=== Speedy Go ===
Contributors: codeandcore
Tags: caching, optimization, performance, minification, compression
Requires at least: 5.0
Tested up to: 7.0
Requires PHP: 7.2
Stable tag: 2.1.6
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Optimize your WordPress site with advanced caching, minification, and performance tools for faster loading.

== Description ==
Speedy Go is an all-in-one performance plugin for WordPress, designed to optimize every aspect of your site's speed and efficiency. It features full-page caching, HTML/CSS/JS minification and combination, browser and object caching, Gzip & Brotli compression, lazy loading, mobile-specific caching, cache preloading, scheduled expiration, and advanced cache rules.

== Major Features & Functions ==

**Caching & Performance**
- **Full-Page Caching**: Cache entire pages for instant delivery, with options for cache expiry, exclusions, and auto-purge.
- **Cache Expiry & Auto Purge**: Set cache expiration rules and automatically purge outdated cache files.
- **Exclude URLs**: Define URLs to be excluded from caching.
- **Browser Caching**: Leverage browser cache to reduce load times.
- **Object Caching**: Speed up dynamic content using object cache and transients.
- **Database Query Caching**: Optimize repeated database queries.
- **Mobile Caching**: Serve optimized cache for mobile users.
- **Cache Preloading & Warm-Up**: Automatically preload and warm up cache for improved response times.
- **Scheduled Expiration**: Automate cache expiration to keep content fresh.
- **Advanced Cache Rules**: Fine-tune caching with advanced rules and exclusions.

**Asset Optimization**
- **HTML Minification**: Reduce HTML file size for faster rendering.
- **CSS & JS Minification**: Minify and combine CSS and JavaScript files for optimal delivery.
- **CSS & JS Combination**: Combine multiple CSS/JS files to reduce HTTP requests.
- **Exclude CSS/JS Files**: Exclude specific files from minification or combination.
- **Gzip & Brotli Compression**: Compress files for improved speed.

**User Experience & Admin Tools**
- **Lazy Loading**: Defer offscreen images for faster initial page loads.
- **Admin Dashboard Widget**: Monitor cache status from the dashboard.
- **Debug Tools & Logging**: Advanced debug logging and error tracking for troubleshooting.
- **User-Friendly Admin Interface**: Modern, easy-to-use settings and management screens, including tabs for General, Advanced, and System Info.
- **Admin Bar Integration**: Quick access to cache purging and settings from the admin bar.
- **Settings API Integration**: All options are managed via the WordPress Settings API for reliability and security.
- **AJAX Bulk Actions**: All bulk actions and progress checks are handled via secure AJAX endpoints.

**Advanced & Developer Features**
- **Custom Cron Schedules**: Register and use custom cron intervals for cache processing.
- **System Info Tab**: View server and plugin environment details (PHP version, GD/Imagick support, disk space, etc).
- **Logging**: Optionally enable detailed logging of batch progress and failures to a log file.
- **Uninstall Cleanup**: On uninstall, all plugin-created cache and database tables are removed.

== Installation ==
1. Upload the plugin files to `/wp-content/plugins/speedy-go` or install via the WordPress plugins screen.
2. Activate the plugin through the 'Plugins' screen in WordPress.
3. Go to **Settings → Speedy Go** to configure caching and optimization settings.

== Usage ==
* Enable/disable features as needed from the settings page.
* Monitor progress and logs from the dashboard widget and debug tools.
* Use the admin bar for quick cache purging and access to settings.

== Frequently Asked Questions ==

= Does this plugin require special server configuration? =
No, Speedy Go works with standard WordPress installations. For best results, use PHP 7.2+.

= Can I exclude specific files or URLs from caching or minification? =
Yes, you can define exclusions for caching, minification, and combination in the settings.

== Screenshots ==
1. Plugin Dashboard: Plugin connection screen.

== Changelog ==

= 2.1.6 =
* New: Added API detection to automatically notify users if another caching plugin is active, preventing conflicts.
* Enhancement: Redesigned the admin connection page with a modern UI and manual connection fallback form.
* Enhancement: Added active and hover state styling for the SpeedyGo admin menu.
* Enhancement: Made the admin connection page WPML translation ready.
* Cleanup: Removed unused promo banners and background images to reduce plugin footprint.

= 2.1.5 =
* Fix: Removed a temporary debug block from the license validation flow that could leak raw database details (table name, query counts) inside the "Invalid license key" error shown on the Connect page. Added a safety net so debug output can never reach a customer's screen again, even from a future server-side regression.
* Fix: font-display: swap now correctly overrides an existing bad value (e.g. font-display: block or auto) shipped in a theme or third-party plugin's own font CSS, instead of only applying when the property was missing entirely. Previously, a theme icon font or a service like Font Awesome that already set font-display: block would keep that value untouched, leaving the PageSpeed "Font display" warning in place even with this setting enabled.
* Fix: Resolved "Mixed Content" errors that could block the plugin's own generated CSS, JS, and WebP images on sites running behind a reverse proxy or CDN that terminates SSL upstream of the server (e.g. Cloudflare, a load balancer). Cache URLs are now correctly generated as https when the site is actually served over https, even when WordPress's own SSL detection is inconclusive.

= 2.1.4 =
* Fix: When both Gzip/Brotli compression and "Defer JS" were enabled at the same time, the defer attribute was silently never added to any script tag. Root cause: compression ran first, converting the HTML to binary bytes, then the defer pass couldn't find any `<script` tags in the compressed data. Fixed by running defer (and all other HTML transformations) before compression. Cache files are now always written uncompressed; only the live HTTP response is compressed.

= 2.1.3 =
* Fix: License activation now works correctly on hosts where the PHP sodium extension is not installed (e.g. shared hosting without libsodium). The plugin now requests an HMAC fallback from the server when sodium is unavailable, so verification succeeds without requiring a server-side extension change.
* Fix: Resolved a false "Cryptographic signature verification failed / forge/tampering detected" error caused by a JSON encoding difference between the server (Node.js outputs raw Unicode) and PHP (escapes Unicode as \uXXXX). Verification now compares decoded data structures rather than raw byte strings, eliminating the mismatch.
* Fix: Added dual-canonical HMAC verification — the plugin now tries both PHP-style and JS-style JSON encoding when verifying HMAC responses, preventing fallback failures on Unicode content.
* Improvement: Verification error messages are now specific (key_mismatch, content_mismatch, no_sodium_no_hmac, hmac_failed) making it easier to diagnose connection issues.
* Improvement: Plugin now sends X-Speedygo-Accept-HMAC header on every request, enabling HMAC fallback automatically when the server detects sodium is unavailable or keys are mismatched.
* Tested up to WordPress 6.7.

= 2.1.2 =
* Improvement: Free plugin detects and deactivates itself when the Pro version is active, preventing function conflicts.
* Fix: Compatibility improvements for WAF-protected sites using outbound polling instead of inbound push for CDN sync.
* Fix: CDN sync progress display for WAF sites.
* Fix: Subscription domain check no longer incorrectly matches subdomains as the root domain.

= 2.1.1 =
* Fix: Resolved all WordPress Plugin Check security, i18n, and coding standards issues.
* Fix: Replaced parse_url() with wp_parse_url() across all files for consistent output.
* Fix: Replaced fopen/fread/fclose with WP_Filesystem::get_contents() in cache serving.
* Fix: Added missing translators comments and corrected mismatched text domains.
* Fix: Prefixed global functions sg_* renamed to cnc_sg_* for WordPress namespace compliance.
* Fix: Escaped all output in admin-connection.php (esc_url, esc_attr).
* Fix: Replaced date() with gmdate() in settings export filename.
* Fix: Replaced unlink() with wp_delete_file() in uninstall.php.
* Fix: Gated all error_log() calls behind WP_DEBUG to remove debug code from production.
* Tested up to WordPress 7.0.

= 2.0.3 =
* New: Added "Exclude WooCommerce Default Pages" option to automatically bypass cache for Cart, Checkout, and My Account pages.
* New: Implemented Import/Export settings tab for backup and migration support.
* Enhancement: Refined settings UI with improved tab layout and background image support for WebP conversion.
* Fix: Resolved "Bad Request" AJAX error in the API key manual connection form.
* Fix: Resolved issue where settings failed to save due to nested HTML form elements.
* Fix: Resolved Admin JS crash occurring on specific settings pages.
* Fix: Resolved PHP errors/warnings related to deprecated functions.
* Enhancement: Clarified "Exclude URLs" instructions to specify full URLs on new lines.

= 2.0.2 =
* Minor UI refinements and styling adjustments.
* Accessibility improvements for admin settings.
* Updated compatibility for latest WordPress versions.

= 2.0.1 =
* Tested up to: 6.9
* Minor stability improvements.
* Documentation updates.
* Code cleanup and small performance refinements.

= 2.0.0 =
* **New**: Added a comprehensive Telemetry tracking feature to monitor usage data, including an opt-in modal on activation and a dedicated tab in Settings.
* **New**: Introduced a Deactivation Feedback modal to safely gather user insights when the plugin is deactivated.
* **Security**: Resolved multiple WordPress Coding Standards (WPCS) security warnings, adding strict sanitization and nonce verification across admin functions.
* **Fix**: Patched a bug in the deactivation flow where conflicting alerts overtook the custom feedback modal.
* **Enhancement**: Refactored the plugin's CSS and JS enqueuing logic to strictly load only on necessary admin pages, improving backward compatibility.
* **Cleanup**: Removed outdated/redundant codebase files and cleaned up the overall plugin footprint.

= 1.0.0 =
* Initial release

== Upgrade Notice ==

= 2.1.6 =
Recommended update. Introduces a redesigned, translation-ready connection page, a new manual connection fallback, cleaner admin interface, and adds automatic detection for other active caching plugins to prevent conflicts.

= 2.1.5 =
Recommended update for all users. Fixes a font-display optimization gap (bad values like block/auto were left untouched instead of upgraded to swap), removes a debug-info leak on license errors, and resolves mixed-content blocking on sites behind an SSL-terminating proxy or CDN.

= 2.1.4 =
Important fix: If you use both Gzip/Brotli compression and "Defer JS" together, the defer attribute was silently never applied. Update to restore correct defer behaviour.

= 2.1.3 =
Recommended update for all users. Fixes license activation failures on hosts without the PHP sodium extension, and resolves a signature verification error that affected sites with Unicode content in API responses.

= 2.0.3 =
Major feature update including WooCommerce auto-exclusion, Import/Export settings, and critical fixes for settings saving and API connection. Recommended for all users.

= 2.0.2 =
UI refinements and accessibility updates. Recommended for a better user experience.

= 2.0.1 =
Maintenance and compatibility update. Tested up to WordPress 6.9 with minor stability improvements, documentation updates, and internal code refinements. Recommended for all users.

= 2.0.0 =
This is a major update. Speedy Go 2.0.0 brings a suite of new optimization features, bug fixes, and a brand new Telemetry tab. We recommend updating to benefit from improved caching performance and advanced settings.

= 1.0.0 =
Initial release of Speedy Go.

== Third Party / External Services ==

This plugin connects to external services. By installing and activating this plugin you agree to the terms and privacy policies listed below.

**SpeedyGo (https://speedygo.io)**

The plugin communicates with speedygo.io for the following purposes:

1. **License validation** — Once per day via WordPress Cron the plugin sends your site URL, domain name, and license key to speedygo.io to confirm your subscription is active. No visitor personal data is included.
2. **Settings synchronisation** — When you save settings in the SpeedyGo dashboard, configuration data is pushed from speedygo.io to your site via a cryptographically signed webhook.
3. **Account connection** — When you click "Connect to Speedy Go", your browser opens a popup to speedygo.io to authenticate and select a plan. Your site URL and a one-time auth token are included in the URL.
4. **Usage telemetry (opt-in only)** — If you choose to share anonymous usage data during connection, aggregate plugin-feature events are sent to speedygo.io. This is optional and can be declined or withdrawn at any time.

Data transmitted to speedygo.io: WordPress site URL, domain name, license key, plugin version. No visitor names, email addresses, or IP addresses are ever transmitted.

* Privacy Policy: https://speedygo.io/privacy-policy/
* Terms of Service: https://speedygo.io/terms-of-service/

**Bunny.net CDN** (only when CDN features are enabled)

When CDN delivery is active, static assets are served from Bunny.net pull zones managed by SpeedyGo. Bunny.net may log standard web-server data (IP address, user agent, requested URL) per its own privacy policy.

* Privacy Policy: https://bunny.net/privacy/
* Terms of Service: https://bunny.net/tos/

== Privacy Policy ==

When the plugin is connected to a SpeedyGo account it transmits your WordPress site URL, domain name, and license key to speedygo.io for license validation and settings synchronisation. No visitor personal data (names, email addresses, IP addresses) is collected or transmitted by this plugin. Anonymous usage telemetry is strictly opt-in and can be declined or withdrawn at any time from the plugin settings.

Full privacy policy: https://speedygo.io/privacy-policy/

== Credits ==
* WordPress Plugin Boilerplate