=== MotionSpec Motion Guard ===
Contributors: motionspec
Tags: accessibility, a11y, reduced-motion, wcag, animation
Requires at least: 5.6
Tested up to: 7.0
Requires PHP: 7.4
Stable tag: 0.1.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Find and fix motion-accessibility issues (WCAG 2.3.3 reduced-motion and 2.2.2 pause/stop) using the free MotionSpec API.

== Description ==

MotionSpec Motion Guard does two small, honest things:

1. **Scan** — from wp-admin, it asks the free MotionSpec motion-a11y audit
   (https://motionspec.dev/api) to check a public URL of your site and reports
   the score, the specific findings, and the suggested fix for each.

2. **Fix** — it can apply the exact mitigation MotionSpec recommends, on the
   front end, with no theme edits:
   * a site-wide **reduced-motion guard** (WCAG 2.3.3) that honors the
     visitor's operating-system "reduce motion" setting. It only changes
     anything for visitors who opted in, so it never alters your default
     design.
   * an optional **"Pause motion" control** (WCAG 2.2.2, Level A) that lets any
     visitor stop all animation.

**What this plugin is not.** It is an accessibility tool, not a security tool.
It does **not** protect against wp2shell / CVE-2026-63030 or any other
WordPress core vulnerability. The fix for those is to update WordPress core to
6.9.5 / 7.0.2 or later. Keep the two concerns separate.

**Privacy.** The scan sends only the URL you enter and your server's IP to the
MotionSpec endpoint; MotionSpec stores neither (URL and result are discarded;
the IP is held in memory for ~60s for rate-limiting only). The front-end fix
layer makes no network requests and stores nothing.

== Frequently Asked Questions ==

= Does this protect me from wp2shell / CVE-2026-63030? =
No. That is a WordPress **core security** bug (an unauthenticated RCE via the
REST batch endpoint). The fix is to update WordPress to 6.9.5 / 7.0.2 or later.
Motion Guard is an accessibility plugin and does not touch security.

= Will enabling the guard change how my site looks? =
No — not for regular visitors. The reduced-motion rules live inside an
`@media (prefers-reduced-motion: reduce)` query, so they only take effect for
visitors who have turned on "reduce motion" in their OS.

= My staging site can't be scanned. =
The MotionSpec API only scans publicly reachable URLs (it blocks
localhost/private/metadata hosts for SSRF safety). Scan the live URL, or run
the guard without scanning.

= A functional transition (e.g. an accordion) broke under reduced motion. =
Add its selector to "Exclude selectors" in the settings; it will keep its
motion even under the guard.

== Changelog ==

= 0.1.0 =
* Initial release: MotionSpec API scan in wp-admin, reduced-motion guard
  (WCAG 2.3.3), optional pause/stop control (WCAG 2.2.2), exclude selectors,
  configurable endpoint.
