CannyForge Archive Generator

CannyForge Archive Generator gives news and blog sites a combined HTML sitemap and JavaScript-powered archive, and replaces WordPress’s default taxonomy pagination with a configurable compact sequence that links out to that archive.

The release supports PHP 8.1 through 8.5. CI runs the automated unit suite on each of those versions; static analysis is pinned to PHP 8.1. The «Requires PHP» value above is the minimum supported version, not a claim that every future PHP release is continuously verified.

The plugin provides a compact pagination experience and a clear HTML archive link, making older and newer content easier to discover through site navigation. It does not promise a search-ranking or crawler outcome.

Features:

• HTML-sitemap archive page at a crawlable, no-JavaScript URL.
• News mode: include content published within a configurable recent window.
• Blog mode: a curated URL list, entered manually or imported from CSV.
• Client-side search and category / tag / month / author filters.
• Configurable compact pagination with a «View Archive» link, targeted per archive type.
• Optional full archive continuation: /archive/ stays the optimised first page and /archive/page/2/ onward lists remaining eligible posts without JavaScript, newest first.
• SEO controls: archive title, meta description, robots directives, canonical.
• Content selection: include / exclude by term, drop noindex, pin URLs first.

External services

This plugin can connect to Google services to fetch top-content signals for the archive. These integrations are optional and are only used when the site owner configures Google credentials and explicitly connects an account.

Google OAuth / Search Console / Google Analytics 4

What the service is used for:

• Google OAuth authenticates the site owner’s Google account and refreshes API access tokens.
• Google Search Console can supply top page URLs for the configured property.
• Google Analytics 4 can supply top page paths as the primary signal or as a Search Console fallback.

What data is sent and received:

• When the owner starts Connect, the browser visits Google’s OAuth authorisation endpoint with the configured client ID, registered redirect URI, requested read-only scopes, response type, access type, and a short-lived state value at https://accounts.google.com/o/oauth2/v2/auth. Google returns an authorisation code to that redirect URI; the code, client ID, client secret, redirect URI, and grant type are sent server-to-server to https://oauth2.googleapis.com/token. Google returns access and refresh tokens plus the access-token lifetime.
• When the access token is missing or expired, the client ID, client secret, refresh token, and refresh grant type are sent to the same token endpoint. The returned access token and lifetime are cached encrypted locally; the refresh token is retained encrypted until Disconnect or plugin deletion.
• After a successful connection that requested Search Console access, the plugin automatically lists the account’s Search Console properties with a GET to https://www.googleapis.com/webmasters/v3/sites. Google returns property URLs and permissions. The selected property list is cached for the current WordPress user for 10 minutes.
• When the owner loads Search Console properties, the same property-list call runs. When the owner refreshes top content, the configured Search Console property URL, date range, dimensions (page), row limit, and access token are sent to https://www.googleapis.com/webmasters/v3/sites/{property}/searchAnalytics/query. Google returns page rows; resolved local post IDs, source URLs, and a refresh timestamp are stored in the Search Console cache option until the next refresh, Disconnect, or deletion.
• After a successful Analytics wizard connection, the plugin automatically lists GA4 accounts and properties with the access token at https://analyticsadmin.googleapis.com/v1beta/accountSummaries. Google returns account/property names and IDs; the list is cached for the current WordPress user for 10 minutes. Clicking Load GA4 properties repeats that call.
• When the owner refreshes GA4 top content, the configured numeric property ID, date range, pagePath dimension, screenPageViews metric, descending order, row limit, and access token are sent to https://analyticsdata.googleapis.com/v1beta/properties/{property}:runReport. Google returns page-path rows; resolved local post IDs, source paths, and a refresh timestamp are stored in the GA4 cache option until the next refresh, Disconnect, or deletion.

What access is requested:

• The Search Console read-only scope (https://www.googleapis.com/auth/webmasters.readonly) is requested for Search Console-only and combined wizard paths.
• The Analytics (GA4) read-only scope (https://www.googleapis.com/auth/analytics.readonly) is requested for Analytics-only and combined wizard paths, or when a GA4 property ID is already configured. A Search Console-only setup never asks for Analytics access.

When it happens:

• Only when the site owner clicks Connect, loads a property list, or manually refreshes a Google-backed cache. The post-Connect Search Console property listing is automatic only when that access was requested; the GA4 property listing is automatic for an Analytics wizard connection.
• Never during wp.org installation or by default on an unconfigured site.

How credentials are stored and removed:

• The client secret, refresh token, and cached access token are encrypted at rest.
• Clicking Disconnect makes a best-effort POST to https://oauth2.googleapis.com/revoke with the refresh token (or still valid access token) before clearing the locally stored tokens and caches, so the connection is invalidated on Google’s side as well as locally. If the endpoint cannot be reached, local credentials are still cleared and the admin is told the remote grant may need to be revoked manually.
• Deleting the plugin (not just deactivating it) makes the same best-effort revocation call, then permanently removes the plugin’s stored settings and credentials, fixed archive caches, and all user-scoped Google property-list and OAuth-state transients, including the encrypted Google credentials. Search-result and rate-limit transients have bounded expirations and are allowed to expire naturally rather than being swept during uninstall. Deactivating the plugin never removes this data — only deleting it does.

Service policies:

• Google APIs Terms of Service: https://developers.google.com/terms
• Google API Services User Data Policy: https://developers.google.com/terms/api-services-user-data-policy
• Google Privacy Policy: https://policies.google.com/privacy
• Google Analytics Terms of Service (where GA4 is enabled): https://marketingplatform.google.com/about/analytics/terms/us/