=== BookPress Readiness ===
Contributors: bookpress
Tags: migration, compatibility, performance, core integrity, scanner
Requires at least: 5.6
Tested up to: 6.8
Requires PHP: 7.2
Stable tag: 1.0.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Reads the PHP of everything that runs on this site and reports whether the BookPress engine can serve it. Also checks WordPress core for modifications.

== Description ==

BookPress is a native server that serves WordPress sites — the same themes, the
same wp-admin, the same URLs and the same database schema — without PHP-FPM.
This plugin answers one question about **your** site: would it run?

It answers it by reading your actual PHP, not by looking things up in a
catalogue. A catalogue cannot say anything about the custom plugin somebody
wrote for you in 2019, and that plugin is usually the one that decides the
answer.

**What it looks at**

* Every active plugin, and every inactive one (reported separately — an
  inactive plugin never counts against your result).
* **Must-use plugins.** These are always active and never appear on the Plugins
  screen. Hosts install them routinely. A scan that skips them can say "ready"
  about a site that is not.
* **Drop-ins** — `db.php`, `object-cache.php`, `advanced-cache.php`,
  `sunrise.php`, `maintenance.php`. These are legitimate WordPress and they hook
  depths BookPress does not reproduce. They are read like any other file, so the
  report names the specific functions and hooks they need rather than just
  noting that they exist.
* Your active theme and its parent.
* **WordPress core itself**, against WordPress.org's official checksums.
* Your `wp-config.php` settings, including whether this is a network.

**How it decides**

It uses PHP's own tokeniser — the same lexer PHP itself uses — so a mention of
`eval(` inside a comment or a string is not mistaken for the real thing.

It is **deliberately cautious**. It is a static scan, so it cannot see calls
that are assembled at runtime, cannot judge reachability, and is not the
authority on the final answer — that comes from BookPress's own compiler when
you migrate. Anything it cannot decide is reported as "needs checking", never as
"ready". A wrong pass costs you a migration that goes wrong; a cautious answer
costs a conversation.

**It changes nothing.** No files are written, no content is touched, no tables
are created, nothing is scheduled. Deactivating it removes the one option it
stores.

== Installation ==

1. Install through **Plugins &rarr; Add New &rarr; Upload Plugin** with the zip,
   or copy the `bookpress-readiness` folder into `wp-content/plugins/`.
2. Activate it through the **Plugins** screen.
3. Open **Tools &rarr; BookPress Readiness** and press **Run the scan**. The scan
   runs in your browser in batches and writes only its own result; it starts by
   fetching the current policy from `bookpress.io` (see the section below).

No configuration, no account, no keys. Deactivating the plugin removes the single
option it stores.

== What this plugin sends, and when ==

This section is the whole story. Nothing is omitted from it.

**1. Automatically, at the start of every scan: one request to
`https://bookpress.io/readiness/policy.json`.**

That file is the list of what the BookPress engine currently supports — its
symbol table, its PHP dialect rules and its `wp-config.php` policy. It is
fetched rather than shipped inside the plugin on purpose: the engine gains
capabilities regularly, and a list baked into an installed plugin would give you
an answer about a version of BookPress that no longer exists. Fetching it is
also what makes "re-run this in a few months and it may say yes" a true
statement rather than a marketing one.

It is a plain static file. There is no account, no cookie, no token and no
identifier in the request.

**Because it is a request to our server, our server sees your site's IP address
and the time of the request.** It is fair to call that telemetry without asking
for telemetry, so we would rather write it down than describe it as a cache
refresh. We deliberately do **not** send your site's URL: WordPress's default
user agent includes it, and this plugin replaces the user agent with
`BookPressReadiness/<version>` so that it does not.

**2. Automatically, during a scan: one request to
`https://api.wordpress.org/core/checksums/1.0/`.**

WordPress.org's official checksums for your exact WordPress version, used to
detect modified core files. This is the same request `wp core verify-checksums`
makes, to a host your site already contacts for every update. It goes to
WordPress.org, not to us, and we do not mirror or proxy it. If it cannot be
reached, the core section is reported as **unknown** — never as a pass.

**3. Only when you type an email address and press "Send my result": your email
address and the verdict.** Optionally, if you tick the box, the list of what is
blocking — which functions, which constructs, which drop-ins. The exact JSON is
shown on the screen before you press the button.

Not sent: your site's URL, your content, your users, your database, your
settings, or the values of anything in `wp-config.php`.

**4. Only if you separately press "Send the inventory": your plugin and theme
list.** This is a different button, a different decision and a different
endpoint, it exists to make a migration conversation useful, and it can never
affect or gate your own result. The exact payload is shown before you press it.

== Frequently Asked Questions ==

= Does it modify anything? =

No. It reads files and it reads options. It writes exactly one option to hold
the progress of a scan, and deactivating the plugin deletes it.

= Why does it say "needs checking" so often? =

Because it is a static scan and it will not guess. The most common cause is a
plugin registering a WordPress hook that BookPress does not yet fire: the plugin
would load without error and simply never run. That is worth telling you about
even though nothing crashes.

= It says my core is modified. Is my site hacked? =

Maybe, and maybe not. Hosts patch core, and so do some optimisation plugins.
The report names every file that differs and every file present in `wp-includes`
or `wp-admin` that WordPress does not ship. Those names are what you take to
your host. Files that are *meant* to be edited — `wp-config.php`, `.htaccess`,
`robots.txt` and everything in `wp-content` — are never reported.

= I run a multisite network. =

BookPress does not run a network; it converts one into separate sites that it
does run — one database each, which is the model it is built around. The report
tells you which kind of network you have (a subdomain network maps cleanly; a
subdirectory network does not, and that is a real blocker), how many sites there
are, and exactly what changes — network-wide users become per-site, there is no
super admin, network-activated plugins become each site's own.

= Do I need to give you an email address? =

No. The scan runs and the full report appears on your screen without one. The
email field exists only if you want us to have the result.

== Screenshots ==

1. Tools &rarr; BookPress Readiness, before the scan: what it reads and what it
   sends, stated up front.
2. The scan running: it works through plugins, must-use plugins, drop-ins and the
   active theme in batches, in your browser.
3. The verdict: each item marked ready, needs-checking or a blocker, with the
   reason, and the core-integrity result.

== Changelog ==

= 1.0.0 =
* First release.
