=== Simple Header and Footer ===
Contributors: albertoreineri
Tags: header, footer, analytics, facebook pixel, scripts
Requires at least: 5.8
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.1.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Insert code in your site's header and footer. Ideal for Google Analytics, Facebook Pixel and other tracking scripts.

== Description ==

Simple Header and Footer lets you add Google Analytics, Facebook Pixel, custom tracking code, verification meta tags and more, with a single straightforward settings page. No need to install a complex plugin with thousands of unnecessary features, and no need to edit your theme files.

* **Header:** printed inside the `<head>` tag.
* **Footer:** printed just before the `</body>` tag.
* **Code editor** with syntax highlighting.
* Your code stays in place when you change or update your theme.

= A note on security =

This plugin outputs the HTML and JavaScript you write, exactly as written, on every page of your site. That is what makes it useful for tracking scripts, and it also means the settings page should be treated like access to your theme files. Only users with the `unfiltered_html` capability (Administrators on a standard install; Super Admins on Multisite) can save raw scripts. Everyone else has their code filtered the same way WordPress filters the Custom HTML block.

This plugin does not run PHP code.

= Privacy and GDPR =

This plugin does not collect or process any personal user data. The scripts you add may do so: check the privacy requirements of the services you connect.

= Translation =

You can contribute to translate this plugin in your language on [WordPress Translate](https://translate.wordpress.org).

== Installation ==

1. Upload the `simple-header-and-footer` folder to the `/wp-content/plugins/` directory.
2. Activate the plugin through the 'Plugins' menu in WordPress.
3. Go to **Settings > Simple Header & Footer**, paste your code and save.

== Frequently Asked Questions ==

= Can I run PHP code with this plugin? =
No. Earlier versions could execute PHP stored in the header/footer fields; that feature was removed in 1.1.0 for security. If you were using it, your previous code was saved for you on the plugin's settings page.

= Why were my scripts removed when I saved? =
Your account does not have the `unfiltered_html` capability, which WordPress requires to save raw scripts (this is the default on Multisite sub-sites). Ask a Super Admin, or save the code from an account that has it.

= Where exactly is the code printed? =
Header code is printed with the `wp_head` hook (late, priority 11). Footer code is printed with the `wp_footer` hook. Your theme needs to call both, as any well-built theme does.

== Screenshots ==

1. Simple Header and Footer settings screen.

== Changelog ==

= 1.1.0 =
* Security: the settings can no longer be saved without a valid security token (CSRF protection).
* Security: removed the ability to execute PHP code from the header/footer fields. Existing code that contained PHP is preserved on the settings page so nothing is lost.
* Security: raw script saving is restricted to users with the `unfiltered_html` capability.
* The settings page now uses the WordPress Settings API and only accepts the two fields it displays.
* Removed unused code and the cache-busting timestamp on the admin stylesheet.
* Added a gentle, dismissible review request on the settings page (shown after a week).
* Tested with WordPress 7.1.

= 1.0.0 =
* Initial release.

== Upgrade Notice ==

= 1.1.0 =
Security update. Adds CSRF protection and removes PHP execution. If you relied on PHP in your header/footer code, it is saved on the settings page after updating.
