=== Inclusive Forge – Accessibility Statement for WooCommerce ===
Contributors: avakodeforge
Donate link: https://inclusiveforge.com
Tags: accessibility, accessibility-statement, wcag, woocommerce, eaa
Requires at least: 6.5
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.2.1
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Verify site ownership for Inclusive Forge and publish your accessibility statement with a shortcode or block. No front-end JavaScript.

== Description ==

**Inclusive Forge** audits European online stores against WCAG 2.1 AA and EN 301 549, records what was found and what was fixed, and publishes an accessibility statement from that record. The audit, the evidence log and the statement live in your Inclusive Forge account. This plugin is the small piece that has to run on your site, and it does exactly three things:

1. **Proves you own the site.** It adds `<meta name="inclusiveforge-verify" content="…">` to your `<head>`. Our scanner reads that tag before it audits anything, so a site is never scanned on the word of whoever filled in a form.
2. **Publishes your accessibility statement.** The `[inclusiveforge_statement]` shortcode and the matching block render the statement you published in Inclusive Forge. The document is fetched over HTTPS and cached locally for 12 hours, so no visitor ever waits on a network request.
3. **Shows your last scan, right in wp-admin.** A "Last scan" card on the settings screen and a dashboard widget show the score, open and closed findings, and the date — filled in automatically when a scan finishes, no page refresh needed.
4. **Lets you ask for a re-test.** A "Re-test now" button on the settings screen asks Inclusive Forge to scan the site again; your plan's monthly allowance is enforced by Inclusive Forge, and the button tells you exactly how many re-tests you have left.
5. **Checks that verification is actually working.** The settings screen fetches your own home page and confirms the verification tag is really there — not just emitted — and flags known cache/optimisation plugins that sometimes strip it.
6. **Gives you one settings screen.** Site token, webhook secret, statement language, verification status, and a button to refresh the cached statement.

= What this plugin deliberately does not do =

* **No overlay.** It never modifies, re-labels or "corrects" your pages in the browser. Accessibility overlays are widely rejected by disabled users and by regulators; real fixes belong in your theme and templates, and Inclusive Forge reports them there.
* **No JavaScript and no CSS on your storefront.** Not one script, not one stylesheet, not one inline style. The statement is plain server-rendered HTML that inherits your theme. The only JavaScript in this plugin runs in the block editor, so the block can appear in the inserter.
* **No scanning from inside your site.** Nothing crawls your pages from your own server, and there is no background job competing with your store for resources.
* **No tracking and no analytics.**

= Honest scope =

An automated scan detects a portion of WCAG 2.1 AA issues, not all of them, and no plugin can make a website accessible on its own. Inclusive Forge sells a documented process — scan, fix, re-test, evidence log, statement — not a compliance guarantee. This plugin and the Inclusive Forge service do not provide legal advice; talk to a qualified adviser about your obligations.

== Third-Party Services ==

This plugin connects to one third-party service. It is not optional: without it there is no statement to render.

* **Inclusive Forge API** (https://app.inclusiveforge.com) — hosts your accessibility statement, verifies site ownership, and runs the scans this plugin reports on.
  * **What is sent:** your Inclusive Forge site token (in the request path) and your site address (in the `User-Agent` header of the request). When you press "Re-test now", a signed, empty request authenticated with your webhook secret asking the scan to be run again. Nothing else — no post content, no order data, no customer data, no visitor IP addresses, no administrator details.
  * **When it is sent:** only when a cached statement is missing or older than 12 hours and a page containing the shortcode or block is rendered, when a failed request is retried (at most once every 15 minutes), when you open the plugin's settings screen, when you press "Refresh statement cache", and when you press "Re-test now".
  * **What comes back:** the HTML of your published accessibility statement, or an error saying the site is unknown or not verified yet; a re-test request answers with an accepted scan or a named reason it was refused, including your remaining monthly allowance.
  * **What this address sends back to your site, unprompted:** when a scan it ran finishes, it calls your site's own REST API (`/wp-json/inclusiveforge/v1/scan-completed`) with the score, the open/closed finding counts, the date, and a link back to the full report. This plugin verifies a cryptographic signature on that request, using the same webhook secret, before storing anything from it — an unsigned or incorrectly signed request is rejected and changes nothing on your site.
  * The endpoint address can be overridden for staging by defining `INCLUSIVEFORGE_API_BASE` in `wp-config.php`.
  * Terms: https://inclusiveforge.com/terms — Privacy: https://inclusiveforge.com/privacy

Your site token is also published in the verification meta tag in your site's `<head>`, which is what makes ownership checkable from outside. It identifies the site to Inclusive Forge; it does not grant access to your Inclusive Forge account. The webhook secret is a separate value, used only to authenticate the scan-completed notice and the re-test request in both directions; it is never displayed anywhere on your storefront.

The plugin's own "verification health" check on the settings screen fetches your site's own home page — not a third-party request, since it never leaves your server — to confirm the verification tag actually reaches visitors.

== Installation ==

1. Upload `inclusiveforge` to `/wp-content/plugins/`, or install it from Plugins → Add New.
2. Activate the plugin.
3. Go to **Settings → Inclusive Forge** and paste the site token from your Inclusive Forge dashboard.
4. Start the verification check from your Inclusive Forge dashboard. The status on the settings screen turns green when it passes.
5. Add `[inclusiveforge_statement]` to your accessibility statement page, or insert the **Accessibility Statement** block.

== Frequently Asked Questions ==

= Do I need an Inclusive Forge account? =

Yes. The plugin is a companion to the Inclusive Forge service: it verifies your site and displays a statement produced there. On its own it has nothing to show.

= Does this plugin make my site accessible? =

No, and be wary of any plugin that says it does. Accessibility is fixed in your theme, templates and content. Inclusive Forge finds issues, tracks them until they are fixed, and documents the process; the fixes are real changes to your site.

= Is this an accessibility overlay? =

No. Nothing from this plugin runs in your visitors' browsers. It adds one meta tag and, on the page where you place it, the HTML of your statement.

= Will it slow down my store? =

No. The statement is cached for 12 hours in a WordPress transient, and a failed request is cached for 15 minutes, so a page view never blocks on our API. Pages without the shortcode or block make no request at all.

= What happens if your API is unreachable? =

It depends on why. If your site token and language are fine but our servers just did not answer (a timeout, for example), visitors see a plain link to your statement on our own domain instead — their browser can often reach it even when ours could not reach yours. If the problem is a configuration one instead (no token, site not verified, an unrecognised token or language), visitors see nothing at all — no error, no empty box, no PHP warning — and if you are logged in as an administrator, you see a short note explaining what is wrong.

= Where does the statement HTML come from? =

From the statement you published in Inclusive Forge, for the language you selected. It is filtered through `wp_kses_post()` before it is printed, so it cannot introduce scripts or styles into your site.

= Can I show the statement in another language? =

Yes. Set the default language on the settings screen, or override it per placement: `[inclusiveforge_statement locale="de"]`. English, German and French are available.

= What is deleted when I remove the plugin? =

All of its options (including the webhook secret and the last-scan summary) and its cached statements. Your Inclusive Forge account, scans and evidence log are untouched — delete those from your dashboard.

= What does "Re-test now" actually do? =

It asks Inclusive Forge to scan this site again immediately, instead of waiting for the monthly schedule. This plugin does not decide whether you are allowed one: Inclusive Forge checks your plan's monthly allowance and either starts the scan or refuses with a named reason (for example, the monthly limit is used up, or a scan is already running), and either way this plugin only displays that answer.

= Can other plugins react when a scan finishes? =

Yes. This plugin fires a `inclusiveforge/scan_completed` action (with the score, the finding counts — open, and closed split into marked fixed / accepted risk / false positives — the finish date and the report URL as arguments) every time a signed scan-completed notice is verified and stored. Automation plugins — Flow Forge, for example — can hook it directly.

= How does the plugin know if verification is really working? =

The settings screen fetches your own home page, right then, with caching disabled, and looks for the verification tag in the response — the same tag Inclusive Forge's own scanner looks for. If it is missing even though a site token is configured, the screen also lists any installed cache or optimisation plugin known to sometimes strip or rewrite the `<head>` section, as a plain hint about where to look.

== Changelog ==

= 1.2.1 =
* Change: the "Last scan" card and the dashboard widget no longer show one "Closed findings" number. Closed findings are three different facts about a store — marked fixed, accepted risk, false positives — and a single total read as "all of this is fixed". The `inclusiveforge/scan_completed` counts array carries the same three keys; `closed` stays as their sum.
* Fix: the webhook secret now has somewhere to come from. Open "Accessibility statement" in your Inclusive Forge dashboard and click "Connect the companion plugin" to generate it, then copy it (and the site token next to it) into the field below — 1.2.0 shipped the field with no way to get a value for it.
* Fix: `inclusiveforge/scan_completed` no longer fires a second time for the same scan when the portal has to retry a delivery that timed out or was lost.
* Fix: the verification health check no longer re-fetches your home page on every visit to the settings screen (the answer is now cached for a few minutes) and no longer follows a redirect while checking it, so a redirecting home page cannot report a stale "visible" result.

= 1.2.0 =
* New: signed "scan completed" notice from Inclusive Forge — drops the statement cache and stores a "last scan" summary (score, open/closed findings, date) the moment a scan finishes.
* New: "Last scan" card on the settings screen and a matching wp-admin dashboard widget, both reading that same summary.
* New: "Re-test now" button on the settings screen. Inclusive Forge alone decides whether your plan's monthly allowance permits it; this plugin only shows the answer, including how many re-tests are left this month.
* New: verification health check on the settings screen — fetches your own home page to confirm the verification tag is actually there, and flags known cache/optimisation plugins that can strip it.
* New: `inclusiveforge/scan_completed` action for other plugins to hook.
* New: a "Webhook secret" field, alongside the site token, authenticating the scan-completed notice and the re-test request in both directions.

= 1.1.0 =
* New: if the plugin's own fetch to Inclusive Forge fails but your site token is fine, visitors now see a plain link to the hosted statement on inclusiveforge.com instead of nothing at all.
* Fix: an unrecognised configured language or a blocked API address now show the administrator-only setup note instead of a link that would 404 for visitors.

= 1.0.0 =
* Initial release: verification meta tag, `[inclusiveforge_statement]` shortcode, Accessibility Statement block, and the settings screen.
