=== Digipacket Site Audit ===
Contributors: digipacket
Tags: site health, security, performance, seo, audit
Requires at least: 5.8
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.0.3
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Check your site's security, speed, SEO and maintenance with 56 checks, a score out of 100, and plain-language explanations.

== Description ==

Digipacket Site Audit looks at your WordPress site from the inside and gives it a score out of 100, with a grade from A to E. For every problem it finds, it tells you three things: what was found, why it matters for your business, and how it gets fixed.

**The interface, the e-mails and the report are in French.** The plugin is translation-ready under the `digipacket-site-audit` text domain.

= 56 checks in four groups =

* **Security (23):** WordPress, plugin and theme updates, abandoned or closed plugins, HTTPS and the SSL certificate, mixed content, debug mode, exposed backup and log files, the file editor, the "admin" username, administrator accounts, security keys, XML-RPC, user enumeration, directory listing, security headers, login protection, wp-config.php permissions.
* **Performance (11):** PHP version, server response time, page cache, object cache, compression, autoloaded data, database clutter, heavy images, home page assets, number of active plugins, memory limit.
* **SEO (14):** search engine visibility, robots.txt, permalinks, site title and tagline, SEO plugin, home page title and description, H1, XML sitemap, image alt text, mobile viewport, social previews, structured data, site icon.
* **Maintenance (8):** backups, automatic security updates, e-mail deliverability, recent PHP errors, scheduled tasks, disk space, PHP modules, database version.

= What you get =

* An overall score, a grade, a score per group, and the change since the previous scan.
* Each problem explained in plain language, with the recommended fix and its level: quick fix, standard job or advanced job.
* An optional weekly scan (off by default), with an e-mail when a new critical problem appears or the score drops by 10 points or more.
* A printable report you can save as PDF from your browser.
* A dashboard widget, and a badge in the admin menu when critical problems are open.
* A one-click quote request to Digipacket for the problems you want fixed. Nothing is sent unless you fill in the form and give your consent.

= Read-only =

Every check only reads. Digipacket Site Audit never changes a setting, a file or your content.

= For agencies =

The agency name, logo, colour, contact details, starting prices and the address quote requests go to are set in `config.php`, or with the `digipacket_audit_agency_config` filter, and cannot be changed from the WordPress admin. Requests can also be sent to a CRM as signed JSON (webhook). Each option is documented in the comments of `config.php`.

== External services ==

Digipacket Site Audit connects to two external services. Nothing else leaves your site.

= WordPress.org Plugins API =

Used to find out whether each installed plugin has been closed in the WordPress.org directory or has not been updated there for more than two years.

* **When:** only if you turn on "Statut des extensions" in the settings (it is off by default), during a scan started by you or by the optional weekly scan. While it is off, this check is shown as "Non vérifié" and nothing is sent.
* **What is sent:** the slug (folder name) of each installed plugin, up to 50. No personal data and no site address are added by Digipacket Site Audit. Answers are cached for three days.
* **Service:** api.wordpress.org, operated by WordPress.org. Terms: https://wordpress.org/about/privacy/

= Digipacket (quote requests and proactive alerts) =

Used to send your quote requests, and the optional proactive alerts, to Digipacket, the agency that provides this plugin. The e-mail is sent by your own server through `wp_mail()`.

* **Quote request — when:** only when you submit the quote form and tick the consent box.
* **Quote request — what is sent:** your name, company, e-mail address, phone number, preferred contact method, urgency and message; the problems you selected and the other problems found; the score; and the site's address, WordPress and PHP versions, active theme and active plugins.
* **Proactive alert — when:** only if you turn on "Assistance proactive" in the settings (it is off by default), and a weekly scan finds a new critical problem.
* **Proactive alert — what is sent:** the new problems, the score, the WordPress and PHP versions, and the contact details from the plugin's settings.
* **Recipient:** dev@digipacket.net, unless the site owner's agency has set another address in `config.php`.
* **Service:** Digipacket. Terms: https://digipacket.net/terms — Privacy policy: https://digipacket.net/privacy

A webhook is only used if one is set in `config.php`. The plugin as distributed has none.

== Installation ==

1. In WordPress, go to **Plugins → Add New Plugin**, search for "Digipacket Site Audit", then click **Install Now** and **Activate**.
2. Open **Diagnostic** in the admin menu and click **Lancer le diagnostic gratuit** to run the first scan.

To install by hand, upload the `digipacket-site-audit` folder to `/wp-content/plugins/` and activate it from the **Plugins** screen.

== Frequently Asked Questions ==

= Does Digipacket Site Audit change anything on my site? =

No. Every check only reads. Fixing what it finds is up to you, or to Digipacket if you request a quote.

= Will it slow my site down? =

No. A scan only runs when you start it, or once a week in the background if you turn on the weekly scan in the settings. Nothing is added to the pages your visitors see.

= Some checks say "Non vérifié". Why? =

They could not run on your server, usually because it refuses requests to its own address. They are left out of the score rather than counted as failures.

= My quote request says it could not be sent. =

Your server could not send the e-mail. Set up SMTP or an e-mail sending service, then try again. The "Fiabilité des e-mails" check warns about this.

= Does the weekly scan run exactly every seven days? =

It runs on WP-Cron, which WordPress triggers when the site receives visits. On a site with very few visits, it can run later.

= What happens to my data when I delete the plugin? =

Deleting it from the Plugins screen removes everything it stored: settings, scans, history, the quote log and its scheduled task, on every site of a multisite network. Deactivating it keeps everything.

= Is there more documentation? =

Yes, in English. Contact us at https://digipacket.net/contact

== Changelog ==

= 1.0.3 =
* Fixed the plugin and documentation links that returned a 404.

= 1.0.2 =
* Renamed to Digipacket Site Audit (slug and text domain: digipacket-site-audit).
* The weekly scan is now off by default.
* The WordPress.org plugin status lookup is off by default and only runs after you allow it in the settings.
* The admin menu now sits below the core WordPress menus.

= 1.0.1 =
* Ready for the WordPress.org directory: the printable report and the dashboard notice load their styles and scripts as files.
* No redirect to the plugin page after a bulk activation.
* New logo and admin menu icon.
* Settings: a "Vos coordonnées" card lets you choose how Digipacket can reach you.
* Header: "Support" button.

= 1.0.0 =
* First release.
