=== Maintenance GENIUS ===
Contributors: 1001webca
Tags: maintenance, coming soon, under construction, maintenance mode, coming soon page
Requires at least: 6.4
Tested up to: 7.0
Requires PHP: 7.4
Stable tag: 2.9.132
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Professional maintenance & coming soon plugin: HD presets, countdown, AI assistant (BYOK), access tokens, cache-proof. Made in Québec.

== Description ==

**Maintenance GENIUS** is a professional maintenance mode and coming soon plugin built for developers, agencies, and site owners who need full control over their offline page — without sacrificing SEO or design.

Designed and developed in Québec (Canada) by [1001Web.ca](https://www.1001web.ca), Maintenance GENIUS gives you two distinct modes in one plugin:

* **Maintenance Mode** — HTTP 503 + noindex/nofollow. Tells search engines the downtime is temporary. Your rankings are protected.
* **Coming Soon Mode** — HTTP 200 + noindex meta only. Your site is crawlable by search engines while you build. Switch to maintenance when you need a hard block.

= Why Maintenance GENIUS? =

* **Two modes, one plugin** — Maintenance (HTTP 503) and Coming Soon (HTTP 200) with a single toggle. No need for two separate plugins.
* **SEO-aware** — Proper HTTP 503, Retry-After header, canonical link in Coming Soon mode, JSON-LD `SpecialAnnouncement` schema (Google-supported).
* **AI-ready** — Built-in AI assistant powered by Claude, unlimited and free with your own API key (BYOK). AI crawler support (GPTBot, ClaudeBot, PerplexityBot) included.
* **Mobile-first** — PWA meta tags, iOS home-screen integration. Toggle from your phone (PRO) — no WordPress login required.
* **Privacy-first** — GDPR mode (zero external requests), bcrypt visitor passwords, no tracking, no third-party data collection.
* **Cache-friendly** — Auto-installs a mu-plugin that bypasses WP Rocket, W3TC, LiteSpeed, WP Super Cache, WP Fastest Cache on activation.
* **Multilingual** — Fully translated in English (US) and French (France, Canada, Belgium). POT file included.

= Free Features =

* **Maintenance Mode** (HTTP 503) and **Coming Soon Mode** (HTTP 200) — switch with one click
* **Instant ON/OFF toggle** from the admin bar or dashboard
* **5 complete themes** (Sobre, Corporate, Festif, Lancement, Horizon) — one click applies colors, fonts, layout and animations
* **Full color customization** with gradients, opacity controls and overlay
* **Google Fonts typography** with live preview
* **Countdown timer** with auto-disable and 3 visual styles
* **AI assistant (BYOK)** — bring your own Anthropic API key, unlimited questions, your key never leaves your server
* **Visitor email signup** with notifications when site is back online
* **Visitor password access** with bcrypt hashing
* **Open Graph + Twitter Card** meta tags
* **JSON-LD Schema.org** (SpecialAnnouncement + WebSite)
* **PWA-ready** — theme-color, iOS/Android home screen support
* **Visit statistics** dashboard
* **Export/Import** all settings
* **Guided setup wizard**
* **Diagnostic tab** — 8 real-time checks (email delivery, DB write, HTTP 503, Cache Guard, mu-plugin, WP-Cron, Turnstile, server environment)
* **Fully translatable** — French (FR, CA, BE) and English included

= PRO Features =

* **Remote control** — toggle maintenance from your phone without WordPress login (PIN + token)
* **Access tokens** — unique time-limited links for clients and testers
* **Background image** with parallax effect
* **Lottie animations** support
* **Whitelist & Blacklist** — IPs, URLs, roles, user-agents, countries, referrers
* **Scheduled maintenance** with start/end dates and timezone
* **Cloudflare Turnstile** CAPTCHA on visitor login and notification forms
* **HD preset library** — 14+ professional designs with high-definition images and video backgrounds
* **WHMCS license management** for agencies

= Security =

* Visitor password hashed with **bcrypt** (not MD5)
* Subscriber IPs hashed with `md5(ip . wp_salt())` for GDPR alignment
* Remote control tokens stored encrypted (AES-256-CBC)
* Anthropic API key encrypted in database, never exposed
* Absolute 2-hour session cap for remote control sessions
* Nonce verification on all AJAX endpoints
* All output run through WordPress escaping functions

= Diagnostic Tab =

Run the 8-point analysis before going live:

1. **Email delivery** — sends a real wp_mail() test (rate-limited to 1/min)
2. **Database write** — verifies write/read roundtrip including Redis/Memcached invalidation
3. **HTTP 503 delivery** — self-request to confirm visitors actually see the maintenance page
4. **Cache Guard (mu-plugin)** — confirms the mu-plugin is in place to bypass cache plugins
5. **Cache plugin conflicts** — detects WP Rocket, W3TC, LiteSpeed, and 4 others
6. **WP-Cron** — checks if scheduling will work
7. **Cloudflare Turnstile** — validates keys against the Cloudflare endpoint
8. **Server environment** — PHP version, WordPress version, HTTPS, security salts

== Installation ==

1. Upload the plugin to `/wp-content/plugins/maintenance-genius/`
2. Activate through the **Plugins** menu in WordPress
3. Go to **Settings → Maintenance GENIUS**
4. Choose your mode: **Maintenance** (HTTP 503) or **Coming Soon** (HTTP 200)
5. Toggle ON from the admin bar

== Frequently Asked Questions ==

= What is the difference between Maintenance Mode and Coming Soon Mode? =

Maintenance Mode returns HTTP 503 (Service Unavailable) with noindex and nofollow — search engines treat it as a temporary outage and will not index the page. Coming Soon Mode returns HTTP 200 with a noindex meta tag only — search engines can crawl the page structure but will not index it. Use Maintenance for scheduled downtime, Coming Soon for pre-launch.

= Will my SEO rankings be affected? =

In Maintenance Mode, the HTTP 503 + Retry-After header tells search engines the outage is temporary. If the site is back online within a reasonable time (a few days), rankings are typically preserved. In Coming Soon Mode, HTTP 200 + noindex lets crawlers access the site without indexing it — no SEO impact.

= Can visitors access the site during maintenance? =

Yes. You can share a bcrypt-secured visitor password (free). PRO users can also whitelist or blacklist specific IPs, user roles, URLs, countries and user-agents, and create time-limited access tokens (unique links).

= Does it work with caching plugins? =

Yes. The plugin auto-installs a must-use plugin (Cache Guard) that intercepts requests before WP Rocket, W3TC, LiteSpeed Cache, WP Super Cache, WP Fastest Cache, and others. Run the Diagnostic tab to verify.

= Is it compatible with Cloudflare? =

Yes. If you use Cloudflare, make sure to exclude your homepage from full-page caching while maintenance is active. The Diagnostic tab will detect if a cache layer is bypassing the maintenance page.

= Does it support multisite? =

Basic compatibility is maintained. Full multisite management is on the roadmap.

= Where is the data stored? =

All settings are stored in `wp_options`. Subscriber emails are stored in a dedicated, non-autoloaded option using direct SQL writes (Redis-safe). No external database or API is required for core features.

== Screenshots ==

1. Admin dashboard — Maintenance Mode active with Lancement theme
2. Admin dashboard — Coming Soon Mode with Horizon theme
3. Frontend — maintenance page with countdown timer and email signup
4. General tab — mode selector (Maintenance / Coming Soon)
5. Appearance tab — complete themes grid
6. Diagnostic tab — 8-point analysis results
7. Access tab — whitelist, blacklist, visitor password, access tokens

== Upgrade Notice ==

= 2.9.128 =
AI assistant is now unlimited in the free version when using your own Anthropic API key (BYOK). No daily limit applies — your key, your usage. Upsell prompts removed from AI chat.

== External Services ==

This plugin connects to the following external services in specific circumstances:

**1. Anthropic API** (AI assistant — BYOK, requires your own API key; unlimited in both free and PRO versions)
- URL: https://api.anthropic.com/v1/messages
- When: Only when the AI chat assistant is used and an API key is configured (BYOK)
- Data sent: Your question and plugin context (no personal visitor data)
- Privacy policy: https://www.anthropic.com/privacy
- Terms of use: https://www.anthropic.com/legal

**2. Cloudflare Turnstile** (optional — bot protection)
- URL: https://challenges.cloudflare.com/turnstile/v0/siteverify
- When: Only when Turnstile is enabled and a visitor submits a form (subscriber signup or visitor access)
- Data sent: Turnstile token for server-side verification
- Privacy policy: https://www.cloudflare.com/privacypolicy/

**3. Google Fonts** (optional — typography)
- URL: https://fonts.googleapis.com
- When: Only when GDPR mode is disabled and a Google Font is selected for the maintenance page
- Data sent: Font family name; visitor IP is sent to Google servers
- Note: Enable GDPR mode to use system fonts and avoid any request to Google
- Privacy policy: https://policies.google.com/privacy

**4. 1001Web.ca License Server** (PRO feature — license validation)
- URL: https://client.1001web.ca/modules/servers/licensing/verify.php
- When: Only when a PRO license key is entered and during periodic license checks (every 24 hours)
- Data sent: License key, site domain, server IP
- Privacy policy: https://www.1001web.ca/privacy

**5. Maintenance GENIUS Update Server** (version check)
- URL: https://maintenancegenius.ca/api/version.json
- When: Only when an administrator manually clicks "Check for updates" in the plugin's admin screen
- Data sent: No plugin or site data is transmitted; this is a plain GET request to retrieve the latest published version number
- Privacy policy: https://www.1001web.ca/privacy

No data is collected by this plugin and sent to external services without the conditions described above being met.

== Changelog ==

= 2.9.132 =
* New : guided assistance — a four-step wizard walks you through reporting a problem in plain language. Pick what went wrong, describe it, confirm your email, send. No technical knowledge required.
* Every request automatically includes a system report (plugin version, WordPress, PHP, theme, active plugins, cache plugins, diagnostic results) so support can help without a round of questions. The report is shown before sending and never contains API keys, passwords or subscriber data.
* If your server cannot send email, the report is offered for copy-paste with a direct link to the ticket form — you are never left stuck.

= 2.9.131 =
* New : update notifications — the plugin now silently checks for new versions once a day and lets you know three ways: a pulsing version badge in the plugin header (click it for the changelog and download link), a counter on the admin menu, and a dismissible notice on the WordPress dashboard. Dismiss once and everything stays quiet until the next release.
* The check is lightweight (one tiny request per day), requires no WP-Cron, and automatically steps aside in favor of native WordPress updates when the plugin is installed from WordPress.org.

= 2.9.130 =
* i18n : repaired 108 corrupted translation strings per French locale (fr_CA, fr_FR, fr_BE) — orphan continuation lines were silently concatenated by msgfmt, duplicating descriptions throughout the admin UI
* i18n : fixed typo « MÊIE » → « MÊME » (whitelist/blacklist descriptions), mistranslation of "Cache plugin detected", and the test-email subject line — all three French locales recompiled
* Compliance (WP.org guideline 10) : the frontend "Powered by 1001Web™" credit is now strictly opt-in — hidden by default for everyone, with a free opt-in checkbox in Advanced → Credits and in the setup wizard's final step. Credit removal is no longer a PRO feature.
* Accuracy : AI assistant claims harmonized everywhere (readme, admin UI, wizard, chat system prompt) — unlimited and free with your own API key (BYOK), matching the actual behavior since 2.9.128

= 2.9.129 =
* WP.org compliance: declared the update-check endpoint (maintenancegenius.ca/api/version.json) in the External Services section — no functional change

= 2.9.128 =
* Free: AI assistant is now unlimited when using your own API key (BYOK) — the 5/day limit was artificial since the key belongs to the user
* Fix: Removed upsell prompts for Rapports GENIUS and Uptime GENIUS from the AI chat — these products are not yet available for purchase
* Fix: Updated outdated comment in class-chat.php suggesting a server-managed API key existed

= 2.9.127 =
* Fix: Applying a preset or theme could silently disable maintenance mode on servers with a persistent object cache (Redis/Memcached). All admin save handlers now read a guaranteed-fresh copy of settings from the database before writing.

= 2.9.126 =
* Free : Countdown timer is now completely FREE (3 visual styles, auto-disable) — no license required
* Free : AI assistant available in free version with your own Anthropic API key (BYOK) — 5 questions/day, unlimited in PRO
* Accuracy : feature lists (Free/PRO) now match the plugin exactly — background image, Lottie, whitelist/blacklist and scheduled maintenance are PRO features
* Removed : uptime monitoring references (available as a separate product)

= 2.9.125 =
* Compliance : DotLottie player is now bundled locally (no external CDN request) — WordPress.org guideline 8
* AI assistant : BYOK only — without an API key the chat is disabled with a clear message and makes zero network requests
* Removed : proxy routing code (unused endpoint) — your API key and your data never leave your server
* Improved : clearer 401/403 error message pointing to the AI tab

= 2.9.124 =
* Fix : JSON-LD SpecialAnnouncement — valeur `category` invalide remplacée par un texte valide (Google Rich Results)
* Sécurité : 16 sorties enveloppées dans esc_attr()/esc_html() (conformité Plugin Check)
* Code : numéros de version synchronisés dans tous les fichiers
* Code : commentaire d'architecture obsolète corrigé

= 2.9.123 =
* readme.txt : section External Services ajoutée (obligatoire WP.org)
* readme.txt : section Upgrade Notice ajoutée
* Code : 190 commentaires de dev supprimés (code production pur)

= 2.9.122 =
* Fix : Tested up to mis à jour vers WordPress 7.0


= 2.9.121 =
* WP.org : readme.txt complet (description Coming Soon, FAQ enrichie, tags mis à jour)
* WP.org : Tested up to WordPress 6.8
* Amélioration : description courte et longue mises à jour pour refléter le mode Coming Soon

= 2.9.120 =
* Badge admin bar vert distinct en mode Coming Soon
* Label header dynamique (MAINTENANCE MODE / COMING SOON MODE)
* Meta canonical automatique en Coming Soon
* Thème Horizon affiché en tête de grille en mode Coming Soon
* Suppression des 29 flags fuzzy FR (strings exclues du .mo corrigées)

= 2.9.119 =
* Nouveau : mode Coming Soon (HTTP 200 + noindex) — différent du mode Maintenance (HTTP 503)
* Nouveau : toggle Maintenance / Coming Soon dans l'onglet Général
* Nouveau : thème Coming Soon « Horizon » dédié
* Nouveau : admin bar affiche le mode actif (MAINTENANCE / COMING SOON)
* Fix : strings Diagnostic non traduites (flag fuzzy retiré)
* Fix : section EFFETS visible en mode Simple (data-mg-level manquant)
* Fix : 4 erreurs Plugin Check (esc_attr sur variables CSS inline)
* Fix : en_US complet — 1097 strings passthrough + header UTF-8


= 2.9.118 =
* New: Complete Themes system — 4 one-click themes (Sobre, Corporate, Festif, Lancement) that apply a full visual configuration: colors, fonts, layout, animations and container style. Designed for non-technical users, themes appear first in the Design tab.
* New: Automatic snapshot before each theme application — the previous design is saved to a dedicated non-autoloaded option (direct SQL write, pattern S2) and can be restored with a single click via the "↩ Revert Theme" button. Snapshot is overwritten when a second theme is applied (documented behavior).
* New: Theme Lancement activates the countdown only when no target date exists yet; a specific toast message guides the user to configure the date.
* New: Active theme badge displayed on the applied theme card; badge cleared after a manual design change (via AJAX response).

= 2.9.117 =
* Fix: Access token creation was completely broken — clicking « Create token » opened an empty success modal without ever sending a request (the JavaScript was written for a form modal that never existed in the template). The inline form (name + duration) is now properly wired to the creation endpoint; the success modal shows the real shareable link.
* Fix: The active tokens list read from a settings key that was never written; it now reads from the actual token storage, and the JavaScript renderer targets the real list markup instead of a nonexistent table.
* Fix: Token writes are now verified (same silent object-cache failure class fixed for subscriber emails in 2.9.115) — a database failure returns a clear error instead of handing out a link that does not work.
* UX: When statistics tracking is disabled but historical data exists, the dashboard now displays a note clarifying that the numbers are historical and new visits are no longer counted.

= 2.9.116 =
* New: 🩺 Diagnostic tab — an 8-point health check that verifies your site can actually deliver what the plugin promises: email sending (real test), verified database writes (detects silent Redis/object-cache failures), maintenance page actually served with the right HTTP status (detects cache layers bypassing the plugin), Cache Guard mu-plugin presence, cache plugin conflicts, WP-Cron, Turnstile keys and endpoint, server environment. Every failed check comes with a one-sentence fix.
* New: Contextual diagnostic badges next to each related section (Notifications, Countdown, Turnstile, Statistics, maintenance toggle) — read the last scan results instantly, click to jump to the relevant check.
* New: Issue counter pill on the Diagnostic tab and a dismissible critical banner (MG pages only) when a failure breaks a core promise, e.g. email collection enabled while the site cannot send emails.
* New: On-demand test email button (rate-limited to one per minute) to verify deliverability before collecting subscribers.

