=== Church Growth Plugin ===
Tags: search console, seo, church, analytics, content planning
Requires at least: 5.8
Requires PHP: 7.4
Stable tag: 0.9.19
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

See read-only Google Search performance inside WordPress and plan up to five blog opportunities using your site's reported search queries.

== Description ==

Church Growth Plugin is an administrator-only dashboard for a Google Search Console property you have access to. It displays impressions, clicks, click-through rate (CTR), and average position for a recent 28-day period, five reported search queries, and up to five rule-based blog title suggestions derived from reported queries. It checks published WordPress posts and pages for possible related content. It does not publish content, conduct a site audit, estimate keyword search volume, or promise rankings.

Two connection methods currently exist. For private pilot sites registered, Google-authorized and paired by the e-Church Digital hub administrator, the hub can supply approved-property read-only reporting without local Google OAuth credentials. Private-pilot website registration and pairing can be initiated by a WordPress administrator only when the hub administrator explicitly enables this feature. Google authorization can be started by a paired WordPress administrator through the private-pilot hub flow. An invitation-only beta registration screen is available with a hub-issued code when redemption has been enabled for controlled tests. The legacy private-pilot route remains available for existing testers. Public unrestricted onboarding is NOT yet available. Alternatively, a site administrator can configure a local Google OAuth client, enable the Search Console API, and authorize a Search Console property directly.

= External service and data disclosure =

This plugin communicates directly with Google's services only when an administrator configures or uses the Google connection. OAuth authorization uses accounts.google.com; code exchange and token refresh use oauth2.googleapis.com; Search Console property listings and performance reports use www.googleapis.com. During authentication Google receives the OAuth client ID, requested read-only scope, redirect URL, and state. Google receives authorization codes or refresh tokens during token exchange and an access token during API requests. Search Console requests include the chosen property and requested date range. When using direct reporting, requests go to Google rather than the plugin author. When hub reporting is enabled, the plugin sends its exact WordPress home URL, matching approved Search Console property, opaque site identity, timestamp and HMAC signature to https://connect.echurchdigital.com/wp-json/cgch/v1/private/report. The hub uses that site’s separately authorized Google connection, then returns Search Console report totals and queries to the paired site. The hub stores Google OAuth refresh tokens and site-specific pairing credentials; Google tokens are not returned to the public plugin. Both the hub and site cache/store information under their respective WordPress installations. This is a private pilot and the public external-service disclosure and privacy policy must be finalized before WordPress.org submission. Consult Google's terms and privacy policy: https://policies.google.com/terms and https://policies.google.com/privacy . Search Console API documentation: https://developers.google.com/webmaster-tools/v1/api_reference_index .

OAuth client credentials and tokens are stored in WordPress options; Search Console results are cached in WordPress transients for up to six hours. On each plugin admin-page view in hub mode, the plugin makes a signed status check; when the hub confirms disconnection it clears the cached report and offers reconnection. When status cannot be verified, it pauses the report rather than displaying stale data. Hub status does not itself guarantee that an externally revoked Google grant remains valid; fresh report requests may reveal later Google authorization failures. Only administrators with manage_options can access the plugin page. Google disconnect deletes stored OAuth tokens, the selected property, and the cached report, but retains the OAuth client settings so you can reconnect. You can remove those settings by deleting the cgg_oauth_credentials option or removing them from your database; revoke the grant in your Google account if desired. Deactivation preserves settings. This plugin does not automatically track front-end visitors, send data to the plugin author, or create posts.

== Installation ==

1. Upload the ZIP through Plugins > Add New > Upload Plugin, or install from WordPress.org when available.
2. Open Church Growth Plugin from the WordPress admin menu.
3. For the controlled invitation beta, obtain an invitation privately from the hub administrator and use Verify invitation and register this website. Only redeem when the hub administrator has enabled redemption. Do not share invitation codes publicly. Existing private-pilot and manual pairing workflows remain as advanced fallback paths.
4. After successful Google consent, the plugin automatically verifies the signed exact-site hub report and selects the dashboard if available. A manual report-check action remains available if authorization succeeds but the report is not ready. Alternatively, configure a local OAuth client for direct Google access.
5. Select a property and click Save selected property. Use Refresh report to request fresh data.

== Frequently Asked Questions ==

= Does this show Google Analytics visits? =

No. Impressions and clicks are reported by Google Search Console and are not website visitor counts.

= Are these trending search terms? =

No. The five queries are ordered by reported clicks in the selected period, not by increases in search popularity.

= Does it use AI or automatically publish blog posts? =

No. Suggested titles are rule-based, derived from available Search Console queries. You review all suggestions manually.

= Why are there fewer than five blog ideas? =

The plugin does not invent keywords when insufficient suitable reported queries are available.

== Changelog ==

= 0.9.16 =
* Add administrator-only, read-only beta recovery self-test for eight message/action scenarios and a saved-options invariance check.
* Share fixed recovery messages between live pending/error states and the self-test preview; preserve connection and invitation behavior.


= 0.9.15 =
* Improve beta onboarding and Google reconnection guidance without changing invitation claims, OAuth permissions, pairing records, reporting mode, or approved property checks. Hide Google reconnection when hub status cannot be verified. Preserve the private-pilot restrictions; this is not a public release.


= 0.7.0 =
* Prepare directory documentation, GPL licensing metadata and Google external-service disclosure.
* Preserve the simplified dashboard, existing settings and keyword-based content suggestions.

= 0.6.0 =
* Introduced Five Keywords to Watch and revised blog opportunity titles.

Private testing note for v0.8.0: an optional connection-hub pairing form can register this WordPress installation using a short-lived code issued by the hub administrator. This does not change the active direct Google connection or enable hub reports.

Private test note v0.9.0: Paired administrators can manually test an authenticated read-only report against the Church Growth Connection Hub. The current direct Google connection remains the live dashboard data source. The hub requires its administrator to set a validated matching Search Console property first. No public one-click connection or automatic migration is included.

Private test fix v0.9.1: the manual hub relay requests the registered WordPress home URL as its property. The hub validates that exact property against its approved property; an unconfigured direct-Google cgg_property no longer blocks hub-only installations. Direct reporting is unchanged.

== Private pilot 0.9.2 ==
Sites already registered, individually Google-authorized, paired, and property-approved on the e-Church Digital hub can switch their dashboard to read-only hub reporting with one administrator click. Enabling validates the hub response first and leaves existing local Google settings untouched. If the hub fails, the dashboard reports the error rather than silently showing another property's data. This is NOT public self-service OAuth onboarding or a WordPress.org-ready release. Hub v0.5.0 remains unchanged.

= 0.9.3 =
* Present existing paired-hub reporting as a simple Connect Google pilot action with connection status.
* Put diagnostics, re-pairing, and optional direct Google setup under expandable advanced sections.
* This is NOT public self-service OAuth onboarding; registered-site approval and pairing remain private.

Private pilot 0.9.4: after secure pairing, auto-select the hub dashboard only when the hub confirmed the exact Google property and a signed report fetch succeeds; otherwise leave existing reporting unchanged. Requires Connection Hub 0.6.0 for automatic approval; previous hub versions still require manual property approval.

Private pilot 0.9.5: administrator-only website ownership proof and site-specific automatic pairing when the hub administrator enables the private pilot on Connection Hub v0.7.0. The plugin submits exact site URL and an ephemeral proof key to connect.echurchdigital.com; the hub fetches a temporary proof from that site over HTTPS and verifies it before returning a site-bound secret. Does not authorize Google or enable reporting until the hub administrator separately authorizes that site's account. Never replaces existing pairings. Public onboarding is not ready.

Private pilot v0.9.6: paired site admins can start Google's read-only consent from the plugin. The hub validates a signed server-to-server launch, uses a short-lived single-use ticket and returns to WordPress after verifying access to the site's exact URL property. The administrator explicitly enables hub reporting after a signed report passes. Automatic public onboarding, domain properties and full tenant security review are not complete.

Private pilot v0.9.7: a Google authorization started by the WordPress administrator stores a 20-minute user/site-specific intent. Upon returning with an approved property, the plugin consumes the intent, validates the signed exact-site report, and automatically activates hub reporting. Missing properties preserve the existing guidance, and a failed report leaves reporting unchanged with a manual retry. This is not a public unrestricted onboarding or cross-tenant security certification. Requires Connection Hub v0.8.0; no hub upgrade is needed from v0.8.0.

== Private-pilot v0.9.9 pairing recovery ==
If the hub rejects a locally saved pairing with HTTP 403, the admin dashboard stops claiming that the site is paired and pauses hub reporting. A WordPress administrator may explicitly clear the old local pairing with a nonce-protected confirmation and register the installation again. A hub timeout or unexpected error never automatically clears a pairing. HTTP 403 does not by itself prove a deletion: it may also indicate an archived or mismatched pairing. Clearing local pairing does not delete hub records, Google authorizations, backups or server logs.

= Private-pilot local privacy controls (0.9.10) =
An administrator may clear only this installation's report caches and short-lived diagnostics without changing its Google connection or hub pairing. After a hub pairing is rejected (HTTP 403), an administrator may additionally confirm the exact local URL and permanently erase this installation's stored Church Growth pairing, report source, direct Google OAuth token/client settings, selected property, caches and temporary diagnostic transients. The hub registration must be removed separately first. This cannot erase hosting backups, server logs, third-party data, or revoke any separately authorized direct Google grant. Do not use the full removal tool to recover a pairing you intend to restore; use the existing pairing-recovery action instead.

== 0.9.11 private-pilot notice fix ==
Show action results above the hub connection panel, including privacy cache-clear confirmation, even when optional direct Google settings are collapsed. No changes to connection or cleanup behavior.

= 0.9.12 =
* Clarify paired-but-not-yet-Google-authorized hub state and hide premature report activation until the hub confirms this site is connected. No changes to hub registration or saved pairings.

= 0.9.13 =
* Add administrator-only isolated onboarding display self-test for pending, connected, unavailable, rejected, and malformed statuses. Reuse the pending notice in the real admin UI and preview; preserve existing connections and pilot restrictions.

= 0.9.14 =
* Add administrator-only invitation entry and verified beta-claim flow for unpaired installations. Fail closed on disabled, expired or used invitations; preserve existing pairings and Google reporting. Invitation redemption remains OFF by default at the hub. Recovery of a successful remote claim with a failed local save requires hub administrator help.

= 0.9.17 =
* Improve beta welcome and dashboard wording around Know Your Impact.
* Add one optional $47 live consultation link to e-Church Digital in the plugin dashboard; no automatic personal or Search Console data transfer on click.
* Improve connected and empty-report messaging without changing registration, OAuth, reporting, or recovery logic.

= 0.9.18 =
* Refine Know Your Impact welcome hero with a separate benefit-focused subheading and concise data disclosure.
* Show a status-aware connection heading and a clearer connected confirmation without changing invitation, Google, reporting, recovery, or consultation behavior.
