=== Anni Marketing ===
Contributors: annimarketing
Tags: analytics, google analytics, search console, site verification, integration
Requires at least: 5.9
Tested up to: 7.0
Requires PHP: 7.4
Stable tag: 1.2.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Connects your site to Anni (anni-marketing.ch): adds your own GA4 tag and Search Console verification. No tracking by the plugin itself.

== Description ==

Anni is a marketing assistant for small businesses in Switzerland (anni-marketing.ch). This companion plugin lets Anni finish your Google setup automatically after you connect your WordPress site:

* Outputs the **Google Analytics 4** tag (gtag.js) in your site's head — only if you (or Anni, with your permission) configure a measurement ID.
* Outputs the **Google Search Console** site-verification meta tag — only if a verification token is configured.
* Provides a small authenticated REST endpoint (`anni/v1`) so the Anni app can read plugin status and set the two values above. All endpoints require the `manage_options` capability (administrators). Requests are authenticated with WordPress Application Passwords.

The plugin itself does **not** track visitors, does not send data anywhere, and stores only two options (`anni_ga4_id`, `anni_gsc_verification`). The Google Analytics tag is only loaded if a measurement ID has been explicitly configured; in that case Google's terms for Analytics apply.

== Installation ==

1. Install and activate the plugin.
2. Connect your website in your Anni account (anni-marketing.ch) — Anni configures statistics and Search Console automatically.
3. Alternatively, set the options manually via WP-CLI or the REST endpoint.

== Frequently Asked Questions ==

= Does this plugin track my visitors? =
No. It only prints the Google Analytics tag if you configure a measurement ID. Without configuration it outputs nothing.

= Who can change the settings? =
Only authenticated WordPress administrators (`manage_options`), typically via an Application Password issued by you. All three endpoints require this — including reading the plugin status.

= Does it work without an Anni account? =
Yes — you can set the GA4 ID and the Search Console token yourself; the plugin is a minimal, dependency-free head-injector.

= Why does this plugin re-enable Application Passwords? =
Anni connects to your site exclusively through WordPress Application Passwords (the built-in
`authorize-application.php` flow — you approve the connection yourself, no password typing).
Some security plugins disable Application Passwords globally, which silently breaks that
connection. If you install this plugin, you explicitly want the Anni connection, so it makes
the feature available again — but only for Anni: authorization requests from any other
application keep whatever policy your security plugin enforces. WordPress' own HTTPS
requirement for Application Passwords stays untouched.

== External services ==

This plugin connects your site to the Anni marketing platform (https://anni-marketing.ch), operated by
digitale rakete GmbH (https://digitalerakete.ch), so that Anni can complete your Google setup for you.

What the plugin itself sends: nothing. The plugin does not initiate any outbound request. It only
*receives* authenticated REST requests from the Anni app and stores/prints two values on your site.

When your site is contacted: only after you connect your website inside your own Anni account and
create a WordPress Application Password for it. The Anni app then calls the endpoints below using
that password:

* `GET /wp-json/anni/v1/status` — reads whether the plugin is active and which values are set
  (requires the `manage_options` capability).
* `POST /wp-json/anni/v1/ga4` — stores your Google Analytics 4 measurement ID (requires `manage_options`).
* `POST /wp-json/anni/v1/gsc` — stores your Google Search Console verification token (requires `manage_options`).

Data involved: your GA4 measurement ID and your Search Console verification token. No visitor data,
no personal data and no site content is transmitted by this plugin.

Google Analytics: if — and only if — a measurement ID is configured, the plugin prints Google's
standard gtag.js snippet, which loads https://www.googletagmanager.com/gtag/js in visitors' browsers.
This is Google's service, used under your own Google Analytics property. Google's terms and privacy
policy apply: https://policies.google.com/terms and https://policies.google.com/privacy

Anni platform terms and privacy policy: https://anni-marketing.ch/nutzungsbedingungen and
https://anni-marketing.ch/datenschutz

== Changelog ==

= 1.2.0 =
* Consent banner built in: the plugin now shows a bottom notice ("Alle akzeptieren" / "Nur notwendige" /
  "Einstellungen anpassen" with categories) before Google Analytics loads. Until now the plugin only set
  Consent Mode to "denied" and never asked, so nothing was measured. Texts, colours, privacy link and
  mode (basic = no Google contact before consent, advanced = cookieless pings) come from Anni via the new
  REST endpoint `anni/v1/consent`; without it, built-in defaults with the site name and WordPress privacy
  page apply. Choice stored as a first-party cookie for 182 days, footer link "Cookie-Einstellungen" to
  change it. No data is sent to Anni except an anonymous accept/decline count when configured.

= 1.1.8 =
* Elementor editing: new REST endpoints `anni/v1/elementor/{id}` (GET the widget tree, POST
  surgical text edits by stable element id) via Elementor's own Document::save() — correct CSS
  regeneration, native revision for undo, per-page locking. Only active when Elementor is installed.

= 1.1.7 =
* GA4 now respects visitor consent: Consent Mode v2 defaults to "denied" before the config call,
  so no analytics or advertising storage is used until a consent tool on the site grants it. Sites
  without a consent banner therefore no longer measure without consent (GDPR/Swiss DPA compliant).

= 1.1.6 =
* Application Passwords availability is now restored surgically instead of globally:
  authorization requests whose application name does not start with "Anni" keep the policy
  enforced by your security plugin (both availability filters plus the
  `wp_authorize_application_password_request_errors` hook, scoped the same way).
* Added a dismissible admin notice after activation pointing back to Anni (no redirect).
* Added a FAQ entry explaining why and how the plugin re-enables Application Passwords.

= 1.1.5 =
* Restore Application Passwords availability via the `wp_is_application_passwords_available`
  filter (latest priority) — some security plugins disable the feature globally, which breaks
  the Anni connection entirely. WordPress' HTTPS requirement stays untouched.

= 1.1.4 =
* Author URI auf https://digitalerakete.ch umgestellt (die alte Adresse hatte kein
  gueltiges Zertifikat und wurde vom Review geruegt).
* Firmenname in readme.txt an das Impressum angeglichen: digitale rakete GmbH.

= 1.1.3 =
* Tightened the `/status` REST endpoint to require `manage_options` (was `edit_posts`), matching the other two endpoints and this readme's own description.

= 1.1.2 =
* Added the required "External services" documentation.
* Corrected the documented capabilities to match the code (status: edit_posts, writes: manage_options).

= 1.1.0 =
* Search Console verification meta support (`anni/v1/gsc`).

= 1.0.0 =
* Initial release: GA4 tag output + status endpoint.
