=== AsafAmos Accessibility Scanner ===
Contributors: asafamos1
Tags: accessibility, accessibility checker, wcag, ada, a11y
Requires at least: 5.8
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.3.0
License: MIT
License URI: https://opensource.org/licenses/MIT

Free WordPress accessibility checker: scan for WCAG 2.1/2.2 AA & ADA issues with axe-core — private, in-admin, no overlay widget. EAA 2025 ready.

== Description ==

**AsafAmos Accessibility Scanner** is a free **WordPress accessibility checker** that finds WCAG 2.1 / 2.2 AA and ADA accessibility violations on your site — the standards behind the EAA 2025, ADA Title III, and Israeli תקנה 35. The scan engine — axe-core 4.11 — is bundled with the plugin and runs **entirely in your WP admin browser tab**. The target page is loaded in a hidden iframe inside the admin area and evaluated there. The default scan flow does not transmit your URL, your HTML, or any scan contents to any external service.

**What it does**

* Loads the target page in a hidden iframe inside your WP admin and evaluates it with bundled axe-core 4.11. Nothing leaves your server during a normal scan.
* Reports every violation grouped by severity (critical / serious / moderate / minor).
* Links to axe-core documentation for each rule so you can fix it in your theme or content.
* **New in 1.3:** a **Generate AI fix** button on every violation. Click it and Claude suggests the exact before / after code change for that element. Nothing is sent until you click — see &ldquo;Optional features&rdquo; below for exactly what is transmitted. Fixes are suggested code changes; you (or your developer) apply them in your theme or content.
* Optional daily cron re-scans (off by default — see &ldquo;Optional features&rdquo; below for what it does and does not transmit).
* Works with any theme, any page builder, any caching plugin.

**Why not an accessibility overlay?**

Overlay widgets (the &ldquo;robot button&rdquo; you've seen on other sites) inject runtime JavaScript over broken HTML. They do not fix anything; the FTC fined the largest vendor $1M in January 2025. Real compliance means fixing the source HTML / CSS. This plugin shows you what to fix — it does not hide problems and it does not ship any JavaScript to your visitors.

**Built for new accessibility regulations**

* **EAA 2025** — European Accessibility Act, enforceable since June 2025
* **ADA** — U.S. courts apply WCAG 2.1 AA as the de facto standard
* **Israeli תקנה 35** — updated October 2024 with stricter enforcement

**Free. Optional paid tier (separate hosted service)**

The plugin itself is free. Unlimited scans, optional daily cron, full per-rule violation report — all included.

A separate hosted service at https://axlescan.com generates the AI fix suggestions. The service is not part of this plugin and is never contacted by the default scan flow. A small number of AI fixes per day is free without an account. For unlimited fixes, the axle Site plan ($19/month) gives you an API key that you paste in this plugin's Settings; it is then sent with your fix requests and with the optional cron scan, both described below.

**Not a compliance certificate**

Automated tools (including axe-core 4.11, the engine used here) catch roughly 57% of WCAG issues. Manual review by a qualified human auditor is still recommended for full conformance.

== Installation ==

1. Upload the plugin zip via Plugins → Add New → Upload, or copy the plugin folder to `/wp-content/plugins/`.
2. Activate through the Plugins menu.
3. Go to **Tools → AsafAmos Accessibility Scanner** and click **Scan now**.

== Optional features (and what they transmit) ==

This is the full and accurate transmission story for every feature. The default install transmits nothing.

**1. &ldquo;Scan now&rdquo; button — default scan flow**

* Runs entirely in your WP admin browser tab.
* Loads the target page in a hidden iframe and evaluates it with bundled axe-core 4.11.
* **Does not transmit anything to any external service.**
* Scan results are written to your WordPress `wp_options` table under the key `axle_last_scan` so the admin dashboard can render the summary.

**2. Auto scan = Daily (opt in only — Off by default)**

* Only relevant if you explicitly enable this in Tools → AsafAmos Accessibility Scanner → Settings.
* WP-Cron runs without a browser, so the daily cron cannot use the in-browser iframe scanner. Instead it uses the hosted scanner at `POST https://axlescan.com/api/scan` with body `{ "url": "<your configured target URL>", "source": "axle-wordpress" }` (and `Authorization: Bearer <key>` if you've entered an axle API key).
* **Requires your target URL to be publicly reachable** — the hosted scanner cannot reach LocalWP, staging behind basic auth, or VPN-only environments.
* No visitor data, form data, or admin content is sent. Only the configured target URL.
* Disabled by default. Setting can be turned off again at any time.

**3. &ldquo;Generate AI fix&rdquo; button — only when an administrator clicks it**

* Nothing is sent when the page loads or when a scan runs. A request is made only when a user with the `manage_options` capability clicks the &ldquo;Generate AI fix&rdquo; button on a violation row.
* Your WordPress server then sends one request to `POST https://axlescan.com/api/fix`. The request contains: the axe-core rule id, impact, description, help text and documentation link for that violation; **one** element&rsquo;s HTML (truncated to 500 characters), its CSS selector, and axe-core&rsquo;s failure summary for that element.
* If you entered an axle API key in Settings, it is sent in an `x-axle-key` header so the service can apply your plan. Without a key the free daily allowance is used.
* **Not sent:** your site URL, other pages, visitor data, form data, WordPress users, passwords or any other admin content.
* The service passes the violation text and the element snippet to Anthropic&rsquo;s Claude API to generate the suggested change, and returns the suggestion to your admin screen. The suggestion is displayed as plain text and is never applied to your site automatically.
* No fix is requested unless you click, and you can stop using the feature at any time simply by not clicking it.

**Service provider for #2 (the opt-in daily cron) and #3 (the Generate AI fix button):** axle (https://axlescan.com)
**Sub-processor for #3:** Anthropic (https://www.anthropic.com/legal/privacy)
**Terms of use:** https://axlescan.com/terms
**Privacy policy:** https://axlescan.com/privacy

You may disable all external communication by deactivating the plugin, by turning off Auto scan and not clicking &ldquo;Generate AI fix&rdquo;, or by blocking the host `axlescan.com` at the network level.

== Frequently Asked Questions ==

= Does this plugin inject any JavaScript into my public site? =

No. The bundled axe-core engine is loaded only inside your WordPress admin pages, never on your public-facing site. Your visitors see nothing.

= What data leaves my site by default? =

By default, **nothing**. The Scan now button runs entirely client-side in your admin browser via a hidden iframe — no analytics, no tracking, no calls to any external server. Only two optional features contact a server: the opt-in daily cron (Off by default) and the &ldquo;Generate AI fix&rdquo; button, which sends data only when an administrator clicks it. Both are described in the &ldquo;Optional features&rdquo; section with the exact contents of each request.

= Do I need an account? =

No. Scanning works without any signup. The &ldquo;Generate AI fix&rdquo; button also works without an account for a few fixes per day; for unlimited fixes, paste an axle API key (Site plan) in Settings.

= Does the AI fix change my site automatically? =

No. A fix is a suggested code change shown to you as before / after text. You (or your developer) apply it in your theme, page builder or content. Always review a suggestion before using it — automated suggestions can be wrong, which is why each one shows a confidence level and flags cases that need manual review.

= Does this replace a professional accessibility audit? =

No. Automated scanning catches roughly 57% of WCAG issues. For full compliance, a human auditor is still recommended.

= What about GDPR / privacy? =

The plugin does not track you or your visitors and includes no analytics. The default scan flow makes no outbound HTTP requests to any external service. The only features that contact a server are the opt-in daily cron (Off by default) and the &ldquo;Generate AI fix&rdquo; button (only on click), documented under &ldquo;Optional features&rdquo; with the exact request contents. Visitor data is never involved.

= I'm on LocalWP / staging behind basic auth / a VPN-only host. Will this still work? =

Yes — the default Scan now flow works on any environment because it runs entirely inside your admin browser. The optional Auto scan = Daily setting requires public reachability and won't work for these environments; leave it Off.

= Why is the plugin called &ldquo;AsafAmos Accessibility Scanner&rdquo; and not &ldquo;axle&rdquo;? =

The author's WordPress.org username is `asafamos1`. The plugin is part of the `axle` accessibility-CI ecosystem (separate hosted service at https://axlescan.com) but maintained by AsafAmos individually for the WordPress.org directory.

== Screenshots ==

1. Admin dashboard showing the latest scan results.
2. Severity breakdown and per-rule violations.
3. Settings page with daily auto-scan toggle.

== Changelog ==

= 1.3.0 =
* New: **Generate AI fix** button on every violation in the results table. On click, the plugin asks the hosted axle service (axlescan.com, powered by Claude) for a suggested before / after code change for that one element, and shows it in an accessible panel under the row. Nothing is sent until an administrator clicks; the request contents are documented in &ldquo;Optional features&rdquo;. Suggestions are plain text and are never applied automatically.
* A few AI fixes per day are free without an account; the Site plan API key from Settings is forwarded to lift that limit.
* Scan results now keep the full HTML of each affected element (previously tags such as `input` were stripped on save, which would have given the AI nothing to work with).

= 1.2.4 =
* Moved the hosted service to its own domain (axlescan.com). The optional daily cron scan and the Site-plan links now use the new address; the free in-browser scanner is unchanged and still transmits nothing.

= 1.2.3 =
* Scan results now show an optional prompt to the hosted axle Site plan ($19/mo), which generates a code-level fix for each detected violation. It is a single inline note on the plugin's own results page — no global admin notices, no tracking, and the free client-side scanner is unchanged.
* Settings: the optional API-key field now explains the axle Site plan and links to the correct pricing page.

= 1.2.2 =
* Tested up to WordPress 7.1. No functional changes — the scanner runs in an admin-side hidden iframe and is unaffected by the 7.1 editor / client-side-media / jQuery-UI changes.

= 1.2.1 =
* Removed the anonymous usage ping entirely per WordPress.org Plugin Review Team feedback — no tracking, no phoning home. The plugin now makes zero outbound requests by default. The only optional network feature is the opt-in daily cron (Off by default), which contacts the hosted scanner as a service you explicitly enable.

= 1.2.0 =
* Renamed plugin display name and slug from &ldquo;Axle Accessibility Scanner&rdquo; / `axle-accessibility-scanner` to &ldquo;AsafAmos Accessibility Scanner&rdquo; / `asafamos-accessibility-scanner` per WordPress.org Plugin Review Team feedback (avoid the &ldquo;Axle&rdquo; trademark concern).
* Rewrote readme to remove inconsistencies between the original 1.0.0 (hosted-scan) and current 1.1.0+ (in-admin-iframe) architectures. The default scan flow now described accurately as fully client-side; optional hosted features moved to a clearly-labelled section.
* Updated `Contributors` to the plugin owner's WordPress.org username `asafamos1`.

= 1.1.0 =
* Scans now run **client-side in the admin browser** using bundled axe-core 4.11. Works for LocalWP, staging behind basic auth / VPN, and any other private environment the previous hosted scanner could not reach.
* No external network calls during a normal Scan now.
* Auto scan cron still uses the hosted scanner (it has no browser available). Disabled by default; opt in via Settings.

= 1.0.0 =
* First public release.
* WCAG 2.1 / 2.2 AA scanning via axe-core 4.11.
* Admin dashboard under Tools menu.
* Settings for target URL, severity threshold, optional API key.

== Upgrade Notice ==

= 1.3.0 =
Adds an optional &ldquo;Generate AI fix&rdquo; button per violation. It contacts axlescan.com only when you click it; scanning is unchanged and still transmits nothing. Update recommended.

= 1.2.4 =
Hosted service moved to axlescan.com. Free scanning is unchanged. Update recommended so the optional cron/Site-plan features use the new address.

= 1.2.3 =
Scan results now offer an optional one-click path to hosted AI fixes (axle Site, $19/mo). Free scanning is unchanged. No tracking. Update recommended.

= 1.2.0 =
Renamed plugin per WordPress.org review feedback. Readme rewritten for accuracy. No functional change. Update recommended.

= 1.1.0 =
Scans now run locally in your browser and work on LocalWP / staging / VPN-restricted sites. No external call required for the free tier. Update recommended.

= 1.0.0 =
Initial release.
