=== OCW Reviews ===
Contributors:      adviespraktijkocw
Tags:              reviews, testimonials, ratings, customer reviews, star rating
Requires at least: 6.0
Tested up to:      7.1
Stable tag:        2.10.0
Requires PHP:      8.0
License:           GPLv2 or later
License URI:       https://www.gnu.org/licenses/gpl-2.0.html

Collect customer reviews via email or WhatsApp invitations and display them in clean card layouts. Self-hosted and privacy-first.

== Description ==

OCW Reviews helps you collect, manage and display customer reviews directly on your WordPress site — no external widgets, no subscriptions, and no vendor lock-in. Invite customers by email or WhatsApp, track responses with secure tokens, and display approved reviews using flexible shortcodes and a clean card layout.

The plugin is fully functional and free. Nothing is locked or time-limited.

This is an independent plugin. It is not affiliated with, endorsed by or sponsored by WhatsApp LLC, Meta Platforms, Inc., Google LLC or Automattic. "WhatsApp", "Google" and "Gravatar" are the trademarks of their respective owners and are used here only to say what the plugin talks to.

= Features =

* Custom Post Type for reviews and a service/product taxonomy
* Star ratings and optional anonymous display (names are partially masked)
* Reviewer avatars from generated initials, with optional Gravatar (off by default)
* Shortcodes: [rvst_reviews], [rvst_review_form], [rvst_reviews_summary]
* Invitation system via email or WhatsApp with per-invite tracking tokens
* Invitation Log drag-and-drop workflow board (Invited → Reminded → Responded → No response) with an automatic 8-day reminder
* Fully editable email templates (subject, header, body, footer) for invitations, reminders and thank-you emails
* Automatic thank-you email and an automatic reminder workflow
* Setup wizard and tutorial page
* Honeypot and rate-limiting to reduce spam
* Fully self-hosted — the free plugin makes no outgoing third-party calls unless you enable Gravatar

= Optional PRO version =

A separate, optional premium plugin — OCW Reviews PRO — is available from https://onlinecursuswebsites.nl/review-starter-pro and adds extra features on top of this free plugin: CSV bulk import & bulk invitations, automatic review requests from WooCommerce orders, SEO rich snippets (star ratings in Google results), reviewer photo upload, extra card designs, webhooks, and Google Reviews import. It is a standalone download and is **not** part of this free plugin; installing it simply adds those extra features. Nothing in this free plugin is disabled or gated.

== Installation ==

1. Go to **WordPress Admin → Plugins → Add New → Upload Plugin**
2. Upload the ZIP and click **Install Now**, then **Activate**
3. The setup wizard opens automatically — follow the steps to configure the plugin
4. Place `[rvst_review_form]` on a page where customers can leave reviews
5. Place `[rvst_reviews]` on a page where you want to display them

== Shortcodes ==

* `[rvst_reviews]` — displays approved reviews as cards. Attributes: `service` (a service/product slug or ID, or a comma-separated list to combine several, e.g. `service="mvk-player,rankly"`), `columns`, `per_page`, `orderby`, `order`.
* `[rvst_review_form]` — displays the review submission form. Attribute: `service` (a single service/product to pre-select).
* `[rvst_reviews_summary]` — displays average rating and total review count. Attribute: `service` (slug/ID, or a comma-separated list).

The older names `[review_starter]`, `[review_starter_form]` and `[review_starter_summary]` still work and do exactly the same thing, so pages written before version 2.10.0 keep working untouched. Use the `rvst_` names for anything new.

== Frequently Asked Questions ==

= Is there a getting-started video? =

Yes. The Getting Started video walks you through installation, the setup wizard, placing the shortcodes and sending your first invitation: https://vimeo.com/1207758228

= Does the plugin contact external services? =

By default, no. The only optional third-party request is Gravatar for reviewer avatars, which is turned off by default. You can enable it under Settings → Display; when enabled, the reviewer's email hash is sent to gravatar.com to fetch the avatar image.

= What data is collected? =

Reviewer name, review text, optional email/company/website and rating. IP addresses are stored for spam protection. Invitations store recipient name and email/phone with a unique tracking token. Nothing is sent off your site except optional Gravatar avatars (see above) and the emails you choose to send via your own mail setup.

= How are reviewers' avatars chosen? =

Generated coloured initials by default. If you enable Gravatar under Settings → Display, an avatar based on the reviewer's email is used when available.

= Can I anonymize reviewer names? =

Yes. Each review can be marked anonymous and the display name will be masked.

== External services ==

The plugin works without contacting anything. Two things reach outside the site, and both need a deliberate action first.

**Gravatar (Automattic, Inc.) — optional, off by default**
What it is used for: showing a reviewer's own avatar on a review card instead of their generated initials.
When it happens: only while **Settings → Display → Show Gravatar avatars** is switched on, and only for reviews that carry an email address and are not marked anonymous. The card is rendered by the visitor's browser, which then requests the image from gravatar.com.
What is sent: an MD5 hash of the reviewer's email address, as part of the image URL, plus whatever the visitor's browser sends with any image request (IP address, user agent).
Turn it off and nothing is sent. The setting ships off.
Terms: https://automattic.com/terms/ — Privacy: https://automattic.com/privacy/

**WhatsApp (WhatsApp LLC / Meta Platforms, Inc.) — only when you click Send**
What it is used for: opening WhatsApp with your invitation text pre-filled, so you can send it yourself.
When it happens: only when you choose WhatsApp as the channel and click Send on the Invitations page. The plugin builds a `https://wa.me/...` link and your browser opens it; the site's server never calls WhatsApp and no message is sent without you pressing send in WhatsApp itself.
What is sent: the phone number you entered and the invitation text, as part of that URL.
Terms: https://www.whatsapp.com/legal/terms-of-service — Privacy: https://www.whatsapp.com/legal/privacy-policy

Nothing else leaves the site: no analytics, no licence check, no phone-home. The Getting Started link on the tutorial page is an ordinary link to Vimeo that opens only if you click it; no video is embedded.

== Screenshots ==

1. Review submission form
2. Reviews card grid
3. Invitations admin page
4. Invitation Log
5. Tutorial / Getting started page

== Changelog ==

= 2.10.0 =
* Fixed: the Tutorial and the Upgrade page still called the email template editor a PRO feature, although 2.9.0 made it free for everyone.
* OCW Reviews PRO is now an add-on that installs alongside this plugin instead of replacing it. Both can be active at once; neither deactivates the other any more.
* Shortcodes are now `[rvst_reviews]`, `[rvst_review_form]` and `[rvst_reviews_summary]`. The old `[review_starter…]` names still work, so existing pages are unaffected.
* Hardening pass for the WordPress.org review: everything the plugin prints is escaped on the way out, form input is sanitised, the term-meta save verifies its nonce, and the rate limiter no longer trusts a header the visitor can forge.
* The plugin no longer switches off another plugin for you; it says which one to deactivate and leaves that to you.
* New `External services` section in this readme: exactly what Gravatar and WhatsApp receive, and what has to happen first. Neither is contacted on its own.
* The translation template shipped empty since 2.3.0 and now actually contains the plugin's strings, so it can be translated.
* Tested up to WordPress 7.1.

= 2.9.0 =
* All features are now fully free and functional: editable email templates (invitation/reminder/thank-you), automatic thank-you + reminder workflow, and the drag-and-drop Invitation Log board. Removed all PRO gating from the free plugin.

= 2.8.2 — 2026-07-09 =
* Fixed: responded cards can no longer be dragged back into the workflow; existing installs keep their WhatsApp invite text on update.

= 2.8.1 — 2026-07-09 =
* Added: a per-invite WhatsApp message box on the Send Invitation page (shown for WhatsApp, pre-filled with your saved text) so you can personalise each invite.

= 2.8.0 — 2026-07-09 =
* Added: Invitation Log drag-and-drop workflow board (Invited / Reminded / Responded / No response).

= 2.7.0 — 2026-07-09 =
* Added: invitation workflow stages (Invited/Reminded/Responded/No-response) in the Invitation Log with a daily cron and a direct review link on response.

= 2.6.1 — 2026-07-09 =
* Fixed: settings cards collapsed to a narrow sliver on several tabs. Rebuilt the two-column layout with flexbox so cards keep a readable width. Clear your CSS cache after updating.

= 2.6.0 — 2026-07-09 =
* Changed: Email tab rebuilt — Invitation/Reminder/Thank You order, each with Subject/Header/Body/Footer. WhatsApp tab gets its own short message.

= 2.5.1 — 2026-07-09 =
* Fixed: settings cards on the General/Display tabs collapsed to a narrow sliver after 2.5.0. The two-column layout now keeps a readable minimum width.

= 2.5.0 — 2026-07-09 =
* Changed: settings UI polish — left-aligned cards, Invitations tab renamed to WhatsApp, and a Parameters + Examples section on the Reference tab.

= 2.4.1 — 2026-07-09 =
* Fixed: email fields are saved reliably again — the save no longer re-checks the licence at save time (which could discard edits). Matches PRO 2.4.1.

= 2.4.0 — 2026-07-09 =
* Changed: editing email texts and the Thank You / Reminder emails are now PRO features, shown locked with an upgrade link. The free plugin sends invitations with a fixed default English text. From Name/Email stay editable.

= 2.3.4 — 2026-07-09 =
* Fixed: rebuilt the duplicate-copy guard so it actually prevents the "Cannot redeclare rvst_activate()" fatal. Core declarations moved to a separate file loaded only after the guard runs. Matches PRO 2.3.4.

= 2.3.3 — 2026-07-09 =
* Fixed: redeclaration fatal ("Cannot redeclare rvst_activate()") is now prevented against any duplicate copy, and the legacy "Review Starter" plugin is deactivated automatically. Delete old duplicate copies of the plugin.

= 2.3.2 — 2026-07-09 =
* Fixed: fatal error "Cannot redeclare class Review_Starter" when the free plugin was loaded alongside OCW Reviews PRO. PRO already includes all free features, so the free plugin now stands down (deactivates itself) when PRO is active.

= 2.3.1 =
* Maintenance release to keep the free plugin in sync with OCW Reviews PRO 2.3.1. No functional changes to the free plugin.

= 2.3.0 =
* Renamed the plugin to OCW Reviews.
* Removed all premium/license code: the plugin on WordPress.org is now fully free and self-contained, with no locked features, license checks or update/phone-home calls. Premium features live in the separate optional OCW Reviews PRO plugin.
* Gravatar avatars are now opt-in and off by default (Settings → Display); coloured initials are used otherwise. No third-party request is made unless you enable it.
* Hardened input handling: all request data is unslashed and sanitized, including nonce values.
* Moved the remaining inline admin script into the enqueued admin script.

= 2.2.2 =
* Maintenance release.

= 2.2.1 =
* The `service` attribute on `[review_starter]` and `[review_starter_summary]` now accepts a comma-separated list, so you can show reviews for several specific products in one shortcode.

= 2.2.0 =
* Fully editable email templates and automatic thank-you + reminder emails.
* Added a Getting Started video link to the FAQ.

= 2.1.0 =
* Security: hardened outgoing emails against header injection.
* Privacy: documented which personal data is processed.
* Uninstall: collected reviews and services are retained as site content; settings and invitation tokens are removed.
* Compatibility: tested up to WordPress 7.0.

= 2.0.0 =
* New Tutorial submenu with progress detection and reset button.
* Refreshed admin design.

= 1.2.0 =
* Configurable brand colour + star colour.

= 1.1.0 =
* Invitation tracking with a custom database table.
* Token-based mapping from invite to review.
* Invitation Log admin page with resend button.

= 1.0.0 =
* Initial release.

== Upgrade Notice ==

= 2.10.0 =
Security and escaping hardening for the WordPress.org directory. The shortcodes gained `rvst_` names; the old ones keep working, so nothing on your pages needs changing.

= 2.3.0 =
Renamed to OCW Reviews and made fully free and self-contained — no license checks, no locked features, and no phone-home. Gravatar avatars are now opt-in and off by default.
