=== thinQit Nora ===
Contributors: thinqit
Tags: security, vulnerabilities, updates, woocommerce, monitoring
Requires at least: 5.8
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 2.1.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Nora, thinQit's website security teammate: free site check, one click connect, security score and approvals for big updates.

== Description ==

Nora watches the software on your site (WordPress core, plugins, themes, WooCommerce) for known vulnerabilities, applies safe updates one at a time and asks for your approval before she touches anything big.

This plugin is Nora's seat inside WordPress:

* **Free site check.** No account needed. Nora reads your public pages and compares what she finds with known advisories.
* **One click connect.** Press "Connect to thinQit", sign in, pick a Nora seat, and your site is paired. No copying of secrets.
* **Your security score** with findings, what Nora patched and what is next.
* **Approve or decline** big updates right in your admin, with a confirm step.
* **Safe by design.** Nora only talks to your site with signed requests. She installs one exact version of one component from wordpress.org at a time, checks the site afterwards and can roll back. She never runs code she receives, never changes users, settings or database tables.
* **WooCommerce aware.** Works on shops, declares compatibility with High-Performance Order Storage.
* English and Dutch included. No tracking, nothing is loaded from third-party CDNs.

Nora is a paid thinQit service (EUR 25 a month). The free check works without one.

== External services ==

This plugin connects to thinQit, the service that runs Nora. It is the only external service the plugin contacts, at https://app.thinqit.io.

**Free site check.** When you press "Check my site for free", the plugin sends your site address (home URL) and the admin language (en or nl) to thinQit. thinQit then reads your public pages and returns a summary of the detected platform, plugins and known advisories. Nothing is sent until you press the button.

**Connect to thinQit.** When you press "Connect to thinQit", your browser opens thinQit with your site address, the address of this plugin's signed endpoint, the platform (WordPress or WooCommerce), the plugin version, the admin language and a one time pairing challenge. After you confirm at thinQit, the plugin sends the one time pairing code, the pairing verifier, a new random secret, the site address, the endpoint, the platform and the plugin version to thinQit to finish pairing. The secret lets thinQit sign requests to your site. It is stored in your database and shown only to administrators.

**While connected.** The admin panel asks thinQit for the status of your site (score, findings, pending approvals) when you open the Nora page, at most once a minute. When you approve or decline an update, the plugin sends that decision. "Disconnect" tells thinQit to remove the pairing. thinQit also sends signed requests to your site's `/wp-json/nora/v1/` endpoints to read installed versions and, for updates you allowed, to install one exact version from wordpress.org.

Service provider: thinQit. Privacy policy: https://www.thinqit.io/privacy-policy. Terms of service: https://www.thinqit.io/terms-of-service.

Vulnerability data shown by the free check comes from public sources such as Wordfence Intelligence, OSV and the CISA KEV catalogue; the sources are named in each result.

== Installation ==

1. Upload the plugin through Plugins, Add New, Upload Plugin, or install it from the WordPress plugin directory, then activate it.
2. Open "thinQit Nora" in the admin menu.
3. Run the free check, or press "Connect to thinQit" to pair your site with a Nora seat.

The site must be reachable over https.

== Frequently Asked Questions ==

= Do I need a thinQit account? =

Not for the free check. To connect the site and let Nora watch and patch, you sign in at thinQit and pick a Nora seat.

= Does the plugin change my site on its own? =

No. Updates are applied only when Nora, after your approval where required, sends a signed request, and only as one exact version from wordpress.org.

= How do I disconnect? =

Press "Disconnect" in the Nora panel, or deactivate the plugin. Deleting the plugin removes everything it stored.

= Can I connect with a secret instead? =

Yes. Open "Advanced: connect with a secret" in the panel, show the secret and paste it into the connection step in thinQit.

== Changelog ==

= 2.1.0 =
* The plugin folder and slug are now thinqit-nora (it was thinqit-nora-helper). Deactivate and delete the old thinqit-nora-helper copy after installing this one; the connection settings are kept.
* Failed calls to the signed endpoints are throttled per client address only, so a valid signed request from Nora is never refused by the throttle. A body over 64 KB answers 413.

= 2.0.0 =
* New admin panel under "thinQit Nora": free site check, one click connect, score, findings, approvals.
* Dutch translation. WooCommerce HPOS compatibility declared.
* Existing signed endpoints and safety rules are unchanged. The manual secret flow moved to "Advanced".

= 1.0.1 =
* The wordpress.org update data is fetched once when it is missing.

= 1.0.0 =
* First release.

== Upgrade Notice ==

= 2.0.0 =
If you have the older thinqit-nora-helper folder installed, deactivate and delete it after installing this version; settings are kept. Adds the Nora panel and one click connect. Existing connections keep working.
