diff --git a/.gitignore b/.gitignore
index 7f07453b..982f1d78 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,6 +1,8 @@
 # Created by .ignore support plugin (hsz.mobi)
 
 ### Gancio dev configuration
+releases
+wp-plugin/wpgancio
 config/development.json
 gancio_config.json
 config.json
diff --git a/assets/style.less b/assets/style.less
index 984fe181..7eb095ff 100644
--- a/assets/style.less
+++ b/assets/style.less
@@ -72,7 +72,7 @@ li {
     overflow: hidden;
     margin: 0.5rem 1rem 0.5rem 1rem;
     font-size: 1.1em !important;
-    line-height: 1em !important;
+    line-height: 1.1em !important;
   }
 
   .body {
diff --git a/docs/contact.md b/docs/contact.md
index c6274cb6..219d21fe 100644
--- a/docs/contact.md
+++ b/docs/contact.md
@@ -7,5 +7,8 @@ nav_order: 9
 
 ## Contacts
 
-### :elephant: Mastodon ⇒  [@gancio@mastodon.cisti.org](https://mastodon.cisti.org/@gancio)
+
+- :elephant: Mastodon ⇒  [@gancio@mastodon.cisti.org](https://mastodon.cisti.org/@gancio)
+- :email: Email ⇒ [info@cisti.org](mailto:info@cisti.org)
+- IRC ⇒ #gancio @ irc.autistici.org (sometimes...)
 
diff --git a/docs/install/debian.md b/docs/install/debian.md
index 0079f240..b61c84d8 100644
--- a/docs/install/debian.md
+++ b/docs/install/debian.md
@@ -19,7 +19,7 @@ apt-get update && apt-get install yarn
 
 1. Install Gancio
 ```bash
-yarn global add --silent {{site.url}}{% link /latest.tgz %} 2> /dev/null
+yarn global add --silent {{site.url}}/latest.tgz 2> /dev/null
 ```
 
 1. Setup with postgreSQL __(optional as you can choose sqlite)__
@@ -64,6 +64,6 @@ sudo pm2 startup -u gancio
 
 ## Upgrade
 ```bash
-sudo yarn global add --silent {{site.url}}{% link /latest.tgz %}  2> /dev/null
+sudo yarn global add --silent {{site.url}}/latest.tgz  2> /dev/null
 sudo service pm2 restart
 ```
diff --git a/docs/install/docker.md b/docs/install/docker.md
index 9d168c7f..caa4ad52 100644
--- a/docs/install/docker.md
+++ b/docs/install/docker.md
@@ -79,7 +79,7 @@ cd ~
 cd /etc/nginx/sites-available
 ```
 
-1. [Setup nginx as a proxy]({% link install/nginx.md %}
+1. [Setup nginx as a proxy]({% link install/nginx.md %})
 
 1. Point your web browser to [http://localhost:13120](http://localhost:13120) or where you specified during setup and enjoy :tada:
 
diff --git a/docs/install/nginx.md b/docs/install/nginx.md
index b3847578..46ba58cd 100644
--- a/docs/install/nginx.md
+++ b/docs/install/nginx.md
@@ -1,4 +1,4 @@
----
+t---
 layout: default
 title: Nginx setup
 permalink: /install/nginx
diff --git a/layouts/default.vue b/layouts/default.vue
index 103829f9..d2eca62d 100644
--- a/layouts/default.vue
+++ b/layouts/default.vue
@@ -1,10 +1,10 @@
 <template lang='pug'>
-  v-app
+  v-app(app)
     Snackbar
     Confirm
     Nav
 
-    v-main
+    v-main(app)
       v-fade-transition(hide-on-leave)
         nuxt
 
diff --git a/package.json b/package.json
index 8071215c..1754bed5 100644
--- a/package.json
+++ b/package.json
@@ -131,7 +131,6 @@
     "resize-img": "2.0.0",
     "underscore": "1.13.1",
     "@nuxtjs/vuetify/**/sass": "1.32.12",
-    "css-what": "5.0.1",
     "postcss": "7.0.36",
     "glob-parent": "5.1.2",
     "core-js": "3.14.0"
diff --git a/pages/Authorize.vue b/pages/Authorize.vue
index ffb8dc09..43f3e7e9 100644
--- a/pages/Authorize.vue
+++ b/pages/Authorize.vue
@@ -1,19 +1,18 @@
 <template lang='pug'>
-  v-row.mt-5(align='center' justify='center')
-    v-col(cols='12' md="6" lg="5" xl="4")
-      v-card(light)
-        v-card-title {{settings.title}} - {{$t('common.authorize')}}
-        v-card-text
-          u {{$auth.user.email}}
-          div
-            p(v-html="$t('oauth.authorization_request', { app: client.name, instance_name: settings.title })")
-            ul
-              li(v-for="s in scope.split(' ')") {{$t(`oauth.scopes.${scope}`)}}
-            span(v-html="$t('oauth.redirected_to', {url: $route.query.redirect_uri})")
-        v-card-actions
-          v-spacer
-          v-btn(color='error' to='/') {{$t('common.cancel')}}
-          v-btn(:href='authorizeURL' color='success') {{$t('common.authorize')}}
+  .d-flex.justify-space-around
+    v-card.mt-5(max-width='600px')
+      v-card-title {{settings.title}} - {{$t('common.authorize')}}
+      v-card-text
+        u {{$auth.user.email}}
+        div
+          p(v-html="$t('oauth.authorization_request', { app: client.name, instance_name: settings.title })")
+          ul.mb-2
+            li(v-for="s in scope.split(' ')") {{$t(`oauth.scopes.${scope}`)}}
+          span(v-html="$t('oauth.redirected_to', {url: $route.query.redirect_uri})")
+      v-card-actions
+        v-spacer
+        v-btn(color='error' to='/') {{$t('common.cancel')}}
+        v-btn(:href='authorizeURL' color='success') {{$t('common.authorize')}}
 </template>
 
 <script>
diff --git a/server/api/controller/event.js b/server/api/controller/event.js
index 792f47f8..096a020e 100644
--- a/server/api/controller/event.js
+++ b/server/api/controller/event.js
@@ -118,7 +118,7 @@ const eventController = {
         order: [[Resource, 'id', 'DESC']]
       })
     } catch (e) {
-      log.error(e)
+      log.error('[EVENT]', e)
       return res.sendStatus(400)
     }
 
@@ -194,7 +194,7 @@ const eventController = {
       const notifier = require('../../notifier')
       notifier.notifyEvent('Create', event.id)
     } catch (e) {
-      log.error(e)
+      log.error('[EVENT]', e)
       res.sendStatus(404)
     }
   },
@@ -264,7 +264,7 @@ const eventController = {
   async add (req, res) {
     // req.err comes from multer streaming error
     if (req.err) {
-      log.info(req.err)
+      log.warn(req.err)
       return res.status(400).json(req.err.toString())
     }
 
@@ -272,6 +272,11 @@ const eventController = {
       const body = req.body
       const recurrent = body.recurrent ? JSON.parse(body.recurrent) : null
 
+      if (!body.place_name) {
+        log.warn('Place is required')
+        return res.status(400).send('Place is required')
+      }
+
       const eventDetails = {
         title: body.title,
         // remove html tags
@@ -329,7 +334,7 @@ const eventController = {
         notifier.notifyEvent('Create', event.id)
       }
     } catch (e) {
-      log.error(e)
+      log.error('[EVENT ADD]', e)
       res.sendStatus(400)
     }
   },
@@ -414,6 +419,7 @@ const eventController = {
       }
       const notifier = require('../../notifier')
       await notifier.notifyEvent('Delete', event.id)
+      log.debug('[EVENT REMOVED]', event.title)
       await event.destroy()
       res.sendStatus(200)
     } else {
@@ -469,7 +475,8 @@ const eventController = {
         { model: Place, required: true, attributes: ['id', 'name', 'address'] }
       ]
     }).catch(e => {
-      log.error(e)
+      log.error('[EVENT]', e)
+      return []
     })
 
     return events.map(e => {
diff --git a/server/api/controller/oauth.js b/server/api/controller/oauth.js
index c792ae81..0822e66f 100644
--- a/server/api/controller/oauth.js
+++ b/server/api/controller/oauth.js
@@ -42,7 +42,7 @@ const oauthController = {
       delete client.id
       res.json(client)
     } catch (e) {
-      log.error(e)
+      log.error('[OAUTH CLIENT]', e)
       res.status(400).json(e)
     }
   },
diff --git a/server/api/controller/settings.js b/server/api/controller/settings.js
index 7a80a24e..0f15d797 100644
--- a/server/api/controller/settings.js
+++ b/server/api/controller/settings.js
@@ -103,7 +103,7 @@ const settingsController = {
       settingsController[is_secret ? 'secretSettings' : 'settings'][key] = value
       return true
     } catch (e) {
-      log.error(e)
+      log.error('[SETTING SET]', e)
       return false
     }
   },
@@ -129,7 +129,7 @@ const settingsController = {
       .png({ quality: 90 })
       .toFile(baseImgPath + '.png', async (err, info) => {
         if (err) {
-          log.error(err)
+          log.error('[LOGO]', err)
         }
         const image = await readFile(baseImgPath + '.png')
         const favicon = await toIco([image], { sizes: [64], resize: true })
diff --git a/server/api/controller/user.js b/server/api/controller/user.js
index a8d1ada0..dd5d3107 100644
--- a/server/api/controller/user.js
+++ b/server/api/controller/user.js
@@ -103,7 +103,7 @@ const userController = {
       mail.send(config.admin_email, 'admin_register', { user, config })
       res.sendStatus(200)
     } catch (e) {
-      log.error('Registration error: "%s"', e)
+      log.error('Registration error:', e)
       res.status(404).json(e)
     }
   },
@@ -116,7 +116,7 @@ const userController = {
       mail.send(user.email, 'user_confirm', { user, config }, req.settings.locale)
       res.json(user)
     } catch (e) {
-      log.error('User creation error: %s', e)
+      log.error('User creation error:', e)
       res.status(404).json(e)
     }
   },
@@ -127,7 +127,7 @@ const userController = {
       user.destroy()
       res.sendStatus(200)
     } catch (e) {
-      log.error('User removal error: "%s"', e)
+      log.error('User removal error:"', e)
       res.status(404).json(e)
     }
   }
diff --git a/server/api/index.js b/server/api/index.js
index f971a01c..1e64001e 100644
--- a/server/api/index.js
+++ b/server/api/index.js
@@ -145,7 +145,7 @@ api.use((req, res) => res.sendStatus(404))
 
 // Handle 500
 api.use((error, req, res, next) => {
-  log.error(error)
+  log.error('[API ERROR]', error)
   res.status(500).send('500: Internal Server Error')
 })
 
diff --git a/server/api/mail.js b/server/api/mail.js
index 5e1302aa..105e68ca 100644
--- a/server/api/mail.js
+++ b/server/api/mail.js
@@ -61,7 +61,7 @@ const mail = {
     }
     return email.send(msg)
       .catch(e => {
-        log.error('Error sending email => %s', e)
+        log.error('[MAIL]', e)
       })
   }
 }
diff --git a/server/api/oauth.js b/server/api/oauth.js
index 9a4dbc28..0f1dd709 100644
--- a/server/api/oauth.js
+++ b/server/api/oauth.js
@@ -34,7 +34,7 @@ oauth.use((req, res) => res.sendStatus(404))
 
 oauth.use((err, req, res, next) => {
   const error_msg = err.toString()
-  log.error(error_msg)
+  log.error('[OAUTH USE]', error_msg)
   res.status(500).send(error_msg)
 })
 
diff --git a/server/api/storage.js b/server/api/storage.js
index 34aa1f29..e44f7d8f 100644
--- a/server/api/storage.js
+++ b/server/api/storage.js
@@ -8,9 +8,7 @@ const config = require('config')
 
 try {
   mkdirp.sync(config.upload_path + '/thumb')
-} catch (e) {
-  log.error(e)
-}
+} catch (e) {}
 
 const DiskStorage = {
   _handleFile (req, file, cb) {
@@ -25,11 +23,11 @@ const DiskStorage = {
     let onError = false
     const err = e => {
       if (onError) {
-        log.error(err)
+        log.error('[UPLOAD]', err)
         return
       }
       onError = true
-      log.error(e)
+      log.error('[UPLOAD]', e)
       req.err = e
       cb(null)
     }
diff --git a/server/federation/helpers.js b/server/federation/helpers.js
index 6160bf5d..a08463fb 100644
--- a/server/federation/helpers.js
+++ b/server/federation/helpers.js
@@ -126,7 +126,7 @@ const Helpers = {
         return res.data
       })
       .catch(e => {
-        log.error(`${URL}: ${e}`)
+        log.error(`get Actor ${URL}`, e)
         return false
       })
 
@@ -195,7 +195,7 @@ const Helpers = {
     //   .update(req.body)
     //   .digest('base64')
     // if (`SHA-256=${digest}` !== req.headers.signature) {
-    //   log.warning(`Signature mismatch ${req.headers.signature} - ${digest}`)
+    //   log.warn(`Signature mismatch ${req.headers.signature} - ${digest}`)
     //   return res.status(401).send('Signature mismatch')
     // }
 
diff --git a/server/federation/webfinger.js b/server/federation/webfinger.js
index d833995f..8390aed6 100644
--- a/server/federation/webfinger.js
+++ b/server/federation/webfinger.js
@@ -140,7 +140,7 @@ router.use((req, res) => {
 
 // Handle 500
 router.use((error, req, res, next) => {
-  log.error(error)
+  log.error('[WEBFINGER]', error)
   res.status(500).send('500: Internal Server Error')
 })
 
diff --git a/server/helpers.js b/server/helpers.js
index 3666ffe5..a9675809 100644
--- a/server/helpers.js
+++ b/server/helpers.js
@@ -163,8 +163,8 @@ module.exports = {
         }))
       }
     } catch (e) {
-      log.error(e)
-      res.status(400).json(e.toString)
+      log.error('[Import URL]', e)
+      res.status(400).json(e.toString())
     }
   },
 
diff --git a/server/log.js b/server/log.js
index 4a4dd824..b4aaf0be 100644
--- a/server/log.js
+++ b/server/log.js
@@ -1,10 +1,14 @@
 const { createLogger, transports, format } = require('winston')
 const DailyRotateFile = require('winston-daily-rotate-file')
-const dayjs = require('dayjs')
+// const dayjs = require('dayjs')
 const config = require('config')
 
-const gancioFormat = format.printf(({ timestamp, level, message, error }) => {
-  return `${dayjs(timestamp).format('DD MMM YYYY HH:mm:ss')} ${level}: ${message}`
+const gancioFormat = format.printf(info => {
+  if (info.stack) {
+    return `${info.timestamp} ${info.level}: ${info.message} \r\n${info.stack}`
+  } else {
+    return `${info.timestamp} ${info.level}: ${info.message}`
+  }
 })
 
 const logger = createLogger({
@@ -12,15 +16,11 @@ const logger = createLogger({
   transports: process.env.NODE_ENV !== 'production'
     ? [new transports.Console(
         {
-          handleExceptions: true,
-          handleRejections: true,
           level: 'debug',
-          format: format.combine(format.errors({ stack: true }), format.timestamp(), format.colorize(), format.splat(), gancioFormat)
+          format: format.combine(format.splat(), format.timestamp(), format.colorize(), gancioFormat)
         }
       )]
     : [new DailyRotateFile({
-        handleExceptions: true,
-        handleRejections: true,
         level: config.log_level || 'info',
         filename: config.log_path + '/gancio.%DATE%.log',
         symlinkName: 'gancio.log',
@@ -28,14 +28,12 @@ const logger = createLogger({
         zippedArchive: true,
         maxSize: '10m',
         maxFiles: '10d',
-        format: format.combine(format.timestamp(), format.splat(), gancioFormat)
+        format: format.combine(format.timestamp(), gancioFormat)
       }),
       new transports.Console(
         {
-          handleExceptions: true,
-          handleRejections: true,
           level: config.log_level || 'info',
-          format: format.combine(format.timestamp(), format.splat(), format.colorize(), gancioFormat)
+          format: format.combine(format.timestamp(), format.colorize(), gancioFormat)
         }
       )]
 })
diff --git a/server/notifier.js b/server/notifier.js
index ac105aab..6405a797 100644
--- a/server/notifier.js
+++ b/server/notifier.js
@@ -51,7 +51,7 @@ const notifier = {
         await notifier.sendNotification(notification, event)
         notification.event_notification.status = 'sent'
       } catch (err) {
-        log.error(err)
+        log.error('[NOTIFY EVENT]', err)
         notification.event_notification.status = 'error'
       }
       return notification.event_notification.save()
@@ -71,7 +71,7 @@ const notifier = {
         e.status = 'sent'
         return e.save()
       } catch (err) {
-        log.error(err)
+        log.error('[NOTIFY]', err)
         e.status = 'error'
         e.error = err
         return e.save()
diff --git a/server/routes.js b/server/routes.js
index 20ab4eee..4bfa6f4e 100644
--- a/server/routes.js
+++ b/server/routes.js
@@ -61,7 +61,7 @@ app.use('/oauth', oauth)
 
 // // Handle 500
 app.use((error, req, res, next) => {
-  log.error(error)
+  log.error('[ERROR]', error)
   res.status(500).send('500: Internal Server Error')
 })
 
diff --git a/wp-plugin/gancio.php b/wp-plugin/gancio.php
index b39d0f1b..60ea1e42 100644
--- a/wp-plugin/gancio.php
+++ b/wp-plugin/gancio.php
@@ -5,7 +5,6 @@ Plugin URI:  https://gancio.org
 Description: Connects an user of a gancio instance to a Wordpress user so that published events are automatically pushed with Gancio API.
 Version:     1.0
 Author:      Gancio
-Author URI:  https://gancio.org
 License:  AGPL 3.0
 
 WPGancio is free software: you can redistribute it and/or modify it under the
diff --git a/wp-plugin/oauth.php b/wp-plugin/oauth.php
index 75470b52..e243e333 100644
--- a/wp-plugin/oauth.php
+++ b/wp-plugin/oauth.php
@@ -4,16 +4,15 @@ defined( 'ABSPATH' ) or die( 'Nope, not accessing this' );
 // eventorganizer / triggered after an event has been updated
 // http://codex.wp-event-organiser.com/hook-eventorganiser_save_event.html
 add_action('eventorganiser_save_event', 'wpgancio_save_event', 15);
-add_action('wp_trash_post', 'delete_post', 15);
+add_action('wp_trash_post', 'wpgancio_delete_post', 15);
 
-function delete_post ($post_id) {
+function wpgancio_delete_post ($post_id) {
   $post = get_post($post_id);
   $instance_url = get_option('wpgancio_instance_url');
 
   if ($post->post_type == 'event') {
-    $gancio_id = get_post_meta($post_id, 'gancio_id', TRUE);
+    $gancio_id = get_post_meta($post_id, 'wpgancio_gancio_id', TRUE);
     if ($gancio_id) {
-      $body['id'] = $gancio_id;
       $http = _wp_http_get_object();
       $response = $http->request( "${instance_url}/api/event/${gancio_id}", array(
         'method' => 'DELETE',
@@ -27,14 +26,21 @@ function delete_post ($post_id) {
 function wpgancio_save_event ($post_id) {
   $event = get_post( $post_id );
 
+  function tagName ($tag) {
+    return sanitize_title($tag->name);
+  }
+
+  $tmp_tags = get_the_terms( $event, 'event-tag' );
+  $tags = array_map('tagName', $tmp_tags);
+
   // do not save if it's a draft
   if ($event->post_status != 'publish') {
     return;
   }
 
-  $gancio_id = get_post_meta($post_id, 'gancio_id', TRUE);
+  $gancio_id = get_post_meta($post_id, 'wpgancio_gancio_id', TRUE);
 
-  // image_path
+  // when
   $date = eo_get_schedule_start( 'U', $post_id );
 
   // get place details
@@ -45,6 +51,7 @@ function wpgancio_save_event ($post_id) {
 
   $body = array (
     'title' => $event->post_title,
+    'tags' => $tags,
     'description' => $event->post_content,
     'start_datetime' => intval($date),
     'place_name' => $place_name,
@@ -54,7 +61,7 @@ function wpgancio_save_event ($post_id) {
   // add image if specified
   $image_url = get_the_post_thumbnail_url($post_id);
   if ($image_url) {
-    $body['image_url'] = $image_url;
+    $body['image_url'] = esc_url($image_url);
   }
 
   // update
@@ -64,20 +71,22 @@ function wpgancio_save_event ($post_id) {
     $response = $http->request( $instance_url . '/api/event', array(
       'method' => 'PUT',
       'headers' => array (
-        'Authorization' => 'Bearer ' . get_option('wpgancio_token')
-      ), 'body' => $body ));
+        'Authorization' => 'Bearer ' . get_option('wpgancio_token'),
+        'Content-Type' => 'application/json'
+      ), 'body' => wp_json_encode($body) ));
   } else { // or create
     $response = wp_remote_post($instance_url . '/api/event', array(
       'headers' => array (
-        'Authorization' => 'Bearer ' . get_option('wpgancio_token')
-      ), 'body' => $body ));
+        'Authorization' => 'Bearer ' . get_option('wpgancio_token'),
+        'Content-Type' => 'application/json'
+      ), 'body' => wp_json_encode($body) ));
   }
 
   if ( is_wp_error( $response ) ) {
     $error_message = $response->get_error_message();
-    echo "<div class='error notice'><p>${error_message}</p></div>";
+    echo "<div class='error notice'><p>" . esc_html($error_message) . "</p></div>";
     return;
   }
   $data = json_decode(wp_remote_retrieve_body($response));
-  update_post_meta($post_id, 'gancio_id', $data->id);
+  update_post_meta($post_id, 'wpgancio_gancio_id', intval($data->id));
 }
diff --git a/wp-plugin/readme.txt b/wp-plugin/readme.txt
index a705fa08..c1315b70 100644
--- a/wp-plugin/readme.txt
+++ b/wp-plugin/readme.txt
@@ -1,10 +1,10 @@
 === WPGancio ===
 Contributors: lesion
 Donate link: https://gancio.org
-Tags: events, gancio
+Tags: events, gancio, fediverse, AP, activity pub
 Requires at least: 4.7
-Tested up to: 5.4
-Stable tag: 4.3
+Tested up to: 5.7.2
+Stable tag: 1.0
 Requires PHP: 7.0
 License: AGPLv3 or later
 License URI: https://www.gnu.org/licenses/agpl-3.0.html
@@ -13,36 +13,12 @@ Connect a gancio instance to a Wordpress user so that published events are autom
 
 == Description ==
 
+This plugin connects a [Gancio](https://gancio.org) instance to a Wordpress website to automatically push events published on Wordpress.
 
-
-== Frequently Asked Questions ==
-
-= A question that someone might have =
-
-An answer to that question.
-
-= What about foo bar? =
-
-Answer to foo bar dilemma.
-
-== Screenshots ==
-
-1. This screen shot description corresponds to screenshot-1.(png|jpg|jpeg|gif). Note that the screenshot is stored in the /assets directory.
-2. This is the second screen shot
+It requires an event manager plugin, only [Event Organiser[(https://wp-event-organiser.com/) is supported but adding another plugin it's an easy task.
+ 
 
 == Changelog ==
 
 = 1.0 =
-* A change since the previous version.
-* Another change.
-
-= 0.5 =
-* List versions from most recent at top to oldest at bottom.
-
-== Upgrade Notice ==
-
-= 1.0 =
-Upgrade notices describe the reason a user should upgrade.  No more than 300 characters.
-
-= 0.5 =
-This version fixes a security related bug.  Upgrade immediately.
+* First release
diff --git a/wp-plugin/settings.php b/wp-plugin/settings.php
index 55e57712..d0900540 100644
--- a/wp-plugin/settings.php
+++ b/wp-plugin/settings.php
@@ -22,7 +22,7 @@ function wpgancio_update_options ($old_value, $instance_url) {
   $redirect_uri = get_site_url(null, '/wp-admin/options-general.php?page=wpgancio' );
   $query = join('&', array(
     'response_type=code',
-    'redirect_uri=' . esc_html($redirect_uri),
+    'redirect_uri=' . esc_url($redirect_uri),
     'scope=event:write',
     'client_id=' . get_option('wpgancio_client_id'),
   ));
@@ -53,8 +53,8 @@ function wpgancio_instance_url_validate ($instance_url) {
       $response->get_error_message());
   } else {
     $data = json_decode( wp_remote_retrieve_body($response), true);
-    update_option('wpgancio_client_secret', $data['client_secret']);
-    update_option('wpgancio_client_id', $data['client_id']);
+    update_option('wpgancio_client_secret', sanitize_key($data['client_secret']));
+    update_option('wpgancio_client_id', sanitize_key($data['client_id']));
     return $instance_url;
   }
 }
@@ -88,7 +88,7 @@ function wpgancio_instance_url_cb( $args ) {
     name="wpgancio_instance_url">
 
   <p class="description">
-    <?php esc_html_e( 'Insert your gancio instance URL', 'wpgancio' ); ?>
+    <?php esc_html( 'Insert your gancio instance URL', 'wpgancio' ); ?>
   </p>
 
   <?php
@@ -104,9 +104,7 @@ function wpgancio_options_page_html() {
   if ( ! current_user_can( 'manage_options' ) ) { return; }
 
   // show error/update messages
-  //settings_errors( 'wpgancio_messages' );
-
-  $code = $_GET['code'];
+  $code = sanitize_key($_GET['code']);
   if ( $code ) {
     update_option('wpgancio_code', $code);
     $instance_url = get_option( 'wpgancio_instance_url' );
@@ -127,8 +125,8 @@ function wpgancio_options_page_html() {
       settings_errors( 'wpgancio_messages' );
     } else {
       $data = json_decode( wp_remote_retrieve_body($response), true);
-      update_option('wpgancio_token', $data['access_token']);
-      update_option('wpgancio_refresh', $data['refresh_token']);
+      update_option('wpgancio_token', sanitize_key($data['access_token']));
+      update_option('wpgancio_refresh', sanitize_key($data['refresh_token']));
       add_settings_error('wpgancio_messages', 'wpgancio_messages', 'Association completed!', 'success');
       settings_errors( 'wpgancio_messages' );
     }
@@ -141,11 +139,14 @@ function wpgancio_options_page_html() {
  <h1><?php echo esc_html( get_admin_page_title() ); ?></h1>
  <form action="options.php" method="post">
  <?php
+
   // output security fields for the registered setting "wpgancio"
   settings_fields( 'wpgancio' );
+
   // output setting sections and their fields
   // (sections are registered for "wpgancio", each field is registered to a specific section)
   do_settings_sections( 'wpgancio' );
+
   // output save settings button
   submit_button( 'Save Settings' );
  ?>