=== Clearyvo Privacy Audit ===
Contributors: kishollo001
Tags: gdpr, privacy, google fonts, cookies, third party
Requires at least: 6.2
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 0.5.5
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Finds third parties your pages load before consent (Google Fonts, YouTube, analytics, CDNs, Gravatar) and shows where they come from.

== Description ==

Every request to an external server sends the visitor's IP address to that server. Under the GDPR this needs a legal basis, and in 2022 a German court (LG München I) ordered a site owner to pay damages to a visitor for loading Google Fonts from Google's servers without consent. Most site owners do not know which of their plugins and theme settings make such requests.

Privacy Audit loads your pages the way a first-time visitor sees them – without accepted cookies – and lists every third party the browser would contact.

**What it checks**

* Home page, privacy policy, pages with videos, maps, iframes or forms, a post with comments and a sample of recent pages (up to 20).
* Scripts, stylesheets, fonts, images, iframes, preconnect hints and loader snippets (Analytics, Tag Manager, Meta Pixel, Hotjar…).
* `@import` and `url()` inside your theme's and plugins' stylesheets – where Google Fonts often hide.
* Resources your consent tool holds back until the visitor agrees are listed separately, so you can see that the banner works.

**For each service**

* Name and category (Fonts, Analytics, Advertising, Video, Maps, CDN…).
* Pages it appears on and example URLs.
* The WordPress handle or stylesheet that adds it, so you know which plugin or theme setting to change.
* A concrete recommendation.

**Consent, cookies and the privacy policy**

* Cookies the server sets on the first visit, with expiry and the Secure, HttpOnly and SameSite flags, marked necessary (WordPress, WooCommerce, security, language) or to check.
* The cookies each recognised service is documented to set, for your cookie policy.
* Consent tools found in the page, also banner services that are not WordPress plugins (Cookiebot, Usercentrics, OneTrust, Iubenda, Termly…), and Google Consent Mode.
* Tracking that runs without any consent tool.
* The privacy policy page: set, published and linked from the home page.

**Quick fixes (optional)**

* Disable WordPress emoji (removes the s.w.org requests).
* Remove Google Fonts that are added the standard WordPress way.
* YouTube privacy-enhanced mode for embeds.

Part of the Clearyvo plugin family: focused plugins that each check one part of your site and share one "Site Toolkit" menu with a Site health score. The Site Toolkit plugin has every checker in one plugin, switched on one by one; when it is installed, this plugin's settings and results are shared with it. More at wp-sitechecker.com.

This plugin is a technical aid and does not provide legal advice.

== Installation ==

1. Upload the plugin and activate it.
2. Go to Site Toolkit → Privacy Audit.
3. Click "Scan site".

== Frequently Asked Questions ==

= What is the /wp-json/clearyvo/v1/app/ address? =
A read-only REST route for the Clearyvo Site Inspector Mac app. It shows the Site health score of the Clearyvo plugins to a signed-in administrator (for example with a WordPress Application Password) and changes nothing. It sends nothing anywhere: the app asks, the site answers.

= Does it see everything? =

It sees what the HTML of the page and its stylesheets request. Requests that JavaScript adds later (for example trackers loaded through Google Tag Manager) need a check in the browser's developer tools.

= My pages could not be loaded =

The scan fetches your pages from your own server (a loopback request, like WordPress Site Health). Some firewalls or security plugins block this.

= Does it send data anywhere? =

No. It only requests your own pages and stylesheets. Results are stored in your database.

== Free and Pro ==
Everything in this plugin is free. Clearyvo Pro is one add-on for the Pro features of the whole family (image optimisation, AI ALT texts, alerts by email, white-label reports); this checker has none of its own.

== Changelog ==
= 0.5.5 =
* Shared Clearyvo framework 2.3.1: the SEO checker is listed as Clearyvo SEO (formerly Image Alt & SEO) everywhere, whichever Clearyvo plugin loads the framework.

= 0.5.4 =
* Database: every query goes through $wpdb->prepare(), with %i placeholders for table names.

= 0.5.3 =
* New icons: one design for the whole Clearyvo family, with a colour per group of checkers.

= 0.5.2 =
* The other checkers in the shared menu have their new names (SSL Checker, Security Checker, Indexing Checker and the rest).

= 0.5.1 =
* The plugin links point to wp-sitechecker.com again, until the site has moved to clearyvo.com.

= 0.5.0 =
* New: read-only connection for the Clearyvo Site Inspector Mac app (Site health as data, for administrators with an Application Password).

= 0.4.1 =
* Links to the new home of the Clearyvo WordPress plugins: clearyvo.com/wordpress.

= 0.4.0 =
* First release under the Clearyvo name (folder and text domain: clearyvo-privacy-audit). Settings and results of the earlier versions are kept; activating this plugin switches the earlier copy off.
