=== Datoden Website Guard ===
Contributors: datoden
Tags: install, update, drag and drop
Requires at least: 6.5
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 3.0.13
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

The guard for your website: an email if it stops working, all of Datoden's plugins on one overview, and install or update by drag and drop.

== Description ==

In the WordPress admin the plugin is shown as "DT-website-guard" in the DT-addons menu (Datoden's menu).

* DT-website-guard: connect the website to a free Datoden account and get an email if it stops working, and before the SSL certificate or the domain expires. The overview shows the website, response time, the padlock (SSL) and the domain.
* Datoden plugins: every DT plugin on one overview. Plugins that are not installed are installed from WordPress.org and turned on with a switch. Plugins that are not on WordPress.org yet link to their page at Datoden.
* Plugins that are not on WordPress.org yet can be installed from My websites at Datoden when the website is connected.
* Logged in as an administrator, drag a plugin or theme ZIP over any page – on the website or in the admin – and drop it in the area that appears. It is installed or updated right away, the cache is cleared and the page reloads. Combined DT packages (plugins/*.zip, themes/*.zip) are installed in batches.
* Maintenance mode with your own heading and text per language.

= Pro add-on =

In the separate paid add-on Datoden Website Guard Pro from Datoden: more websites, all of My websites at Datoden (uptime, response time graph, front page check, email alerts you choose, update and control the website, health, security, cookie scan, backups) and safe updates – if the website breaks after an update, the earlier version is put back.

== External services ==

This plugin can connect to Datoden (https://datoden.com), a service run by Responsit AB, Sweden. The connection is optional – everything in the plugin works without it. Nothing is sent to Datoden until an administrator clicks "Start DT-website-guard" (or "Connect") in the WordPress admin and approves the connection on datoden.se or datoden.com. You can disconnect at any time with "Disconnect" (or by turning DT-website-guard off) on the DT-website-guard page; then nothing more is sent.

What is sent to Datoden, and when (only while the website is connected, except the connection itself):

* When you connect: the website address, the administrator's language (Swedish or English), the WordPress address that Datoden returns to and a random check value. After you approve on Datoden, the website sends the one-time code it got back, together with the website address and the language, and receives a website key that is stored in your database.
* Once a day (WordPress cron), and when an administrator opens a DT plugin page and the last contact is more than six hours old: the website key, the language, and the folder names, versions and active state of the installed Datoden plugins (for example datoden-cookie-consent). The answer can contain short messages from Datoden and updated wording for the DT plugins' texts, which are shown on the plugins' pages.
* When an administrator opens the DT-website-guard page or a DT plugin page (at most every five minutes), or clicks "Check again": the website key, to get the latest result of Datoden's monitoring (up or down, response time, and the expiry dates of the SSL certificate and the domain). "Check again" also asks Datoden to check the website once more.
* When the DT-website-guard page is shown and the DT-website-guard plugin is installed: the list of Datoden's plugins and their versions is fetched from datoden.se, at most every six hours. No data about the website is sent.
* When you click "My websites": the website key, the language and the email address of the logged-in WordPress user, so that Datoden can sign you in directly if it is the same address as your Datoden account.
* When you save, use or delete a settings profile: the website key, and when saving the settings of DT-cookie and DT-darkmode (no personal data; website-specific values such as the logo and the privacy page are left out). They are stored in or read from your Datoden account.
* When you disconnect: the website key, so that Datoden can remove it.
* While connected, Datoden visits the public website every five minutes (like any visitor) to check that it is up, reads its SSL certificate and looks up the domain's public registration data to find when it expires. The plugin shows the dates as Datoden reports them; the website does not contact any other service for this.

DT-website-guard (this plugin) also lets the Datoden account manage the website from My websites on datoden.se or datoden.com:

* Every time the website contacts Datoden as described in the second point above, it also sends its current state: the WordPress, PHP and database versions, the active theme, the Site Health summary, pending updates of plugins, themes and WordPress, the names of inactive plugins, the number of administrators and their usernames and email addresses, the latest installations (up to 20), the number of failed logins (last day and last week), the result of the daily WordPress core file check, whether maintenance mode is on, the available backups, whether DT-cookie and DT-darkmode are on, DT-darkmode's accent colour and position, DT-cookie's consent counts for the last 30 days (numbers only, no visitor data), and the results of earlier commands.
* Datoden can wake the website with a request to /wp-json/datoden-update/v1/wake The request carries no data: the website then makes its normal contact with Datoden and receives the commands that an administrator of the Datoden account has given in My websites. Nothing happens when the website is not connected.
* The commands: turn the cookie banner or dark mode on or off, change dark mode's colour and position, ask all visitors for cookie consent again, clear the cache, turn maintenance mode on or off, sign out all users, check the WordPress core files, update plugins, themes or WordPress (downloaded from WordPress.org as usual), create a backup (the database and wp-content except uploads and cache; a download link valid for 10 minutes is sent to Datoden, and the backup is deleted from the server after two hours), send a test email, and create a one-time sign-in link (valid for 60 seconds, sent to Datoden) for a WordPress administrator with the same email address as the Datoden account.
* Install a DT plugin from My websites: its free version is downloaded from datoden.se, checked against its SHA-256 sum, installed and turned on. Nothing is installed this way unless it is asked for in My websites.

WordPress.org (https://wordpress.org/about/privacy/):

* When an administrator turns on a DT plugin that is not installed, on the DT-website-guard page, it is downloaded from WordPress.org (api.wordpress.org and downloads.wordpress.org). Nothing is downloaded from Datoden in the WordPress admin; if the plugin is not on WordPress.org, the page links to Datoden instead.
* Once a day (also when the website is not connected) the plugin fetches the official checksums of the WordPress core files from api.wordpress.org – the WordPress version and language are sent – to check that no core file has been changed.

Datoden terms: https://datoden.com/terms/
Datoden privacy policy: https://datoden.com/privacy-policy/

== Source code ==

Everything in this plugin is the original, human-readable source code. The PHP, JavaScript and CSS files are written by hand and are neither minified nor generated by a build tool, so there is no build step: the files in the plugin folder are the source and can be read and edited directly.

== Changelog ==

= 3.0.13 =
Core 3.0.8: the return from Datoden (Connect) is also checked with a WordPress nonce (WordPress.org review); the readme describes the source code.

= 3.0.12 =
The drop zone for packages is shown above the message box – it ended up underneath when a message was already showing.

= 3.0.11 =
A package that cannot be read (e.g. a broken ZIP file) is shown in the result with the file's own name instead of the server's temporary file name.

= 3.0.10 =
Drag and drop several updates at once: all ZIP files dropped together are installed one after another ("File 2 of 3"), and the page reloads once with the result for all of them. Files that are not ZIP files are skipped with a line in the result.

= 3.0.9 =
Datoden-core 3.0.7: the plugins' settings are checked with a single database query when the page loads – missing or non-autoloaded settings used to cost one query each on every page.

= 3.0.8 =
* Review fixes in all plugins: prefixed JavaScript names, the WordPress 6.9 template enhancement output buffer (older WordPress: the buffer is closed explicitly), cache paths from content_url(). Dark Mode: block theme palettes are converted per use. SVG Support: steps back while the SVG Support plugin is active. Code Snippets: the WPCode switch button is shown for all imported snippets.

= 3.0.7 =
* Datoden-core 3.0.5: the plugin icon shows its symbol at full size, cut by the corner with the Datoden logo.

= 3.0.6 =
* Dropping a combined package is much faster, and the result box shows one summary line with Show all, scrolls and closes by itself when nothing failed.

= 3.0.5 =
* Datoden-core 3.0.4: plugin icons without the white background – the cut corner is transparent and the Datoden logo uses the icon's light colour.

= 3.0.4 =
* Datoden-core 3.0.3: new plugin icon design – a cut white corner with the Datoden logo.

= 3.0.3 =
* Datoden-core 3.0.2: the plugin's own icon (the same as on WordPress.org) is shown in the DT-addons overview and in the header of the plugin's page.

= 3.0.2 =
* Datoden-core 3.0.1: the header on the plugin's page shows the plugin's name as on WordPress.org.

= 3.0.1 =
* The WordPress.org version never downloads plugins from datoden.se; plugins that are not on WordPress.org link to their page at Datoden.

= 3.0.0 =
* New name on WordPress.org: Datoden Website Guard (shown as DT-website-guard in the DT-addons menu). The free plugin contains no locked Pro features – they are only in the separate Datoden Website Guard Pro. Websites with the earlier version are moved to the new folder automatically; settings are kept.

= 2.0.2 =
* Plugin Check: redirects to Datoden use wp_safe_redirect, and the descriptions on the Datoden plugins overview are translated with WordPress' own function. Datoden-core 2.0.1.

= 2.0.1 =
* Packages that update DT-website-guard from 1.x now install the rest of the plugins too (the installation stopped after the first round).

= 2.0.0 =
* New prefix datoden_ instead of dt_ (WordPress.org). Settings and data are moved automatically on the first load; the old [dt_…] shortcodes, hooks and REST routes keep working. Works together with older DT plugins until they are updated. Datoden-core 2.0.0.

= 1.2.30 =
* Ready for WordPress.org: Plugin Check rules (sanitising, nonces, WordPress file functions), no inline scripts in admin pages, DT-core 1.17.22. Install in the admin downloads from WordPress.org; connected websites get Datoden's version from My websites.

= 1.2.29 =
* DT-core 1.17.21: shared core cleaned up (unused code removed) – the same core in every plugin, no change in behaviour.

= 1.2.28 =
* Cleanup: unused code removed – no change in behaviour.

= 1.2.27 =
* Description and the Pro card updated for the new features; External services lists every contact with Datoden.

= 1.2.26 =
* DT-core 1.17.20: licences from Datoden are stored even without Pro plugins, so the Pro switch can install Pro.

= 1.2.25 =
* DT-core 1.17.19: if connecting to Datoden fails, the reason and error code stay on the page.

= 1.2.24 =
* The maintenance page heading and text are shown in the fields instead of as placeholders.

= 1.2.23 =
* DT-core 1.17.18: header – the name DT-language before the language switch, no divider before Saved, Undo/Redo closer to Saved.

= 1.2.22 =
* DT-core 1.17.17: when DT-website-guard is off, the four boxes explain what is watched.

= 1.2.21 =
* DT-core 1.17.16: "Get started for free" next to the DT-website-guard switch when it is off.

= 1.2.20 =
* DT-core 1.17.15: the Pro switch on the overview installs and turns on Pro directly when the website has a licence (bought or activated by Datoden). Without a licence it opens the shop as before.

= 1.2.18 =
* Every part of a dropped package is passed to the dt_hub_package_part action (also the skipped ones) – on datoden.se they are handed to Datoden's releases, so no upload is needed.

= 1.2.17 =
* Overview cards: the switches (Activate, Pro) are always at the far right.

= 1.2.16 =
* DT-core 1.17.14: the overview cards have switches at the bottom right – Activate (downloads, installs and activates a plugin that is missing, or activates a deactivated one) and Pro (on when Pro runs, otherwise to the plugin in Datoden's shop).

= 1.2.15 =
* DT-core 1.17.13: texts and names can be changed from Datoden without updating any plugin – the menu, the overview, the Plugins list and the plugins' own texts. The core only changes in DT-addons; the newest core applies to every DT plugin.

= 1.2.14 =
* DT-core 1.17.12: the menu heading is called DT-addons and the overview section Datoden plugins.

= 1.2.13 =
* DT-core 1.17.11: the Pro features require a licence – the website must be connected to Datoden and have a purchased licence or be activated by Datoden. Without a licence the base plugin runs without Pro, with a notice saying why (three days to connect after installing or updating).

= 1.2.12 =
* DT-core 1.17.10: DT-website-guard includes itself in the list sent to Datoden – Control the website, Health and Updates show again in My websites, and DT-website-guard gets its updates from Datoden.

= 1.2.11 =
* DT-core 1.17.9: the menu heading is called Datoden Addons (DT-datoden-addons wrapped onto two lines).

= 1.2.10 =
* DT-core 1.17.8: the menu heading is called DT-datoden-addons (without the Pro badge); the first row in the menu and the overview are still called DT-website-guard.

= 1.2.9 =
* The overview shows all twelve DT plugins. Those not installed have an Install button: the free version is downloaded from Datoden, its checksum is compared with Datoden's catalog, and the plugin is installed and activated – the same way as drag and drop (safe updates with Pro, the log). Deactivated plugins have Activate. DT-core 1.17.7.

= 1.2.8 =
* Combined packages (e.g. a DT update with every DT plugin) are installed in rounds of at most about 20 seconds – the browser continues until everything is done and shows how many are left (the server otherwise stopped with HTTP 503). In a combined package only what is already on the website is updated; the rest is skipped and listed on one line.
* DT-addons is now called DT-website-guard (the menu, the overview, the plugins list and the texts in every DT plugin). The folder and the settings stay the same (dt-addons), so updates and everything saved work as before. DT-core 1.17.6.

= 1.2.7 =
* DT-core 1.17.5: the card about what Pro adds is shown at the top of the sidebar (only without Pro) – in every DT plugin.

= 1.2.6 =
* Plugins list: the DT plugins are shown without " - datoden" in the name (e.g. DT-cookie Pro).

= 1.2.5 =
* Plugins list: when a Pro add-on (e.g. DT-cookie Pro) is active, its base plugin is not shown as a separate row – it stays installed, active and updated as usual, and shows again if Pro is deactivated. The Pro row shows which version of the base plugin is included.

= 1.2.4 =
* DT-core 1.17.4: the Pro badge after the plugin name in the header is readable in light mode (white text) and dark mode.

= 1.2.3 =
* DT-core 1.17.3: the DT-addons menu no longer wraps – the plugin name and the Pro tag stay on one line, and the fly-out menu is as wide as needed.

= 1.2.2 =
* Safe updates (Pro): fixed a false alarm where text on an admin page resembling WordPress's critical error message was treated as a failure although the page answered 200, and the earlier version was put back. Only the HTTP status decides now (500 and above, except 503 maintenance).

= 1.2.1 =
* DT-core 1.17.2: with DT-addons Pro active, "Pro" is shown after DT-addons in the overview header and in the admin menu. DT-addons Pro is no longer listed as its own card under Installed DT plugins.

= 1.2.0 =
* DT-addons Pro (included in All DT plugins Pro and the subscription): safe updates. The version in use is saved before every plugin or theme installation and update; afterwards the website is checked and the earlier version is put back at once if it broke. Earlier versions can be put back with one click. The free plugin shows a Pro card.
* Installation results pass through the dt_hub_install_result filter.

= 1.1.5 =
* Dropping a delivery package with parts for different places (folders with ZIP files) now explains that the package should be unzipped and which file to drop, instead of "The ZIP file must contain one folder". If a plugin requires another one (e.g. DT-cookie Pro → DT-cookie) that is installed but inactive, that one is activated first so WordPress does not refuse.

= 1.1.4 =
* DT-core 1.17.1: Installed DT plugins shows one card per plugin – the base plugin and its Pro add-on together, with a Pro badge when Pro is on – and the DT-addons menu shows Pro after the name.

= 1.1.3 =
* DT-core 1.17.0: the Pro plugins are add-ons to the base plugins (the base plugin stays active and keeps the settings).

= 1.1.2 =
* DT-core 1.16.2: Check again waits up to 30 seconds for Datoden to check the website again, and shows the latest state if Datoden does not answer.

= 1.1.1 =
* DT-core 1.16.1: DT-website-guard shows the right state. Check again now also refreshes the Website and Response time tiles (Datoden checks the website again), and the state is only kept until Datoden's next check – at most five minutes, one minute while the website is down – instead of ten minutes.

= 1.1.0 =
* Free and Pro: fully free, also on WordPress.org. DT-core 1.16.0 – the domain expiry is read from rdap.org only when the website is connected or you click Check again; updates from Datoden are Pro-only.

= 1.0.14 =
* DT-core 1.15.3: the guard status pill in the header (e.g. up · 0.1 s) no longer flashes light in dark mode.

= 1.0.13 =
* DT-core 1.15.2: in dark mode the DT-website-guard badge and the Text fields switch no longer flash light while the page loads.

= 1.0.12 =
* DT-core 1.15.1: the header (logo, Datoden badge, buttons, language switch, Saved) and the Made by Datoden line are rendered by the core – the plugin only provides its name, version, description and any tabs. The collapse/expand arrow always sits at the far right of the card.

= 1.0.11 =
* DT-core 1.14.0: the header, the DT-addons menu and everything else shared (dt-hub.php, dt-autosave.js, dt-admin.css and Datoden images) live in the dt-core/ folder. Of all active DT plugins only the newest copy is used – updating one plugin with a newer core gives every plugin the new header, and all pages load the same files (cached once by the browser).

= 1.0.10 =
* Overview: Install or update is the second card in the sidebar, below the Datoden account (slightly shorter drop zone). Messages go below it.

= 1.0.9 =
* The tab row sits at the top of the main column – above the main cards only, so the sidebar starts at the top beside it.

= 1.0.8 =
* Tabs (e.g. Languages | Menus in DT-language) are a full-width row right below the header, above the cards – no longer small inside the header, so they are not missed.

= 1.0.7 =
* Overview: Install or update now sits below Installed DT plugins (before Settings).

= 1.0.6 =
* Every card – also in the main column and the cards above it – collapses and expands with a click on its heading. The arrow sits right after the heading, so switches and buttons on the right stay visible when the card is collapsed.

= 1.0.5 =
* Sidebar cards collapse and expand with a click on their heading – remembered per card. Collapsed Messages shows the count. In DT-addons the Datoden account is at the top of the sidebar (DT-hub 1.13.2).

= 1.0.4 =
* Closed messages stay closed after reloading the page.

= 1.0.3 =
* The drag-and-drop box in the top right corner now also appears on the DT-addons overview.

= 1.0.2 =
* Messages are shown in the sidebar (Messages card) instead of the header.

= 1.0.1 =
* The first item under DT-addons in the menu is called DT-addons instead of Overview.

= 1.0.0 =
* DT-update is now DT-addons: the overview under DT-addons with DT-website-guard, install and update by drag and drop, settings and latest installations in one place. Settings, log and backups are kept.

= 1.7.19 =
* Undo/Redo tooltips say what will be undone or redone. Undo, Redo and Saved are always in the same place, greyed out when there is nothing to do.

= 1.7.18 =
* Header: subtle dividers between the groups of controls.

= 1.7.17 =
* Undo now works everywhere, also right after a change, for added/removed rows, the form builder and the code editor.

= 1.7.16 =
* Undo / Redo in the header of every DT plugin. The save status keeps its width; other messages are shown on top so nothing moves.

= 1.7.15 =
* Header rearranged: version next to the plugin name, buttons top right, Saved after the language switch, the Datoden logo links to Datoden's apps.

= 1.7.14 =
* The Datoden overview page has the same header as the plugins.

= 1.7.13 =
* Dark mode: the header shows the light Datoden logo (datoden-logo-darkmode.svg).

= 1.7.12 =
* The sidebar toggle moved into the header; when hidden the content uses the full width. The collapsed header shows the Datoden logo.

= 1.7.11 =
* The sidebar now lines up with the content (no extra gap at the top).

= 1.7.10 =
* The sidebar toggle sits in the top right corner with a sidebar icon.

= 1.7.9 =
* Header buttons: keep the header at the top while scrolling (pin) and collapse it so only Saved and the language switch show. The sidebar can be collapsed to a small button. The language switch is greyed out on pages without texts to translate.

= 1.7.8 =
* Shared stylesheet updated, same as the other DT plugins.

= 1.7.7 =
* The plugin header now stays at the top when you scroll. Saved status and the SV | EN language switch moved from the admin bar into the header, below the badges.

= 1.7.6 =
* Unified names: the plugin is now called DT-update - datoden (lowercase after DT, like all DT plugins). The folder, settings and shortcodes are unchanged.

= 1.7.5 =
* Saved in the admin bar no longer gets a different background on hover.

= 1.7.4 =
* Saved / Saving… is shown in the admin bar at the top, to the left of the SV | EN language switch (also on mobile) – no longer in the plugin's page header.

= 1.7.3 =
* Messages in the page header: WordPress and plugin notices, messages from Datoden and the Datoden account row (DT-website-guard, Datoden apps) now sit in the page header, to the left of Saved, instead of pushing the page down. Long messages show two lines – click for the full text.

= 1.7.2 =
* Autosave: the settings are saved as soon as something changes – the Save button is removed. The status (Saved / Saving… / Could not save) is shown in the page header, as in DT-slideshow.

= 1.7.1 =
* The fields with per-language texts are tagged, so that Text fields in the admin bar (DT-language 1.3.0) can highlight them.

= 1.7.0 =
* The maintenance page's texts (heading and text) can be changed per language under Settings → Maintenance page. Ready-made texts for ten languages; with DT-language the languages follow DT-language's list and you switch language with SV | EN in the admin bar. The page is shown in the visitor's language.

= 1.6.9 =
* Search engines: robots.txt blocks admin-ajax.php URLs with parameters, and author archives and feeds get noindex.

= 1.6.8 =
* Backups are not kept on the server: one at a time, deleted right after the download and at the latest after 2 hours. Deactivating or uninstalling removes them.

= 1.6.7 =
* After a successful install the page always reloads (it could get stuck on "Clearing the cache and reloading…"); a Reload button appears after 8 seconds.

= 1.6.6 =
* Custom accent colour: the colour picker opens again.

= 1.6.5 =
* DT-hub 1.9.1: the menu icon style is loaded the WordPress way.

= 1.6.4 =
* Messages after drag and drop are shown at the top right, where the file is dropped.

= 1.6.3 =
* Settings profiles with a free Datoden account: save the settings and use them on your other websites.

= 1.6.2 =
* Shared Datoden module updated.

= 1.6.1 =
* Shared Datoden module updated.

= 1.6.0 =
* From Datoden: maintenance mode, sign out all users, WordPress core file check, failed logins, log, ask cookie consent again, dark mode colour/position, backups and test email.

= 1.5.0 =
* From Datoden: waiting updates for plugins, themes and WordPress, website health, and signing in to WordPress with a one-time link.

= 1.4.2 =
* Commands that arrive while results are being reported are now run as well.

= 1.4.1 =
* Waking from Datoden is only refused while a contact is already running.

= 1.4.0 =
* Control from Datoden: My websites can turn the cookie banner and dark mode on/off, clear the cache and update the DT plugins.

= 1.3.0 =
* Datoden channel: new versions of DT plugins as regular WordPress updates; messages from Datoden.

= 1.2.3 =
* Website monitoring as an on/off switch at the top of the Datoden overview.

= 1.2.2 =
* Website monitoring explained in plain words: what you get, three steps to start, and a "Start Website monitoring – free" button.

= 1.2.1 =
* A cleaner Datoden overview: the DT plugins as tiles and a tidier account card.

= 1.2.0 =
* Own page under Datoden → DT-update with the drop area, settings (drag and drop on the website / in the admin, activate all new plugins, clear the cache) and the latest installations.

= 1.1.3 =
* Gets a fresh security token right before each upload, so a page that has been open for a long time still works. Clearer error messages.

= 1.1.2 =
* My websites opens your Datoden account directly through a secure one-time link when it is safe; otherwise you sign in and land on the right page.

= 1.1.1 =
* Shows "Connected to Datoden" next to the version and a shortcut to My websites in Datoden when the website is connected.

= 1.1.0 =
* DT names in code and files.

= 1.0.0 =
* DT-Drop renamed to DT-update.

== Upgrade Notice ==

= 2.0.0 =
Install all DT plugins together; settings are moved automatically.
