=== Mose - SEO & AI Visibility Companion ===
Contributors: trymose
Tags: seo, ai, content, blog, publishing
Requires at least: 6.0
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.7.1
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Connect your WordPress site to Mose: SEO article drafts written from your own search data, SEO fields filled in, and a report of which AI engines read your site.

== Description ==

**Mose Companion** connects your WordPress site to [Mose](https://trymose.com/), the content platform that finds what your customers already search for, writes the article, and hands you a draft to approve.

Install the plugin, press Connect with Mose and approve in your Mose panel. WordPress finishes the connection and takes you back to Mose. Nothing is published without your approval.

= What you get =

* **Two-click setup** - press Connect with Mose, approve in your Mose panel. No codes or API keys to copy between tabs.
* **Drafts, not surprises** - every article lands in WordPress as a draft (or on your schedule, if you turn auto-publish on in Mose).
* **SEO fields filled in** - title, meta description, focus keyword and FAQ schema, written straight into Rank Math or Yoast SEO; a built-in fallback covers sites without either.
* **Cover images** - the article's featured image is uploaded to your media library under the article's own slug.
* **AI visibility** - see which AI crawlers (ChatGPT, Perplexity, Gemini, Claude and others) read your site, per page and per day, in your Mose panel.
* **/llms.txt** - Mose publishes an up-to-date llms.txt for your site so AI engines know what you offer.
* **Works behind firewalls** - your site sends its pages to Mose, so hosts that block outside crawlers still get a full analysis.
* **Lightweight** - no page-builder changes, no theme changes, no front-end scripts.

= How it works =

1. Install and activate the plugin. WordPress opens its **Mose** page.
2. Press **Connect with Mose** and approve in your Mose panel.
    * or paste a pairing code under **Connect another way**
3. Mose reads your published pages, learns how your brand writes, and starts proposing articles. You review each draft in Mose; approved articles arrive in WordPress.

= Requirements =

* WordPress 6.0 or higher
* PHP 7.4 or higher
* A Mose account ([sign up at trymose.com](https://trymose.com/))

= Privacy =

The plugin only talks to Mose, and only after you connect the site. It sends your published pages (so Mose can learn your brand and link between your articles) and an aggregate count of AI-crawler visits. It never sends reader data, IP addresses or your account password. Deactivating the plugin stops all sending. Every payload is listed under "Does this plugin send my data anywhere?" in the FAQ.

== Installation ==

= From the WordPress dashboard =

1. Go to **Plugins > Add New**.
2. Search for **Mose**.
3. Click **Install Now**, then **Activate**.
4. Press **Connect with Mose** and approve in your Mose panel.
    * or paste a pairing code under **Connect another way**

= Manual installation =

1. Download the plugin ZIP from [wordpress.org/plugins/mose-companion](https://wordpress.org/plugins/mose-companion/).
2. Go to **Plugins > Add New > Upload Plugin**, choose the ZIP, click **Install Now**.
3. Activate the plugin and connect it from the **Mose** menu as above.

== Frequently Asked Questions ==

= Do I need a Mose account? =

Yes. The plugin is the bridge between your site and Mose; on its own it does nothing. Sign up at [trymose.com](https://trymose.com/).

= Can I review articles before they are published? =

Yes. By default every article arrives as a draft and waits for you. Auto-publish is a separate switch in your Mose panel that you turn on deliberately.

= Which SEO plugins are supported? =

Rank Math and Yoast SEO are written to directly. If neither is active, the plugin stores the SEO fields itself and prints them.

= Does it work with page builders? =

Yes. Mose reads your pages the way a visitor sees them (rendered HTML), so Elementor, Divi and other builders are read correctly. Articles are created as standard posts.

= Does this plugin send my data anywhere? =

Only to Mose, and only after you connect the site. In full:

This plugin connects to the Mose API ([api.trymose.com](https://api.trymose.com/), operated by [Mose](https://trymose.com/)):

* When an administrator presses Connect with Mose, the browser opens the Mose panel
  ([app.trymose.com](https://app.trymose.com/)) with this site's address and the address of
  its Mose page. The panel sends back a pairing code, which is used only when it returns to the
  Mose page of the administrator who pressed the button, within half an hour.
* When that code returns, or an administrator submits a pairing code, it sends the code, site URL, WordPress username,
  a newly created application password, the shared signing secret and software versions over
  HTTPS to connect the site. The account password is not sent.
* Once connected, it sends published pages for analysis, including their URLs and rendered HTML.
  Page content can include information published by the site owner, such as contact details.
  A full-site push happens after pairing or a plugin upgrade; published page changes are queued.
* Every six hours it POSTs the AI-agent visit report - per AI crawler, the visited URL path, the
  15-minute slot and the hit count, plus the plugin version and the reporting window. The request
  is signed with a secret Mose provisions when the site owner connects the site; it carries no IP
  addresses, user agent strings, reader data or post content. Nothing is sent until the site is
  connected in Mose; deactivating or uninstalling the plugin stops it, and Mose rejects reports
  from a site that is no longer connected. Authenticated Mose requests can also read this site's
  REST endpoints. The plugin does not send data to an AI model provider directly.

The authenticated endpoints report site health, identify the active SEO adapter, write SEO fields
and return the stored values, find a post by its idempotency key, and return rendered HTML only for
URLs belonging to the same WordPress site. When the site is removed in Mose, a signed request tells
the plugin to forget the connection. Requests are authenticated with either a WordPress
Application Password or an HMAC-SHA256 signature.

Terms of Service: [trymose.com/terms](https://trymose.com/terms/)

Privacy Policy: [trymose.com/privacy](https://trymose.com/privacy/)

= Where are the pairing code and the secret shown? =

You do not need to copy a pairing code: Connect with Mose brings one back and uses it. To connect by hand, get a code in your Mose panel and paste it under **Connect another way**. The plugin's own signing secret is shown once, right after it is generated under **Mose > Advanced**; afterwards only a masked prefix is displayed.

= Is PHP 7.4 supported? =

Yes. On older PHP versions the plugin stops before loading, instead of breaking the site.

= Is Composer required on the server? =

No. Composer, PHPUnit and PHPCS are development dependencies only; the released plugin has no build step.

== Screenshots ==

1. AI-crawler visits per day and per crawler, as reported by the plugin to the Mose panel.
2. Connections in the Mose panel: the WordPress site connected through Mose Companion.

== Changelog ==

= 1.7.1 =

* Approving in your Mose panel finishes the connection: WordPress uses the returned code and
  takes you back to Mose. The second confirmation is gone.
* When Mose asks for pages, the first ones are sent in that request instead of waiting for
  WP-Cron.
* Other plugins' notices are hidden on the Mose page.
* Removing the site in Mose disconnects the plugin: the secret is replaced, Mose's application
  password is revoked and the page asks to connect again.

= 1.7.0 =

* Two-click connection: press Connect with Mose, approve in your Mose panel, confirm in
  WordPress. Pasting a pairing code is still available under Connect another way.
* Mose has its own admin menu. Old Settings > Mose links, pairing links included, open it.
* After activation WordPress opens the Mose page once; bulk and network activations are left
  alone.
* The page shows one card for the site's state. The secret, the connection check, the AI
  counter and the health data are in a closed Advanced section.
* Turkish translation included.

= 1.6.1 =

* Directory release. Installation now goes through Plugins > Add New; the readme is rewritten
  for site owners, with the same external-service disclosure kept in full.
* Display name is now "Mose - SEO & AI Visibility Companion". Slug, endpoints and behaviour
  are unchanged.

= 1.6.0 =

* Security: enqueued admin assets, input sanitization, admin-only secret/llms.txt endpoints,
  atomic replay guard.
* The settings screen's CSS and JavaScript are enqueued files loaded only on that screen, instead
  of being printed into the page.
* Server variables read by the plugin are unslashed and sanitized at the point they are read.
* Setting the shared secret and writing the site's /llms.txt now require an administrator.
* A signed request is claimed with a single atomic database write, so two copies of the same
  request arriving together can no longer both be accepted.

= 1.5.3 =

* Keep a durable identity for each full-site transfer so retries cannot open another scan or
  overwrite a later scan's pages on compatible Mose servers.
* Protect transfer initialization with a lifecycle lock and recover empty transfer queues.

= 1.5.2 =

* Allow reconnecting when a Mose application password already exists. Retry a duplicate name
  once with a unique suffix while preserving existing connection passwords.

= 1.5.1 =

* Remove the application password created by an attempt whose pairing code was definitively
  rejected as missing, expired or already used. Existing passwords remain unchanged; ambiguous
  network responses do not revoke a connection that may have succeeded.
* Clarify pairing and published-page data transfers in the external-service disclosure.

= 1.5.0 =

* Sending the whole site now starts an analysis on its own, so a site that was connected before
  this plugin could send pages no longer sits connected and silent. Upgrading an already
  connected site sends everything once.
* Each batch says whether it is the whole site or a single page that was just published, so
  publishing a post no longer looks like a new analysis.
* When Mose cannot reach this site to ask for pages, it asks in its reply to this plugin's own
  scheduled report instead - a connection this site opens, which a firewall cannot refuse.

= 1.4.0 =

* Connect a site with a single pairing code from the Mose panel. The plugin creates its own
  application password on the server, so nobody has to open the Application Passwords screen or
  copy a password between two tabs.
* Send this site's rendered pages to Mose instead of waiting to be crawled. On sites behind a
  firewall that refuses outside crawlers, this is the only way the analysis can be built at all;
  pages are rendered the way a visitor sees them, page builders included.
* The settings screen says how many pages have been sent, how many are still queued, and why the
  last attempt failed if it did.

= 1.3.1 =

* Let Mose read this install's reporting secret over the connection it already has, so the
  AI-agent counter starts working without anyone copying a key by hand.

= 1.3.0 =

* Count visits by known AI crawlers per URL and 15-minute slot and report them to Mose every six
  hours; the settings screen shows when the last report went and, if it did not, why.
* Serve /llms.txt with the content Mose publishes for this site, refreshed after every publish.
* Unify the version stated in the plugin header, the code and this readme.

= 1.1.0 =

* Store and print the JSON-LD schema Mose builds for a published article.
* Print only the FAQ block when Rank Math or Yoast already writes its own schema graph.
* Skip rewriting an identical schema, so republishing an unchanged article changes nothing.

= 1.0.0 =

* Initial companion plugin.
* Application Password and HMAC-SHA256 authentication.
* Rank Math, Yoast, and generic SEO adapter layer.
* Site health, idempotency lookup, and same-site rendered HTML endpoints.
