=== PrePublish Comment Moderator ===
Contributors: koskar22
Tags: comments, moderation, spam, ai, prepublish
Requires at least: 5.8
Tested up to: 7.0
Requires PHP: 7.4
Stable tag: 1.5.4
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Pre-publish AI comment moderation for WordPress. Block spam and toxic comments before they go live — OpenAI, Gemini, Groq, Perspective API, or a free local filter. Greek & English.

== Description ==

**PrePublish Comment Moderator** protects your WordPress site by analyzing every new comment *before* it is published. Each comment receives a toxicity/spam score from **0 to 100**, and the plugin automatically approves, holds, or marks it as spam based on thresholds you control.

No more drowning in spam. No more toxic comments slipping through. Set it up in minutes and let AI (or a free offline filter) do the heavy lifting.

= Why use this plugin? =

* **Real-time moderation** — comments are checked on submission, before they appear on your site.
* **Multiple AI providers** — choose the engine that fits your budget and needs.
* **Free option included** — start with the built-in Local Filter; no API key required.
* **Multilingual** — optimized for **Greek**, **English**, and **Greeklish** (including accent and leetspeak bypass detection).
* **Comment Schema (SEO)** — enriches Yoast SEO, Rank Math, All in One SEO, SEOPress, and Newsroom OS graphs with `Comment` markup (no duplicates).
* **Fail-safe design** — if an API fails or times out, comments are held for manual review instead of being published blindly.
* **Admin-friendly** — clear settings page, step-by-step API key guides, AI Score column, and one-click Retry AI button.
* **Frontend polish** — optional Live Comments banner and AI Verified badge.

= AI providers =

| Provider | API key | Cost | Best for |
|----------|---------|------|----------|
| **Local Filter** | Not required | 100% free, unlimited | Fast offline blocking, Greek/English word lists, custom blocked words |
| **Groq** | Yes (free tier) | Generous free daily limits | Smart AI moderation at no cost |
| **OpenAI (ChatGPT)** | Yes | Pay-as-you-go (~$0.0001/comment) | Highest accuracy, context & sarcasm |
| **Google Gemini** | Yes | Free tier (~20/day) or paid billing | Strong multilingual AI |
| **Perspective API** | Yes (approval) | Free with Google approval | Dedicated toxicity scoring |

The settings screen includes **built-in setup instructions** for every provider, with direct links to API consoles.

= How moderation works =

1. A visitor submits a comment on your site.
2. The plugin sends the comment text to your chosen provider (or runs the local filter on your server).
3. A score from 0 (safe) to 100 (toxic/spam) is returned.
4. Based on your thresholds:
   * **0 – Approve threshold** → comment is published (with optional “AI Verified” badge).
   * **Above approve, up to Hold threshold** → comment is held for moderation.
   * **Above Hold threshold** → comment is marked as spam.
5. If the API errors or times out, the comment is **held** — never silently approved. Failed checks are retried automatically in the background, or manually via **Retry AI** in the admin.

= Key features =

* Adjustable strictness with two thresholds (approve / hold / spam zones).
* Encrypted API key storage on your server.
* Email notification when a comment is held (optional).
* Custom blocked words list for the Local Filter with severity levels.
* Quality Score and auto Top Comment pinning for engagement.
* Comment Schema.org markup merged into existing SEO plugin JSON-LD.
* Greek UI translations when your site locale is Greek.

= Privacy =

When you use an **AI provider** (OpenAI, Gemini, Groq, or Perspective), comment text is sent to that provider’s API for analysis. The **Local Filter** runs entirely on your server and does not send data externally.

You are responsible for complying with your provider’s terms of service and your site’s privacy policy. API keys are stored encrypted using WordPress salts.

See the **External services** section below for details on each third-party service.

= Who is this for? =

* News sites and blogs with active comment sections.
* Greek and international publishers who need bilingual moderation.
* Site owners tired of manual spam cleanup.
* Anyone who wants AI-powered comment safety without coding.

== External services ==

This plugin connects to third-party AI services **only when you select a cloud provider** and enter an API key. The Local Filter runs entirely on your server and does not contact external services.

For each provider below: **what** it is, **what data** is sent, **when**, and links to **terms** and **privacy policy**.

= Groq =

Used for AI-powered toxicity/spam scoring when you select Groq as the provider.

**Data sent:** The plain text of each new comment submitted on the frontend, plus a short moderation prompt (no visitor IP or email is sent by this plugin).
**When:** Only at comment submission time, and only when Groq is the active provider.
**Service:** Groq, Inc. — [Terms of Use](https://groq.com/terms-of-use/), [Privacy Policy](https://groq.com/privacy-policy/).

= OpenAI =

Used for AI-powered toxicity/spam scoring when you select OpenAI as the provider.

**Data sent:** The plain text of each new comment submitted on the frontend, plus a short moderation prompt.
**When:** Only at comment submission time, and only when OpenAI is the active provider.
**Service:** OpenAI — [Terms of Use](https://openai.com/policies/terms-of-use), [Privacy Policy](https://openai.com/policies/privacy-policy).

= Google Gemini =

Used for AI-powered toxicity/spam scoring when you select Google Gemini as the provider.

**Data sent:** The plain text of each new comment submitted on the frontend, plus a short moderation prompt. Your API key is sent as part of the request URL to Google’s API endpoint.
**When:** Only at comment submission time, and only when Gemini is the active provider.
**Service:** Google — [Gemini API Terms](https://ai.google.dev/gemini-api/terms), [Privacy Policy](https://policies.google.com/privacy).

= Google Perspective API =

Used for dedicated toxicity scoring when you select Perspective API as the provider.

**Data sent:** The plain text of each new comment submitted on the frontend.
**When:** Only at comment submission time, and only when Perspective is the active provider.
**Service:** Google Jigsaw / Perspective API — governed by [Google APIs Terms of Service](https://developers.google.com/terms) and [Google Privacy Policy](https://policies.google.com/privacy). See also the [Perspective API FAQ](https://developers.perspectiveapi.com/s/about-the-api-faqs).

== Installation ==

= Automatic installation =

1. In your WordPress admin, go to **Plugins → Add New**.
2. Search for **PrePublish Comment Moderator**.
3. Click **Install Now**, then **Activate**.

= Manual installation =

1. Upload the `prepublish-comment-moderator` folder to `/wp-content/plugins/`.
2. Activate the plugin through the **Plugins** menu in WordPress.
3. Go to **Settings → PrePublish Moderator**.

= Quick start (recommended) =

1. Open **Settings → PrePublish Moderator**.
2. Select **Local Filter (Free — no API key)** as your AI provider.
3. Set your strictness thresholds (defaults: approve ≤ 30, hold ≤ 70, above 70 = spam).
4. Click **Save Changes**.
5. Submit a test comment on any post with comments enabled.

You can switch to Groq, OpenAI, Gemini, or Perspective at any time by selecting a provider and pasting your API key. Follow the on-screen setup guide for each service.

== Frequently Asked Questions ==

= Do I need an API key? =

No. The **Local Filter** works without any API key and is enabled by default. For smarter detection (context, sarcasm, nuanced toxicity), use Groq (free tier) or OpenAI.

= Does it work with Greek comments? =

Yes. The plugin is built for **Greek**, **English**, and **Greeklish**. The Local Filter includes 300+ terms with accent normalization and common bypass patterns. AI providers (OpenAI, Groq, Gemini) also handle Greek well when configured.

= What happens if the API fails? =

The comment is placed **on hold** for manual review. It will not be auto-approved. The plugin retries automatically in the background (~2.5 minutes, up to 3 times), or you can click **Retry AI** in the Comments admin list.

= Will this slow down my site? =

Comment analysis runs only when someone submits a comment — not on every page view. API calls use a 15-second timeout. The Local Filter runs instantly on your server.

= Does it moderate logged-in users? =

Yes. All frontend comment submissions are moderated, including from registered users (except in wp-admin).

= Where are API keys stored? =

API keys are encrypted with OpenSSL using WordPress authentication salts before being saved in your database.

== Screenshots ==

1. Settings page — AI provider selection, thresholds, and API key field.
2. Built-in API setup guide with step-by-step instructions for each provider.
3. Live Comments banner and AI Protected badge on the frontend.
4. AI Score column in the WordPress Comments admin list.
5. AI Verified badge on approved comments.

== Changelog ==

= 1.5.4 =
* Stronger spam detection: URLs, SEO/marketing pitches, and promotional comments scored via heuristics (merged with AI score).
* AI prompt updated to flag polite link spam and consulting outreach as high-score spam.

= 1.5.3 =
* Text domain set to prepublish-comment-moderator (matches WordPress.org slug).
* Removed ini_set/error_reporting from bootstrap (review feedback).
* Main plugin file: prepublish-comment-moderator.php.

= 1.5.2 =
* Updated Tested up to: 7.0.

= 1.5.1 =
* Fixed JSON-LD output: all schema paths encode with JSON_HEX_TAG (and related flags) so comment text cannot break out of script tags.
* Text domain aligned with WordPress.org slug (prepublish-comment-moderator).
* Updated Tested up to: 6.9.
* Fixed Perspective API legal links (Google APIs Terms of Service).

= 1.5.0 =
* Renamed to PrePublish Comment Moderator (SEO-friendly, distinctive slug: prepublish-comment-moderator).
* Removed custom CSS textarea (use theme Customizer for styling instead).
* Error log moved to uploads directory (not inside plugin folder).
* Removed load_plugin_textdomain() — WordPress.org handles translations automatically.
* Added External services section to readme with ToS/privacy links for all AI providers.

= 1.4.3 =
* Admin "Retry AI" button on the comments list for errored or unscored comments.

= 1.4.2 =
* Auto-retry for comments held due to temporary API errors (~2.5 min, up to 3 attempts).

= 1.4.1 =
* Fixed sacm_strtoupper undefined function error.

= 1.4.0 =
* Quality Score and auto Top Comment pinning.

= 1.3.0 =
* Comment Schema markup for SEO plugins.

== Upgrade Notice ==

= 1.5.3 =
WordPress.org review: text domain aligned with slug, removed error_reporting in production bootstrap.

= 1.5.2 =
