=== SafeEdit ===
Contributors: goldenlobster
Tags: frontend editing, content editing, client editing, inline editing, revisions
Requires at least: 6.4
Tested up to: 7.1
Requires PHP: 8.1
Stable tag: 1.0.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Safe, restricted frontend editing for WordPress. Let clients edit text and swap images inside defined zones without breaking layouts.

== Description ==

SafeEdit gives non-technical clients a safe, restricted editing interface for your pages and posts. Clients can only edit text content and swap images inside zones you define — they cannot break layouts, delete sections, touch code, or reach the WordPress admin.

**How it works**

1. You mark editable areas with `data-safeedit="zone-name"` attributes in your page HTML, or simply leave Auto-Content Detection on so the main content area becomes editable automatically.
2. Your client logs in, opens any page, toggles SafeEdit ON, and edits text inline or swaps images through the WordPress Media Library.
3. Changes are autosaved, and a backup snapshot is kept before each editing session so any change can be rolled back.

**Key features**

* Safe text editing — clients edit only within defined zones; the surrounding HTML structure is locked.
* Image swapping — swap any image zone through the WordPress Media Library.
* Auto-Content Detection — make the main content area editable with no template changes.
* Automatic backups — a snapshot is taken before each session, with one-click "Previous versions" rollback from the frontend.
* SafeEdit Client role — a custom role that can only view the site and edit zones. It cannot access wp-admin, create posts, or change settings.
* Per-page control — enable or disable SafeEdit for each page from a metabox.
* Per-client page permissions — choose which SafeEdit Client users can edit each page; unrestricted pages remain editable by every authorized client.
* Paste protection — pasted content is stripped to safe markup (no script or HTML injection).
* Block editor ready — on block editor (Gutenberg) pages, paragraphs, headings, list items, and images become editable automatically, and every save preserves block delimiters and attributes.
* Server-side sanitization — all content is sanitized with WordPress's `wp_kses` before saving; off-site images and `javascript:` links are stripped.
* Rate limiting — save endpoints are rate limited to protect your server.
* No third-party calls — SafeEdit does not load fonts, scripts, or styles from external servers and does not phone home.

**Custom client role**

SafeEdit creates a "SafeEdit Client" role that can only view the frontend and edit SafeEdit zones. Clients are redirected away from wp-admin. They cannot create posts, change settings, install plugins, or do anything beyond editing the zones you allow.

**Looking for more?**

A separate premium version, SafeEdit Pro, adds Advanced Custom Fields (ACF) editing and WooCommerce product and price editing. All features included in this free plugin, including per-client page permissions, work without payment or a license key. The separately distributed Pro plugin is optional. See the "Go Pro" tab in the plugin settings for details.

SafeEdit is developed by Golden Lobster (WordPress.org username `goldenlobster`). Product website: https://safeedit.site/.

== Installation ==

1. Upload the `safeedit` folder to `/wp-content/plugins/`, or install the plugin through the Plugins screen in WordPress.
2. Activate the plugin through the "Plugins" menu.
3. (Optional) Add `data-safeedit="zone-name"` attributes to editable areas in your page HTML. Or just leave Auto-Content Detection enabled under Settings → SafeEdit.
4. Create a user with the "SafeEdit Client" role (Users → Add New) for your client.
5. Your client visits any enabled page and uses the floating toolbar to edit text and images.

== Frequently Asked Questions ==

= Do I need to modify my theme? =

No. With Auto-Content Detection (on by default) the main content area becomes editable automatically. For precise control you can add `data-safeedit="zone-name"` attributes to specific elements in your page HTML or theme templates.

= What can clients edit? =

Text content (headings, paragraphs, lists) and images (swapped through the Media Library). They cannot change HTML structure, CSS, JavaScript, or layout.

= Is it safe? =

Yes. All saved content is sanitized with WordPress's `wp_kses` on the server. Clients cannot inject scripts, change HTML structure, hotlink off-site images, or upload disallowed file types. Save endpoints verify capabilities, the post type allowlist, and per-page enable flags, and are rate limited.

= Can I roll back a change? =

Yes. SafeEdit keeps a backup snapshot before each editing session. Clients can restore a previous version from the frontend "Previous versions" panel, and administrators can always revert from the standard WordPress revisions screen.

= Does it work with the block editor? =

Yes. On pages built with the block editor, SafeEdit automatically makes paragraphs, headings, list items, and images editable, block by block. Saves go through the block parser, so block delimiters and attributes are always preserved and the page stays fully editable in wp-admin.

= Does it support page builders? =

SafeEdit works with standard WordPress content and the block editor. It does not currently support proprietary page-builder content such as Elementor, Divi, or WPBakery.

= Does it support multisite? =

Yes.

== Screenshots ==

1. The frontend editing toolbar.
2. Editable zones highlighted on a page.
3. The admin settings screen.
4. The per-page metabox with detected zones and backup status.

== Changelog ==

= 1.0.0 =
* Initial release on WordPress.org.
* Frontend text editing and image swapping within defined zones.
* Auto-Content Detection for zero-config editing of the main content area.
* Custom "SafeEdit Client" role restricted to zone editing.
* Automatic pre-session backup snapshots with frontend rollback.
* Per-page enable/disable metabox.
* Automatic per-block editing on block editor pages, with block-aware saving.
* Server-side sanitization, off-site image stripping, and rate limiting.

== Upgrade Notice ==

= 1.0.0 =
Initial release.
