# WordPress.org Plugin Directory — Submission Readiness

> Submission URL: https://wordpress.org/plugins/
> Review timeline: typically 1-4 weeks after submission

---

## Status: READY TO SUBMIT

All hard requirements are met. See action items below before clicking submit.

---

## Checklist

### Hard requirements (all pass)

- [x] **GPL-compatible license** — `License: GPLv2 or later` declared in plugin header and `readme.txt`
- [x] **`readme.txt` present** — located at `wp-plugin/rankwiz-ai/readme.txt`; follows WordPress.org standard format (plugin name, description, installation, FAQ, changelog)
- [x] **Stable tag declared** — `Stable tag: 1.0.9` in `readme.txt`
- [x] **Main plugin file** — `rankwiz-ai.php` with standard WordPress plugin header (Plugin Name, Description, Version, Author, License, License URI)
- [x] **No obfuscated code** — PHP source is plain, human-readable PHP 8.1+; no `eval()` patterns in plugin code
- [x] **No minified/encoded PHP** — all PHP files are source, not compiled
- [x] **`uninstall.php` present** — cleans up `rankwiz_options`, plugin transients, per-user meta, and `_rankwiz_jsonld` post meta on uninstall
- [x] **WordPress core function usage** — uses standard WP APIs (`add_action`, `add_filter`, `wp_remote_post`, etc.); no direct MySQL queries

### Banner / icon assets (pass — assets already in place)

- [x] `assets/banner-1544x500.png` — required by WordPress.org (high-DPI)
- [x] `assets/banner-772x250.png` — required by WordPress.org (standard)
- [x] `assets/icon-128x128.png` — required by WordPress.org
- [x] `assets/icon-256x256.png` — required by WordPress.org

### readme.txt quality check

- [x] `== Description ==` section present and descriptive
- [x] `== Installation ==` section with numbered steps
- [x] `== Frequently Asked Questions ==` section with at least 3 Q&A pairs
- [x] `== Changelog ==` section with version history
- [x] `Requires at least: 6.4` — reasonable minimum (6.4 shipped Nov 2023)
- [x] `Tested up to: 6.8` — matches current WP version (verify before submitting)
- [x] `Requires PHP: 8.1`

---

## Action Items Before Submitting

1. **Verify "Tested up to" value** — confirm WordPress 6.8 is the current WP core version at submission time. If WP has released 6.9, update to `6.9`.

2. **Add a `== Screenshots ==` section to readme.txt** — WordPress.org strongly recommends screenshots; they show in the plugin page. Add `assets/screenshot-1.png` (the RankWizAI dashboard widget or settings page) and add:
   ```
   == Screenshots ==
   1. WordPress dashboard widget showing pending SEO recommendations and ROI summary.
   2. Plugin settings page with HMAC setup token entry.
   ```
   Create the PNG files at `wp-plugin/rankwiz-ai/assets/screenshot-1.png` and `screenshot-2.png`. Max width 1200px. These do not need to be uploaded separately — they are picked up from the SVN assets directory automatically.

3. **Self-hosted update channel note** — the plugin uses a self-hosted update channel (`WP-007`). WordPress.org reviewers may flag this. The standard expectation is that plugins distributed via WordPress.org use the .org update system, not a custom updater. Options:
   - Remove the self-hosted updater for the .org version (the `.org` update system becomes the delivery mechanism)
   - Keep the self-hosted updater and be prepared to justify it during review (some plugins do this; reviewers sometimes allow it for premium features delivered outside .org)
   - Recommended: ship the .org version without the self-hosted updater; the self-hosted channel can remain for direct-download users

4. **Multisite block** — `readme.txt` says multisite activation is blocked. This is fine and supported by .org, but the reviewer may ask for clarification. The existing FAQ entry covers this.

5. **HMAC shared secret** — reviewers sometimes look carefully at API key storage. The current implementation encrypts the secret at rest using Libsodium (`wp_options` via `libsodium_*`). Confirm the implementation uses `sodium_crypto_secretbox` (or equivalent) with a site-specific key — not a hardcoded key or direct plaintext storage. Add a brief inline comment if not already present for reviewer clarity.

---

## Submission Steps

1. Create a WordPress.org account if you don't have one
2. Go to https://wordpress.org/plugins/developers/add/
3. Submit the plugin zip file (from `bin/build.sh` output)
4. Wait for automated + manual review (1-4 weeks typical, can be longer)
5. After approval, SVN commit is required to publish (WordPress.org uses SVN for plugin hosting, not git)
6. When approved: add `https://wordpress.org/plugins/rankwiz-ai/` to `sameAs` in `resources/views/app.blade.php`

---

## Post-Approval sameAs Update (reminder)

After the `.org` listing goes live, update `app.blade.php` Organization schema:
```php
'sameAs' => [
    'https://github.com/rankwiz',
    'https://twitter.com/rankwizai',
    'https://linkedin.com/company/rankwizai',
    // add when live:
    // 'https://wordpress.org/plugins/rankwiz-ai/',
    // 'https://profiles.wordpress.org/heatware/',
],
```