=== Watrix Freedom Pages ===
Contributors: watrix
Tags: static, html, landing-page, raw-html, ai
Requires at least: 6.0
Tested up to: 7.0
Requires PHP: 7.4
Stable tag: 1.0.1
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Serve static files under custom URL paths (Freedom Paths) and publish raw HTML pages (Freedom Pages) without theme interference.

== Description ==

Watrix Freedom Pages gives you two simple but powerful ways to publish content outside your theme.

= Feature 1: Freedom Paths =

Register any URL path (for example `/lp/summer-campaign/01/`) from the admin. The plugin creates a directory under `wp-content/uploads/watrix-freedom/<path>/` and serves any file you place there as if WordPress weren't there at all. No `.htaccess` editing is required — routing is handled in PHP, so the same plugin works on Apache, Nginx, and LiteSpeed without configuration.

* Drop files via FTP or use the built-in admin uploader.
* MIME types are detected and sent for HTML, CSS, JS, JSON, images, fonts, PDF, audio, and video.
* PHP and other executable file types are denied for both upload and serve.
* ETag and Last-Modified headers are sent so browsers / CDN can cache properly.

= Feature 2: Freedom Pages (raw HTML CPT) =

Create a new "Freedom Page" from the admin and paste any HTML — including HTML generated by an AI tool such as ChatGPT. The front-end output skips the theme entirely. The post content is rendered verbatim: no `the_content` filter, no embeds rewrite, no Gutenberg blocks. If your HTML already starts with `<!DOCTYPE html>` or `<html>`, the plugin outputs it byte for byte. Otherwise it wraps your snippet in a minimal HTML shell with charset and viewport.

* URL: `/freedom/<slug>/`
* Publishing requires both `manage_options` and core's `unfiltered_html` capability.
* The editor is a plain monospaced textarea (no TinyMCE auto-formatting).

== Installation ==

1. Upload the plugin to `wp-content/plugins/` or install it from Plugins > Add New, then activate it.
2. From the admin sidebar open Freedom Pages > 自由パス to register a URL path. Place files in the shown directory or use the uploader.
3. To publish a raw HTML page, open Freedom Pages > 自由ページ and create a new entry.

== Frequently Asked Questions ==

= Will this rewrite my .htaccess file? =

No. Routing is done in PHP on the `parse_request` hook, so we never touch your server configuration. There is no risk of an `.htaccess` typo taking the site down.

= Can I serve PHP files from a Freedom Path? =

No. Executable extensions (`.php`, `.phtml`, `.phar`, `.cgi`, `.py`, `.sh`, etc.) are denied for both upload and serve, including double extensions like `shell.php.png`.

= Who can publish Freedom Pages? =

Only users who hold **both** `manage_options` and WordPress core's own `unfiltered_html` capability.

`unfiltered_html` is the capability core itself uses to decide whether a user's post content survives `wp_kses_post` unmodified. By gating on it, this plugin can never publish markup that core would not already have published for the same user in an ordinary post:

* On single-site installs, Administrators hold `unfiltered_html`; Editors hold it too, but this plugin stays narrower than core and additionally requires `manage_options`.
* On multisite, only Super Admins hold `unfiltered_html`, so site Administrators cannot publish Freedom Pages.
* If the site defines `DISALLOW_UNFILTERED_HTML`, no one holds it, and Freedom Pages and HTML/JS/SVG uploads are disabled for everyone — automatically, with no plugin-specific setting to configure. Content saved by a user without the capability falls through to core's normal `wp_kses_post` filtering.

= Does the same rule apply to uploads? =

Yes for browser-executed types. Uploading `.html`, `.htm`, `.js`, `.mjs`, `.svg`, or `.xml` through the Freedom Path uploader requires `unfiltered_html` in addition to `manage_options`. Static assets (images, fonts, CSS, PDF, audio, video) require `manage_options` only, matching what core already lets an administrator upload to the Media Library.

= Are uploaded files added to the Media Library? =

No. Freedom Path files live in a separate directory (`uploads/watrix-freedom/`) and do not appear in the Media Library. This keeps standalone landing pages decoupled from regular site content.

= What happens when I uninstall the plugin? =

The plugin option is removed. Posts of the Freedom Page CPT and files in `uploads/watrix-freedom/` are kept, so you can re-activate later without losing work. Delete them manually if you want a clean slate.

== Screenshots ==

1. Freedom Paths settings screen (registered paths with uploader). / 自由パス設定画面。
2. Adding a new Freedom Path. / 新規パスの追加。
3. A static landing page served from a Freedom Path. / Freedom Pathから配信される静的LP。
4. Freedom Page CPT editor with raw HTML textarea. / 自由ページの編集画面。
5. A Freedom Page rendered on the front end with no theme. / テーマを介さず表示される自由ページ。

== Changelog ==

= 1.0.1 =
* Security/permissions: publishing a Freedom Page, and uploading browser-executed files (`.html`, `.htm`, `.js`, `.mjs`, `.svg`, `.xml`), now require WordPress core's `unfiltered_html` capability in addition to `manage_options`. This makes the plugin's permission model identical to core's own rule for raw markup in post content: site Administrators on multisite no longer qualify (only Super Admins do), and defining `DISALLOW_UNFILTERED_HTML` disables the feature for everyone with no plugin-specific setting.
* Content saved by a user without `unfiltered_html` now falls through to core's standard `wp_kses_post` filtering instead of being stored verbatim.
* Admin notices explain the capability requirement on both the Freedom Page editor and the uploader.

= 1.0.0 =
* Initial release. Freedom Paths (static file routing under custom URLs) and Freedom Pages (raw-HTML CPT, theme-bypassed) shipped together.

== Upgrade Notice ==

= 1.0.1 =
Permission model now follows core's `unfiltered_html`. On multisite, site Administrators can no longer publish Freedom Pages — only Super Admins can.

= 1.0.0 =
First release.
