=== My Site Hand – Site Health Scan, Broken Links & AI Alt Text Fixer ===
Contributors: builtbytanin
Tags: site health, broken links, alt text, seo audit, mcp
Requires at least: 6.2
Tested up to: 7.1
Requires PHP: 8.1
Stable tag: 1.3.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Find broken links, missing alt text and SEO gaps in 30 seconds. Fix them right in the report, or let AI fix them all at once. No setup.

== Description ==

**Most site owners do not know what is wrong with their site until a visitor, a client or Google tells them.** My Site Hand tells you first — and then helps you fix it without leaving the page.

Activate it and your first scan starts by itself. About 30 seconds later you have a health score out of 100 and a plain-language list of the real problems on your site: dead links, images with no alt text, pages with no meta description, files slowing you down, and settings that leave you exposed.

Then you fix them. Type the missing alt text straight into the report. Replace a dead link. Move an unused file to the trash. Your score climbs as you go.

**No account. No API key. No setup screen.** The scan and every inline fix work the moment you activate the plugin.

= What it checks =

Twelve checks, run one at a time so they never time out — even on cheap shared hosting.

*   **Broken links** — the links in your 50 most recent posts and pages. Only links that are genuinely gone (404 or 410) are reported. Anything ambiguous is retried, and left out if it is still unclear, so you are not chasing false alarms.
*   **Missing alt text** — images that screen readers and search engines cannot understand.
*   **Missing meta descriptions** — published posts and pages with no SEO description. Works with Yoast SEO and Rank Math.
*   **Oversized media** — images and files over 1 MB, with the space you would get back.
*   **Orphaned files** — uploads that nothing on your site appears to use.
*   **Plugin and core health** — pending updates, an unsupported PHP version, missing HTTPS, errors shown to visitors, and a stalled cron.
*   **Images missing dimensions** — the cause of pages that jump around while they load, which Google measures as a Core Web Vital.
*   **Images missing lazy loading** — images further down a page that load before anyone scrolls to them.
*   **Exposed WordPress files** — readme.html, license.txt and debug logs left publicly readable. A debug log can contain server paths and passwords.
*   **XML-RPC** — reported as a notice with the tradeoff explained, because the WordPress mobile app and Jetpack need it.
*   **Thin content** — published pages under 300 words. Pages built from galleries, shortcodes or embeds are left out.
*   **Accessibility basics** — links with no readable text, "click here" links, more than one main heading, and headings that skip a level.

= Fix problems where you find them =

A list of problems is only useful if you can act on it. With **Quick Fix**, each issue row is its own repair tool:

*   Write alt text for an image and press Enter.
*   Replace a broken link with a working one — only that link's address changes, nothing else in the post.
*   Move an unused file to the trash, with a confirmation step. It goes to the trash, never straight to permanent deletion.

Every repair is checked against your user permissions and recorded in an audit log.

= Fix dozens at once with AI (optional) =

Fifty images with no alt text? Writing them one by one is the job everyone puts off.

Add your own Anthropic (Claude) or OpenAI API key, and the alt text and meta description checks get a **Fix all with AI** button:

1.  You see the estimated cost before anything runs. Writing alt text for 30 images costs a fraction of one US cent on the recommended model.
2.  AI writes a suggestion for every item.
3.  You review each one next to what is there now: approve it, reject it, or edit it.
4.  Only what you approved is saved.

The details that matter:

*   **Completely optional.** Without a key, the plugin works exactly the same and you will never see an AI button, banner or reminder.
*   **You pay your provider directly, not us.** My Site Hand does not charge for AI or resell it.
*   **A daily spend cap** ($1.00 unless you change it) stops AI requests for the day once it is reached.
*   **Nothing is saved without your approval.** There is no "skip review" option.
*   **AI only writes alt text and meta descriptions.** It never replaces links (it cannot know the right address) and never deletes files.

= Send the report to a client or your team =

Built for freelancers and agencies who look after other people's sites:

*   **PDF** — a clean, printable report through your browser's own "Save as PDF".
*   **CSV** — every issue as a row, ready for Excel or Google Sheets.
*   **Shareable link** — a read-only page your client can open without logging in. It expires after 7, 30 or 90 days, and you can revoke it at any time.

Shared reports show the score and how many issues each check found — never file names, page addresses, server paths, IDs, or version numbers. The two security checks are left out entirely. You see exactly what the recipient will see before you create the link.

= Keep an eye on it automatically =

The site can scan itself weekly or monthly and email you a short report — but only when your score changes or new problems appear. No email when there is nothing new to say. Your score history is kept, so you can watch the site improve.

= For developers: connect Claude, Cursor or VS Code (optional) =

My Site Hand is also an **MCP server**. MCP (Model Context Protocol) is the open standard that lets AI assistants such as Claude Desktop, Cursor and VS Code use tools. Connect one, and it can work on your site in plain language:

*   Draft, edit and publish posts and pages.
*   Review and update Yoast SEO or Rank Math metadata.
*   Manage the media library, users and roles.
*   Read error logs, cron status and site health details.
*   List orders, low-stock products and coupons in WooCommerce.

That is 33 abilities on a standard site, or 45 with WooCommerce. Every ability is an individual switch. Access tokens are stored as SHA-256 hashes, shown once, scoped to the abilities you choose, and can be restricted to specific IP addresses. Every call is written to a searchable audit log.

Connecting an assistant needs Node.js on your own computer and HTTPS on your site. The scan, Quick Fix and AI Bulk Fix need neither.

= Who it is for =

*   **Site owners** who want to know what is wrong without hiring someone to look.
*   **Freelancers and agencies** who need a quick health check and a report they can send to a client.
*   **Bloggers and shops** with years of images uploaded with no alt text.
*   **Developers** who want an AI assistant that can safely work inside WordPress.

= Translations =

Includes a Bengali (bn_BD) translation, and every string is ready for translation on translate.wordpress.org.

== Installation ==

1.  In your dashboard, go to **Plugins → Add New**, search for **My Site Hand**, then click **Install Now** and **Activate**.
2.  You land on **My Site Hand → Site Health** and your first scan starts by itself.
3.  Open any check to see its issues, and fix them in place.

That is the whole setup.

= Optional: AI Bulk Fix =

1.  Get an API key from Anthropic (console.anthropic.com) or OpenAI (platform.openai.com).
2.  Go to **My Site Hand → Settings → AI Assistance**, choose your provider and paste the key.
3.  Click **Test connection**. It is free.
4.  On the Site Health page, open **Missing Alt Text** or **Missing Meta Description** and click **Fix all with AI**.

= Optional: connect Claude Desktop, Cursor or VS Code =

1.  Go to **My Site Hand → API Tokens** and create a token.
2.  Open **My Site Hand → How to use** and follow the two copy-and-paste steps for your app.
3.  Restart your AI app and start asking it about your site.

== Frequently Asked Questions ==

= Is it free? =
Yes. The scan, all twelve checks, Quick Fix, PDF and CSV export, share links and scheduled reports are free, with no account and no upsell. The only thing that can cost money is AI Bulk Fix, and only if you choose to add your own API key — your AI provider bills you directly for what you use.

= Do I need an API key, an account or any setup? =
No. Activate the plugin and the scan runs. An API key is only needed for the optional AI Bulk Fix, and a token only for connecting an AI assistant like Claude Desktop.

= How do I find broken links on my WordPress site? =
Install My Site Hand and the first scan checks the links in your 50 most recent posts and pages. Each broken link is listed with the post it is in, and you can replace it with a working address right in the report.

= How do I add alt text to all my images at once? =
Run a scan and open **Missing Alt Text**. You can type alt text into each row yourself (free), or add an Anthropic or OpenAI key and click **Fix all with AI** to get a suggestion for every image, review them, and apply the ones you approve.

= Will AI change my site without asking? =
Never. Every suggestion is shown to you first, and only what you approve is saved. You can edit any suggestion before applying it, and closing the review panel discards everything you did not apply.

= How much does AI Bulk Fix cost? =
It depends on your provider and model. On the recommended models, writing alt text for 30 images typically costs a fraction of one US cent. The plugin shows an estimate before every run and the actual cost after it. A daily spend cap, $1.00 unless you change it, stops requests once it is reached.

= Where is my AI API key stored? =
In your own WordPress database. It is only ever sent to the provider you chose, is never shown again after you save it, is never written to logs or error messages, and is deleted when you delete the plugin.

= Does it work with Yoast SEO and Rank Math? =
Yes. The meta description check reads and writes the description field of whichever of the two you use. Without either plugin the check is marked "not applicable" rather than reporting every page.

= Will it report links that are not really broken? =
It works hard not to. Only 404 and 410 responses count as broken. Anything ambiguous — a 403, a 405, a server error — is retried a different way, and if it is still unclear it is not reported.

= Will the scan slow down my site? =
No. It only runs when you start it, or on the schedule you choose, and it works in small batches so no single request runs long enough to time out. Scheduled scans skip the link check on sites with more than 500 published posts.

= Can I send the report to a client? =
Yes. Save it as a PDF, export a CSV, or create a share link that opens without a login. Share links show scores and counts only, expire after 7, 30 or 90 days, and can be revoked at any time.

= Should I turn XML-RPC off because the scan mentions it? =
Only if you do not use the WordPress mobile app, Jetpack, or a desktop publishing tool, all of which need it. That is why it is reported as a notice, and why sites running Jetpack are skipped.

= Does the "Download PDF" button create a PDF on my server? =
No. It opens a clean printable page and your browser's own print dialog, where you choose "Save as PDF". That keeps the plugin small and works the same in every browser.

= Does this send my data to third-party servers? =
Not unless you set up AI Bulk Fix. The scan, Quick Fix, reports and share links all run on your own site. If you add an AI key and start a run, the details needed for each suggestion are sent to the provider you chose — see External Services below. When you connect an AI assistant over MCP, it talks directly to your site.

= What AI apps can connect over MCP? =
Any app that supports the Model Context Protocol, including Claude Desktop, Cursor, VS Code with an MCP extension, and Windsurf.

= Do I need Node.js? =
Only to connect an AI assistant over MCP, because the small bridge it uses (mcp-remote) runs on your own computer. The scan, Quick Fix and AI Bulk Fix do not need it.

== Screenshots ==

1. One click and no setup: a health score out of 100 and a plain list of what is wrong — broken links, missing alt text and meta descriptions, oversized and unused files, security and accessibility problems.
2. Quick Fix. Write alt text, replace a dead link or trash an unused file straight from the report. No AI and no API key needed.
3. Twelve checks run one at a time, so nothing times out. Results appear as they finish, and you can cancel at any point.
4. Every scan is kept, so you can watch your score improve. The optional email only arrives when something changed.
5. The dashboard opens with your health score, then the MCP endpoint, live figures and the most recent AI calls.
6. Choose how often the site scans itself and where the report goes, or switch it off. Rate limits and log retention live here too.
7. Connecting Claude Desktop, Cursor or VS Code is an optional extra — the scan and Quick Fix need none of it.
8. Every ability is its own switch, and every token is limited to exactly what you allow. Tokens are SHA-256 hashed and shown once.
9. Every call is recorded with its input, duration and the exact reason it failed. Quick Fix and AI Bulk Fix repairs are logged here too. Exportable to CSV.
10. Send the report on as a PDF, a CSV, or a public link with an expiry you choose. You see exactly what the recipient will see first — scores and counts, never a file name, an address or a version number.
11. AI Bulk Fix, entirely optional. Each proposed alt text is shown next to what is there now — approve, reject or edit it, and only what you approved is saved. The estimated cost is shown before anything runs.

== Changelog ==

= 1.3.0 - 11 October 2026 =
*   **New: AI Bulk Fix.** Generate alt text and meta descriptions for every flagged item at once, review each proposal, edit anything you want to change, then apply only what you approved.
*   **New:** Bring your own Anthropic or OpenAI key, with a daily spend cap and a usage readout.
*   **Fixed:** In Orphan Media, the "Move this file to the trash?" confirmation showed beside the Move to trash button before it was clicked. It now appears only after you click.
*   Everything else is unchanged. The scan, Quick Fix, exports, shared reports and MCP all work exactly as before, with no API key required.

= 1.2.0 - 6 September 2026 =
*   **New: six more checks** — image dimensions, lazy loading, exposed WordPress files, XML-RPC, thin content, and accessibility basics. Twelve checks in total.
*   **New: PDF and CSV export.** Send a client the report without giving them a login.
*   **New: shareable report links** with an expiry you choose. Public reports show scores and counts only — never paths, IDs, versions or plugin names.
*   **New:** Bengali translation, and the plugin is now fully ready for community translation.
*   **Improved:** Score weighting was retuned for twelve checks, so an ordinary site still lands in a usable range rather than being marked critical for having twice as much measured.

= 1.1.0 - 26 August 2026 =
*   **New: Site Health Scan** — one click, no setup. Find broken links, missing alt text, missing meta descriptions, oversized media, orphaned files, and plugin or core health problems.
*   **New: Quick Fix** — repair issues inline from the report. No AI or API key required.
*   **New:** Score history and trend so you can watch your site improve.
*   **New:** Optional weekly email report. It stays quiet when there is nothing new to say.
*   **New:** Plugin checks now appear in WordPress's own Tools → Site Health.
*   **Improved:** Activation now takes you straight to a scan of your site instead of setup instructions. The MCP connection steps are still there, collapsed on the Dashboard as an optional upgrade.
*   **New:** Redesigned admin interface. The left sidebar is replaced by a brand row and a tab bar, and every page now has a numbered index so you can jump straight to the section you came for.
*   **Improved:** A single accent colour, flat surfaces, and a monospaced type scale make status, counts, and destructive actions easier to read at a glance.
*   **Improved:** The dashboard now surfaces what needs your attention — missing HTTPS, tokens expiring within 30 days, or a stopped endpoint.
*   **Fixed:** The "Trust proxy headers" and "Allow token in URL query string" settings did not save. Both now work.
*   **Fixed:** The settings page could submit itself and blank stored options if you pressed Enter in a text field. Settings save individually as you change them, so the form has been removed.

= 1.0.2 - 24 August 2026 =
*   **Security:** Tokens created without an explicit ability selection no longer default to full access. Existing tokens are migrated automatically and continue to work unchanged.
*   **Security:** API tokens are no longer accepted via URL query string by default. Use the Authorization header instead. An opt-in setting remains available for clients that cannot send headers.
*   **New:** Optional per-token IP allowlist with CIDR range support.
*   **New:** Trusted proxy setting for sites behind Cloudflare or a reverse proxy.
*   **Improved:** Token creation now clearly distinguishes full access from limited access.
*   **Fixed:** Database schema version was not being stored after an upgrade, causing unnecessary schema checks on every page load.

= 1.0.1 - 9 June 2026 =
*   Added a "Suggest a Feature" page so users can submit feature requests directly to the developer's email.
*   Improved email deliverability with dynamic "From" headers and real-time failure log captures.
*   Styled and aligned the admin menu icon in the sidebar with a white background and centered flex alignment.
*   Added automatic redirection to the dashboard immediately upon plugin activation for faster onboarding.
*   Added a "How to Use" shortcut link directly on the Plugins page.

= 1.0.0 =
*   Official Initial Release.
*   Automated zero-config setup for Claude Desktop.
*   Support for Content, SEO (Yoast, RankMath), WooCommerce, and Diagnostics.
*   Secure token management and real-time audit logs.

== Upgrade Notice ==

= 1.3.0 =
Adds optional AI bulk fixing for alt text and meta descriptions. Everything from 1.2.0 works exactly as before with no API key. Your existing scans, tokens and MCP connection are untouched.

= 1.2.0 =
Six new checks including security and accessibility, plus PDF, CSV and shareable report links. Existing scans, tokens and MCP connections are unchanged.

= 1.1.0 =
Adds a one-click Site Health scan with inline Quick Fix — no setup, no API key. Your existing MCP connection, tokens and audit history are unchanged. If screens look unstyled after updating, refresh once.

= 1.0.2 =
Security update. Token permissions are now enforced strictly. Your existing tokens are migrated automatically and will keep working. Please review your tokens after updating to narrow their scope.

== External Services ==

= Link Checker (SEO Module) =
When the check-broken-links ability is called via the MCP API, this plugin sends HTTP HEAD requests to URLs found in your post content to verify they are reachable. No personal user data is transmitted — only a standard HTTP request is made to each URL being checked. This is triggered only when explicitly called by an authorized API token holder.

= Link Checker (Site Health scan) =
The Broken Links check in the Site Health scan sends HTTP HEAD requests (and, where a server refuses HEAD, a single ranged GET) to the links found in your 50 most recent published posts and pages, to see whether they still resolve. The request identifies this plugin and your site URL in its user agent. No personal user data is transmitted. Results are cached for 12 hours. This runs when you start a scan from the admin, and during the scheduled scan if you leave that enabled — on sites with more than 500 published posts the link check is skipped on the schedule. Turning scheduled reports off in **My Site Hand → Settings** stops the scheduled scan entirely.

= Requests this plugin makes to your own site =
The Exposed WordPress Files and XML-RPC checks ask your own site, over HTTP, whether /readme.html, /license.txt, /wp-config-sample.php, /wp-content/debug.log and /xmlrpc.php answer to an anonymous visitor. These are loopback requests to your own domain, not to any third party, and no data is sent in them. Results are cached for 12 hours. If your host blocks loopback requests, both checks report that they could not run rather than reporting your files as safe.

= AI Bulk Fix: Anthropic API (optional) =
Only if you add an Anthropic API key in **My Site Hand → Settings → AI Assistance** and choose Anthropic as the provider. When you press **Fix all with AI** and then **Write suggestions**, the plugin sends a request to https://api.anthropic.com/v1/messages containing, for each item: for images, the file name, title, caption, description and the title of the page using the image; for posts and pages, the title, excerpt and up to 1,500 characters of text. Pressing **Test connection** sends a request to https://api.anthropic.com/v1/models, which carries no site content. Your API key is sent in the request header. Nothing is sent until you start a run, and nothing at all if no key is stored. Anthropic's terms: https://www.anthropic.com/legal/commercial-terms — privacy policy: https://www.anthropic.com/legal/privacy

= AI Bulk Fix: OpenAI API (optional) =
Only if you add an OpenAI API key in **My Site Hand → Settings → AI Assistance** and choose OpenAI as the provider. The same data described above for Anthropic is sent to https://api.openai.com/v1/chat/completions, and **Test connection** sends a request to https://api.openai.com/v1/models. Nothing is sent until you start a run, and nothing at all if no key is stored. OpenAI's terms: https://openai.com/policies/terms-of-use — privacy policy: https://openai.com/policies/privacy-policy

= Shared report links =
Creating a share link stores a redacted snapshot of your scan in your own database and serves it from your own site at a tokenized URL. Nothing is uploaded anywhere. The page is sent with X-Robots-Tag: noindex, nofollow, every link expires, and you can revoke one at any time.

No data is sent to any third-party analytics or tracking service by this plugin.
