=== MariaCare CRM ===
Contributors: mariacare
Tags: crm, google ads, analytics, salesforce, security
Requires at least: 6.0
Tested up to: 6.6
Requires PHP: 8.0
Stable tag: 2.1.4
License: GPL-2.0-or-later

Live Google Ads & GA4 data (via API) fused with Salesforce leads into timestamp-based attribution, lead scoring, and pay-per-customer invoices — plus WordPress security & speed testing.

== Description ==

MariaCare CRM runs inside your existing WordPress admin — no third login to manage. It combines:

* Live Google Ads & GA4 data via their official APIs, synced hourly — connect once, never export a marketing CSV again. Salesforce leads remain a simple CSV import (no paid SF API required).
* Timestamp attribution: Lead Source is unreliable, so campaigns are credited by correlating their daily click timestamps with each lead's Created Date — fractional, decay-weighted, and honest.
* Campaign verdicts (Profitable / Break-even / Overpriced) judged by true cost per attributed CRM lead vs what a lead is worth, plus concrete next steps for copy, locations, and budget.
* Lead scoring: a ranked "who needs attention soonest" list built from recency, overdue actions, upcoming tours, funnel position, ad attribution, and value — plus per-lead call/text/email outreach guidance.
* Pay-per-customer invoicing: ACV × fee% per Salesforce-confirmed customer, drafted automatically on your billing day (self-healing if a cron day is missed), every line linked to its Salesforce record and attribution snapshot, immutable audit log — and always human-reviewed before sending.
* WordPress & server security: pen-test style checks with one-click remediations — HTTPS/certificate health, file permissions, directory browsing, XML-RPC, DB prefix, custom login URL, enforced 2FA, failed-login limiting, daily malware scans, malicious-IP blocking before PHP, and Cloudflare traffic analysis.
* Data-processing safety: validates the hosting environment is safe for processing ads + CRM data on this server, and says exactly what to change if it isn't.
* Speed testing: TTFB, page/object caching, PHP + OPcache, database latency, and autoloaded-options weight — with prescriptions.
* Claude Code hand-off: one click copies a full diagnostic + prescription report to paste into the AI coding agent managing your server, so it can fix every issue and re-run the audit to 100%.

== Installation ==

1. Download the plugin zip from https://maria.care/crm/
2. In wp-admin, go to Plugins → Add New → Upload Plugin, and upload the zip.
3. Activate MariaCare CRM.
4. Open the new "MariaCare CRM" menu in wp-admin.

== Changelog ==

= 2.1.4 =
* Google Ads API pinned to v25 instead of v26: the v26 endpoint exists but its methods are not yet served ("Method not found"), so v25 is the newest fully working version. With this, sync errors surface Google's real authorization messages (e.g. developer-token access level) instead of "Method not found".

= 2.1.3 =
* Google Ads sync fixed: the pinned Google Ads API version (v19) has been sunset by Google and now returns a bare HTTP 404 — bumped to the current version (v26, verified live). A sunset version is now reported with a clear message instead of "HTTP 404".

= 2.1.2 =
* Fixed "Sorry, you are not allowed to access this page" after connecting Google. The hidden wp-admin landing page for the OAuth callback was registered under the plugin menu and then removed from it, which broke WordPress's page-access resolution; it is now registered as a proper hidden page (no parent menu), so the round-trip lands back in the app with the "connected" banner.

= 2.1.1 =
* Fixed the Google OAuth redirect URI containing a doubled path segment (app/app/), which 404'd the callback after Google's consent screen. Re-copy the redirect URI from the Google Connection page into your OAuth client in Google Cloud Console, then connect again.

= 2.1.0 =
* Google connection fixed: the OAuth consent screen now opens in the top window (Google returns a bare "403. That's an error" page when the consent screen is framed, and the app runs inside a wp-admin iframe). After connecting, the browser lands back inside wp-admin automatically, and OAuth errors come back with plain-English explanations — including the "add yourself as a test user" case.
* Pass-through expense reimbursement on invoices: the agency fronts Google Ads spend, WordPress hosting, and Salesforce licenses; each invoice now adds them back at cost for full reimbursement. Ads spend is computed automatically from the synced Google Ads daily series for the billing period (never double-billed across invoices); hosting and Salesforce are flat monthly amounts set once on the Invoices page. Printable invoices group performance fees and expense reimbursements with subtotals. Expense-only periods (spend but no customers won) still invoice.
* Journey polish across the app: one-click Call / Text / Email action buttons on the lead outreach recommendation, "Customer stage = billable" hint on the lead editor, and every empty state now points to the right next step (connect Google → import Salesforce leads → work leads → invoice).
* Unified styling: shared design-system colors and button classes replace one-off inline styles on the lead detail and Leads pages; fixed a double-escaped "&" in walkthrough titles.

= 2.0.0 =
* Google Ads & GA4 now pull LIVE data via their official APIs (hourly WP-Cron sync + manual refresh) — all marketing CSV uploads removed. New Google Connection page owns the OAuth flow, API configuration, and per-source pipeline status.
* Attribution rebuilt around timestamps: daily campaign click series correlated with Salesforce lead Created Dates (7-day lookback, per-day decay, fractional credit). Lead Source is no longer used for attribution anywhere.
* New clicks→leads and sessions→leads day-by-day timeline charts, plus a clicks/leads correlation sanity check.
* Leads page: "Who needs attention soonest" — scored, ranked, with human-readable reasons. Outreach recommendations now use click-timestamp attribution.
* Invoices simplified and hardened: fee = ACV × fee% (minimum fee, Stripe integration, and 30-day refund credits removed). The daily billing job is self-healing — any run after the billing day drafts the missing period, so a missed cron never skips a month.
* Security dashboard beautified (Inter typography, refreshed cards and score hero) and extended with two new sections: Data Processing Safety (validates the host is safe for processing ads + CRM data) and Speed & Performance (TTFB, caching, PHP/OPcache, DB latency, autoload weight).
* New "Hand the fixes to your Claude Code" box: copies a complete diagnostic + prescriptions report for the AI agent managing the server, including how to re-run the audit until all checks pass.
* Sidebar reordered: Ads, Analytics, Security, Leads, Invoices, Settings.

= 1.3.0 =
* Pay-per-customer billing: ACV×15% ($100 min) fee engine, per-customer invoice lines with Salesforce record + attribution, monthly billing cron with draft review, Stripe draft invoices + webhook status sync, 30-day refund credits, immutable audit log.

= 1.2.0 =
* Animated, dismissible walkthroughs on every page — big-text, step-by-step instructions for imports, invoicing, ad analysis, and security.
* Lead Conversion Path redesigned as clean horizontal bars with per-stage survival rates.
* Post-import analysis: every Salesforce import ends with an instant read-out — conversion rate, biggest funnel drop-off, strongest/weakest sources, leads needing attention, upcoming tours, invoice readiness. Re-run anytime with "Analyze My Leads".
* Invoices radically simplified: one big live total, set-your-numbers-once setup, advanced adjustments tucked away; collected/outstanding money summary absorbed from the removed Financials page.
* Financials page removed — the Invoices page now carries the money summary.
* Google Ads: campaign verdicts (Profitable / Break-even / Overpriced) judged by true CRM cost-per-lead vs lead value, spend-share bars, clearer export instructions.
* Analytics: per-source reality-check verdicts (Star source / Steady / Quality problem) plus a computed "What to do next" action list.
* Security moved to the top of the menu; dashboard redesigned with an animated security score and checks grouped by category, each with a plain-English "why it matters".
* Salesforce "synced" indicators removed across the app.

= 1.1.0 =
* Navigation moved fully into the WordPress admin sidebar; internal app sidebar removed.
* CRM simplified to Leads only — Accounts, Contacts, Opportunities, Calendar, Pricing Tool, Data Transfer and Migrate DB pages removed.
* New Invoices module: Customer-stage lead count x financially-grounded per-customer rate, with transparent math and printable invoices.
* Salesforce leads CSV import/export now lives directly on the Leads page.
* Fixed fatal on Settings (WordPress global $current_user collision).

= 1.0.0 =
* Initial release: embedded CRM app, Google Ads/GA4 CSV analysis, Salesforce CSV import/export, security module.
