=== xiaochen Data Dashboard ===
Contributors: tsxcc
Tags: dashboard, analytics, statistics, charts, data-visualization
Requires at least: 5.6
Tested up to: 7.0
Stable tag: 1.1.1
Requires PHP: 7.4
License: GPL-2.0-or-later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Visualize your WordPress blog data into a full-screen dashboard: posts, comments, tags, provinces and heatmaps.

== Description ==

Data Dashboard turns your WordPress blog statistics into a clean, large-screen visualization. It reads directly from your site's own database (cached via WordPress transients) and renders charts with ECharts.

= Features =

* Admin self-check for data capability (database, core tables, cache, theme IP library, mail, etc.)
* Optional password protection for the front-end (shared password, remembered 7 days via cookie)
* Pick which data modules to show and drag to reorder them
* Configurable cache lifetime
* Three front-end entry points, all sharing the same password / module / order settings:
  * Shortcode `[xiaodada_dashboard]` (drop into any page or post, follows your theme)
  * Theme page `/data-dashboard/` (with your theme header, footer and sidebar)
  * Standalone page `/data-dashboard-standalone/` (fully independent, no theme markup)
* Visualization modules: overview, monthly post trend, category distribution, top tags, top comment phrases, visitor province map (China), monthly comment trend, post status, weekly / hourly distribution, posting-time heatmap, yearly comparison, media types, top commented posts, latest posts, comment / tag word cloud.
* Traffic dimensions (probing): PV / UV trend, source breakdown, device / browser split (uses WP Statistics when available), top read posts.

= Installation =

1. Upload the `data-dashboard` folder to `/wp-content/plugins/`.
2. Activate "Data Dashboard" in Plugins.
3. (Optional) For the "visitor province" module, make sure your active theme ships an `ip2c/ip2c.php` plus a pure IP database (`.dat`), for example the xiaochen theme. Otherwise just disable that module in the admin.
4. Go to **Data Dashboard** in the admin menu to set the password, modules and order, then save.
5. Visit any of the three entry points above. You can create or rebuild the two pages with one click under **Data Dashboard -> Front-end pages**.

= Frequently Asked Questions =

= Where does the data come from? =

All numbers are queried directly from your site's own database and cached with WordPress transients (external object cache / Memcached applies automatically).

= How do I force a cache refresh? =

Log in as an administrator and visit any dashboard URL with `?xiaodada_refresh=1`.

== Screenshots ==

1. Data big screen settings, data acquisition capability self-test, front-end access settings, data and display
2. Security settings, weekly and monthly report push

== Changelog ==

= 1.1.1 =
* Security: brute-force protection now trusts only the direct server IP (REMOTE_ADDR) instead of spoofable client-supplied headers (X-Forwarded-For / HTTP_CLIENT_IP), and stores all attempt/lock counters in a single fixed-key transient with a size cap, preventing storage pollution from forged IPs.

= 1.1.0 =
* Compliance: prefix all declarations, globals and stored data with a unique `xiaodada_` prefix (was `wpdd_`, which is not allowed as it starts with the reserved word "wp").
* Compliance: enqueue admin page CSS/JS via `admin_enqueue_scripts` instead of inline `<style>` / `<script>` tags.
* Security: upgrade bundled ECharts to 6.1.0 and jsPDF to 4.2.1 (fixes CVE-2026-25535 etc.), localize the previously remote pdfobject reference.
* Maintenance: automatic one-time migration of options / page shortcodes from 1.0.x.

= 1.0.0 =
* Initial release.

== Upgrade Notice ==

= 1.1.1 =
* Brute-force counters now use a single fixed-key transient (old per-IP transients are cleaned up automatically on first load).

= 1.1.0 =
* Renames all `wpdd_*` internals to `xiaodada_*` for directory guidelines compliance; options and existing pages are migrated automatically on first load.

= 1.0.0 =
* Initial release.
