[cs1m0n]

Problem

After pressing Send site report now (Settings → BCC Login → Maintenance → Site report), there seemed to be no confirmation. The form posted back to the same page, which reloaded at the top. WordPress's common.js then moved the result notice under the page title, far from the button. People either missed it at the top or scrolled back down to the button and found nothing there.

Changes

• The report is sent in the page's load hook (load-settings_page_bcc_login), before anything is printed. The browser keeps showing the old page until the result is ready.
• While sending, the button is disabled, reads "Sending…" and shows WordPress's spinner. A disabled button isn't submitted, so a hidden field tells the handler which form was sent.
• The form posts to #bcc-login-site-report, so the page comes back to the Site report section.
• The result is an inline notice under the button. WordPress leaves notices with the inline class in place.
  • On success: The site report was sent. followed by the URL, versions, users and subscribers.
  • On failure: The site report could not be sent. followed by the reason (Auth0's error, the API's HTTP status, or a network error), escaped.
• After loading, a small script:
  • moves the focus to the result, so screen readers read it and keyboard users continue from there;
  • removes #bcc-login-site-report from the address, so the page's other forms (Delete subscribers, Flush Groups Cache), which post to the same address, don't return to this section.
• A page whose nonce has expired now says so ("The page had expired, so nothing was sent. Press the button again…") instead of showing nothing. That happens when the page was left open for a day, or loaded before logging in again.

The daily report is unchanged.

Testing

In a throwaway WordPress 7.0.2 with a mock Auth0 and a mock API, using the built JavaScript from the v1.2.16 release. Tested in headless Chrome, WebKit (Safari's engine) and Firefox:

• Before: v1.2.16 reloads at the top with the result under the page title and the button off screen.
• After: the result shows under the button, on screen and focused, for a success, an Auth0 403 (with <script> in its description, shown as text) and an API 401.
• While sending: during a 2.5-second send, the page keeps showing the disabled "Sending…" button and the spinner (DevTools screencast).
• Other cases:
  • A double-click sends one report.
  • It works without JavaScript, with the Enter key, in a 560-pixel-tall window and on a 390×844 phone.
  • Back after sending shows the button ready again, and Forward doesn't send again.
• Other forms: after a send, Delete subscribers still lands at the top with its own notice on screen.
• Access:
  • An expired nonce shows the message and sends nothing.
  • Subscribers, and non-administrators with manage_options, get no form and send nothing.
• Daily report: the daily cron and its 12-hour claim behave as before.

PHPStan with the CI config passes, and php -l passes on PHP 7.4 and 8.4.

🤖 Generated with Claude Code

[Copilot]

🟢 Approval recommended

The focused manual-report changes preserve authorization, nonce validation, and output escaping, with no unresolved findings.

No open issues 🎉

What changed in this PR

This PR improves feedback for manually sending a BCC Login site report by keeping the result beside the button instead of moving it to the top of the settings page.

Changes:

• Sends the report before page rendering and shows an inline success or escaped error message.
• Adds a sending indicator, returns users to the report section, and focuses the result.
• Explains expired nonces while preserving access checks and daily reporting behavior.

File	Description
plugins/​bcc-login/​includes/​class-bcc-login-site-report.php	Updates manual-send handling, progress feedback, inline results, and focus behavior.

_{Review effort: Balanced}