=== MariaCare CRM ===
Contributors: mariacare
Tags: crm, google ads, analytics, salesforce, security
Requires at least: 6.0
Tested up to: 6.6
Requires PHP: 8.0
Stable tag: 2.1.0
License: GPL-2.0-or-later

Live Google Ads & GA4 data (via API) fused with Salesforce leads into timestamp-based attribution, lead scoring, and pay-per-customer invoices — plus WordPress security & speed testing.

== Description ==

MariaCare CRM runs inside your existing WordPress admin — no third login to manage. It combines:

* Live Google Ads & GA4 data via their official APIs, synced hourly — connect once, never export a marketing CSV again. Salesforce leads remain a simple CSV import (no paid SF API required).
* Timestamp attribution: Lead Source is unreliable, so campaigns are credited by correlating their daily click timestamps with each lead's Created Date — fractional, decay-weighted, and honest.
* Campaign verdicts (Profitable / Break-even / Overpriced) judged by true cost per attributed CRM lead vs what a lead is worth, plus concrete next steps for copy, locations, and budget.
* Lead scoring: a ranked "who needs attention soonest" list built from recency, overdue actions, upcoming tours, funnel position, ad attribution, and value — plus per-lead call/text/email outreach guidance.
* Pay-per-customer invoicing: ACV × fee% per Salesforce-confirmed customer, drafted automatically on your billing day (self-healing if a cron day is missed), every line linked to its Salesforce record and attribution snapshot, immutable audit log — and always human-reviewed before sending.
* WordPress & server security: pen-test style checks with one-click remediations — HTTPS/certificate health, file permissions, directory browsing, XML-RPC, DB prefix, custom login URL, enforced 2FA, failed-login limiting, daily malware scans, malicious-IP blocking before PHP, and Cloudflare traffic analysis.
* Data-processing safety: validates the hosting environment is safe for processing ads + CRM data on this server, and says exactly what to change if it isn't.
* Speed testing: TTFB, page/object caching, PHP + OPcache, database latency, and autoloaded-options weight — with prescriptions.
* Claude Code hand-off: one click copies a full diagnostic + prescription report to paste into the AI coding agent managing your server, so it can fix every issue and re-run the audit to 100%.

== Installation ==

1. Download the plugin zip from https://maria.care/crm/
2. In wp-admin, go to Plugins → Add New → Upload Plugin, and upload the zip.
3. Activate MariaCare CRM.
4. Open the new "MariaCare CRM" menu in wp-admin.

== Changelog ==

= 2.1.0 =
* Google connection fixed: the OAuth consent screen now opens in the top window (Google returns a bare "403. That's an error" page when the consent screen is framed, and the app runs inside a wp-admin iframe). After connecting, the browser lands back inside wp-admin automatically, and OAuth errors come back with plain-English explanations — including the "add yourself as a test user" case.
* Pass-through expense reimbursement on invoices: the agency fronts Google Ads spend, WordPress hosting, and Salesforce licenses; each invoice now adds them back at cost for full reimbursement. Ads spend is computed automatically from the synced Google Ads daily series for the billing period (never double-billed across invoices); hosting and Salesforce are flat monthly amounts set once on the Invoices page. Printable invoices group performance fees and expense reimbursements with subtotals. Expense-only periods (spend but no customers won) still invoice.
* Journey polish across the app: one-click Call / Text / Email action buttons on the lead outreach recommendation, "Customer stage = billable" hint on the lead editor, and every empty state now points to the right next step (connect Google → import Salesforce leads → work leads → invoice).
* Unified styling: shared design-system colors and button classes replace one-off inline styles on the lead detail and Leads pages; fixed a double-escaped "&" in walkthrough titles.

= 2.0.0 =
* Google Ads & GA4 now pull LIVE data via their official APIs (hourly WP-Cron sync + manual refresh) — all marketing CSV uploads removed. New Google Connection page owns the OAuth flow, API configuration, and per-source pipeline status.
* Attribution rebuilt around timestamps: daily campaign click series correlated with Salesforce lead Created Dates (7-day lookback, per-day decay, fractional credit). Lead Source is no longer used for attribution anywhere.
* New clicks→leads and sessions→leads day-by-day timeline charts, plus a clicks/leads correlation sanity check.
* Leads page: "Who needs attention soonest" — scored, ranked, with human-readable reasons. Outreach recommendations now use click-timestamp attribution.
* Invoices simplified and hardened: fee = ACV × fee% (minimum fee, Stripe integration, and 30-day refund credits removed). The daily billing job is self-healing — any run after the billing day drafts the missing period, so a missed cron never skips a month.
* Security dashboard beautified (Inter typography, refreshed cards and score hero) and extended with two new sections: Data Processing Safety (validates the host is safe for processing ads + CRM data) and Speed & Performance (TTFB, caching, PHP/OPcache, DB latency, autoload weight).
* New "Hand the fixes to your Claude Code" box: copies a complete diagnostic + prescriptions report for the AI agent managing the server, including how to re-run the audit until all checks pass.
* Sidebar reordered: Ads, Analytics, Security, Leads, Invoices, Settings.

= 1.3.0 =
* Pay-per-customer billing: ACV×15% ($100 min) fee engine, per-customer invoice lines with Salesforce record + attribution, monthly billing cron with draft review, Stripe draft invoices + webhook status sync, 30-day refund credits, immutable audit log.

= 1.2.0 =
* Animated, dismissible walkthroughs on every page — big-text, step-by-step instructions for imports, invoicing, ad analysis, and security.
* Lead Conversion Path redesigned as clean horizontal bars with per-stage survival rates.
* Post-import analysis: every Salesforce import ends with an instant read-out — conversion rate, biggest funnel drop-off, strongest/weakest sources, leads needing attention, upcoming tours, invoice readiness. Re-run anytime with "Analyze My Leads".
* Invoices radically simplified: one big live total, set-your-numbers-once setup, advanced adjustments tucked away; collected/outstanding money summary absorbed from the removed Financials page.
* Financials page removed — the Invoices page now carries the money summary.
* Google Ads: campaign verdicts (Profitable / Break-even / Overpriced) judged by true CRM cost-per-lead vs lead value, spend-share bars, clearer export instructions.
* Analytics: per-source reality-check verdicts (Star source / Steady / Quality problem) plus a computed "What to do next" action list.
* Security moved to the top of the menu; dashboard redesigned with an animated security score and checks grouped by category, each with a plain-English "why it matters".
* Salesforce "synced" indicators removed across the app.

= 1.1.0 =
* Navigation moved fully into the WordPress admin sidebar; internal app sidebar removed.
* CRM simplified to Leads only — Accounts, Contacts, Opportunities, Calendar, Pricing Tool, Data Transfer and Migrate DB pages removed.
* New Invoices module: Customer-stage lead count x financially-grounded per-customer rate, with transparent math and printable invoices.
* Salesforce leads CSV import/export now lives directly on the Leads page.
* Fixed fatal on Settings (WordPress global $current_user collision).

= 1.0.0 =
* Initial release: embedded CRM app, Google Ads/GA4 CSV analysis, Salesforce CSV import/export, security module.
