=== Scrubwell – Hides Emails & Phone Numbers in Comments ===
Contributors: jericswaim
Tags: privacy, pii, comments, gdpr, redaction
Requires at least: 6.0
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.1.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Stops visitors from posting email addresses and phone numbers in your comments. Removed in the browser as they type, and again on your server.

== Description ==

Visitors paste private details into comment boxes all the time: their own phone number, a customer's email, worse. Once it's saved, it's in your database, your backups and your search results, and it's your problem.

Scrubwell removes that information before it is saved.

* **Two layers.** Visitors see `[REDACTED PHONE]` appear as they type, so they know what happened. Your server removes it again when the comment arrives, so bots and visitors with JavaScript turned off are covered too.
* **Leaves the right fields alone.** The comment form's own Name, Email and Website fields are never touched.
* **No outside service.** Everything runs on your site and in the visitor's browser. Nothing is sent anywhere.
* **Counts what it catches.** See how many items were removed under Settings → Scrubwell.

Free version removes:

* Email addresses
* US and Canadian phone numbers

= Scrubwell Pro =

Pro adds credit and debit card numbers (checked with the card-number checksum, so order numbers aren't caught), Social Security numbers, bank routing and account numbers, and US street addresses. It also adds a "Send anyway" button for the types you allow (with a log), a "never remove" list, a per-post off switch, a choice of roles to skip, and protection for Contact Form 7 messages, bbPress and BuddyPress posts and private messages, and WooCommerce order notes.

== Installation ==

1. Upload the plugin and activate it.
2. Go to Settings → Scrubwell to choose what to remove.

== Frequently Asked Questions ==

= Will it remove the email a commenter types into the Email field? =

No. Only the comment text is filtered.

= Are administrators filtered? =

Not by default. Turn off "Don't filter site administrators" if you want them filtered too.

= Can I turn it off for one field? =

Adding `data-scrubwell="off"` to a field (or a wrapper around it) turns off the as-you-type removal in the browser for that field. The server still removes private info when the text arrives, because it can't trust markup sent by a visitor's browser.

To turn off the server side too, use the `scrubwell_skip` filter in a small plugin or your theme's functions.php. For example, to skip comments on one post:

`add_filter( 'scrubwell_skip', function ( $skip, $context ) { return $skip || 42 === $context['post_id']; }, 10, 2 );`

= Can I keep my own phone number or email domain? =

Yes, with the `scrubwell_allowlist` filter. Return a list of values to keep, such as `(214) 555-0100` or `@example.com` (every address at that domain). Scrubwell Pro adds a settings box for this.

== Changelog ==

= 1.1.0 =
* New: `scrubwell_skip`, `scrubwell_allowlist`, `scrubwell_hits` and `scrubwell_exempt_user` filters and the `scrubwell_redacted` action, for developers and Scrubwell Pro.
* Fixed: the FAQ now explains that `data-scrubwell="off"` only affects the browser layer.
* New: "Upgrade to Pro" link on the settings page.

= 1.0.0 =
* First release.
