=== RockStarUI Site Verifier ===
Tags: support, verification, ownership
Requires at least: 6.0
Requires PHP: 7.4
Stable tag: 1.0.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Confirms WordPress site ownership with a short-lived one-time token for RockStarUI support access.

== Description ==

RockStarUI Site Verifier is a temporary helper for clients who need to prove control of the WordPress site attached to a RockStarUI product claim.

The helper:

* Stores only a SHA-256 hash of the one-time token.
* Makes no outbound network requests.
* Exposes no customer, order, content, password, or license-key data.
* Deletes the token immediately after a successful check.

It returns only the site's public URLs, name, a random installation ID, its own version, and proof that the one-time token matched.

== Installation ==

1. In WordPress Admin, go to Plugins > Add New > Upload Plugin.
2. Upload this ZIP and activate RockStarUI Site Verifier.
3. Open Settings > RockStarUI Verification.
4. Paste the one-time token from the RockStarUI client area and save it.
5. Return to the client area and click Verify this site.
6. Deactivate and delete the helper after verification if you no longer need it.

== Frequently Asked Questions ==

= Does this plugin send site data to RockStarUI by itself? =

No. It makes no outbound requests. The RockStarUI portal presents the one-time token to the site's REST endpoint over HTTPS.

= What data does the endpoint return? =

Only the site's public home and WordPress URLs, site name, a random installation ID, helper version, and the hash of the matching one-time token.

= How long does the token remain active? =

The client-area challenge expires after 30 minutes. The local helper clears an unused token after 45 minutes and deletes it immediately when verification succeeds.

== Changelog ==

= 1.0.0 =

* Initial one-time WordPress site-ownership verification flow.
