=== DraftSEO.AI ===
Contributors: klimentp
Tags: ai, blog, content, publishing, seo
Requires at least: 6.2
Tested up to: 6.9
Requires PHP: 7.4
Stable tag: 1.0.4
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Publish AI-generated blogs from DraftSEO.AI directly to WordPress with automatic image import and SEO optimization.

== Description ==

DraftSEO.AI connects your WordPress site to the DraftSEO.AI platform, enabling you to publish AI-generated blog posts directly to your website with a single click.

= Key Features =

* **One-Click Publishing** - Publish AI-generated blogs from DraftSEO.AI to WordPress instantly
* **Automatic Image Import** - Images are automatically transferred from DraftSEO.ai to your WordPress Media Library
* **SEO Optimization** - Maintains all SEO metadata, keywords, and meta descriptions
* **Category & Tag Management** - Sync WordPress categories and automatically create tags from keywords
* **Multiple Publishing Options** - Save as draft, publish immediately, or schedule for later
* **Content Cleanup** - Automatic HTML cleanup and formatting for WordPress compatibility
* **Secure API Connection** - Encrypted API key storage using WordPress native encryption
* **HMAC-SHA256 Webhook Security** - Industry-standard signature verification for deactivation and disconnect notifications

= How It Works =

1. Install and activate the plugin on your WordPress site
2. Click "Connect with DraftSEO.ai" in plugin settings while you are logged in your DraftSEO.ai account
3. Automatically connect using OAuth (no manual API key needed)
4. Toggle Wordpress Auto-publish ON when generating blogs or click "Publish to WordPress" on already generated blogs

= Image Import =

The plugin intelligently handles image import based on blog size:

* **1-5 images**: Direct import (fast, 10-20 seconds)
* **6+ images**: Hybrid approach - featured image imported immediately, remaining images processed in background via WordPress Cron

All images are downloaded from DraftSEO.ai directly to your WordPress Media Library, ensuring full ownership and no external dependencies.


== Installation ==

= Automatic Installation =

1. Go to WordPress Plugins → Add New
2. Search for "DraftSEO.ai"
3. Click "Install Now" and then "Activate"
4. Go to DraftSEO → Settings → "Connect with DraftSEO.ai" while logged in your DraftSEO.ai account in a separate tab

= Manual Installation =

1. Download the plugin ZIP file
2. Go to WordPress Admin → Plugins → Add New → Upload Plugin
3. Choose the ZIP file and click "Install Now"
4. Activate the plugin
5. Go to DraftSEO → Settings to configure

= Configuration =

1. Navigate to WordPress Admin → DraftSEO → Settings
2. Click "Connect with DraftSEO.ai" while logged in your DraftSEO.ai account in a separate tab
3. Connection completes automatically

== Frequently Asked Questions ==

= How do I connect my WordPress site? =

Simply click the "Connect with DraftSEO.AI" button and the connection completes automatically. You must be signed in DraftSEO.ai in another tab.

= What happens to the images? =

Images are downloaded from DraftSEO.ai directly to your WordPress Media Library. You have full ownership and they're stored locally on your server.

= Can I publish to multiple WordPress sites? =

Yes! You can connect multiple WordPress sites to your DraftSEO.AI account. Each site needs the plugin installed.

= Does this work with custom post types? =

The plugin currently supports only standard WordPress posts and pages.

= How many images can be imported per blog? =

The plugin can handle unlimited images per blog. For blogs with 1-5 images, import is instant. For 6+ images, the featured image is imported immediately and remaining images are processed in the background.

= Is there a limit on blog length? =

No, there's no limit on blog length or word count. The plugin handles content of any size.

= Does this require a DraftSEO.AI subscription? =

Yes, you need an active DraftSEO.AI account to use this plugin.

= Where can I get help? =

For support and questions:
* Visit https://draftseo.ai/contact for any questions

== Screenshots ==

1. Plugin settings page

== Changelog ==

= 1.0.4 =

Pipeline ordering and content processing fixes for YouTube embeds and headings.

* Fixed YouTube videos not rendering on WordPress — the content processing pipeline was converting YouTube URLs to Gutenberg embed blocks too late, after other processors had already transformed them into unrecognizable formats. YouTube conversion now runs before markdown and paragraph processing
* Fixed Gutenberg embed block markers being stripped — the HTML comment cleaner was removing all comments including the essential `<!-- wp:embed -->` and `<!-- /wp:embed -->` markers. Comment cleaner now preserves WordPress block comments
* Fixed paragraph wrapper breaking Gutenberg blocks — lines containing Gutenberg block markers were being incorrectly wrapped in `<p>` tags, breaking the block structure. Paragraph wrapper now recognizes `<!-- wp:` lines as block-level content
* Fixed markdown headings appearing as raw text after images — the image-to-figure converter did not add a newline after `</figure>`, causing the next line's heading (e.g., `### Heading`) to be glued to the figure tag and unrecognized by the heading converter
* Removed auto-generated figcaptions from images — image alt text was being duplicated as a visible `<figcaption>` below every image, showing descriptive text that should only be used for accessibility (screen readers). Images now use alt text in the `alt` attribute only

= 1.0.3 =

Content rendering and sanitization fixes for YouTube videos, headings, and citations.

* YouTube video embeds now use WordPress Gutenberg embed blocks instead of plain URLs or [embed] shortcodes, ensuring videos survive wp_kses sanitization and render as responsive players on all themes
* Content sanitizer updated to extract and preserve Gutenberg blocks before running wp_kses, then restore them after — prevents stripping of embed markup
* Removed legacy [embed] shortcode conversion (convert_youtube_oembed_to_embeds) — no longer needed since the platform now sends native Gutenberg block format
* Markdown headings wrapped in paragraph tags (e.g., <p>## Heading</p>) are now detected and converted to proper HTML heading elements before processing
* Citation link normalization added to handle AI-generated [[n]](url) format, converting them to clean [n] references before downstream processing

= 1.0.2 =

Content formatting and SEO structured data hotfix release.

* In-text citations `[1]`, `[2]` now render as clickable superscript links that scroll to the matching reference
* References section converted to a styled numbered list with anchor IDs for citation linking
* All external links now open in a new tab with `rel="noopener noreferrer"` for security
* FAQ Schema (JSON-LD) structured data extracted from content and injected into WordPress post `<head>` for Google rich results
* WordPress plugin now injects front-end CSS for consistent styling of citations, references, and tables across themes
* Updated content sanitization allowlist to support `<sup>`, `<ol>`/`<li>` with IDs, and `<a>` with `target`/`rel` attributes
* WordPress site dropdown now only shows active/connected sites

= 1.0.1 =
* Hotfix: YouTube video embeds now render correctly using WordPress oEmbed
* Hotfix: Data tables now display as formatted HTML tables instead of raw markdown text


= 1.0.0 =

Major release with 30+ improvements across security, stability, performance, and API architecture.

**Security (6 improvements)**

* HMAC-SHA256 webhook authentication — Deactivation and disconnect webhooks now sign payloads with HMAC-SHA256 using the API key as the secret; the API key is never transmitted over the wire
* Replay protection — Webhook requests include a Unix timestamp in `X-DraftSEO-Timestamp` header; requests older than 5 minutes are rejected
* Timing-safe comparisons — All API key and signature comparisons use `hash_equals()` (PHP) and `crypto.timingSafeEqual` (Node.js) to prevent timing-based side-channel attacks
* AES-256-CBC encryption — API keys stored at rest using AES-256-CBC with a random IV per encryption, derived from WordPress auth salt (site-specific, not hardcoded)
* Improved deactivation hook — Now reads the API key via `DraftSEO_Settings::get_api_key()` (properly decrypted) for more reliable key handling
* Enhanced key validation — `verify_api_key()` now explicitly validates both stored and provided keys with specific, actionable error codes

**API & REST Endpoint Improvements (7 improvements)**

* New `/tags` endpoint — Added `GET /wp-json/draftseo/v1/tags` for tag synchronization, matching the existing `/users` and `/categories` endpoints
* Unified endpoint architecture — All three sync resources (users, categories, tags) now use the same plugin-first-then-fallback pattern via `fetchWithPluginFallback()`
* Structured error responses — All error responses now use proper `WP_Error` objects with specific error codes (`rest_forbidden`, `rest_missing_param`, `rest_publish_error`, `rest_update_error`, `rest_post_not_found`, `rest_tags_error`) for better debugging and integration
* `rest_ensure_response()` — All success responses now use `rest_ensure_response()` per WordPress REST API Handbook, allowing WordPress filters to process responses through the standard pipeline
* Input validation arguments — `/publish` and `/update` routes now define `args` with `validate_callback` and `sanitize_callback` for server-side input validation before the handler runs
* Remote disconnect endpoint — `/remote-disconnect` properly clears stored API key and connection settings when triggered from DraftSEO.AI platform
* Bidirectional disconnect sync — When a user disconnects from DraftSEO.AI, the platform now calls the plugin's `/remote-disconnect` endpoint before local deletion, keeping both sides in sync

**Stability & Error Handling (6 improvements)**

* Non-JSON response resilience — Gracefully handles HTML maintenance pages, WAF blocks, and 503 errors from WordPress instead of failing silently
* Sync endpoint timeout & abort — Added configurable timeout with AbortController to prevent hanging sync requests
* Error isolation — Per-card Error Boundaries in the WordPress site list ensure individual site issues don't affect other connected sites
* Guarded data access — All connection data property accesses use optional chaining with fallbacks for maximum reliability
* Response validation — API responses are validated as proper arrays/objects before processing for robust data handling
* Health check hardening — Health check response parsing improved with dedicated error paths for edge cases

**Performance & Optimization (4 improvements)**

* Parallel sync — Users, categories, and tags are fetched simultaneously via `Promise.all()` instead of sequentially
* Smart retry logic — 4xx client errors (401, 403, 400, 422) skip retry entirely; only 5xx server errors are retried, reducing wasted API calls
* Optimized cache invalidation — Streamlined cache invalidation strategy; added health check invalidation after sync for immediate UI updates
* Image import strategy — Intelligent strategy selection: 1-5 images use direct import (fast), 6+ images use hybrid approach (featured image immediate, rest via WordPress Cron background processing)

**Usability**

* Added "Settings" quick-access link on the Plugins page (next to Deactivate) for one-click access to plugin configuration

**WordPress Best Practices**

* Requires WordPress 6.2+ and PHP 7.4+
* Follows WordPress Coding Standards (WPCS)
* Uses `wp_kses_post()` for content sanitization
* Nonces for admin AJAX security
* Capability checks (`manage_options`) for settings access
* Content cleanup: Markdown-to-HTML conversion, responsive table wrapping, blockquote formatting
* Publication logging to custom database table
* Image duplicate detection via URL hash with WordPress object cache

**Tag Management**

* Auto-create tags from AI-generated keywords (configurable 1-10 count)
* Manual tag selection from existing WordPress tags
* Custom tags: create new tags on-the-fly during publishing

**Image Handling**

* Direct download from DraftSEO.ai to WordPress Media Library
* Alt text and heading text metadata preserved
* Featured image setting with URL replacement in post content (DraftSEO.ai URLs → local WordPress URLs)
* Background processing via WordPress Cron for large image sets (6+ images)

= 0.2.0 =
* Initial beta release
* One-click blog publishing from DraftSEO.AI
* Automatic image import from DraftSEO.ai
* SEO metadata transfer
* WordPress category sync
* Auto-create tags from keywords
* Multiple post status options (draft, publish, schedule)
* Content cleanup and formatting
* Secure API key encryption
* Background image processing for large blogs
* Remote disconnect synchronization
* OAuth-based connection flow

== Upgrade Notice ==

= 1.0.4 =
Fixes YouTube videos not rendering on WordPress by correcting pipeline order and preserving Gutenberg block markers. Also fixes headings appearing as raw markdown after images.

= 1.0.3 =
Fixes YouTube videos being stripped when publishing to WordPress. Also fixes headings rendering as plain text and malformed citation links.

= 1.0.2 =
Hotfix: Fixes in-text citations, references list, external links, and adds FAQ structured data (JSON-LD) for SEO rich results.

= 1.0.1 =
Hotfix: Fixes YouTube video embeds and data tables not rendering correctly in published posts.

= 1.0.0 =
Major release with 30+ improvements to security, performance, and API architecture. See changelog for full details.

= 0.2.0 =
Initial beta release of DraftSEO.AI plugin.


== External Services ==

This plugin connects to the DraftSEO.AI service to generate and publish AI-written blog content.

Data sent:
- Website URL
- OAuth authentication token
- Content publishing requests
- HMAC-SHA256 signed webhook notifications (API key is used as signing secret, never transmitted)

Data received:
- Generated blog content
- Images and metadata

Service provider:
DraftSEO.AI  
https://draftseo.ai  
Terms of Service: https://draftseo.ai/terms  
Privacy Policy: https://draftseo.ai/privacy