=== CountingDownTo ===
Contributors: countingdownto
Tags: countdown, timer, embed, block, oembed
Requires at least: 6.2
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 0.2.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Embed live countdown timers from CountingDownTo in posts and pages via a Gutenberg block or shortcode.

== Description ==

CountingDownTo (countingdownto.com) is a countdown timer service. This plugin embeds those timers on your WordPress site without copying countdown logic into WordPress.

This plugin relies on the CountingDownTo service. Countdowns are created and hosted on countingdownto.com and shown on your site in an iframe. See **External services** below for exactly what is sent and when.

**What you get**

* A **Countdown** block: paste a countdown URL or pick one from your connected account
* A `[countingdownto]` shortcode for classic themes and page builders
* An optional **site-wide bar** (fixed top or bottom) that shows a countdown on every page
* Block patterns for common layouts
* Settings diagnostics so you can see whether embeds and API calls reach CountingDownTo

**How it works**

Published embeds load an iframe from `https://countingdownto.com/w4/{slug}`. The timer ticks in the visitor's browser against an absolute target time, so a cached page stays accurate.

* **Fixed-date** embeds do not set cookies on visitors.
* **Evergreen (rolling)** embeds may set a partitioned `vid` cookie from countingdownto.com (not a cookie on your WordPress domain) so the rolling timer continues across visits.

Connect your CountingDownTo account under Settings > CountingDownTo to list and insert your own countdowns from the block editor. The connection uses a read-only access token stored only on your WordPress site and never sent to visitors. Uninstalling the plugin deletes that token on the current site; your countdowns stay in your CountingDownTo account.

**Source code**

The block editor script in `build/` is compiled. Its human-readable source is included in the plugin under `src/countdown/`. To rebuild it, run `npm install` and then `npm run build` in the plugin folder (uses `@wordpress/scripts`).

== Installation ==

1. Install from Plugins > Add New, or upload the plugin ZIP.
2. Activate **CountingDownTo**.
3. (Optional) Open Settings > CountingDownTo and click **Connect your account**.
4. In the block editor, insert the **Countdown** block, or use `[countingdownto slug="your-slug"]` in classic content.

Shortcode attributes: `slug` or `url` (a countingdownto.com countdown link), plus optional `height` (pixels), `aspect_ratio` (for example `16/7`) and `label` (the iframe title read by screen readers).

== Frequently Asked Questions ==

= Do visitors need a CountingDownTo account? =

No. Visitors only load the public embed. You only need an account if you want the editor picker and the create and connect handoffs.

= Does the plugin track visitors? =

The plugin adds no tracking scripts or telemetry. Loading an embed makes a normal HTTPS request from the visitor's browser to countingdownto.com, which receives the visitor's IP address, User-Agent and usually the referring page URL. Fixed-date embeds set no cookies; evergreen embeds may set a partitioned `vid` cookie on countingdownto.com. See External services.

= What happens if CountingDownTo is down? =

The iframe may fail to load, but the rest of your page still renders.

= What is stored in WordPress? =

If you connect an account, WordPress stores a read-only access token and short-lived caches of your countdown list on the current site. Uninstalling removes those for the current site only (on multisite, other subsites are not cleaned up). Countdown content lives on CountingDownTo.

= Can I use this with page builders or the Classic Editor? =

Yes. Use the shortcode, or paste a CountingDownTo countdown URL where oEmbed is supported. The block is the main path.

= Does "Redirect at zero" work in an embedded countdown? =

No. A countdown embedded by this plugin runs in a sandboxed iframe that cannot navigate your page, so when it reaches zero it shows its ending (message, hidden countdown or hidden buttons) inside the iframe instead of redirecting. The redirect works when visitors open the countdown page on countingdownto.com directly.

= Where do I get support? =

Use the support forum for this plugin on WordPress.org, or contact CountingDownTo through the help link on countingdownto.com.

== Screenshots ==

1. The Countdown block in the editor, with a live preview and its settings panel.
2. Settings > CountingDownTo: connect your account, start from a template, and turn on the site-wide bar.
3. A published post with a countdown embed, and the optional site-wide bar across the top.
4. Diagnostics and Privacy & data sections on the settings page.

== External services ==

This plugin connects to CountingDownTo (https://countingdownto.com), a countdown timer service run by the plugin author. It is needed to show countdowns, which are created and hosted there.

* **Countdown embeds.** Every page that contains a Countdown block, a `[countingdownto]` shortcode or the site-wide bar loads an iframe from `https://countingdownto.com/w4/{slug}` in the visitor's browser. That request sends the visitor's IP address, User-Agent and, on HTTPS pages, the referring page URL (`referrerpolicy=no-referrer-when-downgrade`). Fixed-date embeds set no cookies. Evergreen (rolling) embeds may set a partitioned `vid` cookie (about 180 days, `SameSite=None; Partitioned`) on countingdownto.com, not on your WordPress domain.
* **oEmbed.** When an editor pastes a countingdownto.com countdown URL, WordPress fetches oEmbed data from `https://countingdownto.com/oembed` on the server. The pasted URL is sent.
* **Block editor URL lookup.** When an editor pastes a countdown URL into the Countdown block or picks one from the account list, the editor's browser also requests `https://countingdownto.com/oembed` directly to read the countdown's size. That request sends the countdown URL plus the editor's IP address and User-Agent. It is separate from WordPress's own server-side oEmbed lookup.
* **Block editor preview.** When a Countdown block in the editor has a countdown selected (pasted, picked from the account list or created), the editor shows a live preview loaded as an iframe from `https://countingdownto.com/w4/{slug}` in the editor's browser. That request sends the editor's IP address, User-Agent and the referring admin page URL. The block inserter's example preview is drawn locally and makes no request.
* **Settings page.** The settings page does not load anything from countingdownto.com in the administrator's browser. The starter cards are text and links only; nothing is requested until the administrator clicks one of the buttons described below.
* **Connect.** When an administrator clicks Connect your account, the browser goes to `https://countingdownto.com/wp-connect` with the site's host name, the plugin's return URL (`redirect_uri`), a random `state` value, and a PKCE `code_challenge` with `code_challenge_method=S256`.
* **Connected account.** After the administrator approves, the WordPress server exchanges a one-time code at `https://countingdownto.com/api/wp/v1/token`. After that it calls `https://countingdownto.com/api/wp/v1/*` with the stored read-only token to list countdowns and check the account plan. The token is never sent to browsers or visitors.
* **Create a countdown.** When an editor clicks Create a countdown in the block, the WordPress server asks `https://countingdownto.com/api/wp/v1/pending` for a one-time handoff code (sending the site's host name) and then checks it every few seconds, for up to 15 minutes, until the new countdown is ready to insert.
* **Create and starter tabs.** When a user clicks Create a countdown (in the block or on the settings page) or a starter card, a new tab opens `https://countingdownto.com/c/create-countdown` with `src=wp`, the site's timezone, locale and host name, plus the starter's slug (`from`) for a starter and the handoff code (`state`) when started from the block.
* **Diagnostics.** Only when an administrator clicks Run diagnostics, the WordPress server requests `https://countingdownto.com/healthz` and the administrator's browser loads `https://countingdownto.com/favicon.ico`.

Uninstalling deletes the stored token and plugin caches on the current site. Countdowns on CountingDownTo are not deleted.

CountingDownTo terms of use: https://countingdownto.com/terms-of-use
CountingDownTo privacy policy: https://countingdownto.com/privacy-policy

== Changelog ==

= 0.2.0 =
* Site-wide bar, diagnostics, block patterns, privacy policy suggested text, and cache refresh when your plan changes.
* Account connect, countdown picker, and create-a-countdown handoff.

= 0.1.0 =
* Initial release: block, shortcode, and embed rendering.

== Upgrade Notice ==

= 0.2.0 =
Adds the site-wide bar, diagnostics and account connect.
