaped too, and new tests check every tool, category, homepage and page embed against Discord's rules

• A full icon set: favicon.ico (16, 32 and 48px) and apple-touch-icon.png at the site root, and a site.webmanifest with 192px, 512px and maskable icons for Android home screens

• The favicon was missing on the admin pages and the admin sign-in, which listed no icon, and anywhere a browser looked for /favicon.ico, which didn't exist. Every page now lists the same icons
• Saving Stuxs.Tools to a phone's home screen showed a dark, hard-to-see icon: iOS filled the icon's transparent background with black, and Android had no manifest to take an icon from. The home-screen icons now sit on a white background

• Admin alert emails are now a branded HTML email (the Stuxs.Tools logo, an "Admin alert" label, the message with clickable links, and an *Open the admin panel* button), with the plain-text version still included for mail clients that don't show HTML

• With Cloudflare Turnstile switched on, the admin sign-in page showed no challenge and every sign-in failed with "Captcha check failed": the site's Content-Security-Policy blocked Cloudflare's Turnstile script and frame. It now allows challenges.cloudflare.com for both

• The admin Config page now also edits the site URL, alert emails (the address to send to, the sending mailbox and its SMTP server, port, encryption, username and password) and Cloudflare Turnstile (switch and keys). The SMTP password and Turnstile secret key are write-only: never shown back, and an empty box keeps the current one. Settings an older config.php doesn't have yet are added to it on save
• A small built-in mailer (includes/Mailer.php) that sends admin alert emails through any SMTP server, or PHP's mail(), with a *Send a test alert email* button on the Config page. New ALERT_EMAIL, MAIL_FROM and SMTP_* settings in config.example.php

• Stuxs.Tools now uses [Date Versioning](https://datevers.ing) instead of Semantic Versioning. Versions are the UTC release date as YY.MM.DD, with -1, -2… for further releases the same day, so this release, which would have been v1.16.0, is v26.10.22 and follows v1.15.2. commit.sh / commit.bat refuse a VERSION.md that isn't a valid Date Version

• Settings entered on the admin Config page can't contain line breaks, which could otherwise inject extra headers into alert emails
• The local dev server now refuses requests for storage/, includes/ and bin/, as .htaccess already does for storage/ and includes/ in production. It previously served them as plain files (e.g. storage/hits/hits.json)

• The logos and icons in the Markdown docs (README and the like) follow GitHub's light or dark theme, using each brand's logo-light/logo-dark and icon-light/icon-dark files

• The logos and icons in the Markdown docs (README and the like) follow GitHub's light or dark theme, using each brand's logo-light/logo-dark and icon-light/icon-dark files

• 15 new tools, all running entirely in the browser, taking Stuxs.Tools from 95 to 110 live tools:

- Encoding: HTML Entity Encoder (named, decimal or hex, optionally every non-ASCII character), HTML Entity Decoder (every named and numeric entity), Binary to Text (UTF-8, Latin-1 or 7-bit ASCII, with or without separators), ROT13 Encoder and Decoder (with ROT47), Unicode to Punycode and Punycode to Unicode (domains, URLs and email addresses, one per line), Quoted Printable Encoder (UTF-8, 76-character soft line breaks) and Decoder (UTF-8, Latin-1, Windows-1252, Latin-9) - Text: Word Density Counter (single words or 2- and 3-word phrases, optional common-word filter, copy as CSV), Text Repeater (up to 10,000 copies, any separator, optional numbering, download), Bubble Text Generator (circled, filled, squared and filled-square styles), Upside Down Text Generator, Glitch Text Generator (Zalgo marks above, through and below, adjustable intensity) and Random Text Line Picker (fair picks from the browser's secure random generator, with or without repeats)

• assets/js/punycode.js: an RFC 3492 Punycode implementation shared by the two Punycode tools

• The README and the homepage link-preview text give the new count: 110 live tools, 50 more in the pipeline

• Discord link previews for tool, category and other pages start with a small "Stuxs.Tools" line (Discord subtext, linking to the homepage) above the page title, like the site name on a normal preview. The homepage preview, whose title is already Stuxs.Tools, is unchanged

• Discord component embeds: links to Stuxs.Tools pasted into Discord show a custom preview instead of the standard card, in the page's own colour. A tool page shows the tool's name, description and category (or "Coming soon" / "Under maintenance") with buttons for the tool, more tools in its category and all tools; a category page shows its description, how many tools are live and the first ten as links; the homepage shows how many tools are live and every category as a link, with Browse tools, Search and Stux.Dev buttons; other pages show their name and description. It's built server-side (discord_* helpers in includes/helpers.php, set per view as $discordEmbed), left out if it would ever pass Discord's 3,000-byte limit, and the Open Graph tags remain as the fallback

• The category badge on tool OG images (the "PDF TOOLS" label on link previews) was the accent colour on a darker shade of the same colour, which made it almost unreadable with the default purple. It now has a soft accent-tinted fill, a lighter border and near-white tinted text, so it reads clearly with any accent colour, and sits a little lower with the title below it given more room
• Cached OG images are now keyed to og.php itself, so a design change replaces them straight away instead of after the 7-day cache expires, and the OG and Twitter image URLs carry a version (&v=2) so sites that cached the old image fetch the new one

• Recently Used cards on the home page use their category's colour and icon and show the tool's description, the same as Popular Tools; they were plain cards in the accent colour with only the category name. They're built from the current tool list, so history saved by older versions shows correctly too, and tools that no longer exist are left out
• The Recently Used Clear button sits on the right, level with the heading, and has room above the cards; it was a white browser-default button squeezed under the heading against the cards, because its styles were only loaded on tool pages

• The footer's Created-with icons (heart, code, coffee) no longer carry a vertical-align nudge, on the main site and on the maintenance and coming-soon pages; they keep their optical sizes

• The site's timezone is one line in config.php (date_default_timezone_set('Europe/London'), UK time by default instead of UTC); change it there and every date and time the site shows follows

• The admin dashboard's admin-token rotation times were labelled "UTC" whatever the timezone; they now show the configured zone's own label (BST or GMT)

• The Browse menu opened from the left edge of its button and ran off the right side of the screen, cutting off its second column; it now lines up with the button's right edge and never grows wider than the viewport

• Native form controls (checkboxes, radio buttons, range sliders, progress bars and date pickers) used the browser's default blue instead of the Stuxs.Tools accent; they now use accent-color (the brighter accent in the dark theme), and file inputs' "Choose file" button is styled to match

• Image previews in the image tools (compressor, resizer, grayscale, converters and the rest that preview an upload) were blocked by the Content Security Policy, which didn't allow blob: images; img-src now includes blob:
• Search suggestions showed each tool's icon as raw HTML text (<i class="fa-solid …">) instead of the icon
• The home page search dropdown was cut off by the hero and only showed by scrolling inside it; the hero and .container now use overflow-x: clip, which doesn't turn them into scroll boxes, and the results are left-aligned
• Link preview images (og.php) returned a 500 error on PHP 8: imagedashedline() was called with an extra argument that PHP 7 ignored

• The admin pages' footer shows the copyright year on its own in the start year (it read "2026–2026"), then START–CURRENT, like the public pages

• The copyright line reads Stux.Group instead of Stux Group Ltd

• The footer's Created-with icons are optically sized, so the heart no longer looks bigger than the code and coffee icons

• /sitemap (an HTML page in the site layout listing every public page) and /sitemap.xml (for crawlers), built from one page list in includes/sitemap_pages.php with the fixed site URL and each page's source-file modification date as lastmod; the page test checks both
• A Created with love / code / coffee by Stux.Dev line in the footer, on the coming-soon and maintenance pages too
• In dev mode, ?banner=soon,maintenance,site previews the other site banners (production ignores it)

• The footer links to the Sitemap next to Boring Legal Stuff
• The dev-mode and admin-override banners are the shared Stux site banner (assets/css/site-banner.css + assets/js/site-banner.js): a muted tint of each variant's accent with a faint icon pattern and a label chip. The header and mobile menu move down by the banners' measured height, so nothing is covered or cut off, even when a banner wraps on a phone
• The footer's Stux.Dev logo, "A Stux.Dev Service" and the Powered by Stuxedo badge are grey and dimmed until hovered or focused, on every page including coming-soon and maintenance; the hover animates smoothly instead of snapping
• The footer uses Stuxedo's text badge instead of the rectangle one, and the Stux.Dev logo and the badge are both 28px tall
• The copyright line uses Font Awesome's copyright icon instead of the © sign (screen readers still read "Copyright")
• dev-server.sh/.bat run on PHP 7.4, like production (PHP_BIN, then php74/php7.4, then %LOCALAPPDATA%\Programs\PHP\7.4), and warn when only another version is available

• Turning on coming-soon or maintenance mode crashed every page with "Call to undefined function asset()": those pages were shown before includes/helpers.php was loaded. It now loads first
• The footer's service links used an undefined --text-secondary colour on hover, and its "Powered by" text was too faint to read comfortably

• A PHP 7.4 (production) CI job: production runs PHP 7.4, so CI now lints every file, runs the PHPUnit suite (on PHPUnit 9.6) and requests every page on PHP 7.4, alongside the existing PHP 8.1 job
• tests/test_php_pages.sh, the page smoke test that job runs: it serves the site with PHP's built-in server (using config.example.php when there's no config.php, with DEV_MODE on and coming-soon/maintenance mode off) and requests the fixed pages, /legal and its six sub-pages, every category and every tool in the registry, a search and the network APIs, failing on an unexpected status or any PHP error, warning, notice or deprecation
• includes/compat.php, which provides str_contains(), str_starts_with() and str_ends_with() on PHP 7.4 (skipped on PHP 8, where they're built in)

• composer.json, the README, CONTRIBUTING, INSTALL and DEV_GUIDE now say PHP 7.4+ instead of 8.1+

• The site didn't run on PHP 7.4: the image processor and the HTTP status checker used match expressions (a parse error on 7.4; now a switch and a conditional chain with the same results), and 15 calls to PHP 8's str_contains/str_starts_with (network tools, search, the tool registry, What's My IP) had no fallback

• HelpersTest coverage for the changelog section ordering

• The /changelog page (render_changelog() in includes/helpers.php) now sorts each release's ### sections into a fixed order — Added, Changed, Fixed, Removed, Security, Deprecated — at render time, rather than trusting the order CHANGELOG.md lists them in; unknown section types go last
• Changelog type badges now use the fixed family palette — Added #2ecc71, Changed #3ba7ff, Fixed #ffa64d, Removed #ff4d4d, Security #b06bff, Deprecated #8a8a94 — as tinted badges (coloured text on a light tint of the same hue), with darker variants of each for the light theme
• CHANGELOG sections reordered to Added, Changed, Fixed, Removed, Security, Deprecated

• Footer/coming-soon/maintenance credit changed from "A Stux.Dev Project" to "A Stux.Dev Service" (linking to services.stux.dev instead of projects.stux.dev) — Stuxs.Tools isn't a StuxieDev, Ridgwell Family, or Stux.Dev Labs project, so it gets the standard service credit like the rest of the family.

• README.md's tagline was wrapped in bold — changed to the ### *italic* heading style used for taglines elsewhere in the family.

• The coming-soon and maintenance splash pages' icon used fa-user-shield for both — changed to fa-rocket (coming soon) and fa-screwdriver-wrench (maintenance) so each page's icon matches its meaning.

• The remaining Stux.Group mentions missed by v1.11.3: LICENSE.md's copyright holder and the Disclaimer page's branding-copyright line now name the actual legal entity, Stux Group Ltd; CONTRIBUTING.md's "is a Stux.Group project" line and every admin-panel footer (admin/*.php) now credit Stux.Dev, linking to https://stux.dev.

• The Imprint page's Operator section incorrectly said Stuxs.Tools is "built and maintained by Stux.Group" directly — it's operated by Stux.Dev, which is in turn operated by Stux Group Ltd (company no. 13160574). Corrected the Operator section and the "Responsibility for content" paragraph to name Stux.Dev.
• The legal contact address across views/legal-imprint.php, legal-cookies.php, legal-opt-out.php, and legal.php was [email protected] — unified to [email protected] to match the other Stux.Dev-operated products. [email protected] (general contact) is unchanged.
• The "Powered by" footer badge (views/_layout.php) and the coming-soon.php/maintenance.php splash pages named and linked Stux.Group directly — now read "A Stux.Dev Project" (linking to https://projects.stux.dev), with the brand logo itself linking to https://stux.dev and pointing at the new https://global.media.stux.dev/logo.png.
• The About page's "The name"/creator-card section similarly credited Stux.Group as creator — updated to Stux.Dev (name, avatar icon, handle link, and bio text).

• README.md, views/_layout.php's footer, views/about.php's creator card, and views/coming-soon.php/views/maintenance.php's footer Stux.Group logo/icon URLs had a leftover duplicated /global/ path segment (global.media.stux.group/global/logo.png and /icon.png) — corrected to https://global.media.stux.group/logo.png and /icon.png

• The self-hosted Gontserrat/Creato Display/JetBrains Mono @font-face url()s in assets/css/base.css were the one remaining static asset without any cache-busting query — everything else on the site (CSS/JS entry points, logos, icons) already goes through asset()'s ?v=<version>, but a static .css file can't have a PHP-computed version injected into it. Added a manual ?v=1 to each font url() instead, to be bumped only when a font file itself is replaced.

• The changelog page's ### Added/### Changed/### Fixed/### Removed/### Deprecated/### Security section headings (parsed by render_changelog() in includes/helpers.php) now render as colored pill badges — green/blue/amber/red/red/pink respectively — instead of plain uppercase gray text, matching the badge treatment on TIGHC's changelog page. A trailing parenthetical on a heading (e.g. ### Added (Turnstile)) still renders, shown as muted text next to the badge. New .changelog-label/.changelog-label-* rules in assets/css/base.css.

• The asset() cache-busting helper (includes/helpers.php) was only wired up for base.css, tools.css, and app.js — every other asset reference (favicons, the self-hosted FontAwesome stylesheet, the self-hosted Gontserrat/Creato Display @font-face fonts, and every logo/icon <img>) still used a hardcoded /assets/... path with no versioning at all. All of these now go through asset() too, so every asset actually busts the cache on release the way app.js already did

• Footer's "Built & Maintained by Stux.Dev" now links to https://github.com/StuxDev instead of https://stux.dev, matching the GitHub-org link convention used for the other brand footers (StuxAPIs, Stux.Cloud, Stuxedo)

• Footer's version number is now a link to /changelog, replacing the separate "Changelog" link that used to sit in the footer's link list

• "Built and maintained by Stux.Group" (intro sentence and Credits section) corrected to Stux.Dev — Stuxs.Tools is made by Stux.Dev, which is part of the Stux.Group Brand of Companies, not built directly by Stux.Group itself; the closing brand-of-companies disclaimer now reflects this too

• A "Stuxs.Tools is part of the Stux.Group Brand of Companies" line to README.md's License section, matching the disclaimer already rolled out across the StuxAPIs repos

• Changelog intro didn't state the Keep a Changelog format or that versions follow Semantic Versioning, despite VERSION.md/commit.sh/commit.bat already enforcing MAJOR.MINOR.PATCH and the entries below already following the Keep a Changelog Added/Changed/Fixed structure — added both lines

• DEV_GUIDE.md — a dedicated local-development guide (cloning, config.php, the dev server and its flags, verifying the install), split out of CONTRIBUTING.md's old "Local setup" section
• A "Fixing a bare PHP install" section in DEV_GUIDE.md for a manual winget/scoop-style PHP install that ships with no php.ini at all (no extensions, no CA bundle for cURL's SSL verification)
• README.md now has a dedicated Contact section ([email protected] / [email protected]); the same addresses were added to CONTRIBUTING.md and as a "still stuck?" line at the end of INSTALL.md/DEV_GUIDE.md's troubleshooting tables — the site itself already used these addresses everywhere, the docs just didn't mention them

• CONTRIBUTING.md's "Local setup" section is now a short pointer to DEV_GUIDE.md/INSTALL.md instead of duplicating setup steps inline
• README.md/INSTALL.md now cross-link to DEV_GUIDE.md

• INSTALL.md's version header had been stuck at v1.5.1 for the last 7 releases (v1.6.0–v1.8.5) — it's meant to be bumped on every release (and was, consistently, up through v1.5.1) but nothing enforces that; bumped to current

• New site logo and icon (assets/img/icon.png, assets/img/logo.png), replacing the old favicon.svg bolt mark everywhere: browser favicon/apple-touch-icon, header/footer/mobile-nav, README/CONTRIBUTING badges, and the OG-image generator (og.php now composites the real logo instead of hand-drawing an approximation of the old mark)
• New brand accent color, #6B00A2 (was #7C6EFF), applied everywhere it appeared: CSS variables (with derived hover/bright shades), theme-color meta tags, the admin panel, the coming-soon/maintenance pages, and the og.php default

• Header, footer, and mobile-nav now render the logo as a single image instead of an icon plus separately-styled text lockup
• Coming-soon/maintenance pages' "A Stux.Group Project · Powered by Stuxedo" line now uses the same real logo/badge images as the main site footer instead of plain colored text
• Maintenance page's icon now sits in the same boxed accent badge as the coming-soon page's icon (was a bare floating icon), and its card now has the same top accent bar as the coming-soon page's
• Coming-soon/maintenance pages' theme-toggle button now sits inside the card's top-right corner instead of the page's own top-right corner (maintenance's was position: fixed, anchored to the viewport rather than the card)
• Cross-branding on Downl.one updated to match: new stuxs-tools-icon.png/stuxs-tools-logo.png assets and the new accent color throughout, and Downl.one's about-page card for Stuxs.Tools now shows the full logo image, matching this site's own (logo-only) card for Downl.one

• dev-server.bat's echo lines rendered em dashes as mojibake (ÔÇö) in a default cmd.exe console, since cmd.exe doesn't use UTF-8 by default — replaced with plain hyphens; cleaned up the same em dashes in commit.sh, commit.bat, and dev-server.sh for consistency

• The dev-mode/admin-override banner icon now sits inline with the title text ("Development Mode", "Coming Soon Mode", "Maintenance Mode") instead of floating beside the whole two-line block
• The coming-soon and maintenance pages now use the same icon as the admin-override banner instead of a generic wrench icon

• commit.sh/commit.bat no longer add a commit-authorship trailer

• commit.sh/commit.bat had a hardcoded version and message left over from the v1.5.1 release, so they'd tag any future commit as "v1.5.1" if run — now read the version from VERSION.md dynamically, so they can't go stale like this again. Also backfilled the missing v1.6.0–v1.8.2 git tags this staleness had caused to be skipped.

• dev-server.sh/.bat weren't actually forcing DEV_MODE on, so the dev banner and local Downl.one links required manually flipping DEV_MODE in config.php every time — they now force it on by default for every run, with --no-dev-mode to opt out and test production behavior locally

• INSTALL.md: generalized cPanel-only wording to also cover LiteSpeed/StackCP hosts, added a dedicated StackCP hosting notes section, and corrected stale guidance to manually set ADMIN_TOKEN (it auto-rotates now)

• upload_max_filesize/memory_limit/max_execution_time/post_max_size were only set via .htaccess's php_value directives, which silently do nothing on hosts running PHP-FPM or LiteSpeed's LSPHP instead of mod_php (Stuxedo's included) — added a .user.ini with the same values so they take effect regardless of SAPI

• Dedicated /faq page — 10 common questions in an accordion, linked from the footer and mobile nav

• Footer's Stux.Group logo and Stuxedo badge were noticeably small (14px/20px) — bumped to 18px/26px

• Development mode (DEV_MODE in config.php) now shows a small banner on every page and points Downl.one links at your local dev server — port set via DOWNLONE_DEV_PORT, overridable per-run with dev-server.sh/.bat --sister-port <port>
• ?admin_token=<token> now bypasses coming-soon/maintenance mode for the rest of the browser session, with a banner marking the override while it's active; ?admin_preview=off clears it
• ADMIN_TOKEN is now a 128-character token that regenerates itself automatically every ADMIN_TOKEN_ROTATE_HOURS (3h floor enforced regardless of what it's set to) — rewritten straight into config.php so the current token is always readable there. New ADMIN_TOKEN_DISABLED option fully blocks token-based bypass/login even if a token leaks

• Admin dashboard (admin/index.php) — environment status at a glance, admin-token display with rotate-now and disable controls, and an analytics snapshot
• Admin config editor (admin/config.php) — edits the safe config subset (dev mode, coming-soon/maintenance, cache TTL, token rotation settings) directly from the browser, in place in config.php
• Every admin page now shows a footer with the current version, copyright range, and a Stux.Group credit, plus Changelog/About links

• Optional Cloudflare Turnstile challenge on the admin login form (TURNSTILE_ENABLED in config.php) — off by default, fails closed (rejects) on any verification error when on

• The dev-server router pre-defined its CLI-flag overrides before checking whether the request was for a real file, so any direct request to admin/*.php collided with config.php's own define() calls ("constant already defined" warnings) — the overrides now only run when actually falling through to index.php

• Legal hub's Terms page now includes an "Ethical use" section — guidance on responsible use of security/network/generator tools, on top of the existing legal terms
• A consent line above the homepage search box: "By continuing, you agree to our Terms and Ethics of Use"
• Dedicated /changelog and /donate pages — the changelog is no longer folded into the About page, and both are linked from the header, mobile nav and footer

• Consolidated the two separate, independently-wired mobile navigation panels into one — the duplicate hamburger button is gone, and the mobile search box and category links (now with tool-count badges) live in the single remaining panel
• Mobile nav's "Legal" section renamed to "More" and given proper category-colored icons for About, Changelog and Donate; "Boring Legal Stuff" was dropped from it (still available in the footer)
• Hero search box redesigned: the magnifying-glass icon moved out of the input and into the Search button itself, which collapses to just the icon on mobile
• The "160+ free tools" hero badge now shows a blinking dot instead of a static bolt icon, matching Downl.one
• Theme toggle button widened from 34px to 38px
• "Format Converters" category renamed to "Formatters"
• The Browse dropdown's Downl.one link is now a green tinted button instead of a plain top-bordered link
• The Downl.one partner card now stacks its button below the text on mobile instead of squeezing them onto one row

• Category-colored icons in the mobile nav were silently overridden by a higher-specificity default icon-color rule
• The Browse dropdown's Downl.one link text and hover color were overridden by .header-nav a's higher-specificity color rule
• Mobile nav divider lines weren't spanning full width; a leftover duplicate rule from the removed second drawer was winning over the intended fix
• .downl-feature-icon had a stray font-size:3rem left over from when it held a font icon, inflating the wrapper past the 48×48 image now inside it
• Mobile nav's "About" link read "About Stuxs.Tools" instead of just "About"

• A little something for the curious. You'll know it when you find it.

• Per-tool status badges: any tool can now be tagged version (e.g. 1.0.0), soon, or maintenance in ToolRegistry.php, rendered with priority maintenance > soon > version via the new tool_badge_html() helper. All 95 currently-built tools have been tagged version: 1.0.0
• Category pages now show a dedicated "In maintenance" section and stat pill (alongside the existing live/coming-soon ones), only appearing when a tool in that category is marked maintenance
• Individual tool pages show a distinct "under maintenance" state (separate from the existing "coming soon" state) when a tool is marked maintenance
• ?admin_token=<token> on any tool URL bypasses the soon/maintenance gate and previews the real tool, using the same ADMIN_TOKEN secret as admin/*.php — shows a visible "Admin preview" banner so it's never mistaken for the live page
• Legal hub page ("Boring Legal Stuff"): its 6 sections now show in a responsive grid (3 columns on desktop, 2 on tablet, 1 on mobile) with each icon colored distinctly, and the icon sits to the right of the text — built on new standalone .legal-grid/.legal-card classes, fully independent of the shared .tools-grid/.tool-card system

• The homepage search box showed a "double border" on focus — a box-shadow ring stacked on top of the border-color change, and a separate native :focus-visible outline landing on the <input> itself. Both removed; only a clean border-color change remains
• The homepage search box no longer auto-focuses on page load — it was permanently showing its focus state to every visitor
• The "Partner platform" card's top border vanished on hover — a translateY(-1px) hover-lift pushed it 1px past its container's edge, which a site-wide overflow rule then clipped. Removed the lift
• Fixed a naming collision: the legal page briefly reused .tools-grid-full, a class already active on every category page, which broke those pages' card layout. It now uses its own .legal-grid/.legal-card classes instead

• About page: the Downl.one card's logo now sits above its description again instead of beside it

• Self-hosted Creato Display (headings/logo) and Gontserrat (body) fonts — the Google Fonts CDN <link> is gone entirely; JetBrains Mono is now self-hosted too
• About page: the Stux.Group and Stuxedo cards are now themed with each company's real brand color (sampled directly from their logos) instead of the site's generic purple accent, and links inside those cards now inherit the matching brand color instead of the site's default link color
• About page: the "idea" card now shows the real Stuxs.Tools favicon instead of a generic FontAwesome bolt icon
• About page: the Downl.one card now shows the real Downl.one logo alongside its description instead of a stacked logo-then-text layout

• Headings that directly follow an about-page info card now sit close to it instead of inheriting the same 2rem top margin used for regular prose headings
• Font Awesome upgraded from 7.2.0 to 7.3.1 (self-hosted)

• assets/css/base.css's @media (min-width: 769px) query was missing its opening line, so .mobile-drawer/.mobile-overlay were display:none !important unconditionally — the mobile menu was broken at every viewport width

• dev-server.sh / dev-server.bat — local dev server scripts that start PHP's built-in server with a router shim (so static assets actually load), auto-bootstrap config.php from config.example.php on first run, and support --no-coming-soon / --no-maintenance flags to bypass those modes for a single run without touching config.php
• DOWNLONE_URL constant in config.php — the Downl.one link was previously hardcoded as a literal string in nine different view files; it's now driven by one configurable constant via the (previously defined but never actually used) downloader_url() helper

• The legacy in-house downloader API — api/downloader/info.php, api/downloader/proxy.php, includes/MediaDownloader.php, and the tools/downloader/media-downloader.php fragment. These were already unreachable dead code: Router.php redirects every /downloader/* path to Downl.one before the tool-lookup logic that would have served them is ever reached. The now-unused YTDLP_PATH / MAX_DOWNLOAD_SIZE_MB / ALLOWED_DOWNLOAD_HOSTS constants were removed from config.php and config.example.php along with them

• The about page's "The name" section no longer credits the personal "Stux / StuxieDev" handle — it now credits Stux.Group throughout (name, bio, and creator-card icon), consistent with how the rest of the site attributes the project
• The coming-soon.php credit line changed from "Built by Stux.Group · Hosted by Stuxedo" to "A Stux.Group Project · Powered by Stuxedo", matching the footer's established phrasing

• CONTRIBUTING.md — local setup, project conventions, and how to add a new tool, linked from README.md

• Brand name stylization made consistent throughout: "Downl.one" and "Stuxs.Tools" everywhere either is referred to in prose, page titles, meta tags, alt text, and OG image text (URLs, email addresses, User-Agent strings, and CSS/JS identifiers are unaffected — those stay lowercase, since they're literal technical values, not stylized references)

• Removed a stale, completely unreferenced assets/css/app.css — a leftover from before the CSS was split into base.css/tools.css; no <link> tag anywhere loaded it

• The version number itself now lives in VERSION.md (a bare version string, safe to commit) — version.php is now just a thin reader (trim(file_get_contents(...))) instead of hardcoding the version
• config.php no longer pulls in version.php — each real entry point (index.php) requires it directly instead, keeping deployment config and release version decoupled

• Changelog now rendered on the about page via a small dependency-free Markdown renderer
• config.example.php as the committed config template — config.php itself is now gitignored, never committed
• version.php split out of config.php to hold just the version constant (safe to commit; config.php requires it)

• All STUXS_ constants renamed to STUXSTOOLS_ throughout, including the window.STUXS_TOOLS / window.__STUXS_TOOL__ JS globals (now window.STUXSTOOLS_ALL_TOOLS / window.STUXSTOOLS_TOOL)
• Copyright year corrected back to 2026
• "Hosted & provided by Stuxedo" card now shows Stuxedo's real icon instead of a generic server icon; "Stuxedo by Stux.Cloud" corrected to just "Stuxedo" throughout about.php
• og.php now draws the real Stuxs.Tools icon (a rounded badge with the bolt mark from favicon.svg) instead of plain wordmark text
• INSTALL.md updated for the new config.example.php / version.php setup step

• The mobile menu was completely non-functional at every screen width — a missing @media (min-width: 769px) wrapper meant .mobile-drawer and .mobile-overlay had display: none !important unconditionally, not just on desktop
• An unterminated CSS comment at the end of base.css would have silently swallowed any rules appended after it

• "Boring Legal Stuff" hub at /legal, linking to six documents: Privacy Policy, Terms of Use, Cookies Policy, Imprint, Disclaimer, and Opt-Out Preferences (previously just Privacy and Terms, now moved under /legal/)
• Three new tool categories: PDF Tools, Audio Tools, and Math Tools (16 coming-soon tools seeded across them)
• Category icons are now tinted with their category's own colour everywhere they appear — header nav, footer, mobile nav, and the homepage grid — not just on category cards

• Credited to Stux.Group throughout (previously StuxieDev/Stux)
• Footer restructured: version number is now followed by a "Boring Legal Stuff" link, and the Stux.Group / Stuxedo attribution reads "A Stux.Group Project" alongside the Powered by Stuxedo badge
• Downl.one now shown with its real icon/logo everywhere it's referenced (nav, footer, mobile menu, partner card, Browse dropdown) instead of a generic download icon

• Header logo rendered "Stuxs .Tools" with a stray gap caused by a flexbox quirk
• Theme toggle showed two overlapping sun/moon icons, and never updated the mobile menu's separate icon at all
• The "Browse" categories dropdown had no styling and, once styled, was invisible (clipped by the nav bar) and then stuck permanently open
• Footer had a double horizontal divider from a stray single-item row
• Four categories shared duplicate colours (blue, green, coral and pink were each reused twice) — all 17 categories now have a unique colour

• README.md and a rewritten INSTALL.md covering PHP extension requirements, storage permissions, cron setup, and a going-live checklist
• Token-gated admin tools: admin/cache-clear.php, admin/analytics.php (hit-log viewer), and admin/new-tool.php (scaffold generator)
• Full-page search at /search?q=, with a "view all results" link from the homepage search dropdown

• ToolRegistry::all() was missing its return statement — every page on the site was fatal-erroring in production
• A parse error in api/network/_shared.php had broken all 7 network tools (DNS, IP, SSL, port, HTTP, redirects, WHOIS)
• A duplicate "Text to Binary" registry entry under the wrong category was silently falling back to "coming soon" despite being counted as live — corrected the live tool count from 96 to 95
• A parse-error risk in the JSON→XML tool from an unescaped <?xml sequence
• Protocol-relative redirects (//cdn.example.com/...) were mangled by the redirect checker tool

• Split CSS into base.css (loaded everywhere) and tools.css (loaded only on tool/category pages), saving ~26KB on other pages
• Memoised ToolRegistry::all() so it's built once per request instead of on every call
• Added ETag + Last-Modified caching to static pages, with 304 responses on repeat visits
• Network APIs now send Cache-Control: no-store on every response
• Image tool output streams via a temp file with Content-Length, so browsers show real download progress
• Static assets now cache for 1 year with Cache-Control: immutable

• Recently-used tools remembered per-browser via localStorage
• Popular Tools section driven by a real hit-log (api/hits.php)
• Global copy-to-clipboard delegation with icon feedback

• Developer Tools (6), Colour Tools (5), Finance (5), and Converters (5)

• 30 instances of a literal %% that should have been %, across 9 files
• 13 stray arrow characters replaced with proper icons

• Auto-generated sitemap.xml and robots.txt
• JSON-LD SoftwareApplication schema on every tool page
• Related-tools section on each tool page
• Every built tool given a unique meta description

• Format tools (minifiers/formatters for HTML/CSS/JS, JSON/CSV/XML/Markdown/SQL conversion), a scientific calculator, currency and unit converters, and several Fun & Misc tools
• api/cache-prune.php cron script

• SSRF protection added to all network API endpoints
• Image dimension validation (40MP cap) to prevent oversized uploads
• Content-Security-Policy and Permissions-Policy headers added

• Nine network tools with live API endpoints
• Eleven image tools via PHP GD
• Category listing pages

• stux.tools and www.stuxs.tools now redirect to the canonical domain

• PHP router and ToolRegistry, with the first 26 client-side tools
• Light/dark theme, Font Awesome bundled locally, dynamic Open Graph image generation
• About, Privacy, Terms, and 404 pages; Coming Soon and Maintenance modes