=== WWB Restaurant Menu Pro – Food Menu, QR Code Menus, Specials & Printable PDF ===
Contributors: aleksa64
Tags: restaurant, menu, food menu, qr code menu, restaurant menu
Requires at least: 6.4
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 3.4.5
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Build a restaurant menu in minutes. Dishes, sections, daily specials, allergens, QR code menus and a printable PDF. No WooCommerce needed.

== Description ==

**Most restaurant menu plugins make you install WooCommerce before you can show a single dish.** This one doesn't. If you run a café, bistro, bar or food truck and you just need a good-looking menu on your website — plus a QR code for the tables and something you can print — this does that and nothing else.

Everything runs on your own site. No accounts, no license keys, no upsell banners in your dashboard, and no promotional footer on your visitors' menus.

= What you can do =

* **Add dishes** with name, description, price, photo and allergen / dietary information
* **Organise them into sections** — Starters, Mains, Desserts, Drinks — and drag them into the exact order you want
* **Highlight daily specials** that appear automatically on your menu
* **Generate QR codes** for tables, windows or takeaway bags, pointing straight at your live menu
* **Print your menu** with a clean print layout, or save it as a PDF from the browser
* **See what people actually look at** with optional, privacy-first analytics that stay on your own server
* **Import and export** your whole menu as JSON, or load a demo menu to see how it works

= Shortcodes =

Drop these anywhere — page, post, block editor, widget:

* `[wwbrmp_restaurant_menu]` — your full menu
* `[wwbrmp_today_special]` — today's specials
* `[wwbrmp_featured_dishes limit="6"]` — a selection of featured dishes
* `[wwbrmp_menu_section category="Drinks"]` — a single section

= Privacy first, by default =

Analytics is switched **off** until you turn it on. When you do, visitors are asked first, and the plugin records only what it needs: which item, what kind of interaction, and how long it was viewed. No visitor IDs, no IP addresses, no referrers, no user agents. Nothing is sent to a third-party analytics service, ever.

The QR code generator is the only optional external service, and it stays disabled until you explicitly enable it in Settings.

= Who it's for =

Restaurants, cafés, bakeries, bars, pubs, food trucks and catering businesses — and the agencies and freelancers who build their sites. Works with any theme.

= Built by =

Developed by Aleksander Auset Bækkelund at [WildWebBuilder](https://www.wildwebbuilder.com/). Free, GPL-licensed, and actively maintained.

== Frequently Asked Questions ==

= Do I need WooCommerce? =

No. The plugin works entirely on its own. It's a menu display plugin, not an ordering system.

= Can customers order or pay through the menu? =

No. This shows your menu — it doesn't process orders. If you need online ordering, you'll want a WooCommerce-based plugin instead.

= How do the QR codes work? =

You generate a QR code that points at your menu page. Print it, put it on the tables, and guests scan it to see your current menu. The links are signed, so they keep working when you update the menu, and they can't be pointed anywhere else.

= Does it produce a real PDF file? =

It produces a clean, print-ready page that you save as a PDF using your browser's Print dialog. Nothing is generated on the server, which keeps things fast and avoids extra dependencies.

= Can I show allergens and dietary information? =

Yes. Each dish has a food information field, and you control how it displays under Settings > Food information.

= Will my menu match my theme? =

Yes. Appearance and Display settings let you adjust colours, layout and what's shown. The output uses your theme's fonts by default.

= Does it slow my site down? =

Admin assets only load on the plugin's own screens, menu output is cached and invalidated on save, and the front-end scripts are minimal.

= Is it translated? =

A POT template is included, and you can help translate it at translate.wordpress.org.

= What happens to my menu if I deactivate it? =

Nothing is deleted. Deactivating clears scheduled reports and cleanup tasks only. Your dishes, sections and settings stay where they are.

== Screenshots ==

1. A finished restaurant menu on the front end, with sections and dish photos
2. Adding a dish — name, description, price, photo and allergen information
3. Drag-and-drop menu ordering
4. Daily specials, ready to publish
5. QR code generator for table menus
6. The printable menu layout
7. The analytics overview — which dishes get the most attention
8. Settings, organised into eight tabs

== Installation ==

1. In your dashboard, go to **Plugins > Add Plugin** and search for "Restaurant Menu by WildWebBuilder", or upload the ZIP under **Upload Plugin**.
2. Activate it.
3. Open **Restaurant Menu > Overview** and add your first dish.
4. Paste `[wwbrmp_restaurant_menu]` into the page where your menu should appear.

That's it. Optional: review **Settings > QR codes** before enabling the external QR service, and **Settings > Analytics** if you want visitor statistics.

== Upgrade Notice ==

= 3.4.5 =
Maintenance and hardening release. Safe to update; no menu data is changed.

== Changelog ==

= 3.4.5 =
* Validate, unslash, and sanitize the request method before checking legacy admin redirects.

= 3.4.4 =
* Document narrowly scoped nonce-check exceptions for public read-only PDF views and HMAC-validated permanent QR links.
* Prefix the uninstall analytics-table variable with wwbrmp.
* Preserve the 3.4.3 admin access fixes and existing QR validation.

= 3.4.3 =
* Restore hidden admin pages by retaining parent/submenu registration through WordPress access checks.
* Redirect known pre-prefix admin URLs to registered wwbrmp pages with the original capability checks.
* Preserve the wwbrmp/WWBRMP prefix migration and existing menu data.

= 3.4.2 =
* WordPress.org review cleanup: unique `wwbrmp_` / `WWBRMP_` prefixes throughout plugin declarations and stored data.
* Added one-time migration for existing menu content, settings, metadata, analytics table and shortcode content.
* Removed Author URI from the plugin header to avoid review-time availability failures.
* Reviewed request handling, asset enqueueing, contributor metadata and privacy disclosures.

= 3.4.1 =
* Address WordPress.org review feedback for script and style loading.
* Move printable PDF CSS and JavaScript to WordPress enqueue APIs.
* Harden long-lived QR redirects with signed URLs and configured-target validation.
* Add the correct WordPress.org contributor username.
* Preserve the 3.4.0 privacy, retention, translation and admin architecture changes.

= 3.4.0 =
* Add GPLv2-or-later license and complete author/contributor attribution.
* Require administrator activation and visitor opt-in for optional analytics.
* Minimize new event records and remove the persistent visitor identifier.
* Add optional retention, legacy-data removal and privacy policy guidance.
* Bound abuse counters and validate privacy actions with capability and nonce checks.
* Add cached analytics query helpers and document targeted static-check exceptions.
* Make settings schemas and additional admin/frontend messages translatable;
  include a POT translation template.
* Restore return values for the admin parent/submenu compatibility callbacks.
* Preserve existing menu posts, taxonomy IDs, metadata and shortcodes.


= 3.3.0 =
* Consolidate administration into Restaurant Menu with a useful overview,
  native content screens, specials, analytics, data tools and eight settings tabs.
* Split the single-file implementation into administration/data-tool classes
  and compatibility-preserving settings, content, admin, analytics and frontend modules.
* Preserve unrelated settings server-side; remove duplicated forms, hidden
  option copies and the obsolete single-list sorting script.
* Add validated JSON preview/import/export and repeat-safe demo draft creation.
* Enforce per-item sort permissions, taxonomy membership and request validation;
  add keyboard reorder controls, live status and serialized AJAX saves.
* Add analytics export nonces, CSV formula protection, bounded event fields,
  safer SQL identifiers and versioned database setup.
* Correct report scheduling timezone, preserve report cursor and report mail failure.
* Add optional local-analytics collection control and explicit external QR consent.
* Load admin assets only on plugin screens; load sortable only on Menu Order.
* Preserve shortcodes, print layouts, database identifiers and old admin URLs;
  repair visibility for imported items lacking the legacy hide metadata.
* Restore frontend filter script loading and move analytics JavaScript to an asset.
* Invalidate menu caches on save/trash/delete and prevent same-second collisions.

= 3.2.0 =
* Supplied baseline: business-day analytics and scheduled reports.

== Upgrade Notice ==

= 3.4.5 =
Resolve request-method input validation warnings while preserving GET-only legacy admin redirects.

= 3.4.4 =
Address nonce-review warnings and uninstall variable prefixing while preserving permanent PDF/QR links and the admin access fixes.

= 3.4.3 =
Fix admin access for hidden pages and old bookmarked menu URLs without changing role permissions or stored menu data.

= 3.4.2 =
WordPress.org review cleanup with unique plugin prefixes and a one-time migration that preserves existing menu content and analytics history.

= 3.4.1 =
WordPress.org review fixes for asset loading and request hardening; existing menu data and 3.4.0 privacy controls are preserved.

= 3.4.0 =
GPL licensing, attribution, privacy controls and directory preparation.
Re-enable analytics explicitly if wanted. Visitors must consent before collection.
Existing menu data and analytics history remain unless you choose deletion.


= 3.3.0 =
Admin refresh with settings preservation, import/export and security fixes.
Review external QR service consent after upgrading. Back up before installation.

== Technical notes ==

= Roles and capabilities =

Role behaviour follows standard WordPress post capabilities. Users with `edit_posts` manage the items they're allowed to edit; categories and global order require `manage_categories`; settings, analytics and data tools require `manage_options`. Sort requests also check `edit_post` per submitted item.

Order changes do not move items between categories — edit section membership in the item editor. Items in multiple sections share one `menu_order` value; conflicting positions are rejected.

= Import and export =

JSON format version 1, up to 5 MB and 1,000 items or sections. Exports include item metadata, status, section hierarchy, media URLs and settings. This is not a site or database backup — analytics history and image binaries are not included. Analytics CSV exports contain at most 5,000 events per period.

Imports are validated before the preview is saved for 15 minutes. Applying an import creates drafts and reuses sections by slug without altering existing ones. Repeat imports from the same source skip previously imported items. Images are linked only when their URL matches media already in your library; no remote media is downloaded. Analytics configuration, recipients and external-service consent are never enabled by an import.

= External services =

The optional QR image generator is QR Server / goQR.me, operated by Foundata GmbH, at `https://api.qrserver.com/v1/create-qr-code/`. It is disabled until an administrator enables it in Settings > QR codes, including after an upgrade. When enabled, requests include the encoded menu destination or tracking URL, image size, colours and output format. The visitor's browser also contacts the service directly, so the service receives normal connection information such as the browser IP.

Service documentation: https://goqr.me/api/
Terms of service: https://goqr.me/legal/tos-api.html
Privacy policy: https://goqr.me/de/rechtliches/datenschutz-api.html

No external analytics service is used. Report emails are sent through `wp_mail` to administrator-configured recipients and may use your site's mail provider. Delivery depends on that provider and on WP-Cron traffic. Scheduled times use the WordPress site timezone.

= Analytics retention =

Existing installations must reactivate analytics under Settings > Analytics after upgrading to 3.4.0; existing history is preserved. A first-party preference cookie, `wwbrmp_consent`, remembers the visitor's yes/no for 180 days, and the menu remains fully usable either way.

Historical records may still contain fields collected by older versions. Settings > Analytics provides confirmed administrator actions to remove legacy visitor information while preserving metrics, or to delete history in batches of 5,000 events. A retention period of 30, 90 or 365 days can remove older events daily. The default keeps existing history until you choose otherwise. Cleanup depends on WP-Cron traffic.

Because analytics records aren't associated with emails or WordPress users, the plugin cannot locate a visitor's historical events through WordPress's email-based personal data tools. Use the documented privacy actions instead. Suggested privacy policy text is added to WordPress's Privacy Policy Guide; this does not replace your own assessment of your privacy obligations.

= Upgrading =

The 3.3.0 release was an additive admin refactor, not a destructive migration. No uninstall data removal is performed. Previous admin URLs for food information, PDF settings, QR codes and shortcodes remain available; those settings now live inside Settings.

= License =

Copyright (C) 2026 Aleksander Auset Bækkelund – WildWebBuilder. Licensed under the GNU General Public License, version 2 or later. See LICENSE.txt and COPYRIGHT.txt.
