=== SwapAds Client ===
Contributors: swapads, robinsec
Tags: backlinks, barter, exchange, seo, monetization
Requires at least: 6.5
Tested up to: 6.6
Requires PHP: 8.1
Stable tag: 1.6.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Connect your WordPress site to the SwapAds network for 1:1 barter of high-quality backlinks.

== Description ==

SwapAds is a 1:1 backlink barter network for WordPress site operators.

**How it works:**

* You install the SwapAds client plugin on your WordPress site
* You define your site audience (niche + sub-niche + geo) in the Setup tab
* SwapAds matches you with partner sites in similar niches
* You approve partner backlinks to show on your site; they approve yours
* Both sites earn "balance" credits for each backlink shown
* Use credits to get your backlinks featured on partner sites

**Y1 free tier** (12 months): No payment required during the early adopters program. Operate on a pure barter basis.

**Key features:**

* **My Backlinks** dashboard — see all the backlinks YOU show, with clickable source URLs, view/click stats, and per-row actions (Retract, Reactivate, Delete, Recheck)
* **Partner Links** dashboard — see incoming backlink suggestions from partner sites and the backlinks currently displayed on your site, with Unapprove control
* **Activity Log** — every credit transaction is auditable; clickable backlink URLs for full traceability
* **Auto-detect uninstall** — when you deactivate the plugin, the SwapAds server immediately pauses your license and stops sending partner backlinks
* **Backlink shortcode + Gutenberg block** — display approved partner backlinks via `[swapads-backlinks]` shortcode or the `swapads/backlinks` block
* **Site audience self-declaration** — pick from 15 niches and 145 sub-niches across adult, mainstream, iGaming, cannabis, crypto
* **Geo targeting** — NA, EU, UK, APAC, LATAM, WW buckets

**Privacy & Security:**

* No tracking pixels added to your site (the client does not modify your front-end output beyond the explicit shortcode/block you place)
* HMAC-signed API requests (SHA-256, time-limited nonces, replay protection)
* Encrypted credentials at rest (sodium_crypto_secretbox with LOGGED_IN_KEY)
* Per-IP rate limits on all write endpoints
* Full audit trail (180-day retention)
* License auto-pause if your site goes silent for >24 hours
* License auto-pause on plugin deactivation

== Installation ==

1. Upload the plugin to `/wp-content/plugins/swapads-client/` or install via the WordPress Plugin Installer
2. Activate the plugin through the "Plugins" menu in WordPress
3. Visit "SwapAds Setup" in the admin sidebar (it appears as a top-level menu during initial setup)
4. Enter your license key (provided by the SwapAds operator dashboard)
5. Configure your site audience (niche + sub-niche + geo + monthly traffic)
6. Wait for partner suggestions to appear (typically 1-24 hours after setup)
7. Review and approve partner backlinks in "SwapAds → Backlinks → Partner Links"

== Frequently Asked Questions ==

= How does SwapAds differ from a paid backlink service? =

SwapAds is a pure barter network — you give backlinks to partners in exchange for getting backlinks from partners. No money changes hands during Y1.

= Will SwapAds modify my existing content? =

No. The client only renders backlinks where you explicitly place the `[swapads-backlinks]` shortcode or the `swapads/backlinks` Gutenberg block. Nothing else is changed.

= What happens if I deactivate the plugin? =

The SwapAds server is notified within seconds and your license is paused. Your partner backlinks stop showing on your site. Your data is retained (90-day grace period) so re-activating is seamless.

= How long until I get my first partner backlink? =

Most sites receive their first suggestion within 24 hours of setup. Approval is manual (you choose which partners to work with).

= Is this GDPR-compliant? =

Yes. No third-party tracking is added. The only data sent to the SwapAds server is your site's URL, your declared audience (niche/geo), and HTTP request metadata required for API authentication.

= What if my niche is adult / iGaming / cannabis? =

SwapAds supports adult (15 sub-niches), iGaming (9 sub-niches), and cannabis (8 sub-niches) as first-class niches. The matching algorithm respects niche boundaries (you only see partners in compatible niches).

== Screenshots ==

1. Setup wizard (first install)
2. My Backlinks dashboard with clickable source URLs
3. Partner Links review with approve/reject actions
4. Activity Log with full transaction history

== Changelog ==

= 1.6.0 - 2026-08-02 =
* New: Backlinks 2-tab UX (My Backlinks + Partner Links) — per Robin's request 2026-08-02
* New: Setup moved to top-level menu (no longer buried in SwapAds submenu)
* New: Activity log shows clickable backlink URL for each event
* New: 4 per-row actions on My Backlinks (Retract / Reactivate / Delete / Recheck)
* New: Partner Links approved grid with click/view stats + Unapprove action
* Security: 0 hardcoded dev/staging URLs in production source
* Dev: New Http\Request::input* helper (all 33 superglobal reads use wp_unslash)
* Dev: New Http\Redirect::to() helper (centralizes wp_safe_redirect + exit guard)

= 1.5.9 - 2026-08-01 =
* New: API hardening (encrypted options, statistics flush endpoint, license webhook)
* New: F238+ per-backlink controls (pause/activate/delete)
* New: Y1.5+ niche taxonomy expansion (15 niches, 145 sub-niches)
* Fix: Indexation pages URL column empty / system health "22/16" / cron frequency
* Fix: Duplicate top-level menu / onboarding menu persistence / source-check 401

= 1.5.0 - 2026-07-26 =
* Initial public release
* My Backlinks (source-check) dashboard
* Partner Backlinks (review-suggestions) dashboard
* Site audience self-declaration
* Backlink shortcode + Gutenberg block
* Activity Log + statistics flush

== Upgrade Notice ==

= 1.6.0 =
UI rework for early adopters program. All existing data is preserved. No re-configuration required.

== Third-party services ==

This plugin connects to a SwapAds server (default: `https://swapads.eu`). The server URL can be overridden in your `wp-config.php` via the `SWAPADS_SERVER_URL` constant. The plugin makes the following requests to the server:

* `POST /wp-json/swapads-server/v1/license/activate` (once, on setup)
* `POST /wp-json/swapads-server/v1/auth/heartbeat` (twice daily, cron-triggered)
* `POST /wp-json/swapads-server/v1/backlinks/list` (when admin views My Backlinks page)
* `POST /wp-json/swapads-server/v1/backlinks/approvals` (when admin views Partner Links page)
* `POST /wp-json/swapads-server/v1/audience/set` (when admin saves audience settings)

No data is sent to any other third party.

== Source ==

Source code is available at https://github.com/RobinSEC/swapads

== Support ==

* Documentation: https://swapads.eu/operators/docs
* Issue tracker: https://github.com/RobinSEC/swapads/issues
* Email: support@swapads.eu

== Privacy policy ==

See https://swapads.eu/privacy for the full privacy policy. In summary:

* We collect your WordPress site URL, declared audience (niche + geo), and HTTP request metadata
* We do NOT collect: visitor IP addresses (we hash them), browser fingerprints, third-party cookies, or any visitor tracking data
* We do NOT use third-party analytics, tracking pixels, or ad networks
* All data is stored on EU-hosted servers (Hostinger, Netherlands)
* Data retention: 180 days for audit logs, 90 days grace for inactive licenses