=== Baza Helper ===
Contributors: bazadevelopers
Tags: seo, images, performance, cache, redirect
Requires at least: 6.5
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.1.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Site tools for any theme: WebP images, speed, technical SEO, redirects, HTML sitemap, content order and duplicate, on one dashboard.

== Description ==

Baza Helper adds the site tools that do not belong in a theme, each with its own switch on one dashboard:

* WebP image generation with automatic delivery, from the dashboard or from the command line (WP-CLI).
* Page cache and speed tools: lazy images, deferred scripts, server rules and diagnostics, and a speed advisor that reads your home page and a Lighthouse report and turns on what helps.
* Technical SEO: sitemap, robots.txt, structured data, social tags, redirects and an on-page SEO panel.
* Translation of pages, posts and categories with the AI models and translation services you connect (queue run by WP-Cron, a button in the block editor), and a spelling check.
* Analytics and site verification with a consent-first approach (Google Analytics 4, Tag Manager, Meta Pixel, Clarity).
* Menu studio: a drag-and-drop menu with mega panels and languages, for any theme.
* Link checker: wrong-language and out-of-date internal links, fixed in one click.
* Forms and entries (the path a visitor took is shown as a timeline when the form sends it), messenger alerts (Telegram, WhatsApp, Viber), a floating call-to-action button and a cookie banner whose switches start the way you choose.
* Content order: drag posts and terms of any type into your own order, in the admin and on the site.
* HTML sitemap: a page for visitors that lists the site, with a ready shortcode.
* Where a file is used: a "Used in" column for every file of the media library, and image sync for translations (Polylang) that puts missing pictures in place.
* Duplicate: a copy of a post, page or term in one click or in a batch.
* Elementor settings: clean up leftover files and sync the template library when you save.
* Backup and migration, export and import of settings, search and replace, replace image in the media library.
* Security: two-step login, a private login address, a login log and lockouts.
* Admin bar shortcuts, a site icon and web app manifest generator.
* Optional integration with the Baza Booking Calendar plugin.

Baza Helper does not depend on a theme and a theme does not depend on it. Baza Theme keeps its own widgets, menu studio and settings, and uses the same admin design.

== WP-CLI ==

The WebP generator has its own command, for large libraries, servers without cron and deploy scripts. It runs the same job as the dashboard (the same settings from the WebP tab, the same worker) in your terminal, with a progress bar, no browser and no web request time limit:

`wp baza-helper images generate` converts the whole media library. Images that already have a current copy are skipped, so it is safe to run again.

`wp baza-helper images generate --enable` turns the image manager on first (the same switch as on the WebP tab) and then converts the library. Without `--enable` the command stops with a message when the manager is off.

`wp baza-helper images generate --retry` runs only the files that failed last time.

`wp baza-helper images generate --force` encodes every copy again, also those that already exist (the default only makes the missing ones). A job that is still running has to be cancelled first (`wp baza-helper images cancel`).

If WP-CLI prints a parse error from a WordPress core file, the shell's default PHP is older than the one the site uses. Run WP-CLI with the site's PHP binary, for example `/usr/local/php84/bin/php wp-cli.phar --path=/path/to/site baza-helper images generate`.

`wp baza-helper images status` shows the state of the job, the counts, the size saved and whether this server can encode WebP (`--format=json` for scripts).

`wp baza-helper images pause` and `wp baza-helper images cancel` stop the current job; `generate` continues a paused one. Copies already made are kept.

The image manager must be switched on in the WebP tab first.

== Installation ==

1. Upload the `baza-helper` folder to `/wp-content/plugins/` or install the plugin from the Plugins screen.
2. Activate it. A "Baza Helper" item appears in the admin menu.

== Frequently Asked Questions ==

= Does it need Baza Theme? =
No. The tools work with any theme.

= Does it send data to external servers? =
No request is made to Baza Developers or any other server by default. Every service in "External services" below is used only after an administrator turns the matching tool on (and, for visitors' browsers, only after the visitor's consent), and nothing is sent to Baza Developers.

= What personal data does it keep? =
Form entries (what a visitor typed, the page it was sent from, the date and, only if you switch it on, the IP address), kept in your own database until the days you set have passed. The plugin adds a text for your privacy policy (Settings > Privacy) and works with the WordPress personal data export and erase tools, which find entries by e-mail address. The login protection counts failed logins by IP address for a short time.

= Does it change files outside the uploads folder? =
Only when an administrator asks for it: the "direct HTML" rules button writes a marked block into the site's .htaccess (a copy is kept and the old file is put back if the site stops answering), the Child theme tool creates a child theme folder in the themes folder, and restoring a backup writes the files in the archive into wp-content. Caches, converted images and local fonts live in the uploads folder.

== External services ==

Baza Helper calls an external service only when an administrator turns the matching tool on and gives it an account or an address; nothing is sent to Baza Developers. The tools that do:

**Analytics (optional).** The analytics module can load the following scripts, but only after an administrator enables the provider and, by default, only after the visitor consents:

* Google Analytics 4 and Google Tag Manager (Google LLC) - https://policies.google.com/privacy
* Meta Pixel (Meta Platforms, Inc.) - https://www.facebook.com/privacy/policy/
* Microsoft Clarity (Microsoft) - https://privacy.microsoft.com/privacystatement

**Translation (optional).** The Translation tool sends the text of a page, post or category, or the text to be spell-checked, to the service the administrator has connected with their own account and key, and only when a translation or a spelling check is requested (from the editor, the Translation tab or the cron queue). Available services: OpenAI (https://openai.com/policies/privacy-policy), Anthropic (https://www.anthropic.com/legal/privacy), Google Gemini and Google Cloud Translation (https://policies.google.com/privacy), Mistral AI (https://mistral.ai/terms/), DeepSeek (https://www.deepseek.com/privacy), xAI (https://x.ai/legal/privacy-policy), Groq (https://groq.com/privacy-policy/), OpenRouter (https://openrouter.ai/privacy), DeepL (https://www.deepl.com/privacy), Microsoft Translator (https://privacy.microsoft.com/privacystatement), LibreTranslate, Ollama and any OpenAI-compatible address the administrator types (their own server or provider). Nothing is sent until a service is connected.

**Messenger alerts (optional).** When an administrator connects a messenger and an alert is sent (a new form entry, for example), the text of the alert (the fields of the entry, the page address) is sent to that messenger's service with the administrator's own token: Telegram Bot API, api.telegram.org (https://telegram.org/privacy); WhatsApp Business Cloud API, graph.facebook.com (Meta Platforms, Inc., https://www.facebook.com/privacy/policy/); Viber Bot API, chatapi.viber.com (Viber Media, https://www.viber.com/en/terms/viber-privacy-policy/).

**Google Fonts (optional).** When an administrator picks a Google font in the Google Fonts tab, the plugin downloads the font's stylesheet and files from fonts.googleapis.com and fonts.gstatic.com (Google LLC, https://policies.google.com/privacy) once, from the server, and then serves them from the site's own uploads folder; visitors' browsers do not contact Google for them.

**Google Fonts, visitor's browser (optional).** If the site already loads Google Fonts and the option "Connect to Google Fonts early" is on, the page tells visitors' browsers to open a connection to fonts.googleapis.com and fonts.gstatic.com (Google LLC, https://policies.google.com/privacy), which sends the visitor's IP address to Google. Turn the option off, or host the fonts on the site, to avoid it.

**Links that open another site when clicked.** The admin bar shortcut "PageSpeed" opens Google PageSpeed Insights (pagespeed.web.dev, https://policies.google.com/privacy) with the address of the page when you click it; the call-to-action button links to the messenger or social network you chose (Telegram, WhatsApp, Viber, Instagram and others) when a visitor clicks it. Nothing is sent before the click.

**Elementor template library (optional).** If Elementor is active and the Elementor setting "Sync the template library when a page is saved" is on, saving a page asks Elementor to refresh its template library, at most once an hour. The request is made by Elementor's own code to Elementor's servers (https://elementor.com/privacy/); Baza Helper sends nothing itself.

**Backup & migration.** This tool does not contact any server: archives are made on and restored from your own site.

== Source code ==

The compressed CSS and JavaScript in this plugin are built from the readable sources in the same package: the Sass files are in `assets/scss`, and the non-minified `.js` file sits next to every `.min.js`. To build them again, install Node.js, open the plugin folder in a terminal and run `npm install`, then `npm run build` (the build files `package.json` and `gulpfile.js` are in the package; the build uses gulp, Sass, PostCSS and Terser).

== Third party resources ==

* Coloris color picker 0.25.0 (MIT) - bundled in assets/vendor/coloris; the readable `coloris.js` and `coloris.css` sit next to the `.min` files.
* Lucide icons (ISC) and Simple Icons (CC0) - see assets/images/NOTICE.md.
* Iconsax (https://iconsax.io) - the linear icons of the admin screens, used under the Iconsax Free License (https://docs.iconsax.io/license-and-terms/license), built into includes/admin/tab-icons.php and includes/admin/ui-icon-set.php and not offered as separate files. See assets/images/NOTICE.md.

== Changelog ==

= 1.1.0 =
* New: Content order - drag posts and terms of any type into your own order, in the admin and on the site.
* New: HTML sitemap - a page for visitors with a ready shortcode.
* New: "Used in" column for every file of the media library, and image sync for translations (Polylang).
* New: Duplicate - copy a post, page or term from the row of a list or in a batch.
* New: the path a visitor took is shown as a timeline in the form entry; the cookie banner lets you choose which switches start on; Elementor settings clean up leftover files and sync the template library on save.
* New: a text for your privacy policy and support for the WordPress personal data export and erase tools for form entries.
* New: ready article structured data (schema.org BlogPosting) for every post, filled in from the post itself.
* New: compare the translations of a post or category side by side and edit them all at once, and delete a post together with its translations.
* New: an Activity page that shows what the plugin does on your site and what it does not, and a warnings menu in the admin bar for what needs fixing at once.
* New: rules for when the cookie icon is shown (after a scroll depth, or only in chosen sections).
* Improved: the side menu groups fold, one common tooltip for every hint, Menu studio drag and drop to any level.
* Changed: Backup & migration no longer downloads an archive from an address (upload it or place it in the folder by FTP); the Coloris color picker ships with its readable source.

= 1.0.6 =
* New: Speed advisor in Cache & Optimization - reads the home page and the last Lighthouse report, lists what to turn on, and applies it in one click (defer all scripts, merged stylesheets after the first screen, phone-sized pictures, leaving out unused styles).
* New: "Defer all scripts" with an exception list (scripts the first screen waits for), and smaller phone-sized copies of pictures that are already WebP or AVIF.
* New: Replace image accepts SVG; "Retry errors" in the image queue runs the files that were skipped again.
* Improved: deferred styles apply to the home page by default (other pages no longer flash unstyled); the picture learned as the largest is never lazy-loaded; the cache warmup keeps going while the panel is open.
* Improved: the breadcrumbs shortcode is [baza_helper_breadcrumbs] (the old name still works) and its code lines copy on click; the Content group is below SEO & analytics in the menu.
* New: Call to action - a floating contact button (a phone) that opens a call, messengers and social networks, with colours, place, animations and the logos built in.
* New: Shortcode blocker - stop chosen shortcodes, or all of them, in chosen posts, post types or everywhere.
* New: two-step login (authenticator app, backup codes) and a private login address.
* New: child theme generator, export and import of all settings, a switch to remove readme.html and license.txt.
* New: a switch and a card for every tool on the dashboard, a "Pause everything" switch to rule the plugin out when hunting a conflict, and menu items that appear and disappear without a reload.
* New: Scripts and styles can be left out on one page or section; the link checker also reads and fixes custom fields (Elementor, Carbon Fields, ACF).
* Improved: the tracking debugger shows what a click would send without sending it or leaving the page, and remembers when it is hidden; clearing caches answers with a toast notice.
* Fixed: the menu studio full screen on first open, the backup drop area, the cookie window no longer depends on a page builder's button styles, the browser no longer fills a saved login into the settings search.

= 1.0.5 =
* Keep third-party form conversion adapters in site-specific custom scripts instead of the plugin core.

= 1.0.4 =
* Add privacy-safe phone, email and Contact Form 7 lead events to the consent-aware tracking manager.

= 1.0.3 =
* Fix direct GA4 startup after analytics consent and refresh the tracking runtime URL.

= 1.0.0 =
* Dashboard with an on/off switch per tool, Dev / staging mode, Diagnostics.
* Scripts and styles are enqueued through WordPress instead of printed inline.
* First release: moved out of Baza Theme into a separate plugin, native motion toolkit, new dashboard.

== Upgrade Notice ==

= 1.1.0 =
New free tools (Content order, HTML sitemap, Duplicate, Where a file is used) and privacy tools for form entries. Your saved settings are kept.

= 1.0.6 =
New tools (call to action button, shortcode blocker, two-step login) and fixes. Every tool has a switch on the dashboard, and one switch pauses them all.
