{
    "name": "R2 Coming Soon",
    "slug": "r2-coming-soon",
    "version": "1.1.0",
    "requires": "6.0",
    "tested": "6.7",
    "requires_php": "8.0",
    "author": "<a href='https://rise2.studio'>RISE2 Studio</a>",
    "author_profile": "https://rise2.studio",
    "homepage": "https://rise2.studio",
    "last_updated": "2026-08-11",
    "download_url": "https://plugins.rise2.studio/r2-coming-soon/r2-coming-soon-1.1.0.zip",
    "sections": {
        "description": "<p>One switch, one holding page, nothing else to learn. While Coming Soon is ON, every visitor who is not a logged-in administrator gets a single centred screen &mdash; logo, title and a short line of text &mdash; no matter which URL they open. Administrators keep browsing the real site, so you can keep building while the public sees the holding page.</p><h4>What you can set</h4><ul><li><strong>Logo</strong> from the media library, with a max width</li><li><strong>Background</strong>: a solid colour, or a cover photo with an adjustable dark overlay so the text stays readable</li><li><strong>Title</strong> and a <strong>short text</strong> (<code>&lt;a&gt;</code>, <code>&lt;br&gt;</code>, <code>&lt;strong&gt;</code>, <code>&lt;em&gt;</code> allowed)</li><li><strong>Text colour</strong>, so light and dark backgrounds both work</li><li><strong>Font</strong>: inherit the active theme's typography (default) or a system font stack</li><li><strong>Text size</strong>: Small / Medium / Large, scaling title and text together &mdash; useful when an inherited theme font renders bigger or smaller than expected</li></ul><p>Everything is centred and mobile-first: fluid type, responsive logo, safe-area padding for notched phones, and a background photo served through the WordPress <code>srcset</code> so phones download a phone-sized file.</p><h4>On and off, visibly</h4><p>The admin toolbar carries a status pill on every screen, front end and back end, with a coloured dot &mdash; <strong>amber = ON</strong> (the public cannot see the site), <strong>green = OFF</strong> (live). One click toggles it, and a warning notice sits in wp-admin the whole time it is on, so nobody leaves a launched site hidden.</p><h4>Built for caching</h4><p>Page caches answer from disk <em>before</em> plugins load, so a coming-soon plugin that ignores them serves the wrong page to the wrong audience. This one marks every front-end request non-cacheable while the switch is ON (<code>DONOTCACHEPAGE</code> + no-cache headers), and purges WP Rocket, LiteSpeed, W3 Total Cache, WP Super Cache, SG Optimizer, Cachify, Autoptimize and Kinsta whenever you flip the switch, save the design, or activate/deactivate the plugin.</p><h4>Good manners for search engines</h4><p>The holding page answers <code>503 Service Unavailable</code> with <code>Retry-After</code> and <code>noindex</code> &mdash; the correct signal for a site that is not open yet, so crawlers come back later instead of indexing a placeholder.</p><h4>Nothing leaks out the side</h4><p>Hiding the front end is not enough on its own: WordPress serves the REST API and SEO-plugin sitemaps on earlier hooks a front-end-only gate never sees, so <code>/wp-json/wp/v2/pages</code> would hand any anonymous visitor the full content of every published page and <code>/sitemap_index.xml</code> your whole URL list. While the switch is ON, anonymous REST calls get <code>503</code> and sitemap requests go to the holding page. Logged-in users are deliberately unaffected, so the block editor keeps working; the <code>r2cs_rest_allowed_routes</code> filter re-opens a specific endpoint (a payment webhook, say).</p><h4>Password preview</h4><p>Need to show the finished site to a payment provider, a bank or a client&rsquo;s legal team before launch? Set a preview password: they enter it once on the holding page and browse everything normally, while the site stays hidden from everyone else. No account needed. The password is stored hashed, the access cookie is signed with your site&rsquo;s salts and expires after 7 days, changing the password revokes it instantly, and wrong guesses are rate-limited.</p><h4>What is never blocked</h4><p><code>wp-login.php</code>, wp-admin, AJAX, cron, WP-CLI, <code>robots.txt</code> and the site icon. You cannot lock yourself out and scheduled jobs keep running.</p>",
        "changelog": "<h4>1.1.0</h4><ul><li><strong>Added &mdash; password preview.</strong> Switch it on, set a password, and the holding page grows a password field: anyone who knows it browses the whole site normally while it stays hidden from everyone else. Meant for a reviewer who must see the finished site before launch &mdash; a payment provider or card processor, a bank, a client&rsquo;s legal team &mdash; with no WordPress account and without going live.</li><li><strong>Security:</strong> the password is stored hashed (never readable back from the settings) and checked with WordPress&rsquo;s own verifier; access is a signed cookie derived from your site&rsquo;s salts, so it cannot be forged or reused elsewhere, and it lasts 7 days. Changing or removing the password revokes every existing grant instantly. Submissions are nonce-protected and wrong guesses are rate-limited per IP.</li></ul><h4>1.0.0</h4><ul><li><strong>First release.</strong> On/off switch with an admin-toolbar status pill (amber = hidden, green = live) and a one-click toggle, plus a standing warning notice in wp-admin while the site is hidden.</li><li><strong>Closes the routes a front-end-only gate misses.</strong> The REST API and SEO-plugin sitemaps are served on earlier hooks and die before <code>template_redirect</code>, so <code>/wp-json/wp/v2/pages</code> would have returned every published page's full content to anonymous callers. Anonymous REST now gets <code>503</code> (logged-in users keep full access so the block editor works; <code>r2cs_rest_allowed_routes</code> re-opens specific endpoints) and sitemap requests are redirected to the holding page.</li><li><strong>Centred, mobile-first holding page:</strong> logo, title, short text, solid-colour or cover-photo background with an adjustable dark overlay, text colour, theme-inherited or system font, and three text sizes. Fluid <code>clamp()</code> type, safe-area padding, and a <code>srcset</code>-driven background image so phones download a phone-sized file.</li><li><strong>Administrators keep browsing the real site;</strong> everyone else is redirected to the home page (optional) and served the holding page on every URL. A normalised request-path check makes redirect loops impossible.</li><li><strong>Cache-safe by design:</strong> front-end pages are marked non-cacheable while the switch is on, and WP Rocket, LiteSpeed, W3TC, WP Super Cache, SG Optimizer, Cachify, Autoptimize and Kinsta are purged whenever the switch or the design changes &mdash; file-based caches answer before plugins load, so a stale entry would otherwise bypass the gate.</li><li><strong>SEO-correct:</strong> <code>503</code> + <code>Retry-After</code> + <code>noindex</code> while hidden. Nonce- and capability-gated admin preview so you can check the design without logging out.</li><li>Login, wp-admin, AJAX, cron, XML-RPC, WP-CLI and <code>robots.txt</code> are never gated, so lockout and broken scheduled jobs are impossible.</li></ul>"
    }
}