=== EUComply — EU Compliance Audit ===
Contributors: mahope
Donate link: https://mahope.github.io/auditedwp
Tags: compliance, gdpr, nis2, eaa, dora, audit, security, privacy, cookies, ssl, backup, imprint, legal, accessibility
Requires at least: 5.8
Tested up to: 6.8
Requires PHP: 7.4
Stable tag: 1.2.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Know your WordPress site's EU compliance status in 30 seconds — from your admin dashboard. Six checks: SSL, cookies, forms, backups, plugins, legal pages. Free. Pro ($79/yr) generates DPA documents, NIS2 vendor clauses, and EAA statements.

== Description ==

EUComply scans your WordPress installation against **six EU compliance criteria** in a single click. No external services — all checks run server-side on your own WordPress.

= What it checks =

1. **🔒 SSL & HTTPS** — Valid certificate? HSTS header? Mixed content warnings?
2. **🍪 Cookie Consent** — Cookie banner active? WP Consent API registered? GDPR-compliant script blocking?
3. **📋 GDPR Forms** — Form plugins detected? Privacy Policy linked? Consent checkbox required?
4. **💾 Backup Status** — Backup plugin active? Last backup age? Off-server storage configured?
5. **⚠️ Plugin & Core Health** — Outdated plugins? WordPress version current? Unmaintained extensions?
6. **📄 Legal Pages** — Privacy Policy assigned? Imprint/Impressum present? EAA Accessibility Statement published?

= How it works =

1. Install the plugin from wp.org or upload the zip.
2. Activate it. The admin menu now shows "EUComply".
3. Click "Run scan now" — results appear in seconds.
4. Review pass/fail status with fix guidance for each check.
5. Let the weekly automated cron re-scan your site. New results appear automatically.

= Free vs Pro =

| Feature | Free | Pro ($79/yr) |
|---|---|---|
| Compliance scan dashboard (6 checks) | ✓ | ✓ |
| Pass/fail with fix guidance | ✓ | ✓ |
| Weekly automated re-scan | ✓ | ✓ |
| GDPR Data Processing Agreement (Art. 28) | — | ✓ |
| NIS2/DORA vendor clause set (5 clauses) | — | ✓ |
| EAA Accessibility Statement | — | ✓ |
| Quarterly compliance report | — | ✓ |
| Agency name branding in reports | — | ✓ |
| Gumroad license validation + refund auto-revoke | — | ✓ |

= Why another compliance plugin? =

Cookie banners and backup plugins solve one problem each. EUComply is different: it's a **central compliance monitor** that checks six dimensions and **generates the documents you need** — DPA agreements, NIS2 clauses, and accessibility statements.

**No data leaves your site.** Other compliance plugins phone home. EUComply runs everything locally. The only external call is Pro license validation (key check, zero site data).

= Who is this for? =

- **Agency owners** managing 5–50+ client sites. Know every site's compliance status without logging into each one individually.
- **Freelancers** who need GDPR-compliant forms and legal pages for client projects.
- **EU-based businesses** that must comply with NIS2, DORA, the European Accessibility Act, and GDPR — often simultaneously.
- **WordPress site owners** who want a quick compliance audit without hiring a consultant.

== Installation ==

1. Upload the `eucomply` folder to `/wp-content/plugins/` via FTP, or go to Plugins → Add New and search for "EUComply".
2. Activate the plugin through the 'Plugins' screen in WordPress.
3. Go to EUComply in your admin menu and click "Run scan now".

That's it. No configuration required for the free scan. Pro users enter their license key in EUComply → Settings.

== Frequently Asked Questions ==

= Does the plugin send data to external servers? =

No. Every compliance check runs entirely inside your WordPress installation. No telemetry, no analytics, no site data is transmitted. The **only** external call is the Pro license validation, which sends a license key (not site data) to the Gumroad API.

= How is this different from Complianz, CookieYes or WP Activity Log? =

Those plugins solve one compliance problem (cookies or audit logs). EUComply combines **six compliance dimensions** in one plugin, plus **document generation** — DPA agreements, NIS2 vendor clause sets, and EAA accessibility statements. It's a compliance monitor that also produces the paperwork.

= Can I white-label reports for my clients? =

Yes. Pro users set their agency/business name in Settings, and generated reports carry that name. A white-label upgrade without the "Generated by EUComply" footer is available for agencies managing 10+ sites.

= Is the generated DPA legally binding? =

The DPA follows the standard GDPR Article 28 structure used across the EU — it's the same template law firms and compliance consultants use. We recommend having a lawyer review the filled-in agreement for high-value contracts. The plugin gives you a correct starting point, not a substitute for legal advice.

= What happens if I cancel my Pro subscription? =

The plugin continues in Free mode. Dashboard scans and weekly re-scans remain active. Document generation and quarterly reports stop. No data is deleted — your license key simply reverts to free functionality.

= My site is in Germany. Does this help with the Telemediengesetz (TMG)? =

Yes. The "Legal Pages" check verifies you have an Imprint/Impressum page as required under TMG §5. The Pro EAA statement covers the Barrierefreiheitsstärkungsgesetz (BFSG) effective June 2025.

= Does this work on multisite? =

The checks run on a per-site basis within a network. Pro licenses are per-site. A network-wide license option is planned for a future release.

= Can this replace a proper security audit? =

No. EUComply checks compliance posture, not security vulnerabilities. Use dedicated security plugins (Wordfence, Sucuri) for penetration testing and firewall protection. EUComply augments — it doesn't replace — security tooling.

== Screenshots ==

1. EUComply admin dashboard showing six compliance checks with pass/fail status.
2. Settings page with Pro license key input and agency name.
3. Pro document generation table — DPA, NIS2, EAA, and quarterly report.

== Changelog ==

= 1.2.0 (2026-08-23) =

* **New**: uninstall.php — full option cleanup when plugin is deleted.
* **New**: Activation guard — prevents activation on PHP < 7.4 or WP < 5.8 with clear error message.
* **Fixed**: SSL check now handles empty or malformed site URLs without causing PHP notices.
* **Fixed**: readme.txt overhauled with proper wp.org sections, upgrade notice, and detailed FAQ.

= 1.1.0 (2026-08-23) =

* **New**: Gumroad license API integration with daily verification and refund detection.
* **New**: Auto-update checker via update.json manifest (works before wp.org listing).
* **New**: Pro document generation — DPA, NIS2/DORA clause set, EAA statement, quarterly report.
* **New**: Agency name setting for white-label report branding.
* **Improved**: License validation UX showing activation status in settings.
* **Fixed**: All URLs now point to the official GitHub Pages site.

= 1.0.0 (2026-08-20) =

* **Initial public release.**
* Six compliance checks: SSL, cookies, forms, backups, plugins, legal pages.
* Weekly automated re-scan via WP-Cron.
* AJAX-powered scan from admin dashboard (no page reload).
* Pro license system with product ID placeholder for future Gumroad integration.

== Upgrade Notice ==

= 1.2.0 =
Upgrade for the automatic cleanup (uninstall.php), activation guard (no silent failures on old PHP/WP), and a polished readme.txt for wp.org listing. Update from Plugins → Installed Plugins or download the latest zip.

= 1.1.0 =
Upgrade to 1.1.0 for Gumroad license API integration with refund detection, auto-update checker from the official manifest, and full Pro document generation (DPA, NIS2, EAA, quarterly reports). The plugin checks for updates automatically — update from Plugins → Installed Plugins or download the latest zip.