=== PageSoar Connector ===
Contributors: pagesoar
Tags: seo, yoast, structured data, search
Requires at least: 5.8
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 2.2.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Lets PageSoar publish the search improvements you approve, with a log of every change and an undo.

== Description ==

PageSoar finds what holds your pages back in Google and drafts the fixes. A person approves each one in PageSoar. This plugin is how an approved fix reaches your site.

It can change:

* Search titles, descriptions and the hide-from-Google setting of pages and posts
* Page text and headings, saved as a WordPress revision you can compare and restore
* Image alt text
* Structured data Google reads: FAQ, breadcrumbs, and the awards you confirm
* PageSoar's heat map script on your public pages, once you turn heat maps on

It can never:

* Publish a draft, or delete anything
* Change users, plugins, themes or site settings
* Add any other script, or unfiltered HTML
* Save over a page somebody has open in the editor

PageSoar signs in as its own user, pagesoar-connector, with a key made for this site when you connect. It never uses your login, and it needs no application password. Every change it makes is listed in Settings, PageSoar, where you can undo it, pause PageSoar, or disconnect it.

== External services ==

This plugin connects to PageSoar, a hosted service at https://pagesoar.com run by Skail Consulting LLC. It is what the plugin is for: without it the plugin does nothing.

What is sent, and when:

* When you press Connect: the connection code you pasted, this site's address and home address, the name of the PageSoar service user, the key made for PageSoar, and the versions of the plugin, WordPress, PHP and your SEO plugin. Sent to https://pagesoar.com/connector/v1/pair.
* When you press Check with PageSoar, or Disconnect, or deactivate the plugin: this site's PageSoar token and home address, and for a check the same versions. Sent to https://pagesoar.com/connector/v1/ping.
* When WordPress checks for plugin updates (about twice a day): a request for https://pagesoar.com/connector/latest.json, and the update's download when you install one. Nothing that identifies your site is sent.

PageSoar also calls this site's REST API with its key, to read pages and to make the changes a person approves in PageSoar.

Heat maps, only once you turn them on in PageSoar: every public page loads PageSoar's visitor script from https://pagesoar.com/heat/v1/ (an address made for your site), and each visitor's browser sends one short report per page view to https://pagesoar.com/heat/v1/e: the page's path, the screen width, how far down the page the visitor scrolled and where they clicked. Never what anyone types, the text on the page, the visitor's IP address or any cookie; it sets no cookie, and it does not run for a browser that sends Do Not Track or Global Privacy Control. What is kept and for how long: https://pagesoar.com/privacy#privacy-heat

Terms of Service: https://pagesoar.com/terms
Privacy Policy: https://pagesoar.com/privacy

== Installation ==

Start with your test site.

1. In WordPress: Plugins, Add New Plugin, Upload Plugin. Choose pagesoar-connector.zip, press Install Now, then Activate. WordPress opens Settings, PageSoar.
2. Copy the connection code from PageSoar's Connect screen, paste it, and press Connect.
3. PageSoar checks the connection by itself. Its Connect screen turns green.

Sites deployed from git (WordPress VIP and similar): commit the pagesoar-connector folder to your plugins folder and load it with mu-loader.php (copy it into mu-plugins), then deploy it to each environment, staging and production. Each environment is paired on its own, with its own code from PageSoar.

When production is cloned into staging, staging's copy of the connection stays with production and does nothing on staging: Settings, PageSoar says the site is a copy. Paste a new code made for staging.

== Frequently Asked Questions ==

= Does PageSoar get my password? =

No, and it needs no application password either. Connecting makes a separate user for PageSoar with only the permissions listed above, and a key for this site that only PageSoar holds; WordPress keeps just a fingerprint of it. Disconnecting, here or in PageSoar, deletes it.

= What happens if I deactivate the plugin? =

PageSoar's key is deleted with it, so nothing can use it unguarded. Activating again needs a new code.

= How does it update? =

Like any plugin, from the Plugins screen. Updates come from PageSoar, and each download is checked against its published SHA-256 before it is installed. The update check sends nothing that identifies your site.

== Changelog ==

= 2.2.0 =
* Heat maps: when you turn them on in PageSoar's Connect screen, the Connector adds PageSoar's visitor script to your public pages, loaded async. It accepts no other script address, Settings, PageSoar shows whether it is on and turns it off, and the change is in the log with an undo.

= 2.1.0 =
* PageSoar can now make a redirect for a page that is gone when the site runs Safe Redirect Manager or Rank Math (Redirections module on). It lists the redirects there so it never doubles or chains one, and it removes only a redirect it made itself. A site running the Redirection plugin is served as before.

= 2.0.2 =
* PageSoar can now upload a new image into the media library (a generated social-share card), for use as a page's share image. It still never changes or deletes an existing attachment beyond its alt text.

= 2.0.1 =
* A site that cannot install plugin updates itself (WordPress VIP, or any site with file changes switched off) is no longer asked about new versions: the plugin stops checking with PageSoar there, since the update would come through your own deployment.

= 2.0.0 =
* Everything is named PageSoar now: the plugin folder and file (pagesoar-connector), its settings, its keys, the request header (X-PageSoar-Key), the REST address (pagesoar/v1) and the service user. It calls PageSoar at https://pagesoar.com.
* This is a new plugin to WordPress, not an update of the old one: install it, connect it again with a new code from PageSoar, then deactivate and delete the older PageSoar Connector (version 1.x). The two can be active together while you switch, but only the new one is connected to PageSoar.

= 1.3.0 =
* The plugin is now called PageSoar Connector. Nothing about how it connects changes: the plugin folder, the service user, the settings and the keys keep their names, so a site that is connected stays connected.

= 1.2.0 =
* When connecting does not work, the screen says why, in PageSoar's own words, and what fixes it: a wrong or expired code, a site PageSoar does not know, the site unable to reach PageSoar, or PageSoar unable to reach the site. The reason stays on the screen until the next try.
* PageSoar's Connect screen shows the site's name once it is connected.

= 1.1.0 =
* Connecting needs no application password: the plugin makes a key for PageSoar, sent in its own header, so sites with application passwords switched off, or a host that drops the Authorization header, connect too.
* PageSoar can disconnect itself from its Connect screen, and the key stops working here at once.

= 1.0.0 =
* First release: pairing by code, health checks, the change log with undo, pause, structured data and awards.
