=== SimsClaw ===
Contributors: simsclaw
Tags: seo, performance, schema, metadata, optimization
Requires at least: 6.4
Tested up to: 7.0
Requires PHP: 8.1
Stable tag: 1.0.0
License: GPL-2.0-or-later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Applies approved, reversible SimsClaw SEO and performance changes without editing your theme or saved content.

== Description ==

SimsClaw is the WordPress companion for the SimsClaw platform. It applies changes that a site owner has approved in SimsClaw while keeping the original WordPress theme, posts, and pages untouched.

Supported changes use a closed, structured set of operations:

* JSON-LD structured data;
* descriptions, robots directives, canonical links, Open Graph, and Twitter metadata;
* language-alternate and preconnect links;
* bounded image and accessibility attributes;
* limited, sanitized content replacements; and
* same-site page redirects.

The plugin does not accept arbitrary JavaScript, CSS, PHP, or raw head markup.

= Site-owner control =

* **Approved:** The SimsClaw platform sends only the exact change approved by the user.
* **Non-destructive:** Changes are layered onto rendered output. Theme files and saved post content are not rewritten.
* **Reversible:** Disable one override, or pause all overrides, to show the original output again.
* **Auditable:** The WordPress Activity screen records applies, rollbacks, pauses, setup, and credential rotation without logging secrets.
* **Authenticated:** Mutating and health requests use HMAC-SHA256, a bounded timestamp, and a durable single-use nonce.

The native WordPress administration experience provides Overview, Overrides, Activity, and Settings screens. It shows live connection state, plugin/API versions, active change counts, human-readable change summaries, and clear safety controls.

SimsClaw is a service plugin. A SimsClaw account and a connected WordPress site are required to receive approved changes. The plugin remains inactive until you connect it from the SimsClaw platform.

Learn more at https://www.simsclaw.com/wordpress-plugin.

== Installation ==

1. Download `simsclaw.zip` from the WordPress Connections screen in your SimsClaw account.
2. In WordPress, open **Plugins → Add New Plugin → Upload Plugin**.
3. Choose `simsclaw.zip`, select **Install Now**, and then select **Activate Plugin**.
4. Return to **Settings → Connections** in SimsClaw and select **Connect plugin**.
5. Open **SimsClaw → Overview** in WordPress to confirm the connection and safety status.

The one-time connection exchange uses the WordPress Application Password already configured in SimsClaw. The shared signing credential is never displayed in the WordPress administration screens.

== Frequently Asked Questions ==

= Does SimsClaw edit my posts, pages, or theme files? =

No. The plugin applies approved changes when WordPress renders a public page. It does not rewrite your stored post content or theme files.

= Can SimsClaw add arbitrary scripts? =

No. The REST contract accepts only documented, structured directives. Arbitrary JavaScript, CSS, PHP, raw head markup, event-handler attributes, and executable URLs are rejected before storage.

= How do I undo one change? =

Open **SimsClaw → Overrides** and disable that override. The original page output returns immediately, and supported caches are purged for the affected scope.

= How do I pause every change? =

Open **SimsClaw → Settings** and select **Pause all overrides**. Saved overrides are preserved so you can resume later.

= What happens when I rotate credentials? =

The existing SimsClaw signing credential becomes invalid immediately. Reconnect the plugin from the SimsClaw WordPress Connections card before the platform can verify or apply another approved change.

= What happens when I uninstall the plugin? =

Data is preserved by default. To remove overrides, activity, replay records, and connection options during uninstall, first enable **Remove SimsClaw data when the plugin is deleted** under **SimsClaw → Settings**.

= Does the plugin collect analytics or track administrators? =

No. The plugin does not add visitor analytics, advertising pixels, or administrator tracking.

== Screenshots ==

1. Overview shows verified connection health, active overrides, safety status, versions, and recent activity.
2. Overrides provides plain-language summaries, target scopes, technical details, and reversible controls.
3. Activity records meaningful platform and administrator events without exposing credentials.
4. Settings separates connection status, global safety, uninstall retention, and credential rotation.

== External services ==

This plugin connects to the SimsClaw service at `https://www.simsclaw.com`. The service is required to propose, approve, and deliver WordPress changes.

During setup, the SimsClaw platform sends an authenticated request to this WordPress site using the WordPress site URL, username, and Application Password that the site owner previously supplied to SimsClaw. WordPress returns a plugin-generated signing credential to SimsClaw. Later requests from SimsClaw to this site contain an approval reference, target URL or site scope, and the structured change fields needed to apply the approved optimization. Health checks send signed request headers and receive plugin version, API schema version, supported directive names, and the global enabled state.

The plugin itself does not send visitor data, WordPress passwords, post content, or the signing credential to unrelated third parties. Site owners control what they provide to the SimsClaw platform and can revoke the WordPress Application Password or rotate the plugin credential at any time.

SimsClaw terms: https://www.simsclaw.com/terms

SimsClaw privacy policy: https://www.simsclaw.com/privacy

SimsClaw support: https://www.simsclaw.com/support

== Privacy ==

The plugin stores the following data in the WordPress database:

* a randomly generated signing credential;
* approved directive sets, target scopes, source references, versions, and enabled status;
* an activity history containing event names and safe technical metadata;
* hashed, expiring request nonces used to prevent replay; and
* setup, last-authenticated-request, global pause, version, and uninstall-preference options.

The plugin does not store the WordPress Application Password and never includes the signing credential in activity records or administration HTML. No visitor analytics or tracking cookies are added.

Data remains on the WordPress site when the plugin is deactivated. It is also preserved on uninstall unless the administrator explicitly opts into removal under **SimsClaw → Settings** before deleting the plugin.

== Bundled libraries ==

SimsClaw includes the following production libraries, installed through Composer and distributed under compatible MIT licenses:

* Masterminds HTML5, used for standards-aware HTML parsing and serialization: https://github.com/Masterminds/html5-php
* Symfony CSS Selector, used to translate validated CSS selectors for DOM matching: https://github.com/symfony/css-selector

Dependency source and license metadata are available at the linked upstream repositories. SimsClaw source is available from the Plugin URI above.

== Upgrade Notice ==

= 1.0.0 =
Initial public release candidate. Connect from SimsClaw after activation.

== Changelog ==

= 1.0.0 =
* Added native Overview, Overrides, Activity, and Settings screens.
* Added a strict structured-directive contract with no arbitrary executable injection.
* Added signed health verification, atomic replay prevention, reversible override controls, and global pause/resume.
* Added explicit uninstall retention, cache invalidation, and privacy/external-service documentation.
