=== Omninox Site Toolkit ===
Contributors: Sobhitjadoun
Tags: backup, migration, performance, security, seo, database, maintenance
Requires at least: 5.8
Tested up to: 7.1
Requires PHP: 7.2
Stable tag: 1.0.8
License: GPL-2.0-or-later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

All-in-one performance, backup & restore, migration, security, SEO, database cleanup and site health tools for WordPress maintenance and diagnostics.

This plugin is distributed under the GPLv2 or later license. It does not require a licence key or a paid account.

== Description ==

Omninox Site Toolkit is an all-in-one WordPress performance, backup & restore, migration, security, SEO and maintenance plugin. It replaces a stack of single-purpose plugins with one modular toolkit for site health checks, database cleanup, diagnostics, optimization and reporting. Every module answers the same question in the same shape: what is wrong, how bad is it, and what happens if you click fix.

Modules included:

* Complete Backup — Database export (.sql dump) and backup readiness diagnostics
* Website Health — WordPress environment, server limits, permissions and caching layers
* Performance Analyzer — TTFB, render-blocking assets, compression, CDN and plugin asset footprint
* Conflict Detector — duplicate plugin families and documented incompatible pairs
* Database Optimizer — revisions, transients, spam comments, and database cleanup
* Media Manager — unattached media audit, oversize scan, and 100 free WebP image conversions
* SEO Auditor — titles, meta descriptions, headings, canonicals, XML sitemap validator
* Accessibility Scanner — WCAG checks on rendered markup, contrast and alt tag diagnostics
* Security Center — core hardening checks, exposure checks, user enumeration protection
* Error Log Center — PHP error log viewer with de-duplication and severity filters
* Developer Tools — hooks, rewrite rules flush, transients purge, autoloaded options inventory
* Reports — On-demand HTML and CSV site audit exports

== Installation ==

1. Upload the `omninox-site-toolkit/` directory to `/wp-content/plugins/` (or install via zip).
2. Activate the plugin through the Plugins screen.
3. Open Omninox Site Toolkit in the admin menu and run a full audit.

== Frequently Asked Questions ==

= Do the fixes touch my files? =

Some do. Image compression keeps a backup in the plugin storage directory within uploads before optimizing, and WebP conversion never replaces the source image in the free version. Always download a database backup before running database cleanups.

= Does it work without a licence key? =

Yes. All core Free features, diagnostic modules, database cleanups, and HTML/CSV exports are completely free and standalone under GPLv2+. No license key, trial period, or account registration is required to use the free plugin.

= How many images can I convert for free? =

The free plugin includes 100 free WebP image conversions. For unlimited WebP and AVIF conversions, in-place replacements, and database restoration, you can optionally install the separate Omninox Site Toolkit Pro add-on.

= Why did WebP conversion report zero files? =

Check the Image conversion support row at the top of the Media module. If it says "No WebP support", the server has neither Imagick nor a GD build with WebP, and conversion cannot run until the host enables one. Every other failure reports the specific reason in the result message rather than silently counting zero.

== External Services ==

This plugin can connect to external 3rd-party services under specific conditions:

1. **Net Innovix Licensing and Pricing Service**
* **Service Description:** Net Innovix provides optional license activation, deactivation, periodic license status validation, and live pricing catalog retrieval for Omninox Pro upgrades.
* **When data is sent:**
  - When an administrator visits the License or Upgrade settings screen, the plugin fetches current Pro pricing plans via `GET /api/plugins/catalog` (no personal or site data is transmitted).
  - When an administrator enters and activates a Pro license key, the plugin connects to `POST /api/activate` and sends the submitted license key, site URL (`home_url()`), plugin slug, and plugin version.
  - When an administrator deactivates a license key, the plugin connects to `POST /api/deactivate` and sends the license key, site URL, and plugin slug.
  - Once daily via WP-Cron (or upon manual refresh), if a license key is active, the plugin connects to `POST /api/validate` and sends the license key, site URL, and plugin slug to verify active license status.
* **Service Provider & Hosting:** Provided by Net Innovix, hosted at `https://netinnovix.com/api`.
* **Terms of Service:** [Net Innovix Terms of Service](https://netinnovix.com/terms)
* **Privacy Policy:** [Net Innovix Privacy Policy](https://netinnovix.com/privacy)
* **Optionality:** 100% optional. The core Free plugin, all diagnostic modules, database cleanups, and export tools function fully without connecting to this service.

2. **Administrator Webhook Notifications (Slack, Discord, Telegram)**
* **Service Description:** Allows administrators to optionally route automated site health and security alert summaries to their private communication channels.
* **When data is sent:** Sent only when an administrator explicitly enters a webhook endpoint URL in settings and an automated scheduled scan identifies health/security issues or an admin triggers a test notification. Transmits the generated audit summary text to the configured URL.
* **Service Providers:**
  - Slack: [Slack Terms](https://slack.com/terms-of-service) | [Slack Privacy Policy](https://slack.com/privacy-policy)
  - Discord: [Discord Terms](https://discord.com/terms) | [Discord Privacy Policy](https://discord.com/privacy)
  - Telegram: [Telegram Terms](https://telegram.org/tos) | [Telegram Privacy Policy](https://telegram.org/privacy)
* **Optionality:** 100% optional and disabled by default.

== Screenshots ==

1. Dashboard with site health score, module scores and quick actions.
2. Website Health checks grouped by server, WordPress, PHP and filesystem.
3. Security Center with hardening checks and audit details.
4. Media Manager with conversion and compression status.
5. Reports and recent activity history.

== Upgrade Notice ==

= 1.0.8 =
UI/UX redesign with premium light theme, updated brand identity, and WordPress 6.7+ early translation compatibility.

= 1.0.7 =
WordPress.org review security fixes: safe title escaping for the_title filter, origin nonce verification on direct file downloads, and token user-binding checks.

= 1.0.6 =
Major backup & restore engine hardening: prevents destination WordPress crashes, protects recovery plugin activation across database replacement, prevents overwriting destination themes, adds atomic mutex locking, crash-safe DB/file checkpointing, immutable rollback snapshots, and zip bomb safety checks.

= 1.0.5 =
Backup engine refactoring, Free Level 1 Pro Gate integration, and packaging cleanups.

= 1.0.4 =
Security hardening, WordPress.org compliance fixes, and asset enqueue optimization.

== Changelog ==

= 1.0.8 =
* Feature: Complete UI/UX redesign featuring a clean, responsive layout with updated SVG brand identity.
* Compatibility: Full WordPress 6.7+ early translation compatibility, deferring textdomain load to init hook and preventing doing_it_wrong notices.
* Enhancement: Optimized admin CSS footprint and streamlined theme variables.
* Fix: Added standalone printable audit report stylesheet (`report.css`).

= 1.0.7 =
* Security: Escaped post title output in the_title filter callback (`Highlighter::highlight_title`) using `esc_html()`, with search term highlighting applied strictly to escaped plain text and entity skipping (`&[#a-zA-Z0-9]+;(*SKIP)(*FAIL)`).
* Security: Added origin nonce verification (`wp_verify_nonce( $nonce, 'omninox_download' )`) and capability authorization gates in `admin_post_download()`.
* Security: Added user ownership/binding validation in `Security::redeem_token()` to prevent token cross-redemption.
* Feature: Added standardized `Security::generate_download_url()` helper to build nonce-protected download URLs.

= 1.0.6 =
* Fix: Prevented destination site crashes during or immediately following database and file restoration.
* Fix: Preserved OmniNox Free and Pro recovery engine active in `active_plugins` across database replacement.
* Fix: Preserved destination theme throughout restore; deferred third-party source plugin and theme activation until post-restore validation.
* Fix: Protected OmniNox Free and Pro plugin directories from being overwritten or hot-swapped during active file deployment.
* Fix: Implemented atomic ownership-based restore mutex locking with periodic heartbeat lease renewal.
* Fix: Implemented crash-safe database statement checkpointing with exact byte offset boundaries.
* Fix: Implemented immutable file rollback copies ensuring resume operations never overwrite original pre-restore files.
* Fix: Implemented complete filesystem rollback with transaction replay for newly added and replaced files.
* Fix: Added preflight ZIP bomb and decompression safety limits (entry count, single entry ceiling, compression ratio, disk space margin).
* Fix: Guaranteed destination URL persistence (`siteurl` and `home`) across cross-site migrations.
* Fix: Added server-side active restore discovery REST endpoint (`/restore/active`) for recovery without relying solely on browser session storage.

= 1.0.5 =
* Feature: Refactored Backup module architecture with clean Free Level 1 Pro Gate.
* Chore: Packaging cleanups and release zip distribution isolation.

= 1.0.4 =
* Fix: Security hardening and asset enqueue optimization.
* Fix: WordPress.org directory compliance guidelines adherence.
