=== Move to SeedWebs ===
Contributors: seedwebs
Tags: migration, move, transfer, export
Requires at least: 6.0
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 0.7.6
License: GPL-2.0-or-later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

See what of your site can move to SeedWebs, then let your SeedWebs site read it once you connect. Nothing is sent before you click.

== Description ==

Move to SeedWebs moves the content of this site into a site on SeedWebs (https://seedwebs.com), a website platform. Moving needs a SeedWebs account; for plans, see https://seedwebs.com/pricing.

1. Install and activate the plugin, then open **Tools → Move to SeedWebs**. The page shows what this site holds and what will move. Producing it sends nothing and saves nothing.
2. Click **Connect to SeedWebs**. A new tab opens on seedwebs.com, where you log in (or create a site) and confirm.
3. SeedWebs then reads this site through the plugin and fills your SeedWebs site. Progress and problems are shown on seedwebs.com; the plugin page only shows whether the connection is active.

The design changes to the SeedWebs base theme.

This is a public beta. It moves posts, pages, custom post types, WooCommerce products, Media Library items, categories, tags and custom taxonomies, author bylines, ACF field definitions and values (ACF, ACF Pro or Secure Custom Fields), SEO titles and descriptions from Yoast SEO or Rank Math, site identity (logo, icon, colours, fonts), menus, and redirect rules from Redirection, Rank Math or Yoast SEO Premium. On a multilingual site (Polylang or WPML) only the default language moves.

The report lists what arrives as it is, what arrives changed (for example URLs, builder pages, items that arrive as drafts) and what does not move (for example comments, users, orders, forms, widgets).

Requirements: WordPress 6.0 and PHP 7.4 or later, on a single site (not Multisite). On an older site, update first or use Tools → Export.

== Installation ==

1. In Plugins → Add New, search for "Move to SeedWebs" and install it, or click Upload Plugin and choose the plugin's zip file.
2. Activate the plugin.
3. Open Tools → Move to SeedWebs.

== Frequently Asked Questions ==

= Who can connect? =

An administrator who can both manage options and export the site (the same right WordPress uses for Tools → Export). The connection lasts only while that administrator keeps those rights.

= Does the plugin change my site? =

No content or setting is changed. Until you click connect, the plugin stores nothing at all. After the click it keeps three small settings (see Privacy).

= Can rendering content have side effects? =

Yes, the same ones a page view has. SeedWebs reads each item (drafts and private items too) rendered as a logged-out visitor would see it, so WordPress's content filters run, those of other plugins and your theme included: WordPress may cache an embed preview in `_oembed_*` post meta, and a page builder may generate its CSS files. The plugin itself never makes an outbound request.

= How do I stop a move? =

Click **Disconnect** on Tools → Move to SeedWebs, or cancel on seedwebs.com. Either way SeedWebs stops reading this site; what already moved stays on SeedWebs.

== External services ==

This plugin works with SeedWebs (https://seedwebs.com), a website platform. The plugin itself never makes a request to SeedWebs or anywhere else: no callback, no ping, no update check, no telemetry.

When an administrator clicks "Connect to SeedWebs", their own browser sends seedwebs.com: the site address and name, a random identifier for this site, the plugin's endpoint addresses, item counts (with custom post type labels) and the estimated file size, whether WooCommerce accepts payments, the plugin version, the administrator's user ID and name (first and last name, or "Administrator #ID", if the display name is the login or an email), and a connection code.

After the owner confirms on seedwebs.com, SeedWebs reads this site through the plugin's REST endpoint until the connection ends, for example: content items (posts, pages, custom post types, simple and variable products) rendered as a logged-out visitor sees them, with their raw content, page builder CSS, terms, files and field values, drafts, pending, scheduled and private items and the full content of password-protected items included; Media Library items and their files; categories, tags and custom taxonomies; author display names, first and last names, nicenames (the name in author archive addresses), bios and avatar addresses (even where the site does not show avatars); SEO titles, descriptions, canonical addresses, noindex settings, focus keywords and title templates from Yoast SEO or Rank Math; menus; redirect rules; ACF field definitions and values; site identity (for example name, tagline, logo, icon, colours, fonts, theme settings, Additional CSS, menu locations, front page and widget text); and technical details (for example site addresses, language, permalink settings, WordPress, PHP, theme and active plugin versions, server family, names of security plugins).

Never sent: user passwords, post passwords, WordPress's security keys, users other than authors and the connecting administrator, customers, orders, comments, form entries, and private or protected files. Logins and emails are not sent as such, but WordPress sets an author's display name to the login (which may be an email address) and the nicename to a cleaned copy of it, unless they were changed, and both are sent as they are. ACF field values are sent as they are stored, except password fields and fields whose names contain pass, pwd, token, secret, auth, credential, api_key, apikey, api-key, private_key, private-key, license_key or licence_key: a password or key kept in any other ACF field is sent with the rest.

SeedWebs Terms: https://seedwebs.com/terms
SeedWebs Privacy Policy: https://seedwebs.com/privacy

== Privacy ==

The plugin offers this text to your privacy policy page (Settings → Privacy):

Before an administrator clicks "Connect to SeedWebs", Move to SeedWebs stores nothing, not even a cache. From the click on it keeps three options in this site's database: a hash of the connection code with who clicked and when (and the SeedWebs site it connects to, and when SeedWebs last read), a random identifier for this site, and how the last connection ended. The connection code itself is never stored, logged or shown. Uninstalling the plugin deletes the first and the last; it keeps the identifier, so connecting again later continues the same move.

When an administrator clicks "Connect to SeedWebs", their browser sends seedwebs.com details of this site, including its address, name and a random identifier, item counts, the administrator's user ID and name, and a connection code. After the owner confirms on seedwebs.com, SeedWebs reads through the plugin until the connection ends, for example this site's content (drafts, private and password-protected items included), media, terms, menus, redirect rules, SEO, ACF fields and values, site identity, technical details, and authors' names, nicenames, bios and avatar addresses (a Gravatar address contains a hash of the author's email). User passwords, post passwords, customers, orders, comments and form entries are never sent, nor the values of ACF password fields and of fields whose names suggest a secret. Logins and emails are not sent as such, but an author's display name and nicename are copies of the login, which may be an email address, unless they were changed. The plugin's readme (External services) lists the details.

== Uninstall ==

Deleting the plugin removes the connection and its history (`mtsw_connection`, `mtsw_last_end`). It keeps `mtsw_source_site_id`, a random identifier for this site, so that reinstalling and connecting the same SeedWebs site continues the same move instead of copying everything again. Deactivating keeps all three.

== Source code ==

There is no build step: the files in this plugin are its source.

== Changelog ==

= 0.7.6 =
* Security: the connection code signs in only requests WordPress sends to the plugin's own routes, while the connecting administrator can still manage options and export, until the answer is decided or the request ends.
* Security: the file route checks where a file really is, so no link reaches a protected folder.
* More ACF field names that suggest a secret are held back (pwd, credential, apikey, license_key and others).
* Too many ids are refused before each one is checked; the routes are left out of the REST API index.
* The "sends" box lists the site identifier and your user ID, and links the Privacy Policy.
* Counts and byte units are translatable; translation files have standard headers.
* The hand-off page prints through WordPress; request values are sanitised; the readme says exactly what is sent; LICENSE is shipped.

= 0.7.5 =
* Files of unknown size (on a CDN or missing) are estimated from the average, not counted as 0 bytes.

= 0.7.4 =
* A click before any file size is counted leaves the size out instead of sending 0 bytes.

= 0.7.3 =
* A page whose builder CSS alone is too large is sent without it; Spectra's custom page CSS is not sent as builder CSS.

= 0.7.2 =
* Page CSS that Greenshift, Spectra, Stackable or Elementor keeps in post meta is sent with the page.

= 0.7.1 =
* Pages built with block plugins are reported as builder pages.

= 0.7.0 =
* WooCommerce: simple products move; variable products arrive as drafts without their options; a currency other than ฿ is pointed out.

= 0.6.0 and earlier =
* 0.6.0: menus and redirect rules; SEO says which values were set on each item.
* 0.5.0: ACF field groups and values.
* 0.4.0: site identity.
* 0.3.0: the full Readiness report; multilingual sites.
* 0.2.0: connection views, Disconnect and Reconnect.
* 0.1.0: first release: the Readiness report, Connect to SeedWebs, blog reads.
