=== AIUNSEEN AI Readability & SEO ===
Contributors: aiunseenstudio
Tags: seo, audit, llms, ai-readability
Requires at least: 6.9
Tested up to: 7.1
Requires PHP: 8.2
Stable tag: 0.1.15
License: GPL-2.0-or-later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Audit AI readability and technical SEO, review recommendations, and use paid hosted audits to generate verified AEO files for optional publication.

== Description ==

AIUNSEEN AI Readability & SEO connects WordPress to AIUNSEEN Studio's hosted audit service. It checks public pages, machine-readable resources and SEO issues. Auditing and AI review run on the service, not on your WordPress host. This is not an offline crawler.

= Before you buy or install =

* Requirements: WordPress 6.9+, PHP 8.2+, Tested up to WordPress 7.1, and an administrator account. Self-service supports root, single-site public HTTPS installations without an explicit port in the URL, using the standard /wp-admin/tools.php path. Public REST verification and outbound HTTPS to the hosted service must work. Multisite, subdirectory installations and private/local sites are unsupported. WooCommerce is optional.
* Hosted dependency: auditing, AI review, reports and ZIP generation require AIUNSEEN Studio's service and its availability. No Node.js, shell access or your own OpenAI/Stripe API keys are required on the WordPress host. Activation alone does not connect or start an audit; an administrator must review the disclosures and connect the site.
* Separate charges: buying or downloading the plugin does not include paid audit credits. Hosted one-off credits cost $10 for up to 300 public content pages or $20 for up to 700; these are not subscriptions. The free audit covers up to 20 pages and is report-only. Page allowances are maxima, not guaranteed coverage.
* Publication: Auto Publish requires PHP ZipArchive, valid-TLS same-site HTTPS loopback requests, readable directory checks and enough database/resource capacity for the bundle and previous revision. ZIP bytes and declared expanded content each have a 10 MiB limit. Preview and explicit administrator approval are required; existing files or occupied routes block publication, with no overwrite or merge. Manual installation requires separate conflict review and backups.
* Included package: WordPress plugin PHP source, dashboard assets, the languages/aiunseen-audit.pot translation template, readme documentation and GPL-2.0-or-later license. The hosted backend is not included. Reports and paid AEO ZIPs are generated per audit, not prebundled. The interface/report framework is translation-ready; generated findings and evidence remain English. AI review is targeted, not exhaustive; file verification is not a guarantee of factual accuracy, rankings, traffic or AI citations.
* Retention: hosted free reports expire after 5 days, paid reports after 30 days and ZIP downloads after 7 days, measured from completion (reports without a completion date use creation). Downloaded copies and local publications do not expire with hosted content. These periods are not blanket deletion of installation records, audit metadata, payment/credit history, logs, backups or provider records; see the retention details below.

= Audit workflow and plans =

The workflow combines public-page auditing, checks for conflicting business information in AI-readable resources, targeted paid AI review, and verified AEO file generation. Reports group SEO and AI-readability findings by severity. Optional administrator-approved publication serves the generated public files through WordPress, with rollback for a plugin-managed release. All report fields returned by the service are displayed without a separate local paid-feature filter. Security, file verification and expiry checks still apply.

Hosted audit options (USD, one-off credits, not subscriptions):

* Free: up to 20 public content pages; report only, without AI review or ZIP.
* $10: up to 300 public content pages, targeted AI review, detailed report and verified ZIP.
* $20: up to 700 public content pages, with the same features and a larger crawl allowance.

Charges pay for hosted processing, not for unlocking locally included plugin code. Checkout is available only when enabled by the service. Page limits are maxima, not guaranteed coverage; permissions, discovery, failures and resource limits affect results. Additional resource and link checks are bounded. The hosted free allowance is two accepted jobs per registrable domain per UTC day, shared by its subdomains and including failed jobs, separate from the public website's allowance. Only one audit per installation can be queued or running at a time.

A matching credit is reserved when a paid audit starts. Paid delivery requires both a report and verified ZIP. After at most two attempts, terminal failure places the returned credit on hold for support review. A held credit is not immediately reusable and is not a cash refund. Each credit has a limited lifetime AI allowance; retries and support review do not reset it or guarantee another attempt.

AI review prioritizes selected findings, not every page or claim. Evidence checks recheck up to five detected price conflicts and five sampled broken same-site links. Blocking results prevent AI review for that attempt. A verified ZIP has passed implemented checks against observed evidence; it is not certification of every fact. Rankings, traffic, recommendations and AI citations are not guaranteed.

== Languages ==

The dashboard, report headings, controls, local errors and publishing instructions are translation-ready using the aiunseen-audit text domain. A translation template is included in languages/aiunseen-audit.pot. Translations must be supplied separately; translation readiness does not include complete language packs. Generated report findings, evidence and hosted-service messages remain in English for now. Hosted completion emails and generated AEO files are not translated by the plugin's interface catalogs.

== External Services and Privacy ==

= AIUNSEEN Studio =

Activation alone sends no data. An administrator must review the disclosures and choose Connect my site. Connection sends the public site address, a site-scoped credential and temporary verification challenge over HTTPS to https://audit-api.aiunseenstudio.com. The service verifies a temporary public WordPress REST response. Connecting does not start an audit. Connected dashboard visits check the connection; audit, status, report, ZIP and checkout requests contact the service as needed. Protect the stored credential in your WordPress database and backups.

Starting an audit authorizes remote fetching and processing of public URLs, page content and resources. The service also processes findings, audit identifiers, installation and credit/payment history, and generated files. Do not submit private content. The crawler does not sign in to WordPress. Administrators do not provide WordPress passwords or OpenAI/Stripe API keys.

* [AIUNSEEN privacy information](https://audit-api.aiunseenstudio.com/privacy)
* [AIUNSEEN service terms](https://audit-api.aiunseenstudio.com/service-terms)

= OpenAI =

For paid AI review, the hosted service contacts https://api.openai.com/v1/responses and its input-token counting endpoint. It sends selected finding titles, numeric identifiers, priorities and observation counts, not raw page text, URLs or extracted evidence. Response storage is disabled for these requests, but this is not a promise of zero provider retention. OpenAI's applicable terms and data-handling policies still apply.

* [OpenAI privacy policy](https://openai.com/policies/privacy-policy/)
* [OpenAI services agreement](https://openai.com/policies/services-agreement/)
* [OpenAI API data controls](https://platform.openai.com/docs/guides/your-data)

= Stripe =

When you choose to buy a credit, the hosted service creates a checkout session through https://api.stripe.com and redirects your browser to https://checkout.stripe.com. It sends the selected tier, USD amount, internal checkout reference and WordPress return URL. Payment details are entered at Stripe, not in the plugin. The service retains payment references and credit, refund and dispute history.

* [Stripe privacy policy](https://stripe.com/privacy)
* [Stripe services agreement](https://stripe.com/legal/ssa)

= Retention and optional email =

Free reports expire five days after completion; paid reports expire after 30 days. Reports without a completion date use their creation date. ZIP downloads expire seven days after completion, independently of reports. Expired content is immediately unavailable; stored content cleanup runs at service startup and hourly. Structured audit diagnostics are pruned after 30 days.

Installation records, audit metadata, credit/payment history, lifetime AI allowances, service logs, backups and provider records do not share these expiry periods. There is no automatic blanket deletion of hosted account history. Contact support about hosted deletion or credential revocation. Downloaded copies and local publications do not expire with hosted reports.

Hosted completion email is optional for each audit and offered only when the service advertises direct notification mode and availability. Select "Email me when this audit finishes", type an address in the initially empty optional field, and choose Yes in the local Yes/Edit dialog. Edit returns to the field without starting an audit. Unchecked or blank means no email; an invalid typed address must be corrected or cleared. Only the exact address you type and approve is sent over verified HTTPS in the private audit POST. No account or Administration Email Address is used automatically. The address is not placed in URLs, analytics, browser storage, public reports or publication files. Older services show email as unavailable; new audits never fall back to local WordPress mail. Without JavaScript, the field stays visible and the server provides the same Yes/Edit review before starting.

The hosted mail server handles completion delivery and queued retries. No inbox verification, SMTP keys or mail plugin are needed in WordPress. A sent status means sender acceptance, not guaranteed inbox delivery. WordPress scheduled tasks still track audit status for the sidebar for up to two days, independently of hosted email. Previously queued WordPress events now track status only and never send mail.

== Installation ==

1. Upload the aiunseen-audit folder into wp-content/plugins, or install its ZIP through Plugins > Add New > Upload Plugin.
2. Activate AIUNSEEN AI Readability & SEO. Minimum requirements are WordPress 6.9 and PHP 8.2; Tested up to remains WordPress 7.1. Use current security-patched versions, not the historical patch versions used for testing. See Compatibility below for the tested combinations and limits.
3. Open AIUNSEEN AI Readability & SEO in the main WordPress admin sidebar with an administrator account. The previous Tools address remains available for existing links and payment returns.
4. Review external processing and choose Connect my site. Self-service requires a single-site installation at the domain root, public HTTPS without an explicit port in the URL and the standard /wp-admin/tools.php location. Its public REST verification endpoint must be reachable without stale caching or firewall interference, and outbound HTTPS to the hosted service must be allowed. Multisite, subdirectory and private/local domain layouts are unsupported.
5. Start a free audit or buy a matching hosted credit when checkout is available. Publishing files requires separate administrator approval.

No shell, Node.js or service API keys are required on the WordPress host. Publication requires PHP ZipArchive, readable directory checks, database capacity for the bundle and previous revision, and working same-site HTTPS requests with valid TLS certificates. Both ZIP download and total declared expanded content are limited to 10 MiB each. Host memory, database, request-time and caching limits can prevent publication. Operator-configured recovery does not establish support for other layouts.

== Compatibility ==

Local branch tests passed six check groups on each combination below, using the earlier UI:

* WordPress 6.9.4 / PHP 8.2.31 and 8.3.31.
* WordPress 7.0.4 / PHP 8.2.33 and 8.3.33.
* WordPress 7.1.4 / PHP 8.2.35 and 8.3.36.

The exact minimum pair, WordPress 6.9 (initial 6.9.0 release) / PHP 8.2.0, also passed all six groups before and after the earlier UI changes. The download and publishing UI in earlier releases passed ten browser checks on that exact pair, including download, explicit publication approval, rollback, failure handling and layouts down to 320px. These historical checks do not establish an exact-minimum browser rerun of every later UI change. PHP 8.2.0 is old and unpatched; it was used only in an isolated local test environment, not as a public hosting recommendation.

These checks used mocked hosted responses and sample ZIPs, not live crawling, payments, AI review or inbox delivery. They do not establish compatibility with every host, later version, cache, firewall or resource limit. The latest UI has not been rerun across all six branch combinations. Multisite and subdirectory installations remain unsupported.

== Publication and Existing Files ==

= Download and install AEO files manually =

Open your ready paid audit and choose Download and install AEO files manually while the verified ZIP is available. Unzip it on your computer and read READ-ME.txt. In your hosting control panel's File Manager, open your website's main folder (the website root). Upload everything inside website-root, including the .well-known folder and its contents; upload the contents, not the website-root folder itself. Make sure hidden folders are visible.

If a destination already exists, stop and review the conflict before replacing anything. Back up existing files and approve any manual replacement separately. Never upload the whole ZIP, private-report.json, existing-catalogs.json or READ-ME.txt publicly. Manual changes are not covered by the plugin's rollback; restore your own backups if needed. If someone else manages your website, give them the files and these instructions to publish for you.

= Auto Publish AEO files =

In your ready paid audit, choose Check & Preview Publishing under Auto Publish AEO files. Review the checked public files and explicitly approve the preview; nothing goes live merely by opening it. Unavailable or expired packages cannot be published from that audit, and free audits are report-only.

For a routing failure, open Settings > Permalinks and click Save Changes without changing the existing selection, then retry Check & Preview Publishing. This is not a guaranteed fix and the plugin does not change your settings. If it still fails, ask your host to check routing, redirects, caching and secure loopback requests, or use the manual option after reviewing conflicts. Do not disable TLS verification or overwrite occupied paths.

Preview and approval apply to the exact archive, audit, site and current local publication. Publication checks these eleven fixed routes before proceeding:

* /agents.md
* /llms.txt
* /llms-full.txt
* /ai-sitemap.json
* /services.json
* /products.json
* /packages.json
* /pricing.json
* /actions.json
* /page-inventory.json
* /.well-known/agent.json

Existing files, symbolic links, occupied routes, unreadable directories or unverifiable responses block publication. Redirects also block it except supported WordPress trailing-slash normalization. The plugin does not overwrite or merge existing files, edit posts or write to the web root. Generated files are served virtually from the WordPress database only on exact, query-free GET/HEAD routes where WordPress would otherwise return 404. Private report and instruction files are excluded. Do not publish the entire downloaded ZIP.

After switching the bundle, the plugin checks live response types and file checksums. Failed checks attempt recovery only if that publication is still current; failed content may briefly be public. One previous local release is retained for rollback. Restoring it requires fresh checks; without a previous release, removing the local publication removes the virtual bundle. Caches and later routing changes can affect what visitors see, so removal does not guarantee a 404 everywhere. Manual installation needs separate review and backups.

Use Restore previous local publication when a prior managed release is available, or Remove local publication when there is no prior release. Review and approve the selected action; neither action restores physical files changed manually.

== Frequently Asked Questions ==

= What does disconnect do? =

Disconnect withdraws local connection consent and clears pending verification. It remains available during a hosted-service outage and retains the credential and publication so you can manage local state. Local publication controls remain available while disconnected; removing the local publication does not require a hosted connection. Disconnect does not revoke hosted credentials, cancel hosted audits, delete hosted history, refund payments or remove publications. Ask support for hosted revocation or recovery.

= What happens on deactivation or deletion? =

Deactivation cancels local status tracking and legacy local-mail events, clears the plugin's temporary site-verification and notification-tracking data, and withdraws connection consent without contacting the hosted service. It does not cancel hosted completion email already requested. It retains credentials and publication settings. Virtual publications stop serving while the plugin is inactive and may serve again after reactivation; connecting to the hosted service requires renewed consent.

Deleting the plugin through WordPress removes only this plugin's local options, temporary data and scheduled tasks for the current single site. It makes no hosted network calls and does not delete hosted history, cancel hosted jobs or issue monetary refunds. Physical website files are untouched. Multisite uninstall is unsupported. Arrange hosted deletion or revocation with support separately.

With persistent object caching, orphaned short-lived verification or notice entries can remain until their original expiry (up to two minutes). Cleanup removes the current pending proof explicitly and never flushes another plugin's cache.

= Do audit emails need WordPress SMTP configuration? =

No. Select "Email me when this audit finishes", type an address, and choose Yes in the local Yes/Edit dialog. No inbox verification is required. Edit lets you change the address without starting the audit; changing it requires another review. Blank or unchecked sends no recipient. The hosted mail server manages completion delivery and retries. No SMTP keys or email plugin are needed. Check spam folders if necessary; sender acceptance is not a guarantee of inbox delivery. If direct hosted email is unavailable, use the dashboard. Neither new audits nor older queued WordPress events send WordPress mail.

= Where can I get help? =

Use Contact support in the AIUNSEEN AI Readability & SEO sidebar screen, or the [AIUNSEEN contact page](https://www.aiunseenstudio.com/contact/). Include your audit reference and a description of the problem, never passwords, credentials or private customer data. No response time is guaranteed.

== Changelog ==

= 0.1.15 =
* Display connection failures inside the connection panel with accessible, prominent orange notices, including clear public HTTPS requirements for unsupported local environments.
* Stack distinct errors without replacing earlier messages; show audit, checkout, report, download and publication failures beside the relevant controls.
* Translate known hosted error codes locally, use safe fallback messages, and keep uncertain submission/payment outcomes explicit.
* Add bounded, administrator-scoped action error history to the latest-ten Activity view without storing error bodies or email addresses.
* Keep authorization, ownership, nonce, TLS and package validation checks unchanged.

= 0.1.14 =

* Clarify buyer-facing requirements, supported layouts, hosted dependency, separate audit charges, package contents, publication prerequisites and retention in the documentation.
* Documentation-only release; no runtime features, audit limits, pricing, publication behavior or retention policies changed.

= 0.1.13 =
* Make PHP and JavaScript interface strings and report framework translation-ready, preserving English report findings and evidence.
* Include a translation template and standard WordPress script translation loading.

= 0.1.12 =

* Use the distinctive AIUNSEEN AI Readability & SEO name while preserving existing dashboard routes and site connections.
* Display recommended actions and page coverage whenever supplied by the hosted report, without redundant local tier filters.
* Require POST for ZIP downloads in addition to existing administrator, nonce, site and package checks.
* Clarify the hosted workflow and retain external-service, privacy, pricing and verification disclosures.

= 0.1.11 =

* Show the daily free-audit limit warning in an orange notice above Start an audit, including its UTC reset time.

= 0.1.10 =

* Review directory scanner findings and document narrowly scoped exceptions for strict input validation and atomic security-sensitive storage.
* Extend regression coverage for exact recipient handling, proof requests, publishing and local cleanup.

= 0.1.9 =

* Show the two-free-audits-per-UTC-day allowance and midnight UTC reset in the free plan comparison.

= 0.1.8 =

* Match the publication panel to the connection panel, including the divider, rounded corners and green border.

= 0.1.7 =

* Group routine checkout, email and publication updates in an Activity tab showing the latest ten entries.
* Simplify publication status while retaining internal package-integrity checks, approval and rollback.
* Move the completion-email privacy explanation to FAQ; retain connection consent disclosures.

= 0.1.6 =

* Use an empty optional email field and local Yes/Edit review for hosted completion notices. Blank or unchecked sends no email.
* Remove inbox challenge delivery, automatic recipient fallback and WordPress email sending; retain status-only sidebar polling.

= 0.1.5 =

* Add explicitly opted-in hosted completion email availability.
* Display hosted delivery status while retaining independent sidebar tracking.

= 0.1.4 =

* Retain safe public page identifiers in hosted report evidence while hiding private query parameters.

= 0.1.3 =

* Add a main admin sidebar entry with per-administrator unread ready/failed audit notifications, independently of email opt-in.
* Make connection progress and the All audits button more visible, show available audits, and explain held returned allowances.
* Improve the plugin description and preserve legacy dashboard, checkout and report links.

= 0.1.2 =

* Lower declared minimums to WordPress 6.9 and PHP 8.2 after isolated compatibility tests; retain Tested up to 7.1.
* Clarify manual AEO installation, Auto Publish AEO files preview and approval, conflict handling and publishing failures; improve report and preview layouts on small screens.

= 0.1.1 =

* Prepare distribution metadata, include the complete GPL2 license and clarify hosted services, requirements and local cleanup.

= 0.1.0 =

* Initial release candidate with hosted audits, explicit connection, paid credits, verified ZIP and administrator-approved virtual publication with rollback.

== Upgrade Notice ==

= 0.1.15 =

Adds prominent, translatable connection and action-error notices, separate boxes for distinct errors, and privacy-conscious local Activity references. Unsupported local installations are explained before any connection request. Existing consent, authorization and publication checks remain enforced.

= 0.1.12 =

Renames the plugin, displays all supplied report fields and requires POST for ZIP downloads. Hosted tiers, prices, file permissions, connections and published files are unchanged.

= 0.1.11 =

The existing free-limit rejection now appears as a clear orange notice above the audit plans. Hosted limits, credits and publishing are unchanged.

= 0.1.10 =

Submission review preserves strict input validation, site-scoped authorization, publishing integrity and atomic storage. Prior reports, published files and hosted allowances are unchanged.

= 0.1.9 =

The free plan now displays its existing domain-wide daily allowance and reset time. Server enforcement and paid audits are unchanged.

= 0.1.8 =

Publication panel styling now matches the connected-site panel. Publishing controls and hosted audit allowances are unchanged.

= 0.1.7 =

Routine status updates move to Activity. Publication integrity checks and administrator approval remain unchanged. Previous reports, purchases and published files are preserved.

= 0.1.6 =

Type an optional completion email and approve it with Yes, or choose Edit. Blank or unchecked means no email. The hosted server sends only final ready/failed notices. WordPress mail and inbox challenges are not used. Existing reports and purchases are unchanged.

= 0.1.5 =

Optional completion emails use the hosted mail server in direct mode. Type an address and approve it locally with Yes, or choose Edit. Blank or unchecked means no email; no inbox verification or WordPress mail setup is required. Older WordPress events now track status only.

= 0.1.4 =

Hosted reports preserve public page identifiers without exposing private query parameters. No store settings are changed. Current completion notifications use only an explicitly typed and locally approved address through the hosted mail server.

= 0.1.3 =

Adds a main sidebar entry, clearer connection progress and audit notifications. Old Tools links and site connections remain valid. Sidebar updates depend on scheduled tasks and page refresh. Held allowances require support review.

= 0.1.2 =

Requires WordPress 6.9 and PHP 8.2; use current security patches. Review the AEO files before manual installation or explicit publishing approval. Existing paths remain protected; manual changes require your own backups. Hosted processing, privacy, retention and refund policies are unchanged.

= 0.1.1 =

Requires WordPress 7.1 and PHP 8.3. Deactivation withdraws connection consent; deletion removes local plugin data only. Hosted records require separate support requests.
