=== wpShadow ===
Contributors: thisismyurl
Tags: seo, accessibility, security, broken links, site health
Requires at least: 6.0
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 0.6298
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Run free website checks from your WordPress dashboard: titles and descriptions, broken links, page speed, accessibility and security.

== Description ==

wpShadow puts [Shadow Steward](https://shadowsteward.com/)'s website checks inside your WordPress dashboard. Pick a page, press Run, and read what is wrong in plain language, with what to do about it.

**Five checks, free, with no account:**

* **Titles and descriptions.** How your title and search description look in Google, what to fix, and three better titles and two better descriptions written for you.
* **Broken links.** Up to 60 links on the page, opened the way a visitor would. Broken links, detours and links that refuse automatic visits are listed.
* **Page speed.** Server response, page weight, big pictures, blocking scripts, compression, caching and outside services.
* **Accessibility.** Alt text, link and button names, form labels, headings, zoom, page regions and more, with examples of what to fix.
* **Security.** https, security headers, cookie flags, insecure files and software version disclosure. It only reads what your site already tells every visitor and never probes or attacks anything.

You can run them on your home page or on any published page or post. Results stay in your dashboard.

**One more check that runs inside WordPress and sends nothing:**

* **WordPress site health.** Looks at your site's own settings and database: launch mistakes (search engines asked to stay away, plain permalinks, http address, debug errors showing), updates and versions (an unsupported PHP version, waiting updates, unused plugins), database weight (the settings loaded on every page, old temporary data, late scheduled tasks), accounts and exposure (a user named "admin", open sign-up with a strong role, visible usernames) pictures with no alt text, backups and outgoing email (a known backup plugin and how recent its last backup is, and whether your domain publishes SPF and DMARC records), caching (a cache plugin installed, or two that conflict), comments (open comments with no spam protection or moderation), links in your posts to pages that are unpublished and pictures that are missing, and WooCommerce (shop pages set, checkout page in place, cart and checkout kept out of the cache). It runs in the plugin and changes nothing. An optional link under the card also looks up each active plugin on WordPress.org to find ones that were closed or not updated for two years.

**Paid checks, only if you add them:**

Two more checks need a Shadow Steward account because they use AI. You will only be asked about them if you open "Want more? Add paid checks".

* **Full SEO report.** All 31 SEO checks on your home page with a plain-language summary. 8 credits (about US$0.08).
* **Image check with AI alt text.** Choose an image in your media library and get alt text, a title, a caption, tags and a better file name. Save the alt text on the image with one click. 3 credits (about US$0.03) per image.

Credits start at US$10 for 1,000 and never expire. You pay only for the checks you run.

**About the free allowance:** free checks are rate limited to protect the quality of the service for everyone. There is a daily limit per site and an hourly limit per tool, a site that has just connected starts with fewer a day for its first two days, and the limits can change. The dashboard always shows how many are left.

**What wpShadow does not do:** it does not change your site. It reports, and you decide. It does not run in the background, add anything to your public pages, or show ads.

== External services ==

wpShadow connects to one service, **Shadow Steward** (shadowsteward.com), which runs the checks. It is operated by the plugin's author.

* **When:** only after you press Run on a free check, or save a Shadow Steward key to use the paid checks. Nothing is sent when the plugin is installed or activated, and nothing is sent in the background.
* **Free checks, first run:** your site's home address, the plugin version and your WordPress version are sent once to connect the site. Shadow Steward then asks your site for a one-time code at `/?rest_route=/wpshadow/v1/verify` to confirm you control the address. The free checks run only on your own website.
* **WordPress site health:** nothing is sent to Shadow Steward. It runs inside your site. It makes one request from your site to its own address, to see whether usernames are visible, and looks up the DNS records (SPF and DMARC) of your own domain. If you press "Also look up plugin ages on WordPress.org" and confirm, it asks WordPress.org about the folder name of each active plugin, the same thing WordPress does when it checks for updates. Nothing else is sent.
* **Each free check:** the address of the page you chose, on your own site. Shadow Steward reads that public page the way a visitor's browser would. The page is not stored.
* **Paid checks:** your Shadow Steward key, and for the SEO report your home address, or for the image check the public address of the image you chose, its file name and your site name.
* **What Shadow Steward keeps:** your site's address, the plugin and WordPress versions, and a count of free checks run (to apply fair-use limits). Refused or suspicious requests are logged for a few weeks with a one-way fingerprint of the connection, never its address. Pages and results are not kept. Disconnect in the dashboard, or delete the plugin, to remove the site and its counts.

Terms: https://shadowsteward.com/terms/ · Privacy: https://shadowsteward.com/privacy/ and https://wpshadow.com/privacy/

== Installation ==

1. Upload the plugin or install it from the Plugins screen, then activate it.
2. Open **wpShadow** in the admin menu.
3. Pick a page and press **Run all five checks**. The first run connects your site to Shadow Steward.

The checks need a public https website. They cannot run on a local or test site.

== Frequently Asked Questions ==

= Do I need an account? =
Not for the five free checks. A Shadow Steward account is only needed for the two paid checks, and only if you add them.

= Is there a limit on the free checks? =
Yes. Free checks are rate limited to protect the quality of the service for everyone. Each site gets 30 free checks a day, and each check can run 10 times an hour. A site that has only just connected starts with 5 a day for its first two days. When the shared daily allowance is nearly used, sites connected for under a day may be asked to wait. The limits can change, and the dashboard always shows how many are left.

= Can I check other people's websites? =
No. The free checks run only on the website you connected. The connection is confirmed by the site itself.

= Does it change my site? =
No. wpShadow only reports. You decide what to change.

= Why can't it run on my local or staging site? =
The checks are run from the internet, so they can only see public https websites.

= What happens to my data if I delete the plugin? =
The plugin tells Shadow Steward to forget your site and removes its own settings.

== Changelog ==

= 0.6298 =
* Free checks are rate limited to protect the quality of the service: new sites start with 5 a day for two days, and the dashboard says so.
* WordPress site health also checks backups, outgoing email records, caching, comment settings, dead links inside your posts, and WooCommerce basics, plus an optional WordPress.org lookup of plugin ages.
* WordPress site health: launch mistakes, updates and versions, database weight, accounts and exposure, and pictures without alt text, checked from inside your site with nothing sent.
* First release of the new wpShadow: five free checks in the dashboard, optional paid SEO report and image check.
