=== WPGraft – Copy any web page into your page builder ===
Contributors: sasagugunovic
Tags: page builder, import, clone, copy, block editor
Requires at least: 6.0
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.0.2
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Copy any web page into Elementor, Bricks, Divi, Oxygen, Breakdance, Beaver Builder or Gutenberg as native, editable builder elements.

== Description ==

wpgraft copies a section of any public web page and rebuilds it inside your own
page builder — Elementor, the block editor (Gutenberg), Divi, Bricks, Beaver
Builder, Breakdance or Oxygen — not as an embedded screenshot, not as a block of
pasted HTML, but as the builder's own elements, with the styles written into the
builder's own fields. Once it lands you edit it the way you edit anything else
you built by hand.

This plugin is the WordPress half of that. The copying happens in the wpgraft
browser extension; this plugin receives the result, shows it in a panel inside
the editor, inserts it into the page you have open, and pulls the images and
fonts it needs into your Media Library.

**Supported editors**

* Block editor (WordPress core)
* Elementor — both the classic (v3) and the atomic (v4) document models
* Bricks
* Divi 5
* Beaver Builder
* Breakdance
* Oxygen 6 and Oxygen Classic

**What the plugin itself does**

* Adds a wpgraft panel inside the editor listing sections waiting to be inserted.
* Inserts a section into the open document using each builder's own data
  structures, so the result is editable natively — no shortcode, no iframe, no
  "do not edit this block" wrapper.
* Imports the images and web fonts a section needs into the Media Library and
  rewrites the references to point at your own copies, so the layout does not
  break when the source site changes.
* Registers REST routes under `wpgraft/v1`, each one gated on both a capability
  check and the `wp_rest` nonce.

**What it will never insert**

The plugin has no code editor and accepts no code from anyone. What arrives is
a page description the conversion service produced; before any of it is stored
the plugin removes every `script` element, event-handler attribute and PHP open
tag, empties every JavaScript field a builder element may have, and validates
every stylesheet statement by statement with the same rules WordPress applies
to its own Additional CSS (no markup, no executable URL, no `expression()`).
That happens for every user, administrators included, because the content was
copied off somebody else's page. On top of that, page-level CSS is only stored
for users who hold `edit_css` or `unfiltered_html` — the capability WordPress
itself requires for Additional CSS — and raw-HTML builder elements are only
kept for users who hold `unfiltered_html`; everyone else gets the section with
those parts removed and a warning saying so. Styles are written into each
builder's own fields, so you edit them where you edit everything else.

**What it does not do**

No account, no licence key, no options page to fill in — the settings screen is
a status readout and nothing else. Nothing in this plugin is metered, counted,
time-limited or held back for a paid plan: there is no licence check anywhere in
the code, no usage counter and no upgrade prompt. It inserts whatever the
extension hands it, on any site, for as long as you keep it installed. It stores
no data of its own beyond the queue of sections waiting to be inserted, reads no
visitor data, and writes nothing to your pages that you did not insert yourself.

**Requires an account with an external service**

This plugin is free software and always will be, but on its own it does nothing:
sections reach it from the wpgraft browser extension, and the extension converts
a captured page through the wpgraft conversion service, which requires an
account. That remote service is the part with a free tier and paid plans, and
the metering happens there — in the browser and on our server, before anything
reaches WordPress. See the section below for exactly what is sent where.

**Not affiliated with** Elementor, Bricks, Elegant Themes (Divi), Beaver
Builder, Soflyy (Oxygen, Breakdance) or any other builder vendor. Those names
appear here to describe compatibility, and they belong to their owners.

**Bundled resources.** The plugin ships the Cooper Hewitt typeface
(`assets/fonts/`), used only for the wordmark on its own settings screen, under
the SIL Open Font License 1.1 — the full text is in
`assets/fonts/LICENSE-OFL.txt`. Everything else in the plugin is GPLv2 or later.

== External services ==

This plugin is a companion to the wpgraft browser extension and the wpgraft
conversion service, operated by wpgraft (https://wpgraft.com).

**1. The wpgraft conversion service — used by the extension, not by this plugin.**
When you copy a section, the browser extension sends the captured HTML and CSS
of the page you chose to `https://wpgraft.com/api/convert`, together with your
account token, and receives the builder document that this plugin then inserts.
That request is made by the extension in your browser. This plugin does not make
it and does not hold your account credentials. The service is what the free tier
and the paid plans meter.

* Terms: https://wpgraft.com/terms
* Privacy policy: https://wpgraft.com/privacy

**2. Downloading the assets a copied section uses.** When a section references
images or web fonts, your WordPress site downloads them from the URLs the
capture recorded — usually the site you copied from — and stores them in your
Media Library. That traffic goes from your server to that site directly; it
does not pass through wpgraft. Only users who can already upload files can
trigger it, and only image and font bytes are accepted (SVG is refused
deliberately, because it can carry script).

This build of the plugin contacts wpgraft.com for nothing at all — updates come
from WordPress.org like any other plugin here.

== Installation ==

1. Install and activate this plugin.
2. Install the wpgraft browser extension for Chrome, and sign in.
3. Open the page you want to copy from, pick a section with the extension, and
   choose the site and builder to send it to.
4. Open the target page in your builder. The wpgraft panel lists what is
   waiting; insert it, and edit it like anything else.

The plugin needs no configuration. Settings → wpgraft shows which builder it
detected, whether the in-editor runtime loaded, and the REST base the extension
talks to — useful when something does not arrive.

== Screenshots ==

1. The copied section inside your builder's own editor — a real section with
   real fields, editable like anything you built by hand.
2. How a section gets from their page to yours: point at it, wpgraft rebuilds
   it into your builder's format, this plugin drops it into your open editor.
3. Picking the section on the source page with the browser extension.

== Frequently Asked Questions ==

= Which page builders does it work with? =

Elementor (both the classic v3 and the atomic v4 document models), Bricks,
Divi 5, Beaver Builder, Breakdance, Oxygen 6, Oxygen Classic, and the
WordPress block editor. Each one gets a document written in its own native
format, so a copied section arrives as Elementor widgets, Bricks elements,
Divi modules, Beaver Builder modules or core blocks — whichever builder you
opened.

= Do I need the browser extension? =

Yes. The plugin is the receiving end; nothing is copied without the extension.

= Is a copied section really editable? =

That is the point of it. Each builder gets its own document written in its own
format, with the styles in the builder's own style fields, so you edit, restyle
and delete the elements normally. Where a builder has no field for something the
source page did, the plugin says so rather than faking it with a raw HTML block.

= Does it work without the paid plan? =

The free tier includes a small number of conversions per account. The plugin
itself is not metered and has no licence check — the limit lives in the
conversion service the extension talks to.

= Does the plugin phone home? =

Not in the version distributed here. Update checks come from WordPress.org.

= Which user can use it? =

Inserting requires `edit_post` on the post being edited; importing assets
requires `upload_files`. Anything that writes raw HTML or CSS additionally
requires `unfiltered_html` / `edit_css`, so a contributor cannot smuggle markup
in through a copied section.

= Can a copied page inject JavaScript or PHP into my site? =

No. The plugin never stores or prints JavaScript or PHP for any user. Script
elements, event-handler attributes and PHP open tags are removed from every
copy before it is stored, the JavaScript field of every builder code element
is emptied, and every stylesheet is validated statement by statement. Links
that point at executable code (`javascript:` URLs) are disabled. Each of those
removals is reported in the editor panel so you know what was left out.

= Will it copy a whole page? =

Yes. Whole-page copies and section copies arrive through the same panel and are
inserted by the same code — this plugin treats them identically and puts no
limit on either. How many conversions of either kind your account may run is
decided by the remote conversion service.

== Changelog ==

= 1.0.2 =
* Sites installed from the wpgraft.com download are now offered new releases:
  the update check answers with the `version` field WordPress requires. A site
  running 1.0.0 or 1.0.1 from that download needs one manual update to get
  this; sites installed from WordPress.org are updated by WordPress.org and
  were never affected.

= 1.0.1 =
* Every copy is now scrubbed of script elements, event-handler attributes, PHP
  open tags and JavaScript fields before it is stored, for every user, and
  every stylesheet is validated statement by statement before it is saved.
* A copy whose only root element was a code block no longer bypasses the
  `unfiltered_html` gate on Breakdance and Oxygen.
* Oxygen 6's HTML Code and CSS Code elements are now covered by the same gate
  as the Breakdance Code Block.
* Stylesheets the plugin prints on the front end go through the WordPress
  style API instead of a hand-written `style` element; the settings screen's
  styling moved to a stylesheet file.

= 1.0.0 =
* First stable release. All ten builder targets supported: Gutenberg, Elementor
  (v3 and v4), Bricks, Breakdance, Divi 5, Beaver Builder, Oxygen 6 and
  Oxygen Classic.

= 0.1.2 =
* Beaver Builder and Divi 5 support.
* Elementor: both the classic (v3) and atomic (v4) document models are detected
  and written natively.
* Assets are matched by content, so re-importing a section reuses the
  attachments it already created.

= 0.1.1 =
* Block editor support, including per-instance custom CSS.
* Oxygen Classic: stylesheet writes normalised so the editor cannot be left
  hanging on load.

= 0.1.0 =
* First release: Bricks, Breakdance, Oxygen 6, Oxygen Classic and Elementor.

== Upgrade Notice ==

= 1.0.2 =
Fixes automatic updates for sites installed from wpgraft.com. Install this one by hand; later releases arrive on their own.

= 1.0.1 =
Hardening: script, PHP and invalid CSS are stripped from every copy for every user.

= 1.0.0 =
First stable release.

= 0.1.2 =
Adds Beaver Builder and Divi 5, and stops duplicate media on re-import.
