=== Accessonaut Accessibility ===
Tags: accessibility, reading aids, wcag, inclusion
Requires at least: 6.3
Requires PHP: 7.4
Stable tag: 1.2.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Connect WordPress to optional Accessonaut reading aids using your public project ID and HTTPS service origin.

== Description ==

Accessonaut Accessibility adds the Accessonaut widget once, in the footer of your public pages. Follow the project's central design or configure a local WordPress design in Settings > Accessonaut. No API secret belongs in the plugin.

Local appearance includes five presets, six colors, system/light/dark theme, three icons, German/English/automatic language, title and subtitle, icon or text launcher, six local font stacks, font size, panel width, corner radii, launcher size, separate mobile/desktop offsets, shadow and spacing. No fonts are fetched from an external font provider. Numeric and text limits are validated when saving and again when reading stored options.

New installations follow central design by default. Existing 1.0 position/color settings retain their local appearance on upgrade. Functional features, approved image descriptions and branding are controlled by the service and cannot be overridden locally.

The widget provides optional reading and display adjustments. It does not repair the source code of your website and is not a WCAG, BFSG or other legal compliance certificate. Combine automated checks with manual testing and source fixes.

This connector requires an Accessonaut account and a project for your website. The service may offer free and paid plans. Free projects display an Accessonaut credit link. Plan entitlements and branding are managed by the service, not by a local bypass switch.

== External service and privacy ==

No external connection is enabled by default. The administrator must configure a trusted Accessonaut HTTPS service origin, a public project ID and explicitly enable the connection.

When enabled, each visitor browser requests {service-origin}/widget.js and public project configuration from {service-origin}/api/widget/config. These requests send the visitor IP address, normal browser request data and the website hostname to that origin. The service uses the project ID and hostname to check project and plan entitlements. Widget reading preferences are saved locally in the visitor browser. This plugin does not send WordPress users, passwords, posts or API secrets to the service, and performs no server-side outbound requests.

An optional administrator preview connects only after clicking "Load preview from configured service". It requests {service-origin}/widget-preview.html and its public widget preview assets from the saved HTTPS origin. The browser sends its IP address and ordinary request data. An opaque script-only sandbox receives public appearance values via postMessage, without the project ID, private findings or account API requests. Closing the preview removes the frame. The preview displays Free branding; it does not determine the actual project's subscription. Saving design settings does not enable the visitor service connection automatically.

The final hosted Accessonaut domain is configured by the operator. Before enabling or opening the optional preview, open {service-origin}/privacy-policy and {service-origin}/terms-of-service and review them. The settings screen links directly to these pages after the service origin is entered. Only use a service you trust: its JavaScript runs on your public website. Update your own privacy information and assess applicable consent requirements for your deployment.

== Installation ==

1. Upload accessonaut-1.2.0.zip using Plugins > Add Plugin > Upload Plugin, or copy the inclusiveweb directory to wp-content/plugins.
2. Activate Accessonaut Accessibility.
3. Create a project for your domain in your Accessonaut account and open the installation screen.
4. Under Settings > Accessonaut enter the HTTPS service origin and public project ID. Choose central design or configure the local appearance. A preset fills the local form; save to publish it.
5. Review the external-service disclosure, enable the connection and save.
6. Clear page/CDN caches and test the published website in a private window, including keyboard access and mobile layout.

Use one embed per page. Remove duplicate scripts from your theme, code-injection plugins or tag manager. The optional Accessonaut for WooCommerce connector can coexist: it owns recognized commerce pages, including disabled scopes, while this connector keeps normal WordPress pages. Your theme must call wp_footer().

== Frequently Asked Questions ==

= Does this plugin make my website compliant? =
No. Optional display aids do not replace accessible source code, suitable content, manual evaluation or testing complete user journeys.

= Is a secret API key needed? =
No. Only the public project ID and service origin are embedded. Never paste credentials or private API keys into these fields.

= Does activation send visitor data? =
No. The widget remains disabled until you configure the connection and check Enable. Disabling or deactivating stops new script embeds. Clear page/CDN caches to remove previously cached HTML.

= Can I preview without enabling the visitor connection? =
Yes. Save a trusted HTTPS service origin and explicitly click the preview button. Only that action loads the administrator preview. It shows the current local form, including unsaved changes, and always includes Free branding. Central design should be tested in Accessonaut or on the published website.

= Does local design remove Free branding or enable paid features? =
No. Local design controls only appearance. A valid paid service entitlement controls branding removal, and functional settings remain central.

= Is this plugin available in the WordPress.org directory? =
This package is distributed as a downloadable ZIP. A package alone is not a WordPress.org listing or approval.

== Changelog ==

= 1.2.0 =
* Shared appearance implementation and editor assets with the standalone WooCommerce connector.
* Commerce-scope bridge prevents the general connector from overriding WooCommerce page selections.
* Explicit no-referrer script requests; existing settings, PHP entry points and public project protocol remain compatible.

= 1.1.1 =
* Product name and administrator interface updated to Accessonaut.
* Existing plugin directory, settings, public project IDs and integration protocol remain compatible.
* Download distributed as accessonaut-1.1.1.zip; installed plugin directory remains inclusiveweb for upgrades.

= 1.1.0 =
* Central/local design source with backwards-compatible migration of 1.0 appearance.
* Five design presets and 28 bounded appearance settings matching the shared widget contract.
* Explicit opt-in sandbox preview with appearance-only messages, local administrator assets and no external font requests.
* Expanded validation, real WordPress runtime coverage and reproducible release packaging.

= 1.0.0 =
* Initial connector with opt-in service connection, strict validation, scoped script attributes, administrator settings and uninstall cleanup.
