=== Aranx Connector ===
Contributors: aranx
Tags: seo, ai content, blog automation, content generation, publishing
Requires at least: 5.0
Tested up to: 7.1
Stable tag: 1.3.3
Requires PHP: 7.4
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Connect your WordPress site to Aranx for AI-powered SEO content that publishes on autopilot.

== Description ==

Aranx turns your WordPress blog into a traffic engine that runs on autopilot. Connect your site, and Aranx handles everything - from finding the right keywords to publishing optimized articles.

This plugin connects your WordPress site to Aranx so articles flow directly into your posts.

= What it does =

* **Keyword research to publishing in one step** - Aranx researches, writes, and publishes. Articles appear as WordPress posts automatically
* **Two-way sync** - Post status changes in WordPress are reflected in Aranx
* **SEO meta tags** - Outputs the title and meta description when no SEO plugin is active
* **Built-in image creation** - Each article includes AI-generated images, uploaded to your media library
* **Connection monitoring** - Automatic health checks and reconnection if anything drops
* **Activity logging** - See exactly what's been synced and when

= How it works =

1. Install and activate the plugin
2. Click "Connect to Aranx" and approve the secure connection
3. Content created in Aranx publishes to your site automatically

== External services ==

This plugin connects your site to [Aranx](https://aranx.com), an SEO content service run by Aranx. **An Aranx account is required.** Aranx writes articles and publishes them to your site through this plugin.

**No data is sent until you connect your site.** The plugin makes no external requests before you click "Connect to Aranx" on its settings page.

When you click "Connect to Aranx", your browser opens aranx.com with these details so Aranx can set up your site:

* Site URL, site name, and the site admin email address
* WordPress version, plugin version, site language, timezone, and permalink structure

After you approve the connection, the plugin sends these requests to aranx.com:

* Once, to exchange a short-lived, one-time authorization code for paired API keys. The request contains the code, a PKCE verifier, and the site URL.
* When an Aranx-created post is edited, changes status, or is deleted. The request contains the post ID, title, content, excerpt, status, type, slug, URL, edit URL, created and modified dates, categories, tags, featured image, comment and ping status, menu order, parent ID, and the author's ID and display name.
* Every hour, a heartbeat for connection health. It contains the site URL, admin URL, site ID, WordPress, PHP, and plugin versions, and post and page counts.
* After the plugin imports article images, a report for each import job. It contains the job ID, the result, the new media library IDs and URLs, and any errors.
* Once a day, a connection check that sends empty HEAD requests to three Aranx API endpoints.
* Every 30 days, a request to rotate the API keys.
* When you disconnect or delete the plugin, a request to revoke the site's keys. On deletion this request also contains the site URL, site name, admin email address, and plugin version.

After you connect, Aranx also calls the plugin's REST API on your site. All of these calls require the site's API key. Aranx uses them to:

* Create, update, and delete the posts it publishes, and upload their images
* Read posts, categories, media, and authors (ID, display name, role, and avatar URL), so you can pick a category and author in Aranx
* Read the connection status: site name and URL, WordPress, PHP, and plugin versions, and which SEO plugins are active

The plugin downloads article images over HTTPS from images.aranx.com and from other public image URLs that Aranx sends with an article. It adds them to your media library.

* [Aranx Terms of Service](https://aranx.com/terms)
* [Aranx Privacy Policy](https://aranx.com/privacy)

== Installation ==

1. Upload the `aranx-connector` folder to `/wp-content/plugins/`
2. Activate the plugin through the **Plugins** menu in WordPress
3. Go to **Aranx** in your admin sidebar
4. Click **Connect to Aranx** and authorize your site

== Frequently Asked Questions ==

= Do I need an Aranx account? =

Yes. This plugin is a connector between your WordPress site and the Aranx platform. Create an account at [aranx.com](https://aranx.com).

= What happens to my content if I deactivate the plugin? =

All published content remains on your site. Deactivating pauses the connection to Aranx. Reactivating restores it automatically.

= Does this work with my SEO plugin? =

Yes. If Yoast SEO or Rank Math is active, Aranx saves the article's meta title and description in that plugin's fields. With neither active, Aranx prints them itself.

= Is the connection secure? =

All communication uses HTTPS with separate, revocable API keys for each direction. Browser callbacks carry only a short-lived authorization code. Webhooks, heartbeats, and image-transfer callbacks are HMAC-signed. API keys are encrypted in non-autoloaded WordPress options.

== Screenshots ==

1. Dashboard showing connection status and recent activity

== Changelog ==

= 1.3.3 =
* Accepts only the one-time authorization code on the connect callback, never API keys in the URL
* Sends only post and page counts in the hourly heartbeat, not user counts or server details
* Translates the connection notices
* Lists every request to and from Aranx under External services

= 1.3.2 =
* Parses URLs with wp_parse_url()
* Tested with WordPress 7.1

= 1.3.1 =
* Keeps backslashes in post titles and content
* "Publish now" publishes a scheduled post instead of keeping it scheduled
* Keeps private posts private when Aranx changes their date
* Reports a wrong server clock as clock skew instead of disconnecting the site
* Shows connection notices only to administrators, only on the Dashboard and Plugins screens, and lets them be dismissed
* Makes no requests to Aranx before you connect
* Removes every scheduled task on deactivation and uninstall
* Lists all data sent to Aranx in this readme

= 1.3.0 =
* Queues post changes while the site is disconnected and sends them after it reconnects
* Keeps retrying webhooks that failed for network, server, or auth reasons instead of dropping them
* Sends the current site identity with each delayed webhook

= 1.2.0 =
* Encrypts API keys and pending authorization credentials at rest
* Adds automatic and manual two-phase WordPress API key rotation
* Signs outbound webhooks and heartbeats and adds replay identifiers
* Removes author email addresses from the users response
* Hardens production builds, callback privacy, SSRF checks, logs, and admin output

= 1.1.0 =
* Activates confirmed connections without depending on WordPress cron
* Adds durable webhook and image-transfer queues with safe retries
* Preserves updates for legacy Aranx and BlogEmpire-generated posts
* Improves authorization, reconnection, and credential-rotation safety
* Adds WordPress 5.0-compatible one-off cron scheduling

= 1.0.0 =
* Initial release
* One-time authorization-code exchange with paired API keys
* Automatic content publishing via webhooks
* Post status synchronization
* SEO meta tag output (when no SEO plugin is active)
* Connection health monitoring with auto-reconnection
* Activity logging and debug tools

== Upgrade Notice ==

= 1.3.3 =
Recommended update. The heartbeat sends less data, and the connect callback no longer accepts API keys in the URL.

= 1.3.2 =
Maintenance update for the WordPress.org plugin directory. No change in behavior.

= 1.3.1 =
Recommended update. Fixes lost backslashes in posts, "Publish now" on scheduled posts, and false disconnects when the server clock is wrong.

= 1.3.0 =
Recommended update. Post changes made while the site is disconnected now reach Aranx after it reconnects.

= 1.2.0 =
Recommended security update for all Aranx Connector installations.

= 1.1.0 =
Recommended reliability update for all existing Aranx Connector installations.

= 1.0.0 =
Initial release.
