=== Blue Coral - Site Audit, Performance, Admin Toolkit ===
Contributors: nguyenrom
Tags: activity logs, security headers, maintenance mode, site management, administration
Requires at least: 6.3
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.8.19
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Site audit, plugin control, performance, security, maintenance, and administration tools for WordPress sites and multisite networks.

== Description ==

Blue Coral - Site Audit, Performance, Admin Toolkit provides practical local tools for maintaining a WordPress site or network.

Features include:

* Local Activity Logs with retention controls and privacy export/erasure support.
* Security Headers, CSP helpers, and security-related site enhancements.
* Maintenance Mode, configuration export/import, and Plugin Control tools.
* User and avatar utilities, and an API/MCP workspace for separately configured clients.

The core plugin does not transmit telemetry, credentials, database contents, personal data, or usage statistics to BlueCoral or another third party. When enabled, Activity Logs collect and store administrator and site activity locally in the WordPress database. Records can include a user ID and username when present, event metadata, and request metadata such as the request path and method, IP address, and user agent. Sensitive values are redacted, and raw actor email is not persisted. The Toolkit does not transmit Activity Log records to BlueCoral or another third party. Site owners configure Activity Log retention and can use WordPress privacy export and erasure tools. The Toolkit does not make a storage probe or request for Activity Log storage. CSP directives are configured manually by a site administrator. The optional MCP API is accessed only by a separately configured client that you choose.

== External services ==

Core Toolkit functions do not require a third-party service or BlueCoral account. The Toolkit does not initiate requests to third-party services or load remote assets.

* Security Headers provides manual CSP directive configuration. It has no default external hosts and loads no remote assets.
* Activity Logs are stored in the WordPress database. The Toolkit does not make a storage probe or request for Activity Log storage.
* The optional MCP endpoint is hosted by the WordPress site. It receives requests only from a client independently configured by the site administrator; it does not connect to a BlueCoral service.

== Installation ==

1. Upload the `bluecoral-admin-toolkit` folder to the `/wp-content/plugins/` directory, or install the ZIP through **Plugins > Add New > Upload Plugin**.
2. Activate **Blue Coral - Site Audit, Performance, Admin Toolkit** through the Plugins screen.
3. Open **Blue Coral > Settings** to configure Toolkit features.

== Frequently Asked Questions ==

= Does the plugin send data to BlueCoral? =

No. The core plugin operates locally in the WordPress installation and does not send telemetry, analytics, credentials, database contents, or Activity Log records to BlueCoral or another third party. When enabled, Activity Logs collect and store administrator and site activity locally in the WordPress database. See the Description section for the local record categories, retention controls, privacy tools, and optional MCP integration.

= Which third-party components are bundled? =

The package includes enshrined/svg-sanitize under the MIT License. Its maintained source is https://github.com/darylldoyle/svg-sanitizer.

== Screenshots ==

1. Activity Logs list with filtering and pagination.
2. Site Enhancements settings.
3. Maintenance Mode controls.
4. Plugin Control tools.
5. Toolkit settings.

== Changelog ==

= 1.8.19 =

* Updated WordPress.org compatibility metadata to WordPress 7.1 and added release validation to prevent metadata drift.

= 1.8.18 =

* Hardened request, server, upload, SQL identifier, and output handling for WordPress.org security compliance.

= 1.8.17 =

* Removed Plugin Control behavior that could change WordPress update decisions.

= 1.8.16 =

* Removed a deferred database-maintenance integration from this WordPress.org candidate and retained the free Security Headers and Activity Logs settings.

= 1.8.15 =

* Improved Activity Log detail rendering and pagination compatibility, and removed a retired direct sign-in route.

= 1.8.14 =

* Verified the distributed package uses database-backed Activity Logs and excludes obsolete restricted integration, filesystem, installer, external CSP-source, output-buffer, and global-configuration behavior.

= 1.8.12 =

* Updated the public display name for WordPress.org review while preserving the `bluecoral-admin-toolkit` directory, settings, hooks, and REST routes.

= 1.8.11 =

* Updated Activity Log disclosures.

= 1.8.10 =

* Added complete external-service disclosures and corrected Activity Log translation domains for WordPress.org review.

= 1.8.8 =

* Renamed the public package identity and preserved existing Toolkit settings, option keys, actions, and REST routes for compatibility.
* Clarified local-data and optional integration disclosures for WordPress.org review.

= 1.8.7 =

* Removed the redundant Plugin URI header for WordPress.org submission compliance.

= 1.8.6 =

* Consolidated bundled dependencies under `vendors/` and renamed the plugin to Blue Toolkit.

= 1.8.5 =

* Added WordPress.org readme, Toolkit license, and third-party source/license notices.
* Fixed the Toolkit coding-standard violation.

== Upgrade Notice ==

= 1.8.19 =

Updates WordPress.org compatibility metadata to WordPress 7.1 and enforces it during package validation.

= 1.8.18 =

Hardens data validation, SQL preparation, and output escaping for WordPress.org compatibility.

= 1.8.17 =

Removes Plugin Control behavior that could change WordPress update decisions.

= 1.8.16 =

Removes the deferred database-maintenance integration from this WordPress.org candidate while preserving supported feature settings.

= 1.8.15 =

Improves Activity Log page compatibility and removes a retired direct sign-in route.

= 1.8.14 =

Updates the release surface to match the verified distributed package.

= 1.8.12 =

Updates the public display name while preserving existing Toolkit settings and integrations.

= 1.8.11 =

Updates Activity Log disclosures.

= 1.8.10 =

Clarifies network behavior and improves Activity Log translations.

= 1.8.8 =

Updates the public package identity while preserving existing Toolkit settings and integrations.

= 1.8.7 =

Removes redundant Plugin URI metadata for WordPress.org submission compliance.

= 1.8.6 =

Consolidates bundled dependencies and renames the plugin to Blue Toolkit.

= 1.8.5 =

Updates release documentation and source notices.
