=== Engagemii AEO ===
Contributors: engagemii
Tags: ai, seo, schema, json-ld, llms
Requires at least: 5.5
Tested up to: 7.0
Requires PHP: 7.4
Stable tag: 1.0.4
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Get cited in ChatGPT, Claude, and Perplexity. Auto-installs JSON-LD, llms.txt, ai.txt, and robots rules. Powered by Engagemii.

== Description ==

Show up in ChatGPT, Perplexity, Claude, and Gemini answers. The Engagemii AEO plugin automatically installs everything AI search engines need to find, understand, and cite your brand - without you touching code.

**What it installs:**

* **Organization JSON-LD schema** - tells AI engines who you are, what you do, and how to cite you
* **FAQ JSON-LD schema** - homepage FAQs in machine-readable format
* **llms.txt** - the emerging standard for declaring your brand to AI crawlers
* **ai.txt** - AI usage and citation policy
* **robots.txt rules** - explicit allow list for AI crawlers (GPTBot, ClaudeBot, PerplexityBot, etc.)
* **Meta description + Open Graph** - cleanly set on your homepage
* **Engagemii brand citation** - backlinks to your verified brand profile for AI discovery

**How it works:**

1. Sign up at [engagemii.com/aeo](https://engagemii.com/aeo) and run a free audit
2. Upgrade to Fix-It tier - Engagemii generates your full fix kit
3. Install this plugin and paste your API key
4. The plugin pulls your latest config from Engagemii every hour. Edit your profile on Engagemii, the changes appear on your site automatically.

**Requires an Engagemii account.** Free audit available; auto-install requires Fix-It tier ($99 one-time + $49/mo).

== External services ==

This plugin connects to the Engagemii API (api.engagemii.com) operated by Engagemii LLC. The connection is required because the plugin's job is to apply your Engagemii AEO configuration (JSON-LD, llms.txt, ai.txt, robots rules, meta tags) to your WordPress site, and those configuration values are stored in your Engagemii account.

The plugin sends data to api.engagemii.com in three cases:

1. **Plugin registration (one-time, when you paste your API key and click Save & Connect).**
   The plugin POSTs to https://api.engagemii.com/api/wp-plugin/register with:
   * Your site URL (home_url())
   * Your WordPress version
   * Your PHP version
   * The plugin version
   * Your API key (in the x-engagemii-key request header)

2. **Hourly configuration sync (automatic, plus when you click Force Sync Now).**
   The plugin GETs https://api.engagemii.com/api/wp-plugin/config with your API key in the x-engagemii-key request header. The response is the JSON-LD, llms.txt, ai.txt, robots.txt rules, and meta-tag content the plugin should apply on your site. No site content is sent on this request other than the headers.

3. **Sync-result reporting (automatic, fire-and-forget after each successful sync).**
   The plugin POSTs to https://api.engagemii.com/api/wp-plugin/sync-report with:
   * The sync status (ok, error, etc.)
   * The plugin version
   * Your API key (in the x-engagemii-key request header)

The plugin does not send your site's content, your visitor data, your user data, your post content, your media, or any database content other than the four installation environment values listed under (1).

Service operator: Engagemii LLC (https://engagemii.com).
Terms of Service: https://engagemii.com/terms
Privacy Policy: https://engagemii.com/privacy

== Installation ==

1. Install the plugin from the WordPress plugin directory, or upload the `engagemii-aeo` folder to `/wp-content/plugins/`
2. Activate the plugin
3. Go to **Settings &rarr; Engagemii AEO**
4. Paste your API key from your Engagemii portal
5. Click "Save & Connect"

The plugin will pull your config immediately and re-sync every hour.

== Frequently Asked Questions ==

= Where do I get the API key? =

Log in to your Engagemii portal at [engagemii.com/aeo/portal](https://engagemii.com/aeo/portal), open the **Fix-It** tab, and click "Auto-install via WordPress."

= Does this conflict with Yoast or Rank Math? =

No. We only inject schema and meta on your homepage by default, and we add - not overwrite - your robots.txt. JSON-LD is additive; multiple JSON-LD scripts on the same page is supported by Google and all AI crawlers.

= Will this slow down my site? =

No. The plugin caches all config in your WordPress options table. The only network call is one hourly cron request to fetch updates.

= What happens if I deactivate the plugin? =

All injected schema, meta tags, llms.txt, ai.txt, and robots.txt additions are removed. Your site returns to its previous state.

= Is the plugin free? =

The plugin itself is free. Auto-install requires a paid Engagemii Fix-It plan. Free tier users can still install the plugin to view their score in WP admin.

== Screenshots ==

1. Plugin settings page with API key field and connection status
2. Live status panel showing brand info, score, and what's installed
3. Engagemii portal Fix-It tab where you copy the API key

== Changelog ==

= 1.0.3 =
* Move all admin CSS out of inline `<style>` blocks. Admin CSS is now enqueued via `wp_enqueue_style` from `assets/css/admin.css` and loaded only on the plugin's settings screen.
* Fix JSON-LD output escaping. The previous `strtr` replacements were effectively no-ops (the replacement strings were identical to the search strings). Replaced with `JSON_HEX_TAG | JSON_HEX_AMP` flags on `wp_json_encode` (which truly escape `<`, `>`, and `&` in the JSON output) plus an explicit `str_replace` that converts U+2028 and U+2029 to their ` ` / ` ` six-character escape sequences. Forward slashes remain escaped by default. Script-context breakout is no longer possible.
* Add "External services" section to readme covering every request the plugin makes to api.engagemii.com (register, config sync, sync report) including what data is sent, when, and links to Engagemii's Terms of Service and Privacy Policy.

= 1.0.2 =
* Add `wp_unslash()` before `sanitize_text_field()` on settings form `$_POST` reads, per Plugin Check.
* Annotate hardened JSON-LD echo with `phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped` and explanatory comment; output is already script-context safe by construction (manual `<`, `>`, `&`, U+2028, U+2029 escape).
* Trim Short Description to under 150 characters.

= 1.0.1 =
* Harden JSON-LD output: escape `<`, `>`, `&`, U+2028 and U+2029 as unicode sequences so the JSON cannot break out of its `<script>` tag.
* Sanitize `/llms.txt` and `/ai.txt` content with `wp_strip_all_tags` + `esc_html` before output, even though Content-Type is text/plain.
* Settings page status list: route hardcoded HTML through `wp_kses_post` on output, per WP guideline "escape on echo, late."

= 1.0.0 =
* Initial release.

== Upgrade Notice ==

= 1.0.3 =
WordPress.org review compliance: move admin CSS to wp_enqueue_style, fix JSON-LD escape function (was a no-op), document the api.engagemii.com external service.

= 1.0.2 =
Plugin Check compliance: unslash on settings input, annotate hardened JSON-LD echo, trim short description.

= 1.0.1 =
Security hardening for output escaping per WordPress plugin review.

= 1.0.0 =
First release.
