=== PHPReady ===
Contributors: marcos0811258
Tags: php, compatibility, updates, php 8, plugins
Requires at least: 6.4
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 0.1.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Helps find PHP 8.2 to 8.5 problems in plugins and themes with static analysis, which can miss problems and flag false ones. Holds back breaking updates.

== Description ==

PHPReady helps you find PHP 8.2 to 8.5 problems in your plugins and themes with static analysis, and holds back updates with known problems on your server's PHP version.

Static analysis reads code without running it. It can miss problems and it can flag false positives, so treat a result as a pointer to where to look, not a verdict. A clean result reads "No known problems found": the scanner found nothing it knows about, which is not proof that nothing is wrong.

The scanner runs inside PHP on your server. It does not need `exec()` or shell access.

**Tools > PHPReady**

* Your server: the PHP version running now, its end-of-life date and its support status.
* Scan: pick a PHP version from 8.2 to 8.5 and scan every installed plugin and theme. Scan skips items that already have a result for that version. Rescan all checks everything again.
* Results: one row per plugin or theme with its version and one verdict: No known problems found, Deprecation warnings, or Breaks.
* Held updates: updates the guard is holding back, each with an Update anyway button.
* Update guard: two settings, described below.
* Upgrade to Pro: plans and links.

**Plugins screen**

Each scanned plugin gets a link in its row that reads, for example, "PHP 8.3: no known problems". It opens Tools > PHPReady.

**End-of-life notice**

When the PHP version running on your site has reached end of life, or is close to it, administrators see a notice on the Dashboard and the Plugins screen. The notice names the version and its end-of-life date. You can dismiss it.

**Update guard**

When an update is offered, PHPReady downloads the package from WordPress's own update offer, scans it for the PHP version running on your server, stores the result and deletes the files. Two settings, both on by default, control what happens next:

* Hold updates with known problems: an automatic update is skipped when a stored scan found errors on your PHP version. A manual update from Dashboard > Updates is stopped, with the first findings and a link to Tools > PHPReady, where Update anyway lets it through once.
* Hold auto-updates until checked: an automatic update with no stored scan yet is not installed. You can still update it by hand.

To turn the guard off, open Tools > PHPReady, find the Update guard section, clear both checkboxes and choose Save settings.

**Upgrade to Pro**

The free plugin keeps every scan, result and update-guard feature. Pro adds a weekly rescan against the next PHP version with an email alert, a log of PHP deprecation notices grouped by plugin, a check whether a plugin from WordPress.org that fails a scan is fixed in a newer version, and an exportable client report.

Planned prices, not final: PHPReady Pro is $9/month per site. PHPReady Agency is $49/month for up to 25 sites, with the same features. Pricing and checkout are on brightlabs.app: https://brightlabs.app/apps/phpready/pro/ (Pro) and https://brightlabs.app/apps/phpready/ (Agency, sold by email). The plugin sends nothing to brightlabs.app; those pages open only when you click a link.

**Want it fixed for you?**

Under the scan results, one link opens a paid done-for-you PHP upgrade on Fiverr, from $35, tested on staging first. It is offered by the person behind Bright Labs, selling on Fiverr. The plugin sends nothing to Fiverr; the page opens only when you click the link.

== Installation ==

1. Upload the `phpready` folder to `/wp-content/plugins/`, or install it from the Plugins screen.
2. Activate the plugin.
3. Open Tools > PHPReady and choose Scan.

== Frequently Asked Questions ==

= Can static analysis be wrong? =

Yes. Static analysis reads code without running it, so it can miss problems, for example code that builds a function name while it runs. It can also flag false positives, for example code that checks the PHP version before it uses a newer feature. Use the findings to decide where to look, and test on a staging copy of your site before you rely on a result.

= Does it need exec() or shell access? =

No. The scanner runs inside PHP on your server. PHPReady does not call `exec()`, `shell_exec()` or any other shell command.

= Why was my auto-update held? =

One of two reasons:

1. A stored scan found errors for the PHP version your server is running, and "Hold updates with known problems" is on.
2. The update has not been checked yet, and "Hold auto-updates until checked" is on. The check runs once an hour through WP-Cron.

To see the findings, open Tools > PHPReady. The Held updates list shows each held update with its verdict, and the Results tables list the findings per plugin or theme. If you decide the update is fine, choose Update anyway in that list. That lets the one update through once; you then run it from Dashboard > Updates. To stop holding updates, clear the checkboxes in the Update guard section.

= Does it send data anywhere? =

No. It has no tracking and collects no data. The only network request it makes is downloading an update package that WordPress has offered, from the URL in that offer. See "External services".

= What happens when I uninstall it? =

Deleting the plugin drops the scan results table, deletes all its options, and the user meta that remembers a dismissed end-of-life notice, and removes the temp folder `wp-content/uploads/phpready-tmp/`. It also stops the hourly WP-Cron job.

== External services ==

PHPReady downloads update packages so it can check them against your server's PHP version before they install. It does this under these limits:

* It downloads only from the package URL in WordPress's own update offer. That is WordPress.org for plugins and themes hosted there, or the vendor's own server for plugins and themes that bring their own updates.
* It downloads only when WordPress has offered an update. With no update on offer, it makes no request.
* It sends nothing of its own with the request: no site data, no list of your plugins, no usage data.
* It unzips the package into `wp-content/uploads/phpready-tmp/`, scans it, stores the result in your database, and deletes the package and the unzipped files.
* If a package cannot be downloaded or unzipped, it tries again later and gives up after three tries for that update.

The server that hosts a package sees an ordinary download request from your site, the same as when WordPress downloads the update itself. For WordPress.org, see the privacy policy at https://wordpress.org/about/privacy/. For vendor servers, see that vendor's privacy policy.

== Credits ==

PHPReady bundles two open-source projects as its scan engine:

* PHP_CodeSniffer, licensed BSD-3-Clause: https://github.com/PHPCSStandards/PHP_CodeSniffer
* PHPCompatibility and PHPCSUtils, licensed LGPL-3.0-or-later: https://github.com/PHPCompatibility/PHPCompatibility

== Changelog ==

= 0.1.0 =
* First release: scan installed plugins and themes for PHP 8.2 to 8.5 problems, a verdict badge on the Plugins screen, a PHP end-of-life notice, and an update guard that holds back plugin and theme updates with known errors on this server's PHP version.

== Privacy ==

PHPReady sets no cookies, has no tracking and collects no personal data. The only external request is the download of an update package that WordPress has offered, described under "External services". On uninstall it removes its own `phpready_` options and its `phpready_results` table.
