=== SteerWP Console ===
Contributors: steerwp
Tags: agency, client management, white label, multisite, reports
Requires at least: 6.0
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 2.48.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

The free master plugin for WordPress agencies. Manage clients, connect their sites, and deliver branded dashboards.

== Description ==

SteerWP is the free, open-source master plugin in the SteerWP suite. Install it on the WordPress site you use to run your agency. Add each client as a record, connect their websites via the free **SteerWP Connector** plugin, and (optionally) extend it with paid add-ons for proposal generation, site-health reporting, accessibility audits, lead attribution, and more.

= What you get in the free version =

* Unlimited clients, contacts, and connected sites
* Activity log with internal and client-visible entries
* Document store with internal and client-visible documents
* White-label branding propagated to every connected client site
* Custom roles (Agency Admin, Agency Team) for your staff
* Add-on registry for clean integration with paid extensions
* A complete REST API for connecting your own tooling

= Branded client dashboard =

When you connect a client site with the free [SteerWP Connector](https://wordpress.org/plugins/steerwp-connector/) plugin, that site gets a new top-level admin menu — a branded dashboard showing the client every proposal, report, audit, training video, and document you have produced for them. No separate client portal, no new logins. Visibility is controlled by a single custom capability on the client site.

= Extending with paid add-ons =

SteerWP is designed to be extended. Paid add-ons that plug into it include (sold separately):

* **Proposal Builder** — branded proposals with e-signatures and PDF export
* **Site Health Reporter** — monthly automated health snapshots per site
* **AI Accessibility Auditor** — WCAG audits with prioritised remediation
* **Lead Attribution Tracker** — UTM-to-form-submission attribution
* **Brand Kit Manager** — per-client brand kits, one-click apply
* **Page Speed Optimizer** — before/after visual diff and optimisation
* **Client Training Video Library** — per-client video library inside their dashboard
* **Auto-Generated User Docs** — tailored, auto-refreshing user manuals

Browse all paid add-ons inside SteerWP → Extensions.

= Privacy =

SteerWP does not send any data to third parties. It does not phone home. Communication is exclusively between your master site and the client sites you choose to connect, over your own HTTPS connection.

== Installation ==

1. Upload the `steerwp` folder to `/wp-content/plugins/`, or install via Plugins → Add New → Upload.
2. Activate SteerWP.
3. Visit **SteerWP → Settings** and configure your white-label branding.
4. Add your first client in **SteerWP → Clients**.
5. Install the [SteerWP Connector](https://wordpress.org/plugins/steerwp-connector/) plugin on each client site you want to connect.

== Frequently Asked Questions ==

= Is this really free? =

Yes. Both SteerWP and SteerWP Connector are free, open-source GPL plugins. Paid extensions are sold separately and are optional.

= Where do add-ons install? =

On the SteerWP (agency) site only. The Child plugin on the client side never needs to know about which add-ons you have installed — it just exposes a fixed capability surface that add-ons consume.

= How do I connect a client site? =

Create the client, add a site to it, copy the pairing token and site secret shown once, then paste them into the SteerWP Connector plugin on the client's WordPress site.

= Does this work over plain HTTP? =

Technically yes, but you should run both sites over HTTPS. The pairing secret authenticates every REST call between the master and child sites; sending it over HTTP would expose it to anyone listening on the network.

= Will my clients have access to my master site? =

No. Clients never log in to your agency site. Each client site has its own branded dashboard, accessible to users with the `view_agency_dashboard` capability on that site.

= Can I host paid add-ons myself instead of buying through Freemius? =

Yes — the add-on contract is a public, documented API. Anyone can write add-ons and distribute them however they like. The commercial add-ons listed in the Extensions screen are independent products sold through Freemius.

== Screenshots ==

1. Dashboard with at-a-glance counts and recent activity
2. Client list and edit screen with tabbed UI
3. Sites tab showing connected client sites
4. Extensions screen with installed and available add-ons
5. Settings screen for white-label branding

== External Services ==

This plugin connects to the following external services:

* **WordPress.org Plugin & Theme APIs** (api.wordpress.org) — used when you search for plugins/themes to bulk-install and to check for available updates. Only the search terms you type are sent. See the WordPress.org privacy policy: https://wordpress.org/about/privacy/
* **Your own managed sites** — the Console communicates with the SteerWP Connector plugin on WordPress sites you pair, over their REST API, to collect inventory/health data and perform the actions you request (updates, maintenance mode, and so on). Uptime monitoring periodically sends HTTP requests to those sites. No data is sent to sites you have not explicitly paired.

* **Freemius** (freemius.com) — used for licensing and (optionally) usage tracking for paid add-ons. Freemius only collects data after you explicitly OPT IN on the consent screen; skipping the opt-in keeps the plugin fully functional. See the Freemius privacy policy: https://freemius.com/privacy/

Beyond the above, no analytics or telemetry are collected, and no data is sent to the plugin author.

== Changelog ==

= 2.48.0 =
First WordPress.org release. Consolidated notes since 2.21.4:

* New: Client-site area setting (Settings → Branding). Choose whether SteerWP Connector stays hidden on client sites, shows the documents you share, or shows a full branded overview. Hidden by default.
* New: Comments command centre — scan pending comments across every connected site, with a spam scorer built from real-world spam patterns, asynchronous rescans and a one-click “mark all suspects as spam” purge, both with live progress bars.
* New: MainWP migration wizard — import clients, groups and sites from an existing MainWP dashboard.
* New: Pair existing sites from their own page; connection dashboard widget showing pairing progress across the fleet.
* New: Client merging (combine duplicate client records; sites, contacts and history move with them).
* New: Dashboard widgets can be shown or hidden per user; widgets are bounded so a slow site never slows the dashboard.
* New: Sidebar navigation with keyboard shortcuts; built-in knowledge base with searchable how-to articles.
* New: Freemius-based licensing for paid add-ons — one bundle key unlocks every add-on. Opt-in is optional and nothing is sent without it.
* Improved: All scripts and styles load through the WordPress enqueue APIs; output escaping and input sanitisation reviewed throughout; all option and transient names use the steerwp_ prefix; database identifiers are whitelisted and prepared.
* Improved: Top-level menu placed below the core WordPress items.
* Improved: Client Documents tab explains where uploaded files appear on the client's site.
* Fixed: Comment counts refresh after a spam purge; display pagination on large comment queues; branding colour on the proposal signing page; login screen branding.
* Removed: The remote WP-CLI runner (not permitted for WordPress.org-hosted plugins). Services custom-CSS embedding (returns in a compliant form later).

= 2.21.4 =
* Fixed: `sites.child_version` was written exactly once, when a site was first paired, and never refreshed afterwards. The moment an agency updated the SteerWP Connector plugin on a site, the Console's record of its version went permanently stale, and nothing would ever correct it short of re-pairing. The "Connector plugin" row on the site detail page has been showing a stale value ever since, and add-ons that gate on the Client version were rejecting sites that had already been updated.
* The Child has always reported its version in `system_info`; the Console was discarding it. Sync now refreshes the column on every run.
* Fixed: `child_version` was also missing from the allowlist in `update_cached_data()`, so any attempt to write it there was silently dropped — the update ran, reported success, and wrote nothing.

= 2.21.3 =
* Maintenance mode copy is now honest. The Manage tab claimed that "logged-in admins still see the real site" — that was false for SteerWP Connector 1.22 and earlier, which used WordPress's `.maintenance` file. That file is checked before authentication, so it locked the agency out too, and WordPress stops honouring it after ten minutes, silently bringing the site back online while SteerWP still showed it as down.
* Sites running Client 1.23.0+ get the real behaviour and accurate copy. Sites on an older Client now see an explicit warning explaining both defects, rather than a promise the Client cannot keep.
* Adds support for the SteerWP Maintenance Pro add-on.

= 2.21.2 =
* Monitoring tab rebuilt with an explicit main + rail layout. The first pass reused the old card grid, which could not balance cards of very different heights: Security overflowed while a third column sat nearly empty, and Cron and Comments were pushed below the fold.
* Fixed: the Backups, Cron and Comments cards render no card wrapper of their own — the old code always supplied one at the call site. Calling them directly left the backup form floating on the page with no heading and no chrome. Each is now properly wrapped.
* The create-backup form no longer appears on Monitoring, which is a read-only tab. The backup list stays; the action lives on Manage.
* Security findings now lead with the findings. The explanation of what the scan checks was pushing the counts and the actual critical issue four elements down the card; it is now a collapsed hint.
* Fixed: the Overview uptime metric read a `uptime_pct` key that does not exist (the real keys are `uptime_pct_24h` / `uptime_pct_7d`), so it silently rendered an em-dash on every site.
* Fixed: Overview read `client_version` from the site row; the column is `child_version`. It silently rendered an em-dash.
* Fixed: the Monitoring tab badge and the Overview "Needs attention" list filtered health signals on severities of `crit`, `risk` and `critical`. Only `crit`, `warn` and `info` are ever emitted — so two of those were dead branches, and `warn` was omitted entirely, silently undercounting every warning on the site.

= 2.21.1 =
* Fixed: row action dropdowns were being clipped by their own table and could not be seen or clicked. The table carried `overflow: hidden` — added only so its `border-radius` would clip the corners of the striped rows — but that also clipped any menu opened from inside a cell. This affected every table with a row menu: broken links, clients, plugins, themes and users. Corners are now rounded on the corner cells directly, so the visual is unchanged and the menus can escape the table.
* Row menus now close when another is opened, when you click outside them, or when you press Escape. Previously nothing ever closed them, so two could sit open at once, overlapping.

= 2.21.0 =
* Site detail page rebuilt around four tabs: Overview, Updates, Monitoring, Manage. The old six-tab layout answered the same question in two places (health, broken links and the error log appeared on both Overview and "Health & errors"), and scattered actions across three regions — maintenance mode rendered three times on a single screen.
* Overview is now read-only status only: four headline metrics plus a "Needs attention" list that deep-links to the tab where each problem is fixed.
* Tab badges show pending update and monitoring-issue counts, so the nav itself tells you where the work is.
* Plugins and Themes merged into a single Updates tab with a type switch.
* Settings and Tools merged into a single Manage tab; every action and setting now lives in exactly one place.
* New site hero replaces the old title block and quick-actions toolbar.
* Modern, neutral visual design across the whole site detail page.
* Legacy tab URLs (?tab=health, plugins, themes, settings, tools) are redirected forward, so existing bookmarks and deep-links keep working.
* Fixed: the AJAX tab switcher toggled WordPress's old nav-tab-active class, which after the redesign would have left the tab bar with nothing highlighted after a swap.
* Fixed: component filter pills, bulk actions and single-component actions redirected to tab=themes without carrying the type, silently returning the user to the plugin list after acting on a theme.

= 1.0.0 =
* Initial release

== Upgrade Notice ==

= 2.48.0 =
First WordPress.org release. Adds the Client-site area setting, comments command centre, MainWP migration and Freemius licensing; all assets now load through WordPress APIs.

= 1.0.0 =
Initial release.
