Security hardening, WPCS fixes, and WP 7.0 compatibility confirmation (v1.0.1)

[miyanialkesh7]

Summary

Security hardening, coding-standards cleanup, and documentation improvements for CommentGate, with no functional or UX changes.

• Security: Stripe webhook signature verification now rejects signatures older than 5 minutes, closing a replay window where a previously captured, validly-signed webhook payload could be resubmitted later to mark payments as paid.
• i18n: the default payment/refund email subject and body strings (shown to admins before they customize them) are now wrapped in __() so they're translatable.
• Coding standards: the codebase is now clean against WordPress-Extra (0 errors/0 warnings) and PHPCompatibilityWP for PHP 7.4–8.3 (0 errors), via phpcbf auto-fixes plus a couple of manual fixes (short ternaries, a false-positive base64_encode() obfuscation warning — that call is PayPal's required OAuth2 HTTP Basic Auth encoding, not obfuscation, now annotated accordingly).
• Docs: added PHPDoc blocks to previously undocumented methods across all includes/ classes.
• WordPress 7.0: confirmed compatible; readme.txt already declared Tested up to: 7.0 and needed no change there.
• Version: bumped to 1.0.1 (plugin header, COMMENTGATE_VERSION, readme.txt Stable tag, changelog/upgrade notice) and expanded the readme.txt short and long descriptions.
• load_textdomain() was already absent from the codebase, so there was nothing to remove for the WP 5.8 deprecation. The languages/ directory (with its standard index.php stub) is unrelated to that call — it exists to match the Domain Path: /languages plugin header and is left as-is.

No test files or editor/tooling folders are included in this diff.

Files changed

• commentgate.php — version bump
• readme.txt, README.md — version, contributor, compatibility, and description updates
• includes/class-commentgate-stripe-gateway.php — webhook replay-window fix + docblocks
• includes/class-commentgate-settings.php — i18n fix for default email strings + docblocks
• includes/class-commentgate-payments-table.php, class-commentgate-paypal-gateway.php, class-commentgate-comment-gate.php, class-commentgate-admin-payments.php, class-commentgate-webhooks.php, class-commentgate-plugin.php, class-commentgate-cli.php — formatting/docblock-only changes

Test plan

• php -l on every changed PHP file — no syntax errors
• phpcs --standard=WordPress-Extra across the plugin — 0 errors, 0 warnings
• phpcs --standard=PHPCompatibilityWP --runtime-set testVersion 7.4-8.3 — 0 errors
• Smoke-tested against a local WordPress 7.0.1 install via WP-CLI:
  • Activated the plugin; confirmed the wp_commentgate_payments table is created with the expected schema and commentgate_db_version updates correctly
  • Rendered all 5 admin dashboard tabs (General Settings, Transaction History, Payment API Configuration, Email Settings, Appearance) with no errors
  • Confirmed the frontend payment gate correctly locks the comment form on a protected post
  • Simulated a full Stripe webhook cycle: a freshly-signed checkout.session.completed payload correctly marks a payment paid; replaying the same payload with a signature timestamp 10 minutes old is now correctly rejected (400 Invalid signature) instead of being processed again; a payload signed with the wrong secret is rejected
  • Exercised the wp commentgate status/settings/payments CLI commands
  • Cleaned up all test data and restored the plugin to its original (inactive) state afterward