=== Mend Connect ===
Contributors: champlinenterprises
Tags: support, maintenance, access, remote support, login
Requires at least: 5.6
Tested up to: 6.7
Requires PHP: 7.4
Stable tag: 1.1.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Securely grant Mend (wpmend.com) one-click, revocable access to fix your WordPress site — no passwords to share.

== Description ==

Mend Connect is the secure way to give the Mend team access to fix your WordPress site. Instead of emailing FTP details or sharing your admin password, you install this plugin, paste the connection code from your Mend order, and click Connect.

* **No passwords shared.** Mend never sees or stores your login. The plugin creates one dedicated `mend_support` administrator account just for the engagement.
* **One-click, time-limited access.** Mend logs in through short-lived, single-use links signed with a secret shared only between your site and Mend, over HTTPS.
* **Revoke anytime.** Click "Revoke access" in the Mend menu — or simply delete the plugin — and the support account is removed immediately.
* **Full audit log.** Every time Mend requests or uses access, it's recorded in the plugin so you can see exactly what happened.

You need an active order at https://wpmend.com to get a connection code. Mend is a paid WordPress-fix service from Champlin Enterprises.

== How it works ==

1. Install and activate this plugin.
2. Open the **Mend** menu in your WordPress admin sidebar.
3. Paste the connection code from your Mend order page and click **Connect to Mend**.
4. When the fix is done, click **Revoke access** (or delete the plugin).

== External services ==

This plugin connects to **Mend** (https://wpmend.com), a paid WordPress-fix service operated by Champlin Enterprises, LLC. The plugin requires an active Mend order to function. It communicates with Mend in the following ways:

* **When you click "Connect to Mend":** the plugin sends your connection code, your site URL, and the plugin version to `https://wpmend.com/api/connect/claim` to pair your site with your Mend order.
* **On connect, and when Mend requests it:** the plugin sends a diagnostic snapshot to `https://wpmend.com/api/connect/snapshot` — your WordPress, PHP and database versions, active theme, the names of your active plugins and which ones have updates available, your server's memory/execution limits, whether HTTPS/multisite are in use, and the most recent lines of your `debug.log`. This helps the Mend engineers diagnose the problem. The plugin does **not** send your site content, customer data, post/page data, or any passwords.
* **When you click "Revoke access":** the plugin notifies `https://wpmend.com/api/connect/disconnect` that access has been revoked.
* **Inbound:** Mend can call this site's `/wp-json/mend/v1/` endpoints to request a one-time login link, a fresh diagnostic snapshot, or a restore point (a backup of your database + themes/plugins, media excluded — built on your server and offered back as a one-time download, never stored by Mend). Every such request must carry a valid HMAC-SHA256 signature created with a secret shared only between your site and Mend; unsigned or stale requests are rejected.

All communication is over HTTPS. Use of the Mend service is governed by its Terms of Service (https://wpmend.com/terms) and Privacy Policy (https://wpmend.com/privacy).

== Frequently Asked Questions ==

= Do I have to share my password? =
No. That's the whole point. The plugin creates a separate, dedicated `mend_support` administrator account, and Mend logs in through one-time links. Your own username and password are never shared with anyone.

= How do I remove Mend's access? =
Open the **Mend** menu in your dashboard and click **Revoke access**, or simply deactivate/delete the plugin. Either action removes the `mend_support` account immediately.

= Does access expire on its own? =
Yes. Access is time-limited on Mend's side and ends when your fix is complete. You can always revoke sooner.

= What data is sent to Mend? =
See the "External services" section above. In short: your site URL and a technical diagnostic snapshot — never your content or passwords.

= Does Mend back up my site before working on it? =
Yes — Mend works backup-first. Before any changes, our team can create a "restore point" — a backup of your database plus your themes and plugins (your media library is excluded to keep it fast, and stays safe on your host). It's built on your own server and offered back as a one-time, link-protected download. Mend doesn't store a copy.

== Changelog ==

= 1.1.0 =
* Restore points: Mend can now create a backup of your database + themes/plugins (media excluded) before any work, offered back as a one-time, link-protected download. The archive is built on your server and is not stored by Mend.

= 1.0.3 =
* Polished, on-brand redesign of the connect screen (branded header, clearer steps, refined input and buttons) and a warmer, more professional help message.

= 1.0.2 =
* Smoother onboarding: lands you on the Mend page right after activation, clearer step-by-step setup, and a help box with our phone number and a link to the step-by-step guide.

= 1.0.1 =
* Hardening pass: full output escaping, input sanitization, internationalization (i18n), and a complete external-services disclosure.

= 1.0.0 =
* Initial release: secure connect, one-time auto-login, diagnostics snapshot, audit log, one-click revoke.
