=== Zeopilot ===
Contributors: zeopilot
Tags: website optimization, conversion, experiments, monitoring, automation
Requires at least: 6.5
Tested up to: 7.1
Requires PHP: 8.1
Stable tag: 0.3.2
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Connect WordPress to Zeopilot for governed website improvements, experiments, and recovery using a revocable application password.

== Description ==

Zeopilot connects a WordPress website to your Zeopilot account with a dedicated content account and WordPress application password. You do not need to give Zeopilot your normal WordPress sign-in password.

From Zeopilot, site owners can review website information, prepare improvements, and decide whether to approve changes. The dedicated account can read and update page content and manage Zeopilot experiment data. It cannot manage plugins, themes, users, site settings, or application passwords, delete pages, or log in interactively. Zeopilot applies separate approval safeguards to content changes.

Features:

* Create and revoke a dedicated WordPress application credential from Settings > Zeopilot.
* Show the WordPress site URL, username, and one-time connection credential securely to an administrator.
* Expose a permission-checked REST status endpoint for connection verification.
* Support time-limited, owner-configured A/B experiments with signed exposure/click events and reversible content variations.
* Keep site administration outside the connector: no plugin, theme, user, or settings management.

This is a connector for the hosted Zeopilot service, not a standalone website optimization dashboard. A Zeopilot account is necessary to use the cloud analysis and improvement features. Every feature implemented in the plugin code itself is available without a paid license, artificial usage quota, or trial timer. The connector itself is free; subscriptions for the separate hosted Zeopilot service and their prices are described at https://zeopilot.com/pricing. Installing this plugin does not automatically enroll you in a paid subscription or send your site content to Zeopilot.

= External service and data =

This plugin connects to the Zeopilot service operated by Zeo Platforms, Inc. at https://zeopilot.com. A website administrator must first create a dedicated WordPress application password and enter the connection information in Zeopilot. With that authorization, Zeopilot can request WordPress REST API data, including site information, WordPress page content, titles, slugs, and excerpts, to analyze and prepare proposed changes. It can submit approved WordPress page updates and verify/restore changes under the access the WordPress application password grants. Disconnect from Settings > Zeopilot to revoke that password and remove the dedicated account’s capabilities.

When an administrator explicitly configures an A/B experiment, the plugin may set an anonymous visitor-assignment cookie named `zeopilot_vid` (up to one year), show a selected page variation, and send signed exposure or click events to a same-site WordPress REST endpoint. WordPress relays these event records to the HTTPS Zeopilot event endpoint at https://zeopilot.com/api/experiments/event. Other relay destinations are rejected. Event records can contain a pseudonymous visitor ID, experiment ID, assigned version, event type, metric, timestamp, and signed proof; they do not intentionally include visitor names, emails, or full page content. Your site's hosting provider and the Zeopilot service may process routine server/network metadata as described in their privacy policies. The site owner is responsible for providing any legally required visitor notice or consent before enabling experiments. If no experiment is active, this plugin does not set the experiment cookie.

Please review https://zeopilot.com/privacy and https://zeopilot.com/terms. No unrelated advertisements or third-party tracking libraries are installed by the plugin.

== Installation ==

1. In WordPress, install and activate **Zeopilot**.
2. Open **Settings > Zeopilot**. You need an administrator account with the `manage_options` capability.
3. Click **Create Zeopilot connection**. WordPress creates a dedicated, limited content account and a revocable application password specific to Zeopilot.
4. Sign in to your Zeopilot account at https://zeopilot.com/login and open the WordPress website connection workflow. Enter the WordPress site URL, username, and application password into Zeopilot's secure connection form.
5. Confirm the site connection in Zeopilot and review its access and permission settings. The connection has page-content and experiment permissions only; it does not inherit your administrator role.
6. To revoke access, open **Settings > Zeopilot** and click **Disconnect Zeopilot**, or deactivate the plugin.

The connection password is displayed once in the authenticated creation response and is not your normal WordPress login password. Avoid sharing or saving it in chat, screenshots, or public documents. You can create a new password after a disconnection.

== Frequently Asked Questions ==

= Do I need a Zeopilot account? =

Yes. This plugin connects WordPress to a hosted service. A free plugin installation does not include paid Zeopilot monitoring or optimization services.

= Does installing the plugin publish changes to my website? =

No. Installation and creation of a connection password do not publish changes. The WordPress site owner must grant access and approve any governed change in Zeopilot. WordPress application-password permissions still apply.

= Can Zeopilot see my regular WordPress password? =

No. Zeopilot uses a dedicated, revocable WordPress application password; your usual WordPress login password is not requested.

= Can I disconnect? =

Yes. Use Settings > Zeopilot > Disconnect Zeopilot to revoke the dedicated application password. Deactivating or uninstalling also revokes connector credentials. The dedicated content account is left without roles so existing page attribution is preserved.

= Does this plugin track visitors? =

Only if an administrator enables an A/B experiment. An active experiment can set a pseudonymous assignment cookie and report signed exposure or click events. No active experiment creates a new cookie; visitors may retain an existing assignment cookie until it expires or is cleared. See the privacy section above.

= What happens if I uninstall? =

Uninstalling revokes connector credentials, removes connector configuration and experiment data, and removes its role. Existing pages remain. The dedicated account remains without roles to preserve author attribution.

= Where can I get support? =

Visit https://zeopilot.com/docs/wordpress or email alerts@zeopilot.com. Do not send passwords, application tokens, or private customer information in support emails.

= What changes when upgrading from 0.3.1? =

The old administrator-level Zeopilot credential is revoked. Open Settings > Zeopilot to create a new limited connection, then update its username and password in Zeopilot. Your personal password and other application passwords are not changed. Existing experiment assignment IDs and queued receipts are migrated.

== Changelog ==

= 0.3.2 =
* Replaced administrator-level credentials with a dedicated account restricted to page content and experiment data.
* Added upgrade, disconnect, deactivation and uninstall credential cleanup.
* Loaded static CSS and JavaScript through WordPress enqueue APIs.
* Adopted the unique zeopilot prefix with compatibility migration for existing experiment evidence.
* Restricted experiment relay destinations to the Zeopilot HTTPS endpoint.


= 0.3.1 =
* Public WordPress.org naming updated to Zeopilot.
* Added directory-ready documentation, GPL license metadata, external-service/privacy disclosures, and secure handling of administrator-facing status notices.
* Preserved the existing administrator-only revocable connection and governed experiment behavior, with additional direct-access and input/output validation protections.

= 0.3.0 =
* Added the signed measurement v2 experiment protocol and governed WordPress verification safeguards.
