=== Cynoque Customer Reviews ===
Contributors: cynoque2
Tags: reviews, customer reviews, testimonials, ratings, feedback
Requires at least: 6.2
Tested up to: 7.1
Stable tag: 2.0.2
Requires PHP: 7.2
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Independent customer reviews hosted off your site, not self-edited testimonials. Connect your site in under five minutes.

== Description ==

Cynoque Customer Reviews connects your WordPress site to the What They Say review service at whattheysay.reviews. Once your site is connected you get your own review page on the service, and this plugin gives you a shortcode and a widget for sending customers there.

**Set up in under five minutes**

This plugin was built to be quick to install and simple to use. There is no setup wizard, no onboarding sequence, and no long list of options to work through. Getting a free API key takes about a minute, and pasting it into the settings screen configures the plugin for you. From installing the plugin to having a working "Leave a Review" link on your site is a five minute job.

There is one settings screen with one field that matters. Everything else on it is there to tell you what is already working. The shortcode and the widget need no configuration of their own: once your key is saved, drop either one in place and it points at your review page.

The plugin is a client for the What They Say review service, which is operated by the author of this plugin. A free account on that service is required in order to obtain an API key. See the "External services" section below for full details of what is sent and when.

**How this is different from an on-site reviews plugin**

Most WordPress review and testimonial plugins store reviews in your own database and render them on your own site. That is useful, but it means the business being reviewed also controls the reviews, and a visitor has no way to tell whether anything was edited or quietly removed.

This plugin does not store or display reviews on your site at all. Customers leave reviews on your business page on the What They Say review service, where they are held independently of your WordPress installation:

* Reviews live outside your site, so you cannot silently edit or delete them, and your visitors can see that
* Your review page is a public URL that anyone can visit, share, or link to without going through your site
* Reviews left after a purchase can carry a "Verified" tag, which is applied by the service rather than by the site owner
* Removing this plugin, or losing the site entirely, does not take your reviews with it

If what you want is on-site testimonials under your own control, an on-site reviews plugin is a better fit. This plugin is for businesses that want reviews a customer has reason to trust because the business does not control them.

**Features**

* One settings screen and one required field, so there is nothing to configure beyond your API key
* API key verification, which configures the plugin automatically
* Your review page address, shown on the settings screen and ready to copy
* `[wtsrev_review_button]` shortcode with configurable text, CSS class and link target
* A "Review Link Button" widget for sidebars and widget areas, which works as soon as your key is saved and has nothing to configure
* A suggested privacy policy section, added to the WordPress privacy tools
* A link to create a free account, for site owners who do not have one yet
* A one-click disconnect, which clears the key from your site and leaves your reviews untouched

**How it works**

1. Create a free account on the What They Say review service to get your API key.
2. Enter the API key on the plugin settings screen to connect your site.
3. Add the shortcode or widget wherever you want a "Leave a Review" link.
4. Customers leave reviews on your page on the What They Say review service.
5. Read and reply to those reviews on your dashboard on the service.

**Everything in this plugin works on a free account**

Nothing in this plugin is locked, metered, restricted by plan, or disabled after a trial. There is no paid tier of this plugin. Review collection itself is unlimited.

Additional features of the hosted service, such as replying to reviews and your review management dashboard, are provided by the service rather than by this plugin.

**Optional paid add-on**

A separate add-on plugin, What They Say Reviews Pro, is sold and distributed from whattheysay.reviews. It is a distinct plugin with its own code, and none of its code is contained in this plugin. It lets you conveniently send review invitation emails directly from your WooCommerce order screen with the push of a button to collect "Verified" tagged reviews, and adds a live ratings widget and email notifications when new reviews arrive. This plugin does not require it, does not download it, and is fully functional without it.

== External services ==

This plugin relies on the What They Say review service (https://whattheysay.reviews) and does not function without it.

That service is owned and operated by the author of this plugin. This plugin is not affiliated with, endorsed by, or connected to any other review platform or company.

**Endpoint contacted**

* `https://whattheysay.reviews/api/verify-key.php` - to validate your API key and retrieve your review page URL and account type.

**When the plugin contacts the service**

* When you save your API key on the settings screen, to validate it.
* When you open the plugin settings screen, to refresh your review page URL and account type. This is throttled to at most once per hour.
* Once per day via WP-Cron, to re-validate the stored API key.

No request is made at all until you have entered an API key.

**Data sent to the service**

* Your API key and your site URL. That is all.

This plugin does not send any visitor or customer data to the service. Reviews are submitted by your customers directly on the service's own review page, not through your site.

The service's terms and privacy policy apply to data it receives:

* Terms of service: https://whattheysay.reviews/terms-of-service/
* Privacy policy: https://whattheysay.reviews/privacy-policy/

== Installation ==

The whole process below takes about five minutes, including creating your free account.

1. Upload the plugin files to `/wp-content/plugins/cynoque-customer-reviews/`, or install it through the WordPress plugins screen.
2. Activate the plugin through the Plugins screen in WordPress.
3. Go to **Customer Reviews**, enter the API key from your What They Say account and save it.
4. Copy your review page link, or add the `[wtsrev_review_button]` shortcode to a page.

Saving the key confirms the connection straight away and fills in your review page address, so you can tell immediately that it worked.

**Getting an API key**

1. Visit https://whattheysay.reviews and sign up for a free account.
2. Complete your business profile.
3. Copy the API key from your dashboard into the plugin settings.

== Frequently Asked Questions ==

= Is the plugin free? =

Yes, and every feature in it works on a free service account. A free account on the What They Say review service is required only to obtain an API key. Nothing in the plugin is restricted by plan.

= How long does it take to set up? =

About five minutes in total. Creating a free account and copying your API key takes roughly a minute, and pasting that key into the settings screen configures the rest of the plugin for you. There is no wizard to click through and nothing else you are required to fill in.

= Do I need WooCommerce? =

No. This plugin has no WooCommerce features.

= Where are reviews displayed? =

Reviews are collected and displayed on your page on the What They Say review service. Link to it from your site with the `[wtsrev_review_button]` shortcode or the bundled widget.

= Why are reviews not stored on my own site? =

Because a review a business can edit is worth less to the person reading it. Holding reviews on the service means neither you nor this plugin can alter them after the fact, and your customers can see that. It also means your reviews survive a site migration, a database restore, or removing this plugin.

= Can I moderate or reply to reviews? =

You can reply to reviews from your dashboard on the service, and your reply is shown alongside the original review. You cannot rewrite or silently delete a customer's review, which is the point of hosting them off your site.

= How do I customise the review button? =

The shortcode accepts three attributes. For example:

`[wtsrev_review_button text="Rate our service" class="my-button" target="_self"]`

= How do I reply to a review? =

Replies are handled on your dashboard on the service, at https://whattheysay.reviews/business-dashboard/

= Can I send review invitation emails from my site? =

Not with this plugin. That is part of the separate What They Say Reviews Pro add-on, which is sold and distributed from whattheysay.reviews and is not required for anything this plugin does.

= What does the plugin do about data protection? =

The plugin sends only your API key and site URL to the service. It adds a suggested section to your site's privacy policy, and removes its own data on uninstall. You remain the data controller for your site, so please review the service's privacy policy and update your own accordingly. This is not legal advice.

= Where do I get help? =

Plugin issues: the WordPress.org support forum, or support@whattheysay.reviews. Service issues: https://whattheysay.reviews/support or support@whattheysay.reviews.

== Screenshots ==

1. The plugin settings screen. Paste your API key, save, and the shortcode and your review page link are ready to use.
2. Your public review page on the What They Say service, with your rating summary and your customers' reviews.
3. Customer reviews on your review page. The "Verified" tag is applied by the service, not by the site owner.
4. The form your customers fill in to leave a review, hosted on the service rather than on your site.
5. Your dashboard on the service, where you copy the API key that connects your site.

== Changelog ==

= 2.0.2 =
* Renamed the plugin to Cynoque Customer Reviews at the request of the WordPress.org plugin review team. No functionality has changed; your API key, review page link and settings are unaffected.

= 2.0.1 =
* Front-end and settings screen styles are now enqueued as stylesheets instead of being printed inline.
* Added a "Disconnect this site" button. Previously a saved API key could not be removed without deleting the plugin.
* Fixed detection of the optional add-on, so the add-on notice is no longer shown to sites that already have it installed.
* Removed an unused internal endpoint.
* The settings table is now created on any site that is missing it, instead of only on the site the plugin was activated from. This fixes saving on multisite subsites.
* Saving an API key now reports an error if the value could not actually be written, rather than always reporting success.
* Fixed the Settings link on the Plugins screen, which was registered against the wrong file and never appeared.
* Key verification now checks the HTTP status and the shape of the response before storing anything, so an error or maintenance page returned by the service can no longer overwrite a working review page link.
* The settings screen reports when the last check failed instead of always showing "Connected", and explains why a saved key was rejected.
* The cached review page link is now cleared when the stored link changes, so a new API key takes effect immediately on sites using a persistent object cache.
* The settings screen no longer re-validates the API key on every page load; validation is throttled, alongside the existing daily check. Saving the form still verifies immediately.
* Submitting the form after the page has been open a long time now reports an expired session rather than silently discarding the entered key.
* The daily validation event is scheduled on activation and on init, so it is registered on sites whose front end has not been loaded.
* The shortcode now honours its own list of permitted link targets, and external links open with rel="noopener noreferrer".
* Uninstall cleanup removes the widget's stored settings, is scoped to this plugin's own option, transient and meta prefixes, leaves the add-on's data alone when the add-on is installed, and no longer flushes the entire site object cache. It also runs correctly under WP-CLI.

= 2.0.0 =
* Added a link to create a free service account on the settings screen, and a description of the optional add-on shown only on that screen.
* The review invitation, email tracking and privacy consent features have moved to a separate add-on plugin, What They Say Reviews Pro, distributed from whattheysay.reviews. If you were using those features, install the add-on to keep them; your API key and settings are unchanged.
* This plugin now focuses on connecting your site to the service and linking customers to your review page.
* Removed the review request table, order screen panel, invitation history and tracking pixel from this plugin.
* The privacy policy suggestion now describes only what this plugin sends, which is your API key and site URL.

= 1.3.4 =
* Review invitations are now available on every account. The plan check that prevented sending has been removed from the plugin; all functionality implemented in the plugin now works regardless of service plan.
* Removed the upgrade prompt that appeared when sending was blocked, and the plan-comparison links from the settings and order screens.
* The email open tracking action is now registered as wtsrev_track_email. The previous wts_track_email name remains registered as an alias so tracking pixels in already-sent emails keep working.
* Corrected documentation: review invitations are sent from WooCommerce order screens and require WooCommerce.

= 1.3.3 =
* Invitation emails now use a From address on your own site domain, with your admin email kept as Reply-To, so messages are not discarded by recipients enforcing DMARC.

= 1.3.2 =
* Hardened database queries, output escaping and input sanitization throughout.
* Added nonce verification to all administrative actions.

= 1.3.1 =
* Renamed functions, options and hooks to use the wtsrev prefix.

= 1.3.0 =
* Added email open tracking, disabled by default.
* Added the privacy settings screen and explicit consent before any customer data is sent.

== Upgrade Notice ==

= 2.0.0 =
Review invitations, email tracking and privacy consent have moved to the separate What They Say Reviews Pro add-on. Your API key and review page link are unaffected. Install the add-on from whattheysay.reviews if you used those features.
