=== SpeedPilot - WordPress Speed & Performance ===
Contributors: your-wordpress-org-username
Tags: performance, core web vitals, pagespeed, compatibility, optimization
Requires at least: 6.8
Requires PHP: 7.4
Tested up to: 6.8
Stable tag: 0.10.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

SpeedPilot is a WordPress speed and performance platform. This Phase 10 release adds WordPress.org production hardening, privacy-tool integration, runtime cache cleanup, and an internal production audit on top of the secure foundation, official Google PageSpeed Insights scans, native local WordPress diagnostics, the Phase 4 image optimizer, the Phase 5 asset optimizer, the Phase 6 cache and font analyzer, the Phase 7 database workflow, the Phase 8 compatibility center, and the Phase 9 reporting system.

== Description ==

SpeedPilot is designed around a simple product path:

Measure -> Diagnose -> Optimize -> Verify -> Monitor

This release intentionally implements the plugin foundation through Phase 10. Reporting, export, privacy, and production-hardening workflows are now live as real features instead of placeholder promises.

What is included in 0.10.0:

* Secure plugin bootstrap with PHP and WordPress version guards
* Activation, deactivation, migration, and uninstall behavior
* WordPress.org-ready metadata, GPL licensing, and translation-ready strings
* Admin dashboard shell with environment and compatibility visibility
* Settings framework for general, API, and advanced controls
* Custom table architecture for scans, results, optimizations, logs, and jobs
* Structured local logging for future diagnostics
* Compatibility framework for page builders, WooCommerce, and overlap detection
* Server-side Google PageSpeed Insights integration using the official API
* Google PageSpeed API connection test
* Manual mobile, desktop, and dual-device scans
* Result storage and dashboard history for Google PageSpeed scans
* Native local WordPress analysis with source-labeled findings
* Local diagnostics for WordPress, server configuration, themes, plugins, database signals, and homepage resource hints
* Separate local scan history so native diagnostics stay distinct from Google PageSpeed lab data
* Media Library image scanner with format, size, display-context, duplicate, and homepage background signals
* Backup-first image optimization for supported local attachments
* WebP sidecar generation and AVIF generation where supported
* Restore Original actions backed by stored local backups
* Background bulk image optimization with WP-Cron batch processing
* Homepage CSS and JavaScript analysis with local-versus-third-party visibility
* Conservative local CSS minification and cached stylesheet rewriting
* Conservative local JavaScript minification with protected handle exclusions
* Shared safe, balanced, and aggressive asset modes
* Defer support for eligible local scripts in balanced mode
* Protected delay support for additional non-critical local scripts in aggressive mode
* CSS and JavaScript exclusion controls plus generated asset cache purging
* Phase 5 overlap protection against common asset and cache optimization plugins
* Cache detection for active cache plugins, hosting cache headers, site CDN signals, third-party CDN hosts, and persistent object cache
* Read-only cache recommendations so SpeedPilot does not create a conflicting page-cache layer
* Font analysis for Google Fonts, local font-face declarations, families, weights, formats, preloads, WOFF2 usage, and display-swap gaps
* Optional Google Fonts `display=swap` rewriting for WordPress-enqueued Google Fonts stylesheets
* Optional Google Fonts preconnect hints on safe frontend requests when the theme has not already added them
* Database analysis for revisions, auto drafts, trashed posts, spam comments, trashed comments, expired transients, orphaned post meta, orphaned comment meta, orphaned term relationships, large autoloaded options, and large tables
* Explicit administrator-confirmed database cleanup batches for the supported cleanup categories
* Local cleanup history for database actions, including processed counts and remaining-item visibility
* Compatibility detection for Gutenberg, Elementor, Elementor Pro, WPBakery, Divi, Beaver Builder, Bricks, Oxygen, Breakdance, and WooCommerce
* Current request classification for admin, login, REST, AJAX, cron, builder-editor, preview, and WooCommerce-sensitive routes
* Builder-asset and WooCommerce-protection rules for Phase 5 asset optimization and Phase 6 font helpers
* Compatibility decision logging for protected skip scenarios when debug mode is enabled
* Compatibility admin visibility for target status, overlap conflicts, and current protection decisions
* Reports screen with stored scan history, optimization history, before-and-after comparisons, and lightweight charts
* CSV, JSON, and PDF report exports for the latest SpeedPilot data snapshot
* Export payload fields for website URL, scan date, Google scores, Core Web Vitals, page size, request counts, issues, recommendations, and optimization history
* WordPress privacy policy guidance for explicit Google PageSpeed requests, local logs, local backups, and retained plugin data
* WordPress personal-data exporter and eraser integration for administrator-linked scan, optimization, log, and background-job records
* Runtime transient cleanup during deactivation and uninstall so short-lived cache data does not linger unnecessarily
* Production Audit screen with security, compatibility, privacy, uninstall, and release-readiness checkpoints

What is not included yet:

* A built-in page cache engine or automatic CDN configuration
* Automatic local font conversion or guessed font preload injection
* Automatic scheduled database cleanup or automated rollback for destructive database cleanup actions
* Automated scheduled reporting or emailed report delivery

== Installation ==

1. Upload the `speedpilot` folder to `/wp-content/plugins/`.
2. Activate the plugin through the WordPress admin.
3. Open `SpeedPilot` from the admin menu.
4. Review the dashboard, save your API key if you want Google PageSpeed scans, and open `Settings > Images`, `Settings > CSS`, `Settings > JavaScript`, `Settings > Cache`, `Settings > Fonts`, and `Settings > Database` to configure the live optimization modules.
5. Use `Reports` to export the latest scan history and `Audit` to review production-hardening readiness before release.

== Frequently Asked Questions ==

= Does this release optimize my site already? =

Yes, selectively. Version 0.10.0 can run real Google PageSpeed scans, a native local WordPress diagnostic pass, safe local image optimization with backups and restore support, optional Phase 5 CSS and JavaScript optimization for eligible same-site frontend assets, Phase 6 cache and font analysis with optional Google Fonts swap and preconnect hints, Phase 7 database analysis with manual confirmed cleanup batches for supported database-bloat categories, Phase 8 compatibility protection for builder editors, WooCommerce-sensitive routes, and overlap conflicts, Phase 9 reports that turn stored history into exportable verification artifacts, and Phase 10 production hardening tools for privacy and release readiness. It still does not include a built-in page-cache engine, automatic CDN configuration, or automatic scheduled database cleanup.

= Does SpeedPilot send data to third parties? =

Only when an administrator explicitly runs a PageSpeed connection test or scan. In that case the scanned URL is sent to Google through the official PageSpeed Insights API. The API key remains stored on the server and is not exposed in frontend JavaScript.

= What does the local analysis scan do? =

It runs inside WordPress, inspects the current site configuration, performs a loopback request to the homepage, checks active plugins and theme updates, summarizes database signals, and parses homepage resource hints. It does not require a third-party API.

= How does image optimization work in this release? =

SpeedPilot scans Media Library attachments, creates a local backup before changing files, recompresses supported image formats, optionally generates WebP and AVIF sidecars when the server supports them, and lets administrators restore originals later. Bulk jobs run in WP-Cron batches instead of processing the whole library in one request.

= How does CSS and JavaScript optimization work in this release? =

SpeedPilot analyzes homepage assets through a local loopback request, reports local versus third-party files, and rewrites only eligible same-site local files when the feature is enabled. Safe mode minifies local CSS and JavaScript. Balanced mode also adds defer to eligible local scripts. Aggressive mode can delay additional non-critical local scripts after page load or first interaction. Third-party assets and protected core handles are never rewritten.

= What do the Cache and Fonts tabs do? =

The Cache tab detects active cache plugins, hosting cache headers, site and third-party CDN signals, and persistent object cache so you can avoid stacking conflicting systems. The Fonts tab analyzes Google Fonts requests and local font-face declarations, recommends WOFF2, reduced families and weights, preload discipline, and display-swap improvements, and can optionally add Google Fonts `display=swap` and preconnect hints on safe frontend requests.

= What does the Database tab do? =

The Database tab analyzes common cleanup targets such as revisions, auto drafts, trashed content, expired transients, orphaned metadata, large autoloaded options, and large tables. It never deletes anything automatically. Each supported cleanup action runs only after an administrator confirms it, and each run is limited to a bounded batch so you can review results incrementally.

= What does the Compatibility tab do? =

The Compatibility tab shows which builders, WooCommerce integrations, and overlapping optimization plugins are active, classifies the current request type, and explains when SpeedPilot is deliberately skipping a risky optimization for safety. It does not disable other plugins automatically. It helps you understand why a protection rule is active and what to review before changing optimization layers.

= What happens on uninstall? =

SpeedPilot keeps its data by default. You can opt in to full cleanup from the settings page, including image backups and generated asset-cache files.

= Does SpeedPilot support WordPress privacy tools? =

Yes. SpeedPilot adds privacy-policy guidance to WordPress, supports personal-data export for administrator-linked records it stores in custom tables, and anonymizes those requester links through the WordPress personal-data eraser tools without silently deleting operational history by default.

= What does the Audit page do? =

The Audit page summarizes production-hardening checkpoints for security, performance, PHP and WordPress compatibility, coding standards, accessibility follow-up, internationalization, licensing, privacy, uninstall behavior, directory-guideline readiness, and final regression testing. It is a release checklist assistant, not a replacement for manual staging-site verification.

== Screenshots ==

1. Dashboard with separate Google PageSpeed and local analysis scan lanes.
2. Local analysis findings, WordPress diagnostics, and homepage resource signals.
3. Images tab with scan preview, server capability checks, and backup-first optimization controls.
4. CSS and JavaScript tabs with homepage asset analysis, exclusions, and runtime protection summaries.
5. Cache and Fonts tabs with cache-stack detection, Google Fonts analysis, local font-face inventory, and safe Google Fonts helper toggles.
6. Database tab with cleanup candidates, large autoload and table visibility, and manual confirmed cleanup batches.
7. Compatibility tab with builder and WooCommerce protection status, overlap conflicts, and current request decisions.
8. Reports screen with score history, issue summaries, optimization history, and CSV/JSON/PDF exports.
9. Audit screen with production-hardening checkpoints, release metadata, and final regression reminders.

== Changelog ==

= 0.10.0 =

* Added the Phase 10 WordPress.org production-hardening pass.
* Added WordPress privacy-policy guidance plus personal-data exporter and eraser integration for administrator-linked plugin records.
* Added runtime transient cleanup during plugin deactivation and uninstall.
* Added a production audit screen covering security, compatibility, privacy, uninstall, and release-readiness checks.

= 0.9.0 =

* Added the Phase 9 Reports module.
* Added stored-history report aggregation for Google PageSpeed, local analysis, image optimization, and database cleanup activity.
* Added before-and-after comparisons and lightweight chart views for recent performance and findings history.
* Added CSV, JSON, and PDF exports for the latest report snapshot.

= 0.8.0 =

* Added the Phase 8 Compatibility module.
* Added current request classification for builder editors, WooCommerce-sensitive routes, login, REST, AJAX, cron, preview, and editor contexts.
* Added compatibility target visibility for page builders, WooCommerce, and overlap categories.
* Added builder-aware and WooCommerce-aware runtime protection for asset and font optimization modules.
* Added compatibility decision logging when debug mode is enabled.

= 0.7.0 =

* Added the Phase 7 Database module.
* Added database analysis for revisions, drafts, trash, spam comments, expired transients, orphaned metadata, large autoloaded options, and large tables.
* Added explicit administrator-confirmed cleanup batches for supported database cleanup categories.
* Added local cleanup action history and remaining-item visibility for database cleanup runs.

= 0.6.0 =

* Added the Phase 6 Cache and Fonts modules.
* Added cache-plugin, hosting-cache, site-CDN, third-party-CDN, and object-cache detection with read-only recommendations.
* Added homepage font analysis for Google Fonts, local font-face rules, families, weights, formats, preloads, WOFF2 usage, and display-swap gaps.
* Added optional Google Fonts `display=swap` rewriting for WordPress-enqueued stylesheets and safe frontend preconnect hints.

= 0.5.0 =

* Added the Phase 5 CSS and JavaScript optimizer.
* Added homepage asset analysis for local, third-party, duplicate, render-blocking, and estimated-savings visibility.
* Added conservative CSS minification with cached local stylesheet rewriting.
* Added conservative JavaScript minification, balanced defer support, and protected aggressive delay mode.
* Added CSS and JavaScript exclusions, generated asset cache purging, and overlap protection for asset optimization plugins.

= 0.4.0 =

* Added the Phase 4 image optimizer.
* Added Media Library scan previews, image settings, and homepage background signals.
* Added backup-first image compression, WebP generation, optional AVIF generation, and restore actions.
* Added WP-Cron-based bulk image optimization jobs.

= 0.3.0 =

* Added native local WordPress analysis.
* Added local findings, WordPress, server, plugin, database, and resource diagnostics on the dashboard.
* Added local analysis scan history with cached-versus-fresh visibility.

= 0.2.0 =

* Added official Google PageSpeed Insights integration.
* Added API connection testing.
* Added mobile, desktop, and dual-device manual scans.
* Added stored scan history and latest results on the dashboard.

= 0.1.0 =

* Initial Phase 1 foundation release.
* Added plugin bootstrap, activation/deactivation flow, settings framework, logging, database schema, compatibility architecture, and admin dashboard shell.

== Upgrade Notice ==

= 0.10.0 =

First release with the Phase 10 production-hardening audit, WordPress privacy-tool integration, and runtime cache cleanup.

= 0.9.0 =

First release with the Phase 9 reporting center, comparisons, charts, and CSV/JSON/PDF exports.

= 0.8.0 =

First release with the Phase 8 compatibility protection center, builder and WooCommerce runtime protection decisions, and overlap-conflict visibility.

= 0.7.0 =

First release with the Phase 7 Database analyzer, manual confirmed cleanup batches, large-table visibility, and oversized autoload-option visibility.

= 0.6.0 =

First release with the Phase 6 Cache and Fonts analyzer, cache-stack conflict guidance, Google Fonts swap handling, and optional preconnect hints.

= 0.5.0 =

First release with the Phase 5 CSS and JavaScript optimizer, exclusions, defer rules, and protected aggressive delay mode.

= 0.4.0 =

First release with the Phase 4 image optimizer, backup-first local image optimization, and background batch processing.

= 0.3.0 =

First release with native local WordPress diagnostics alongside Google PageSpeed integration.

= 0.2.0 =

First Google PageSpeed-enabled release.

= 0.1.0 =

Initial foundation release.

== Privacy ==

This release sends URLs to Google only when an administrator explicitly runs a PageSpeed connection test or scan. A saved PageSpeed API key is stored locally for server-side use only. Local analysis, Phase 5 asset analysis, Phase 6 cache and font analysis, Phase 7 database analysis and cleanup, Phase 8 compatibility decisions, Phase 9 report generation, and Phase 10 production audits all run inside WordPress and use the local site database or loopback requests rather than a third-party API. Image optimization runs locally inside WordPress and stores backups on the same site before files are modified. SpeedPilot now also integrates with the WordPress privacy policy page and personal-data exporter and eraser tools for administrator-linked records.
