=== WingPilot – Your AI Site Consultant & Security Expert ===
Contributors: ilyag
Tags: ai, site management, security, seo, content
Requires at least: 6.0
Tested up to: 7.0
Requires PHP: 8.0
Stable tag: 1.1.2
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Connect WordPress to WPPilot — AI that reads your content, understands your business, and makes specific, reversible improvements through chat.

== Description ==

WPPilot is the WordPress plugin half of [WPPilot](https://getwppilot.com), an AI site manager that actually knows your site.

WPPilot reads every page, post, and plugin on your site, builds a structured model of what your site is and who it's for, then writes you a Briefing — a magazine-quality assessment of what's working, what isn't, and where to start.

**What WPPilot does once connected:**

* **The Briefing** — A deep, editorial-quality analysis of your site delivered in the first 90 seconds. Not a checklist. Not a score. A real assessment written in clear language, with specific recommendations you can act on immediately.
* **Conversational actions** — Ask WPPilot to rewrite a post title, improve an excerpt, update a meta description, fix typos in body content, or unpublish stale content. Every change shows you a preview first (current vs. proposed, with rationale), and every change can be rolled back with one click. Nothing happens without your approval.
* **Multi-site cockpit** — Manage multiple WordPress sites from a single WPPilot account. The cockpit at app.getwppilot.com shows each site's status, recent findings, and Briefing insights at a glance.
* **Watchtower monitoring** — WPPilot continuously watches your site for security issues, content drift, and structural problems. Findings surface in the cockpit with severity indicators and timestamps.
* **Activity feed** — Every action WPPilot takes is logged with timestamps in the cockpit. Roll back any change. Full transparency, full reversibility.
* **Safe by design** — The plugin itself is read-only by default. It collects site data (content, metadata, plugin list) and sends it to the WPPilot service for analysis. Write operations (content changes) go through explicit preview → approve → execute → rollback steps. You approve every write individually.

**What the plugin does locally:**

The plugin registers your site's REST API endpoints so the WPPilot service can read content and, when you approve an action, write changes. It maintains the secure connection (per-site cryptographic secret + JWT authentication) and provides the settings page where you manage the connection.

**Free tier included.** Install, connect, get your Briefing, try a few actions. No credit card required.

== External Services ==

**This plugin requires connection to the WPPilot service to function.**

This plugin connects to the WPPilot backend at **api.getwppilot.com** (operated by WPPilot). This is not optional — the plugin's core value (the Briefing, conversational actions, AI analysis, Watchtower monitoring) is provided by this external service. Without a connection, the plugin provides no standalone functionality.

**What data is sent to api.getwppilot.com:**

* Site URL, WordPress version, PHP version, active plugin list, active theme
* Post and page content (titles, excerpts, body text, metadata) — read via the plugin's REST API when the service requests it
* Site activity events (logins, plugin and theme changes, post edits, uploads) as they happen, so the service can show you an activity feed
* Security scanning data: a list of scannable files with their sizes, timestamps and fingerprints, and the contents of files that are new or have changed since the previous scan, so malware detection can run on the service
* WordPress admin email address (during the initial connection only, to create your account)

**When data is sent:**

* During the initial connection handshake (one-time)
* During periodic heartbeats (site health + metadata refresh)
* Continuously, as activity events occur on your site while it is connected
* During scheduled security scans (approximately daily)
* When the WPPilot service requests content via the plugin's REST API (e.g., to build the Briefing or preview an action)
* When you approve a write action in the SPA (the service sends the change back to the plugin's REST API)

**What is NOT sent.** File *contents* are transmitted only from the directories that hold distributed software — WordPress core, plugins, themes and must-use plugins — and only for code files. This is a property of where a file lives, not a guess about what is inside it, which is what makes it dependable.

Everything else is inspected **on your server**, and only the finding is reported. That includes:

* `wp-config.php` and any other configuration file — still checked for injected or malicious code, because that is exactly where such code hides; its contents are never sent, so your database credentials and WordPress security keys never leave your server.
* `.htaccess`, `.user.ini` and similar server configuration.
* Everything in your uploads directory.
* Every data file — `.json`, `.xml`, `.txt` — wherever it lives, since these are where exported settings, service-account keys and pasted credentials collect.
* Private keys, certificates and key stores; database dumps, SQL files and archives; `.env`, `.htpasswd` and similar credential stores. These are never read for content at all.

For those files, what travels is a statement rather than the file: for example "this file contains two `eval()` calls, the first on line 14". No file content, no values, no credentials.

Also never sent: WordPress user passwords or password hashes, and the contents of your database's options table.

Files whose contents stay on your server are still fingerprinted, so if one is added or altered you are still told.

**An honest limitation.** Within plugin and theme source code, which is transmitted, a developer who stored a credential directly in their own PHP file may have that line sent. WPPilot removes the ones it can recognise, but it cannot promise to recognise every name a developer might choose. Configuration files — where credentials actually belong, and where yours are — are covered by the boundary above rather than by that recognition.

**A free account is required** at [app.getwppilot.com](https://app.getwppilot.com) to use this plugin. Accounts are created automatically during the connect flow using your WordPress admin email address (which you can change during confirmation).

* **Service Terms of Use:** [https://getwppilot.com/terms](https://getwppilot.com/terms)
* **Privacy Policy:** [https://getwppilot.com/privacy](https://getwppilot.com/privacy)

== For Reviewers ==

To evaluate the full product experience:

1. **Install and activate** the WPPilot plugin on a test WordPress site. The test site must be publicly accessible from the internet (or tunneled via ngrok/similar) — the WPPilot backend needs to reach the site's REST API to read content and verify the connection.

2. **Connect.** Open **WPPilot** from the main wp-admin menu (it's a top-level item, alongside Plugins and Tools) and click **Connect to WPPilot**. This generates a per-site cryptographic secret, registers your site with the backend, and opens WPPilot in a new tab.

3. **Authorize.** In the new tab, an authorize screen shows the site requesting access. Click **Authorize** — that's the whole connection. (No secrets to copy or paste.) An account is created automatically using your WordPress admin email; you can confirm or change the email at this step.

4. **Experience the Briefing.** The AI reads your site and generates a Briefing — a detailed, site-specific analysis. This takes 60–90 seconds on first run.

5. **Try an action.** Ask WPPilot to rewrite a post title or meta description. You'll see a preview (current vs. proposed), approve it, and verify the change in WordPress. Then roll it back from the activity feed in the cockpit.

6. **Return visits.** Sign back in at [app.getwppilot.com/login](https://app.getwppilot.com/login) using your email — either with the password you set, or with a magic link emailed to you. Your cockpit shows all your connected sites at a glance.

**Manual fallback:** If you prefer (or for local debugging), the WPPilot admin page also displays your **Site Secret** with a Copy button (under "Connection details") — you can visit [app.getwppilot.com](https://app.getwppilot.com), choose to connect manually, and paste your site URL + secret instead.

**Testing multiple sites:** Multiple test sites can be managed from a single WPPilot account — connect each site via its own Authorize flow from its wp-admin, and switch between them from the cockpit at app.getwppilot.com.

No special reviewer tokens or demo modes are needed. The one-click authorize flow IS the reviewer experience. If you have questions during review, contact us at the email in the plugin header.

== Installation ==

1. Install directly from the WordPress plugin directory, or upload the `wingpilot` folder to `/wp-content/plugins/`.
2. Activate the plugin through the **Plugins** menu in WordPress.
3. Open **WPPilot** from the main wp-admin menu and click **Connect to WPPilot**. WPPilot opens in a new tab.
4. Click **Authorize** in the new tab. An account is created automatically with your WordPress admin email — confirm or change it. That completes the connection.

(Prefer to connect manually? The WPPilot admin page also shows your **Site Secret** with a Copy button under "Connection details", so you can paste your site URL + secret at [app.getwppilot.com](https://app.getwppilot.com) instead.)

Your Briefing will be ready in about 90 seconds.

== Frequently Asked Questions ==

= Do I need an account? =

Yes. A free account at [app.getwppilot.com](https://app.getwppilot.com) is required. The account is created automatically the first time you connect a site — you'll confirm your email address as part of the connect flow. The plugin connects your WordPress site to the WPPilot service; without the connection, the plugin has no standalone functionality.

= What data does the plugin send? =

Site metadata (URL, WordPress/PHP versions, plugin list, theme), content (titles, excerpts, body text) when requested by the service, activity events while your site is connected, and security scanning data. Your WordPress admin email is sent once, during the initial connection, to create your account.

Security scanning still reads the files attackers actually modify — `wp-config.php` included, since skipping it would make for a poor security product. What it does not do is send them. Files outside WordPress core, plugin and theme code are inspected on your own server, and only the finding travels: "this file contains executable code it should not", never the file. Private keys, database dumps, archives and credential stores are not read for content at all. See the full External Services disclosure above.

= Can WPPilot change things on my site? =

Only with your explicit approval. Every write action (title rewrite, meta description update, excerpt change, content edit, post status change) shows you a preview first. You approve or reject each change individually. Every approved change can be rolled back from the activity feed in the cockpit.

= Can I manage multiple sites from one account? =

Yes. Install and connect WPPilot on each WordPress site you want WPPilot to manage. All sites connected with the same account email appear in your cockpit at app.getwppilot.com.

= Can I disconnect at any time? =

Yes. Open **WPPilot** from the main wp-admin menu and click **Emergency Disconnect** (you'll be asked to confirm). This immediately revokes all tokens and stops all backend communication. The plugin becomes inert. You can also disconnect individual sites from the cockpit at app.getwppilot.com.

= Does the plugin work on localhost? =

For the full experience, your site needs to be accessible from the internet so the WPPilot backend can reach the plugin's REST API. For local development, you can use a tunnel service like ngrok to expose your local site.

= What WordPress versions are supported? =

WordPress 6.0 and above, tested through 7.0, with PHP 8.0 or higher.

= Is WPPilot free? =

Yes, there's a free tier — install, connect, get your Briefing, and try the conversational actions without a credit card. Paid tiers (Starter, Pro, Agency) unlock higher usage limits and additional capabilities; see [getwppilot.com](https://getwppilot.com) for current pricing.

== Changelog ==

= 1.1.2 =

* Tells WPPilot exactly which of its endpoints this build of the plugin serves, so your account knows what it can do here instead of guessing from a version number. The report lists this plugin's own registered endpoints and nothing else — no additional site content or personal data. When something is genuinely not available on your site yet, you are told to update the plugin rather than sent to look for a security plugin that was never blocking anything.
* Corrects the 1.1.1 note below: that release did add a writable surface — the in-place text editing used for Beaver Builder and Bricks pages. Every write still goes through preview, your approval, and rollback.

= 1.1.1 =

* Reports whether a WPPilot Advanced Actions module is present on this site, so your WPPilot account can tell you truthfully what it can and cannot do here.
* Read-only and passive: this plugin does not install, download, activate or verify anything, and adds no new writable surface.

= 1.1.0 =

* Security scanning no longer sends your configuration files. File contents are now transmitted only from WordPress core, plugin, theme and must-use-plugin directories — distributed software that holds no secrets of yours. `wp-config.php`, `.htaccess`, your uploads and every data file are inspected on your own server instead, and only the finding is reported, so database credentials and security keys never leave the site. Previously these files were sent in full.
* Files whose contents stay local are still fingerprinted and still checked for injected code, so a tampered configuration file is still detected and reported.
* Private keys, certificates, database dumps, archives, `.env` and `.htpasswd` are never read for content.
* Removed the database-content scanning endpoint. It could return the values of every autoloaded WordPress option, which is where other plugins keep their own API keys, and nothing used it.
* Hardened scan path containment so a request can no longer reach outside the WordPress directory by way of a similarly named sibling directory or a symbolic link.
* Opening the WPPilot cockpit or your Briefing from wp-admin now signs you in securely and lands on the page you asked for, instead of sometimes stopping at a sign-in screen that asked you to paste your site secret.
* A WordPress administrator is no longer assumed to be the WPPilot account holder. Account access requires a WPPilot sign-in that establishes the link once; the site's admin email address is never used to guess who somebody is.
* Replaced the "Since connecting" counters, which were not measuring what they claimed. The admin screen now shows the site's real recent WPPilot activity, and says plainly when the service cannot be reached instead of reporting zero.

= 1.0.16 =

* Accepts the details block, so a page or post containing an FAQ can be saved. Previously such a draft was prepared, reviewed and approved, and then refused at the moment of writing.
* Keeps the details and summary markup intact on save, so an accordion is not quietly flattened into loose text on older WordPress versions.
* Copies images in approved content into your own media library, so a published page owns its pictures instead of linking to a third-party service for ever.
* Reports each object's registered type when content is read, so content added to a custom post type is written to the right surface.

= 1.0.15 =

* Says explicitly when a request is refused because the site no longer recognises WPPilot, so a broken connection is never confused with a permission WordPress declined for that one operation.
* Tells WPPilot the pairing has ended when the plugin is deleted, so the site is not left listed as connected.

= 1.0.14 =

* Adds a read-only theme-style endpoint so generated content can be composed in the active theme's own palette, typography and layout instead of an invented one.
* Reports which core blocks and block styles this WordPress registers, so generated content only uses blocks the editor recognises.

= 1.0.13 =

* Adds explicit publication-status support when creating prepared content.
* Reads back the created post status so unsupported plugin contracts cannot be reported as successful.

= 1.0.11 =

* Supersedes 1.0.10 with menu inspection and guarded editing endpoints for existing menu items.
* Adds menu and menu-item fingerprints so stale or structurally moved items are refused instead of edited.
* Supports relabeling existing items and repointing existing custom-link items; adding, removing, reordering, nesting, and menu assignment changes remain unsupported.
* Reads back the stored WordPress menu item after every write.

= 1.0.10 =

* Fixes Elementor reads when WordPress returns `_elementor_data` as a deserialized PHP array: arrays are re-encoded as JSON, while unsupported or unencodable values are refused instead of being string-cast to `Array`.
* Removes the 1.0.9 slash-unslashing fallback. Production diagnosis showed the live failure was the unsafe PHP array cast, not slash escaping; the earlier fallback could not repair that class of corruption.
* Applies safe postmeta conversion to the remaining metadata readers so array-valued filters or migrations cannot silently become the string `Array`.

= 1.0.9 =

* Adds explicit ordering direction and status filtering to content queries, including filtered search for drafts and other non-published content.
* Preserves each site's registered post-type labels and supports custom post types in content discovery and progress reporting.
* Added a provisional slash-escaped Elementor `_elementor_data` fallback. This was superseded in 1.0.10 after production diagnosis showed the actual failure was an unsafe PHP array cast, not slash escaping.

= 1.0.7 =

* Add post permalinks to content responses for direct page links in the app.

= 1.0.6 =
* Adds capability-detected layered cache purging after successful content writes and a one-time redirect to the WPPilot connect page after activation.

= 1.0.5 =
* Adds draft page and post creation support, capability checks and structure-aware validation for content writes, plus an automatic compatibility migration for existing connections.

= 1.0.4 =
* Content search now matches a page or post by its URL slug (not just its title), with fuzzy word matching, so naming a page by its address — or the closest thing to it — finds it.

= 1.0.3 =
* Content search now includes your unpublished work (drafts, pending, scheduled, private) so a page or post you just created is findable the moment you name it in chat.

= 1.0.2 =
* New REST endpoints for surgical, reversible builder edits: Elementor page content (`_elementor_data`) and image alt text (`_wp_attachment_image_alt`).
* All new endpoints use capability + callback-token permission checks, sanitize input and escape output — no direct file writes.

= 1.0.0 =
* Initial public release.
* Site connection with per-site cryptographic secret and JWT authentication.
* One-click "Connect to WPPilot" authorize handoff (single-use, short-lived token), with manual site-secret paste as a fallback.
* Account creation on connect: confirm or change your admin email, set a password (or use magic-link login).
* Multi-site cockpit at app.getwppilot.com — manage all your WordPress sites from one place.
* The Briefing: 60–90 second AI-generated, magazine-quality site analysis.
* Conversational actions with preview/approve/rollback: title rewrites, meta description rewrites, excerpt rewrites, body content edits (anchored find-and-replace), and post status changes.
* Page builder detection (Elementor, Divi, Beaver Builder, WPBakery, Brizy, Oxygen) with graceful refusal and manual-edit guidance.
* Watchtower monitoring with severity-tagged findings surfaced in the cockpit.
* Admin settings page with connection status, site secret display, and emergency disconnect.
* REST API endpoints for backend content access (posts, pages, metadata, status).
* Heartbeat system for ongoing site health monitoring.
* Abilities API integration (WordPress 6.9+) with graceful degradation.
* SEO plugin detection (Yoast, Rank Math, All in One SEO, SEOPress, The SEO Framework).
* Full WP.org Plugin Check compliance (0/0 errors/warnings).

== Upgrade Notice ==

= 1.1.2 =
Your site now tells WPPilot which endpoints it actually serves, so WPPilot stops inferring that from a version number. No additional site content or personal data is collected; this release reports which WPPilot endpoints the plugin itself has registered, and adds no new way to change your site.

= 1.1.1 =
Lets WPPilot tell you honestly what it can and cannot do on this site. This release only reports whether an Advanced Actions module is present — it installs nothing, downloads nothing, and adds no new way to change your site.

= 1.1.0 =
Security and privacy release. Your configuration files — including wp-config.php — are now inspected on your own server and no longer sent to the service, while still being checked for injected code. Opening WPPilot from wp-admin now signs you in and lands on the right page.

= 1.0.0 =
First public release. Install, connect, and get your first Briefing.
