=== TrustBeacon Email Delivery Auditor ===
Contributors: fiatlux5775
Tags: email, email-delivery, dmarc, spf, dkim
Requires at least: 6.0
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 0.1.13
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Find public DNS and authentication problems that can affect WordPress email delivery, including MX, SPF, DKIM, and DMARC.

== Description ==

TrustBeacon Email Delivery Auditor identifies publicly visible DNS, email-authentication, and domain-configuration problems that can interfere with WordPress email transmission and delivery.

If WordPress messages are failing, being rejected, or landing in spam, TrustBeacon provides a single plain-English audit of the public configuration affecting your domain and email. Every finding includes an explanation, a recommendation, and the potential business impact.

The plugin checks email-delivery and domain-trust signals such as:

= Email transmission and receipt =

* MX records
* Public mail-domain configuration

= Email authentication and deliverability =

* SPF records and enforcement strength
* Limited common-selector DKIM discovery, plus administrator-supplied selectors
* DMARC policies and enforcement strength

= Supporting domain and website trust =

* SSL certificate availability
* HTTP security headers
* CAA records
* DNSSEC indicators when supported by the server
* Cloudflare indicators in public response headers
* Public security plugin indicators visible in page HTML

The report includes:

* An overall Trust Score
* Separate category ratings
* Passing, warning, failing, and informational findings
* Plain-English explanations
* Recommended corrective actions
* Business-impact explanations

TrustBeacon performs diagnostic checks. It saves only the latest timestamped report and optional DKIM selector settings in this WordPress database. It does not change DNS records, mail settings, security controls, or content.

Important: TrustBeacon evaluates publicly visible configuration and trust indicators. It does not send a test email, inspect private mail-server settings, guarantee inbox placement, or provide a security certification, penetration test, malware scan, or compliance audit.

== Installation ==

1. Upload the plugin folder to the `/wp-content/plugins/` directory, or install the plugin ZIP through the WordPress Plugins screen.
2. Activate the plugin through the Plugins screen.
3. Open the TrustBeacon page in the WordPress admin menu.
4. Click Run Audit.

== Admin Dashboard ==

The Trust Auditor admin page presents results as a dashboard rather than a single wide table:

* An overall Trust Score is shown as a circular gauge alongside the trust grade and counts of passing, warning, failing, and informational findings, all derived directly from the current audit's findings.
* Email Authentication, Website Security, Visitor Protection, and DNS Security are shown as separate summary cards using the plugin's existing category ratings (Excellent, Good, Fair, Needs Attention, or Additional Review Recommended).
* Findings are grouped by category. Each finding keeps its category, check, status, score, message, recommendation, and business impact; recommendation and business impact are available in an expandable "Recommendation and business impact" section.
* Status is always shown as visible text (PASS, WARN, FAIL, INFO) in addition to color, and a small status dot is decorative only.
* Before an audit has been run, an introductory panel explains what will be checked. It does not display a score or findings, so nothing can be mistaken for real results.
* The dashboard styling loads only on the Trust Auditor admin page and does not affect the rest of the WordPress admin area.
* The dashboard works without JavaScript. Recommendation and business impact sections use the browser's native expand/collapse control.

== Frequently Asked Questions ==

= Does TrustBeacon send a test email? =

No. TrustBeacon examines publicly visible DNS, email-authentication, and domain-trust configuration. It does not send a message through the WordPress mail system or guarantee delivery to a particular recipient.

= Can TrustBeacon explain what needs attention? =

Yes. Every finding includes a plain-English message, a recommended action, and an explanation of the potential business impact.

= Does this plugin scan private files or private server data? =

No. It checks public trust indicators for the installed site.

= Does a high score prove my site is secure? =

No. A high score means the checked public trust signals look good. It does not prove that the site is secure.

= Does a low score prove my site was hacked? =

No. A low score means that one or more public trust signals may be missing, weak, or unavailable.

= How are DKIM selectors discovered? =

DKIM selectors vary by sender and cannot be generally enumerated through DNS. Automatic discovery searches a limited common list and remains informational even when it finds a key. Supply your actual selectors to assess those DNS keys. Finding a valid public key does not verify outgoing signatures, DMARC alignment, or delivery.

= Why is DNSSEC sometimes informational? =

Some PHP environments cannot query DNSSEC records reliably. In that case, the plugin avoids punishing the score for a check it cannot verify.

== Screenshots ==

1. Admin audit dashboard with trust score gauge, category cards, and grouped findings.
2. Pre-audit introductory panel shown before the first audit is run.

== External services ==

TrustBeacon Auditor performs remote HTTPS requests to websites selected
by the site administrator in order to audit publicly available trust
signals.

The plugin connects directly to the website being audited to inspect
information such as:

* SSL certificate availability
* HTTP response headers
* Cloudflare detection
* Security plugin indicators

Data transmitted:

* The domain name entered by the administrator.
* Standard HTTP request headers, including a User-Agent string.

These requests occur only when an administrator initiates an audit.

No personal visitor information is collected, stored, or transmitted.

The plugin does not use any third-party commercial APIs.

Privacy Policy:
https://itechguide.com/privacy-policy/

Terms of Use:
https://itechguide.com/terms-of-use/

== WPVibe and WordPress Abilities ==

On WordPress 6.9 or newer, TrustBeacon exposes two administrator-only abilities:

* trustbeacon/run-audit: run the installed site audit and save its latest report. Optional selectors is an array of up to 10 names. Omit it to use saved selector settings; [] requests limited automatic discovery. A supplied list is a one-run override and does not change settings.
* trustbeacon/get-last-audit: read the saved report without running new checks.

WPVibe can discover these abilities through WordPress. No separate AI key, account, pairing protocol, or WPVibe-specific credential is added by TrustBeacon. A WPVibe connection must already be authorized independently. Administrator permission (manage_options) is required for both abilities. Older WordPress installations retain the normal dashboard without Abilities integration.

Identical scans within 60 seconds return the same timestamped report. Always check completed_at. Reports contain structured findings, DKIM lookup evidence, limitations, and message_authentication=not_tested. Unknown/INFO findings are excluded from the score; this exclusion does not establish that an unknown check passed. Each supplied-selector assessment contributes at most one DKIM summary to the score, regardless of the number of selectors. Discovery contributes no scored DKIM pass.

The most recent report and selector settings are stored locally until replaced or manually removed. They contain public configuration observations, not messages, private keys, visitor data, or mailbox credentials. When a connected client requests an audit, the results pass through that client and its connector under their own privacy policies. TrustBeacon itself does not contact an AI service.

== Changelog ==

= 0.1.13 =
* Made DKIM discovery results, selector help, ability descriptions, and documentation provider-neutral.
* Retained existing common-selector support, DNS validation, scoring, and administrator permissions.

= 0.1.12 =
* Excluded development tests from the installable ZIP; the separate development archive preserves the test suite.
* Included the declared languages directory and updated Tested up to after the 0.1.11 audit and both WordPress abilities ran on WordPress 7.1.3.
* Informational findings now display Not scored rather than 0/10.
* Audit checks and WordPress ability behavior are unchanged from 0.1.11.


= 0.1.11 =
* Preserved common-selector discovery, but made discovery informational rather than proof of active DKIM configuration.
* Added optional custom DKIM selectors, bounded CNAME traversal, key parsing, and explicit unknown/revoked/invalid states.
* Removed repeated scored passes per DKIM selector. The summary covers DNS/key checks only, never actual message authentication.
* Added administrator-only run-audit and get-last-audit WordPress abilities for compatible clients including WPVibe.
* Added shared timestamped latest-report storage, a 60-second identical-request cache, a dashboard selector field, WPVibe documentation, and a compatibility notice scoped to the TrustBeacon page.
* Other DNS, HTTP, scoring thresholds, and public-indicator checkers are unchanged.
* Initial live acceptance completed after installation on WordPress 7.1.3: audit execution and saved-report retrieval through WPVibe. Nonadministrator HTTP denial and final package Plugin Check remain to be verified.


= 0.1.10 =
* Fixed the dashboard version display by synchronizing the internal version constant with the plugin release.
* Updated the WordPress admin page title, menu label, dashboard heading, explanatory text, and limitation notice to reflect the email-delivery focus.
* The displayed plugin version is supplied through the shared version constant rather than a separate dashboard value.
* No changes to audit checks, scoring, category ratings, or stored data.

= 0.1.9 =
* Repositioned the plugin around its primary benefit: identifying public configuration problems that can affect WordPress email transmission and delivery.
* Improved the title, short description, tags, feature organization, and directory description.
* Clarified that every finding includes a recommendation and business-impact explanation.
* Clarified the distinction between public configuration auditing and sending an actual test email.
* No changes to audit checks, scoring, category ratings, or stored data.

= 0.1.8 =
* Redesigned the admin results page as a dashboard: a circular Trust Score gauge, finding-status counts, category summary cards, and findings grouped by category with expandable recommendation/business impact detail.
* Added a dedicated pre-audit introductory panel explaining what the audit checks, shown before any audit has been run.
* Added a scoped admin stylesheet that loads only on the Trust Auditor admin page.
* No changes to audit checks, scoring, or category-rating calculations. This is a presentation-only update.

= 0.1.3 =
* Revised scoring so INFO findings are excluded and WARN findings receive partial credit instead of harsh zero-point treatment.
* Adjusted grade labels to better reflect public trust signals rather than full security certification.

= 0.1.1 =
* Standardized plugin name, slug, text domain, prefix, contributor metadata, licensing, and WordPress.org readme format.
* Replaced mixed class prefixes with TBAUD-prefixed classes.
* Replaced raw HTTP header fetching with the WordPress HTTP API.
* Added safer DNS lookup wrapper and defensive handling for unavailable DNS constants.
* Added escaping, sanitization, nonce name, capability checks, and translatable admin strings.

= 0.1.0 =
* Initial development version.
