WordPress.org
Get WordPress

Plugin Directory

Changeset 3488301


Ignore:
Timestamp:
03/22/2026 04:29:33 PM (6 days ago)
Author:
DaveFX
Message:

Versión 26.03.22 desde GitHub Actions

Location:
dfx-parish-retreat-letters
Files:
34 added
1 edited

Legend:

Unmodified
Added
Removed

  • dfx-parish-retreat-letters/trunk/readme.txt

    r3488281 r3488301  
    88License: GPLv3 or later
    99License URI: https://www.gnu.org/licenses/gpl-3.0.html
    10 Manage parish retreat programs with confidentiality, GDPR compliance, and user management.
    11 
    12 == DFX Parish Retreat Letters ==
    13 
    14 # DFX Parish Retreat Letters
    15 
    16 **Enterprise-Grade Retreat Management System for WordPress**
    17 
    18 A comprehensive, security-focused WordPress plugin designed for parishes and organizations to
    19 manage retreat programs with complete confidentiality, GDPR compliance, and advanced user management capabilities.
    20 
    21 ## Description
    22 
    23 DFX Parish Retreat Letters is a professional-grade retreat management system that provides churches and organizations
    24 with enterprise-level security and functionality for managing retreat programs. The plugin features a complete retreat
    25 lifecycle management system, secure confidential messaging with military-grade encryption, and a sophisticated three-tier
    26 authorization system designed to protect sensitive spiritual and personal communications.
    27 
    28 ## Core Features
    29 
    30 ### Comprehensive Retreat Management System
    31 - **Complete Retreat Lifecycle Management**: Create, edit, organize, and track retreats from planning to completion
    32 - **Advanced Date Management**: Flexible scheduling system with date tracking and conflict resolution
    33 - **Retreat Status Tracking**: Monitor retreat progress through customizable status workflows
    34 - **Multi-Retreat Organization**: Handle multiple concurrent retreats with separate management streams
    35 
    36 ### Advanced Attendant Management
    37 - **Complete Registration System**: Comprehensive attendant registration with personal information tracking
    38 - **Attendant-Retreat Associations**: Flexible assignment system linking attendants to multiple retreats
    39 - **Bulk Operations**: Import/export attendant data via CSV with data validation
    40 - **Personal Information Security**: Encrypted storage of sensitive personal data with GDPR compliance
    41 
    42 ### Secure Confidential Message System
    43 - **Privacy-Compliant Messaging**: Full adherence to Spanish privacy laws (LOPD-GDD) and European GDPR regulations
    44 - **Cryptographically Secure URLs**: Unique, unguessable URLs generated for each attendant using cryptographic tokens
    45 - **Military-Grade Encryption**: AES-256-CBC encryption for all message content and file attachments
    46 - **Public Submission Interface**: Rich text editor with file upload capabilities for attendant message submission
    47 - **Print-Only Backend Access**: Administrative interface shows no content preview - messages only accessible via secure printing
    48 - **Complete Audit Trails**: Comprehensive logging of all message operations, access attempts, and administrative actions
    49 - **Secure File Storage**: Encrypted file storage outside web directory with access control protection
    50 
    51 ### Three-Tier Authorization System
    52 - **Plugin Administrators**: Global access to all functionality with complete system control
    53 - **Retreat Managers**: Full control over assigned retreats with permission delegation capabilities
    54 - **Message Managers**: Specialized message-only access with read-only attendant information
    55 - **User Invitation System**: Email-based invitations with secure token authentication and role assignment
    56 - **Hierarchical Permissions**: Sophisticated permission inheritance with granular access control
    57 - **Complete Audit Logging**: Track all administrative actions with user attribution and timestamps
    58 
    59 ## Enterprise Security & Compliance
    60 
    61 ### Advanced Security Features
    62 - **Enterprise-Grade Encryption**: AES-256-CBC encryption for all sensitive data storage and transmission
    63 - **GDPR Full Compliance**: Complete implementation of European General Data Protection Regulation requirements
    64 - **Spanish Privacy Law Compliance**: Full adherence to LOPD-GDD (Ley Orgánica de Protección de Datos)
    65 - **Complete Input Validation**: Comprehensive sanitization and validation preventing SQL injection and XSS attacks
    66 - **CSRF Protection**: Cross-Site Request Forgery protection with WordPress nonce validation throughout the system
    67 - **Rate Limiting**: Advanced abuse protection with intelligent rate limiting on sensitive operations
    68 - **Comprehensive Audit Logging**: Complete audit trails for all administrative actions with forensic-level detail
    69 
    70 ### Privacy & Data Protection
    71 - **Right to be Forgotten**: Complete GDPR Article 17 implementation with secure data erasure
    72 - **Data Minimization**: Collect and store only necessary data with configurable retention policies
    73 - **IP Address Anonymization**: Automatic IP address anonymization after 30-day retention period
    74 - **Automated Data Cleanup**: Configurable data retention policies with automatic secure deletion
    75 - **Consent Management**: Integrated consent tracking and privacy policy compliance
    76 - **Data Export/Portability**: GDPR Article 20 compliance with secure data export functionality
    77 
    78 ## Technical Architecture
    79 
    80 ### WordPress Integration Excellence
    81 - **Custom Post Types**: Seamless integration with WordPress content management system
    82 - **Custom Database Tables**: Optimized database schema for retreat-specific data with proper indexing
    83 - **WordPress Capability System**: Deep integration with WordPress user roles and capabilities
    84 - **Email System Integration**: Native WordPress email system for secure invitations and notifications
    85 - **Internationalization Ready**: Complete i18n support with professional Spanish translations
    86 - **Responsive Admin Interface**: Modern, mobile-friendly administration interface with intuitive UX/UI
    87 
    88 ### Modern Development Standards
    89 - **Object-Oriented Architecture**: Clean, maintainable OOP design with singleton patterns for optimal performance
    90 - **Enterprise Design Patterns**: Implementation of proven design patterns for scalability and maintainability
    91 - **WordPress Coding Standards**: Full compliance with WordPress coding standards and best practices
    92 - **Modern PHP Requirements**: Built for PHP 7.4+ with support for latest PHP features and security standards
    93 - **Database Schema Management**: Automated database migrations with version control and rollback capabilities
    94 - **Security-First Development**: Security considerations integrated into every aspect of the codebase
    95 
    96 ## System Requirements
    97 
    98 ### Minimum Requirements
    99 - **WordPress**: 5.0 or higher (WordPress 6.0+ recommended for optimal performance)
    100 - **PHP**: 7.4 or higher (PHP 8.0+ recommended for enhanced security and performance)
    101 - **MySQL**: 5.6 or higher (MySQL 8.0+ or MariaDB 10.3+ recommended)
    102 - **Memory**: 256MB PHP memory limit minimum (512MB+ recommended for bulk operations)
    103 - **Disk Space**: 50MB minimum for plugin files and database storage
    104 
    105 ### Security Recommendations
    106 - **HTTPS Required**: SSL/TLS encryption mandatory for production environments
    107 - **Server Configuration**: Secure server configuration with proper file permissions
    108 - **WordPress Updates**: Keep WordPress core, themes, and plugins updated
    109 - **Database Security**: Secure database configuration with strong passwords and restricted access
    110 - **Backup Strategy**: Regular automated backups of database and uploaded files
    111 
    112 ## Installation & Setup
    113 
    114 ### Quick Installation
    115 1. **Download Plugin**: Download the latest release from the official repository
    116 2. **Upload to WordPress**: Upload the `dfx-parish-retreat-letters` folder to `/wp-content/plugins/`
    117 3. **Activate Plugin**: Activate through the WordPress 'Plugins' admin menu
    118 4. **Database Setup**: Plugin automatically creates required database tables on activation
    119 5. **Initial Configuration**: Access plugin settings to configure basic parameters
    120 
    121 ### Post-Installation Setup
    122 
    123 #### 1. Administrator Configuration
    124 - Navigate to **DFX Retreat Letters** in WordPress admin menu
    125 - Configure global plugin settings and security parameters
    126 - Set up email templates for invitations and notifications
    127 - Configure data retention and privacy compliance settings
    128 
    129 #### 2. Permission System Setup
    130 - Create initial Plugin Administrators through WordPress user management
    131 - Set up Retreat Manager roles for retreat-specific administration
    132 - Configure Message Manager roles for confidential message access
    133 - Test invitation system with secure token generation
    134 
    135 #### 3. Security Configuration
    136 - Verify HTTPS is properly configured and enforced
    137 - Configure secure file storage directory outside web root
    138 - Set up backup procedures for encrypted data
    139 - Review and configure rate limiting settings
    140 
    141 #### 4. GDPR Compliance Setup
    142 - Configure data retention policies according to local regulations
    143 - Set up privacy policy integration
    144 - Configure consent management settings
    145 - Test data export and erasure functionality
    146 
    147 ## Usage Guide
    148 
    149 ### For Plugin Administrators
    150 
    151 #### Creating and Managing Retreats
    152 - **Retreat Creation**: Create new retreats with comprehensive details including dates, descriptions, and capacity limits
    153 - **Retreat Organization**: Organize retreats by categories, dates, and status for efficient management
    154 - **Attendant Registration**: Set up registration forms and manage attendant information securely
    155 - **Message URL Configuration**: Generate cryptographically secure URLs for confidential message submission
    156 
    157 #### User Permission Management
    158 - **Invite Users**: Send secure email invitations with role-specific access tokens
    159 - **Assign Roles**: Delegate specific retreat management or message access permissions
    160 - **Monitor Access**: Review user activity and access logs through comprehensive audit trails
    161 - **Revoke Access**: Instantly revoke user permissions with complete session invalidation
    162 
    163 ### For Retreat Managers
    164 
    165 #### Managing Assigned Retreats
    166 - **Retreat Administration**: Full control over assigned retreats including attendant management
    167 - **Attendant Operations**: Add, edit, and manage attendant information with bulk import/export capabilities
    168 - **Message Management**: Access confidential messages through secure print-only interface
    169 - **Permission Delegation**: Invite and assign Message Managers for specific retreat message handling
    170 
    171 #### Advanced Attendant Features
    172 - **CSV Import/Export**: Bulk attendant operations with data validation and error reporting
    173 - **Personal Information Security**: View and manage encrypted personal data with audit logging
    174 - **Communication Tracking**: Monitor message submission and printing activity
    175 
    176 ### For Message Managers
    177 
    178 #### Confidential Message Operations
    179 - **Secure Message Access**: View submitted confidential messages through print-only interface
    180 - **Print Tracking**: All message printing activities are logged with timestamp and user attribution
    181 - **Attendant Information**: Read-only access to attendant details for message context
    182 - **Audit Compliance**: Complete audit trail of all message access and printing operations
    183 
    184 #### Privacy Protection Features
    185 - **No Content Preview**: Administrative interface prevents content display for maximum privacy
    186 - **Secure Printing**: Encrypted message content only accessible through controlled printing system
    187 - **Access Logging**: All message access attempts logged for security and compliance
    188 
    189 ## Developer Information
    190 
    191 ### Plugin Architecture
    192 
    193 #### Database Schema
    194 The plugin creates and manages several custom database tables:
    195 
    196 - **`{prefix}_dfx_prl_retreats`**: Core retreat information with status tracking
    197 - **`{prefix}_dfx_prl_attendants`**: Encrypted attendant personal information
    198 - **`{prefix}_dfx_prl_confidential_messages`**: AES-256 encrypted message content
    199 - **`{prefix}_dfx_prl_message_files`**: Encrypted file attachments with secure storage
    200 - **`{prefix}_dfx_prl_message_print_log`**: Comprehensive audit trail for message printing
    201 - **`{prefix}_dfx_prl_retreat_permissions`**: Three-tier authorization system data
    202 - **`{prefix}_dfx_prl_retreat_invitations`**: Secure invitation token management
    203 
    204 #### Core Classes and Design Patterns
    205 
    206 ```php
    207 // Main plugin singleton
    208 DFXPRL::get_instance()
    209 
    210 // Security and encryption utilities
    211 DFXPRL_Security::get_instance()
    212 
    213 // GDPR compliance management
    214 DFXPRL_GDPR::get_instance()
    215 
    216 // Three-tier permission system
    217 DFXPRL_Permissions::get_instance()
    218 
    219 // Database operations
    220 DFXPRL_Database::get_instance()
    221 ```
    222 
    223 #### Security Implementation Details
    224 
    225 ##### Encryption Methods
    226 - **Algorithm**: AES-256-CBC with HMAC-SHA256 authentication
    227 - **Key Management**: WordPress-integrated key derivation with salt rotation
    228 - **File Encryption**: Separate encryption keys for file contents and metadata
    229 
    230 ##### Permission System
    231 ```php
    232 // Check user permissions for retreat access
    233 $permissions->can_user_manage_retreat($user_id, $retreat_id)
    234 
    235 // Verify message manager access
    236 $permissions->can_user_access_messages($user_id, $retreat_id)
    237 
    238 // Audit logging for all permission checks
    239 $audit->log_permission_check($user_id, $action, $resource_id)
    240 ```
    241 
    242 #### Extension Points for Developers
    243 
    244 ##### Custom Hooks and Filters
    245 ```php
    246 // Customize encryption parameters
    247 add_filter('dfx_prl_retreat_letters_encryption_config', $callback);
    248 
    249 // Extend GDPR compliance features
    250 add_action('dfx_prl_retreat_letters_gdpr_data_export', $callback);
    251 
    252 // Customize permission logic
    253 add_filter('dfx_prl_retreat_letters_user_permissions', $callback);
    254 
    255 // Extend audit logging
    256 add_action('dfx_prl_retreat_letters_audit_log', $callback);
    257 ```
    258 
    259 ##### API Endpoints
    260 The plugin provides secure REST API endpoints for:
    261 - Retreat management operations
    262 - Attendant data handling (with encryption)
    263 - Secure message submission
    264 - Permission verification
    265 - Audit log access (admin only)
    266 
    267 ### Security Best Practices Implemented
    268 
    269 - **Input Validation**: Comprehensive sanitization using WordPress standards
    270 - **SQL Injection Prevention**: Prepared statements and WordPress database abstraction
    271 - **Cross-Site Scripting (XSS) Protection**: Output escaping and Content Security Policy headers
    272 - **Cross-Site Request Forgery (CSRF) Protection**: WordPress nonce validation throughout
    273 - **Data Encryption**: AES-256-CBC for all sensitive data at rest
    274 - **Secure Communications**: HTTPS enforcement and secure token generation
    275 - **Audit Logging**: Complete forensic-level activity logging
    276 
    277 ## Plugin Structure
    278 
    279 ```
    280 dfx-parish-retreat-letters/
    281 ├── dfx-parish-retreat-letters.php    # Main plugin file and initialization
    282 ├── includes/                         # Core plugin classes
    283 │   ├── class-dfx-parish-retreat-letters.php    # Main plugin singleton
    284 │   ├── class-admin.php                          # Administrative interface
    285 │   ├── class-database.php                      # Database management
    286 │   ├── class-security.php                      # Encryption and security
    287 │   ├── class-permissions.php                   # Three-tier authorization
    288 │   ├── class-retreat.php                       # Retreat management
    289 │   ├── class-attendant.php                     # Attendant operations
    290 │   ├── class-confidential-message.php          # Secure messaging
    291 │   ├── class-message-file.php                  # Encrypted file handling
    292 │   ├── class-print-log.php                     # Print audit logging
    293 │   ├── class-gdpr.php                          # GDPR compliance
    294 │   ├── class-invitations.php                   # User invitation system
    295 │   ├── class-i18n.php                          # Internationalization
    296 │   └── admin.js                                # Admin interface scripts
    297 ├── languages/                        # Translation files
    298 │   ├── dfx-parish-retreat-letters.pot          # Translation template
    299 │   ├── dfx-parish-retreat-letters-es_ES.po     # Spanish translation
    300 │   └── dfx-parish-retreat-letters-es_ES.mo     # Compiled Spanish translation
    301 ├── uninstall.php                     # Clean uninstallation procedures
    302 ├── LICENSE                           # GPL v3 license
    303 └── README.md                         # This comprehensive documentation
    304 ```
    305 
    306 ## Internationalization
    307 
    308 The plugin is fully translation-ready and includes professional translations:
    309 
    310 - **English (en_US)**: Default language with complete interface coverage
    311 - **Spanish (es_ES)**: Professional translation for Spanish-speaking parishes
    312 - **Translation Template**: Complete `.pot` file for additional language translations
    313 
    314 ### Adding New Languages
    315 1. Use the provided `dfx-parish-retreat-letters.pot` template
    316 2. Create new `.po` and `.mo` files for your target language
    317 3. Place translation files in the `languages/` directory
    318 4. Follow WordPress translation standards and guidelines
    319 
    320 ## License
    321 
    322 This plugin is licensed under the **GNU General Public License v3.0 or later**.
    323 
    324 - **Freedom to Use**: Use the plugin for any purpose, including commercial applications
    325 - **Freedom to Study**: Access to complete source code and documentation
    326 - **Freedom to Modify**: Modify the plugin to meet your specific requirements
    327 - **Freedom to Distribute**: Share the plugin with others under the same license terms
    328 
    329 For complete license terms, see [LICENSE](LICENSE) file or visit [GNU GPL v3](https://www.gnu.org/licenses/gpl-3.0.html).
    330 
    331 ## Author & Support
    332 
    333 **David Marín Carreño (DaveFX)**
    334 - **Website**: [davefx.com](https://davefx.com)
    335 - **GitHub Profile**: [@davefx](https://github.com/davefx)
    336 - **Project Repository**: [dfx-parish-retreat-letters](https://github.com/davefx/dfx-parish-retreat-letters)
    337 - **Issue Tracking**: Report bugs and feature requests through GitHub Issues
    338 - **Documentation**: Complete documentation available in this README
    339 
    340 ### Contributing
    341 Contributions are welcome! Please:
    342 1. Fork the repository
    343 2. Create a feature branch
    344 3. Submit a pull request with detailed description
    345 4. Follow WordPress coding standards
    346 5. Include appropriate tests and documentation
     10Manage personal messages in parish retreats: attendants, confidential messages, permissions, and GDPR compliance — all in one place.
     11
     12== Description ==
     13
     14DFX Parish Retreat Letters lets your parish manage the full lifecycle of confidential personal messages for retreat attendants — from collecting letters through a public web form to printing them securely in the admin, while keeping every piece of content fully encrypted and every action fully audited.
     15
     16= How it works =
     17
     181. **Create a retreat** and register your attendants.
     192. **Share each attendant's unique, private URL** with the people who want to write to them — family, friends, spiritual directors.
     203. **Writers fill in the form** on a clean public page: they can type a rich-text message, attach images or documents, and agree to a legal disclaimer. A simple arithmetic CAPTCHA protects against bots.
     214. **Messages are stored encrypted** in the database. Nobody can read them by browsing the admin — they are only revealed at print time.
     225. **Authorised staff print the messages** from the admin panel. Each print is logged with the user's name, timestamp, and IP address.
     236. **Messages are handed to attendants** during or after the retreat.
     24
     25= Retreat management =
     26
     27* Create retreats with name, location, start and end dates, and a custom welcome message shown on the submission form.
     28* Set a legal disclaimer text and an acceptance checkbox label that writers must tick before they can submit.
     29* Enable or disable optional **Notes** and **Internal Notes** fields per retreat (Notes are exportable; Internal Notes are not).
     30* Set custom **body CSS classes** on the message-form page per retreat, so each retreat can use a different visual style.
     31* Choose a custom **header block** and **footer block** (any WordPress block or template part) to brand the submission form page.
     32* Delete a retreat together with all its attendants and messages in one action.
     33
     34= Attendant management =
     35
     36* Add attendants individually or **import them from a CSV file** (supports merge mode to add emergency-contact data without overwriting existing records).
     37* Each attendant stores: name, surnames, date of birth, and the following optional fields — notes, internal notes, emergency-contact details (name, surnames, relationship, email), inviting person, and incompatibilities.
     38* **Export attendants to CSV** including their unique message URL, message count, and all standard fields.
     39* Sort and filter the attendant list by name, message count, notes, or any other available column.
     40* The attendant list shows at a glance how many messages each person has received and how many have not yet been printed.
     41* Delete individual attendants, or remove all attendants from a retreat at once.
     42
     43= Confidential message submission (public form) =
     44
     45* Each attendant has a **unique, cryptographically secure URL** (based on a random token). Anyone with the link can submit a message without logging in to WordPress.
     46* The submission form provides a **rich-text editor** (with formatting, images, and copy-paste from Word or Google Docs).
     47* Writers can attach **images and documents** (PDF, DOCX, and other common types). If a message has multiple non-image files, they are bundled into a ZIP for printing.
     48* An optional **legal disclaimer** with a configurable acceptance checkbox can be required before submission.
     49* A simple **arithmetic CAPTCHA** prevents automated submissions. Logged-in WordPress users skip the CAPTCHA.
     50* The form URL includes the attendant's initials as a suffix for easy identification when sharing links, without exposing the full name.
     51* **Rate limiting** (20 requests per hour per IP) prevents abuse.
     52
     53= Secure message access and printing =
     54
     55* The admin interface **never displays message content** — there is no content-preview panel. This protects confidentiality if a screen is visible to others.
     56* Authorised users open a message and click **Print**. The plugin decrypts the content on the fly, renders it in a print-ready format with the recipient's name and the sender's name, and sends it to the printer.
     57* Each print action is recorded in a **print log** (user, timestamp, IP address). The log is visible from the attendant's message list.
     58* Multiple images in a single message are laid out so they do not split across pages.
     59
     60= Three-tier permission system =
     61
     62The plugin uses three access levels, each scoped to specific retreats:
     63
     64**Plugin Administrators** (WordPress users with the `manage_retreat_plugin` capability, automatically granted to WordPress Administrators):
     65
     66* Create and delete retreats.
     67* Manage all attendants and all messages across all retreats.
     68* Grant or revoke permissions for any retreat.
     69* Access Global Settings and Privacy & Compliance pages.
     70
     71**Retreat Managers** (assigned per retreat):
     72
     73* Full control of their assigned retreat: edit retreat details, manage attendants, access all messages.
     74* Invite and assign Message Managers to their retreat.
     75* Cannot access other retreats or global settings.
     76
     77**Message Managers** (assigned per retreat):
     78
     79* Read-only access to attendant names for context.
     80* Can open and print confidential messages for their retreat.
     81* Cannot edit attendants, retreat details, or permissions.
     82* All print actions are logged.
     83
     84= User invitations =
     85
     86* Invite any email address to become a Retreat Manager or Message Manager for a specific retreat directly from the retreat's **Access Management** tab.
     87* The invitee receives an email with a secure, time-limited token link.
     88* If the email address already belongs to a WordPress user, they are granted the role immediately on acceptance. If not, a new WordPress account is created for them.
     89* Pending invitations can be cancelled at any time. Expired invitations are cleaned up automatically.
     90
     91= Encryption and data security =
     92
     93* All message content and file attachments are encrypted with **AES-256-CBC** and authenticated with HMAC-SHA256 before being written to the database or disk.
     94* Encrypted files are stored **outside the web root**, so they cannot be accessed directly via a browser.
     95* The encryption key is generated automatically on first activation and stored in the database. An admin notice prompts you to move it to `wp-config.php` by defining the constant `DFXPRL_ENCRYPTION_KEY` for better security. If the constant and the database key ever differ, the plugin detects the mismatch and offers a one-click resolution.
     96* Every sensitive admin action (permission grants, revocations, invitation events) is written to a **permission audit log**.
     97
     98= GDPR and privacy compliance =
     99
     100* **Right to Erasure** (GDPR Article 17): delete all personal data for a specific email address or attendant in one action.
     101* **Data Portability** (GDPR Article 20): export all personal data associated with an email address as a structured file.
     102* **IP address anonymisation**: sender IP addresses are automatically anonymised after a configurable retention period (default 30 days). A daily WordPress cron job handles the cleanup.
     103* **Configurable data retention**: set how long messages and audit log entries are kept before automatic deletion.
     104* **Spanish privacy law (LOPD-GDD)**: the plugin was designed with Spanish data-protection requirements in mind, in addition to GDPR.
     105* All settings are found under **Retreats > Privacy & Compliance**.
     106
     107= Global settings =
     108
     109Under **Retreats > Global Settings** you can configure:
     110
     111* Default header and footer blocks for the message submission form (overridable per retreat).
     112* Default body CSS classes for the submission form page.
     113* Encryption key management (including the option to remove a database-stored key in favour of the `wp-config.php` constant).
     114
     115= Internationalisation =
     116
     117* The plugin ships with a complete **Spanish (es_ES)** translation.
     118* A `.pot` template file is included so you can add your own language.
     119* The public submission form uses informal Spanish ("tú") for a friendlier tone.
     120
     121== Installation ==
     122
     1231. Upload the `dfx-parish-retreat-letters` folder to `/wp-content/plugins/`.
     1242. Activate the plugin through the WordPress **Plugins** menu.
     1253. The plugin automatically creates all required database tables on activation.
     1264. Navigate to **Retreats** in the WordPress admin sidebar to get started.
     127
     128= Recommended post-installation steps =
     129
     1301. Go to **Retreats > Global Settings** and review the default header, footer, and body-class settings for the submission form.
     1312. Go to **Retreats > Privacy & Compliance** and configure data-retention periods to match your local legal requirements.
     1323. For production sites, add the following line to `wp-config.php` to store the encryption key outside the database:
     133   `define( 'DFXPRL_ENCRYPTION_KEY', 'your-long-random-secret-here' );`
     134   Replace the placeholder with a long, cryptographically random string — for example one generated by `wp_generate_password( 64, true, true )` in the WordPress shell, or by an equivalent secure random generator. The plugin will display a notice reminding you to do this if the key is still in the database.
     1354. Verify that your site uses HTTPS. The submission form URLs contain sensitive tokens and must be served over a secure connection.
     136
     137== Frequently Asked Questions ==
     138
     139= Who can see the content of submitted messages? =
     140
     141Nobody can read message content by browsing the admin interface. Content is only revealed at print time, and only to users who have the Retreat Manager or Message Manager role for that retreat. Every print is logged.
     142
     143= How do writers submit messages without a WordPress account? =
     144
     145Each attendant has a unique, cryptographically secure URL. You share that URL (e.g. by email or WhatsApp) with the people who want to write to the attendant. They open the link in any browser, fill in the form, and submit — no login required.
     146
     147= What happens to the submission form URL after the retreat? =
     148
     149The URL remains valid until you delete the attendant or the retreat. If you want to stop accepting new messages, you can delete the attendant's token by deleting and re-adding the attendant, or by deleting the retreat entirely.
     150
     151= Does the plugin use WordPress Custom Post Types or pages? =
     152
     153No. All data is stored in custom database tables (prefixed `{prefix}dfxprl_*`, e.g. `wp_dfxprl_retreats`). The public submission form is served directly by the plugin using a rewrite rule — you do not need to create any WordPress page.
     154
     155= Can I customise the look of the submission form? =
     156
     157Yes. You can set a custom WordPress block as the header and footer of the form page — globally under **Retreats > Global Settings**, or per retreat on the retreat edit screen. You can also add custom CSS body classes per retreat.
     158
     159= What file types can writers attach? =
     160
     161Common image formats (JPG, PNG, GIF, WebP), PDF, DOCX, and other document types supported by your server. The maximum file size is determined by your PHP and server configuration and is shown on the form. If a message contains multiple files and at least one is not an image, a ZIP archive is generated for printing.
     162
     163= Is the plugin GDPR-compliant? =
     164
     165Yes. It implements GDPR Articles 17 (Right to Erasure) and 20 (Data Portability), anonymises sender IP addresses after a configurable period, and supports configurable data-retention policies with automatic deletion. All settings are under **Retreats > Privacy & Compliance**.
     166
     167= Where is the encryption key stored? =
     168
     169By default it is generated automatically and stored in the WordPress database (`wp_options`). The plugin will display an admin notice recommending that you move it to `wp-config.php` by defining the `DFXPRL_ENCRYPTION_KEY` constant. The wp-config.php approach is safer because the key is then separate from the encrypted data.
     170
     171= Can I add translations for my language? =
     172
     173Yes. A `.pot` translation template is included in the `languages/` directory. Create `.po` and `.mo` files for your language and place them in that folder following standard WordPress translation conventions.
    347174
    348175## Changelog
Note: See TracChangeset for help on using the changeset viewer.