=== scinet IndexNow ===
Contributors: scinet
Donate link: https://www.scinet.eu/danke-sagen/
Tags: indexnow, seo, indexing, search engines, sitemap
Requires at least: 6.4
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.2.1
License: GPL-2.0-or-later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Queues changed public WordPress URLs and submits them to IndexNow after an administrator explicitly enables the service.

== Description ==

scinet IndexNow detects published, changed, moved and removed public WordPress
content and adds the corresponding same-host URLs to a persistent queue. A
WP-Cron worker combines up to 100 URLs in one request and retries temporary
network, HTTP 408, HTTP 429 and server failures with increasing delays.

The plugin can also import same-host XML sitemaps and integrates with the Scinet
Podcast event hooks when that companion plugin is present. Extension filters
allow projects to add related URLs or refine whether a post is indexable.

IndexNow transmission is disabled after installation and after updating from a
version older than 1.1.0. An administrator must review the service disclosure
under Settings > IndexNow and explicitly enable outbound submissions. Enabling
IndexNow does not guarantee crawling, indexing or search-result placement.

= External service: IndexNow =

When an administrator enables the feature, the plugin sends requests to the
global IndexNow endpoint at `https://api.indexnow.org/indexnow`. Requests are
triggered by public content or taxonomy changes, compatible Scinet Podcast
events, a manual submission/import, or the queue worker.

The transmitted payload contains the public website hostname, changed public
URLs, the public URL of the verification key file and the generated IndexNow
key. Normal HTTP connection data, including the server IP address and user
agent, is also available to the endpoint. IndexNow states that participating
search engines share submitted URLs with one another. No WordPress user,
visitor profile or page-content body is intentionally submitted by this plugin;
URL paths and query strings can nevertheless contain information chosen by the
site operator.

Service documentation: https://www.indexnow.org/documentation

Terms and privacy information: https://www.indexnow.org/terms

== Installation ==

1. Upload the `scinet-indexnow` directory to `/wp-content/plugins/` or install a release ZIP.
2. Activate "scinet IndexNow".
3. Open Settings > IndexNow and review the external-service disclosure.
4. Explicitly enable the IndexNow transmission and save the settings.
5. Open the displayed key-file URL and confirm that it returns HTTP 200 with only the key.
6. Optionally import a sitemap belonging to the same website.

The importer reads at most 100 XML sitemap files and 50,000 URLs per run. Each
file is limited to 5 MB, redirects are not followed, and only HTTP(S) URLs for
the site's own hostname and normal web ports are accepted.

== Frequently Asked Questions ==

= Does the plugin send data automatically after activation? =

No. Outbound IndexNow submissions require an administrator to explicitly enable
the service under Settings > IndexNow. Updating from version 1.0.0 also pauses
submission until this choice is saved.

= Which data is sent to IndexNow? =

The public hostname, public URLs selected for submission, the verification-key
file URL, the generated public key and normal HTTP connection metadata are sent.
See the external-service section above for the provider links and sharing rules.

= Does IndexNow guarantee that a URL is indexed? =

No. A successful response only confirms receipt of the submission. Search
engines independently decide whether and when to crawl or index a URL.

= What happens when the plugin is deleted? =

Deactivation retains data. Submitted entries and terminal failures are removed
after 90 days. Under Settings > IndexNow, administrators can choose to delete
the queue table, generated key and plugin settings permanently when WordPress
deletes the plugin; the option is disabled by default to avoid unexpected loss.

= Which URLs can be submitted? =

Only HTTP and HTTPS URLs whose hostname matches the WordPress home URL are
accepted. URL fragments and deceptive user-information components are rejected
or removed. Administrators should avoid public URLs containing confidential or
personal information.

= Is the plugin completely free? =

Yes. All included functionality and regular updates remain free, without
paywalls, license keys, trials, quotas or paid feature unlocks. If the plugin is
useful, users can optionally say "DANKE" and support continued development at
https://www.scinet.eu/danke-sagen/. Support is voluntary and does not change the
available features or update access.

== Privacy ==

The plugin stores its generated IndexNow key, enablement and uninstall choices,
schema version and URL queue in the site's WordPress database. The queue
includes URL, status, event count, timestamps, attempt count, HTTP status and a
bounded error message. Verification keys reflected by a remote error are
redacted before storage. Submitted entries and failures without another retry
are removed after 90 days. It does not add visitor cookies, analytics or
telemetry.

Data is sent externally only when an administrator explicitly enables IndexNow
and WordPress does not discourage search engines.
See "External service: IndexNow" for the exact data, triggers and provider
links. Deactivation does not delete queue data or settings.

== Changelog ==

= 1.2.1 =

* Applied the confirmed GPL-2.0-or-later license with the complete license text.
* Hardened sitemap limit reporting, XML rejection and processing deadlines.
* Redacted verification keys in transport errors as well as HTTP error responses.
* Made the horizontally scrollable URL table a named keyboard-focusable region.
* Verified PHP 7.4 and upgrades from 1.1.0, with expanded security and integration tests.

= 1.2.0 =

* Added English source strings and a bundled German translation catalog for verified German and English administration.
* Made the verification-key file work independently of permalink mode and removed the guessable query-parameter shortcut.
* Canonicalized and revalidated URL batches, including ports, subdirectory scope, length and encoded traversal segments.
* Added owner-token queue claims so expired workers cannot overwrite a newer claim; invalid legacy rows no longer poison valid batches.
* Bounded sitemap imports by requests, unique URLs, response size, redirects and wall-clock time.
* Prevented duplicate content events, covered indexability and old-term-URL changes, and paused all submissions when search engines are discouraged.
* Added schema health repair, downgrade-safe version handling, bounded/redacted remote errors and 90-day terminal-history retention.
* Added an explicit, disabled-by-default option to remove all plugin data during deletion.
* Added a real WordPress release matrix, lifecycle/function tests, UI QA evidence and an itemized Plugin Check report for this candidate.

= 1.1.0 =

* Added explicit informed opt-in before any IndexNow transmission.
* Paused legacy 1.0.0 installations until an administrator reviews and saves the service setting.
* Documented the external endpoint, transmitted data, sharing behavior, terms and privacy implications.
* Added strict request typing, same-site URL checks and bounded, non-redirecting sitemap downloads.
* Improved admin labels, translated status text, responsive layout and accurate success/error notices.
* Fixed manual submission so one action creates only one queue event.
* Added multisite-aware activation, deactivation and new-site setup.
* Cleared cron jobs and processing locks while retaining settings and queue data on uninstall.
* Added identifier-safe SQL placeholders, protocol-key validation and an mbstring-independent error limit.
* Added release documentation, smoke tests and a reproducible `dist` build with SHA-256 verification; WordPress.org submission remains blocked until licensing is confirmed.
* Documented that all functionality remains free and added one unobtrusive, voluntary "DANKE sagen" link on the plugin settings page.

= 1.0.0 =

* Initial private version.

== Upgrade Notice ==

= 1.2.1 =

Adds the confirmed GPL license and improves sitemap/error handling. Existing settings and queue data are retained.

= 1.2.0 =

This update hardens key verification, sitemap imports and concurrent queue
processing. Existing valid settings and pending queue entries are retained;
terminal history is now retained for 90 days.

= 1.1.0 =

For privacy compliance, outbound submissions are paused after this update. Open
Settings > IndexNow, review the disclosure and explicitly enable the service.
Existing queue entries and settings are retained.
