=== MariaCare CRM ===
Contributors: mariacare
Tags: crm, google ads, analytics, salesforce, security, seo, performance
Requires at least: 6.0
Tested up to: 6.6
Requires PHP: 8.0
Stable tag: 2.5.0
License: GPL-2.0-or-later

Live Google Ads, GA4 & Search Console data (via API) fused with Salesforce leads into timestamp-based attribution and lead scoring — plus WordPress security, website-performance audits, and a read-only MCP server for Claude.

== Description ==

MariaCare CRM runs inside your existing WordPress admin — no third login to manage. It combines:

* Live Google Ads & GA4 data via their official APIs, synced hourly — connect once, never export a marketing CSV again. Salesforce leads remain a simple CSV import (no paid SF API required).
* Timestamp attribution: Lead Source is unreliable, so campaigns are credited by correlating their daily click timestamps with each lead's Created Date — fractional, decay-weighted, and honest.
* Campaign verdicts (Profitable / Break-even / Overpriced) judged by true cost per attributed CRM lead vs what a lead is worth, plus concrete next steps for copy, locations, and budget.
* Lead scoring: a ranked "who needs attention soonest" list built from recency, overdue actions, upcoming tours, funnel position, ad attribution, and value — plus per-lead call/text/email outreach guidance.
* Customer confirmation: the moment a lead reaches the qualifying Salesforce stage it is stamped as a confirmed customer — conversion date, campaign credit, and Salesforce record ID frozen in an immutable audit trail.
* WordPress & server security: pen-test style checks with one-click remediations — HTTPS/certificate health, file permissions, directory browsing, XML-RPC, DB prefix, custom login URL, enforced 2FA, failed-login limiting, daily malware scans, malicious-IP blocking before PHP, and Cloudflare traffic analysis.
* Data-processing safety: validates the hosting environment is safe for processing ads + CRM data on this server, and says exactly what to change if it isn't.
* Website performance: weekly Google PageSpeed Insights audits of your key pages (scores, Core Web Vitals from lab and real-visitor data, issues ranked by impact) plus server self-checks — TTFB, page/object caching, PHP + OPcache, database latency and overhead, autoloaded-options weight, plugin count, and image weight.
* Search Console SEO: daily organic-search sync with striking-distance queries, CTR-underperformer rewrite candidates, movers, and brand vs. non-brand split.
* Ads account health: a skeptical audit verified against Salesforce — tracking reconciliation, target drift, keyword hygiene, wasted spend, asset coverage, and budget facts with break-even framing instead of "spend more" advice.
* Claude hand-offs: one click copies a diagnostic + prescription report (security) or a "fix it" prompt with your site's actual numbers and file names (performance) to paste into Claude or the Claude Code agent managing your server.
* MCP server: 17 read-only, insight-shaped tools over everything above, so Claude can answer "what should I focus on this week?" against your real data.

== Installation ==

1. Download the plugin zip from https://maria.care/crm/
2. In wp-admin, go to Plugins → Add New → Upload Plugin, and upload the zip.
3. Activate MariaCare CRM.
4. Open the new "MariaCare CRM" menu in wp-admin.

== Changelog ==

= 2.5.0 =
* Every page loads roughly twice as fast: the app now renders natively inside wp-admin instead of an iframe that booted WordPress a second time on every view; the heavy analyses (campaign attribution, lead scoring, the ads audit) are computed once per data refresh instead of on every page view; and the external webfont request is gone.
* Simpler, larger interface: system fonts at a bigger size, tutorial walkthroughs removed, long tables (campaigns, leads, pages) fold to the top rows with one "Show all" click.
* Performance page is now the site's task manager: a "What to do this week" list ranks everything the plugin's audits find — security, speed, ads, and SEO — by impact × confidence ÷ effort, with effort estimates and a Done button (14-day snooze).
* PageSpeed key is verified with Google the moment you save it — a bad key is refused with Google's actual error instead of silently never producing results. Queued/running/failed audit status is visible per page, and failures show their real reason on the dashboard. Fixed a URL-encoding bug that would have failed every audit.
* Analytics page gains an Organic Search section: Search Console clicks/impressions/CTR/position, brand vs. non-brand share, page-2 queries worth pushing to page 1, title-rewrite candidates ranked by missed clicks, and rising/declining queries.
* Lead Conversion Path now follows the Salesforce Lifecycle Stage field (Marketing Qualified Lead → Sales Qualified Lead → Opportunity → Customer), imported from your Leads CSV; customer confirmation also triggers when Lifecycle Stage reaches Customer. The per-lead drill-down page is removed — leads are worked in Salesforce; the attention list and analysis remain.
* Ads page: the Won Value KPI is retired from the header row.

= 2.4.0 =
* Website Performance module: weekly Google PageSpeed Insights audits (mobile Lighthouse) of the homepage, your busiest landing pages, and any pinned URLs — scores, Core Web Vitals from lab and real-visitor data, and issues ranked by estimated impact, on a new Performance dashboard with a plain-English "State of things" verdict. New server self-checks: active plugin count, oversized/unscaled images on key pages, and database overhead. The speed checks moved from the Security page to their new home here.
* "Fix it with Claude": one click copies a prompt containing your site's actual diagnostics — scores, failing vitals, the named images and scripts slowing things down, and your WordPress environment — in two variants: advice for chatting with Claude, or hands-on instructions for the Claude Code session managing your server.
* Google Search Console: one reconnect of your existing Google account grants the new read-only scope; pick a property and organic-search data syncs daily — 13 months of queries, pages, and devices. Insights: striking-distance queries (page 2, worth on-page work), CTR underperformers (title/meta rewrite candidates ranked by missed clicks), movers, and brand vs. non-brand split.
* Google Ads account health: a skeptical audit verified against Salesforce, not Google's claims — conversion-tracking health, Google-vs-Salesforce reconciliation, tCPA/tROAS drift vs 28-day reality, keyword hygiene (free wins), wasted spend with zero verified outcomes, ad strength & asset coverage, and budget-limited status reported as fact with break-even framing, never as "spend more". Auto-Applied Recommendations being ON is flagged as a warning; Google's spend-serving recommendation types are listed neutrally and never relayed as advice.
* MCP server grown from 6 to 17 read-only tools: performance report & trend, organic-search performance & SEO opportunities, ads health check & wasted spend, landing-page health ("are we paying to send traffic to a slow page?"), a unified ranked priority list (impact × confidence ÷ effort), a weekly digest, anomaly detection vs. trailing baselines, and a one-call client-report payload.

= 2.3.0 =
* MCP server: Claude (Claude Code or any MCP client) can now query this CRM's data read-only over a new stateless Streamable HTTP endpoint at /wp-json/mariacare/v1/mcp. Six insight-shaped tools: instance/integration health, funnel summary (spend → clicks → leads → customers with cost per lead/customer), per-campaign performance with time-based attribution, stale-lead detection, security report, and period-over-period comparison. Authenticated with a per-site API key generated on the Settings page (stored hashed, revocable, shown once) or a WordPress Application Password; rate-limited; every tool call logged to crm_mcp_log with a 30-day retention cap. PII is minimized by default — contact details only on explicit request.

= 2.2.0 =
* Invoicing moved out of the plugin: monthly pay-per-customer invoices are now generated by MariaCare account executives at maria.care from the Salesforce Customers report, so the client-facing app focuses on ads, analytics, leads, and security. The Invoices page, billing settings, and daily billing cron are removed (the cron is unscheduled automatically on upgrade); existing invoice history tables are left untouched. Customer confirmation is unchanged — leads reaching the Customer stage are still stamped with conversion date and campaign attribution, audit-logged.

= 2.1.4 =
* Google Ads API pinned to v25 instead of v26: the v26 endpoint exists but its methods are not yet served ("Method not found"), so v25 is the newest fully working version. With this, sync errors surface Google's real authorization messages (e.g. developer-token access level) instead of "Method not found".

= 2.1.3 =
* Google Ads sync fixed: the pinned Google Ads API version (v19) has been sunset by Google and now returns a bare HTTP 404 — bumped to the current version (v26, verified live). A sunset version is now reported with a clear message instead of "HTTP 404".

= 2.1.2 =
* Fixed "Sorry, you are not allowed to access this page" after connecting Google. The hidden wp-admin landing page for the OAuth callback was registered under the plugin menu and then removed from it, which broke WordPress's page-access resolution; it is now registered as a proper hidden page (no parent menu), so the round-trip lands back in the app with the "connected" banner.

= 2.1.1 =
* Fixed the Google OAuth redirect URI containing a doubled path segment (app/app/), which 404'd the callback after Google's consent screen. Re-copy the redirect URI from the Google Connection page into your OAuth client in Google Cloud Console, then connect again.

= 2.1.0 =
* Google connection fixed: the OAuth consent screen now opens in the top window (Google returns a bare "403. That's an error" page when the consent screen is framed, and the app runs inside a wp-admin iframe). After connecting, the browser lands back inside wp-admin automatically, and OAuth errors come back with plain-English explanations — including the "add yourself as a test user" case.
* Pass-through expense reimbursement on invoices: the agency fronts Google Ads spend, WordPress hosting, and Salesforce licenses; each invoice now adds them back at cost for full reimbursement. Ads spend is computed automatically from the synced Google Ads daily series for the billing period (never double-billed across invoices); hosting and Salesforce are flat monthly amounts set once on the Invoices page. Printable invoices group performance fees and expense reimbursements with subtotals. Expense-only periods (spend but no customers won) still invoice.
* Journey polish across the app: one-click Call / Text / Email action buttons on the lead outreach recommendation, "Customer stage = billable" hint on the lead editor, and every empty state now points to the right next step (connect Google → import Salesforce leads → work leads → invoice).
* Unified styling: shared design-system colors and button classes replace one-off inline styles on the lead detail and Leads pages; fixed a double-escaped "&" in walkthrough titles.

= 2.0.0 =
* Google Ads & GA4 now pull LIVE data via their official APIs (hourly WP-Cron sync + manual refresh) — all marketing CSV uploads removed. New Google Connection page owns the OAuth flow, API configuration, and per-source pipeline status.
* Attribution rebuilt around timestamps: daily campaign click series correlated with Salesforce lead Created Dates (7-day lookback, per-day decay, fractional credit). Lead Source is no longer used for attribution anywhere.
* New clicks→leads and sessions→leads day-by-day timeline charts, plus a clicks/leads correlation sanity check.
* Leads page: "Who needs attention soonest" — scored, ranked, with human-readable reasons. Outreach recommendations now use click-timestamp attribution.
* Invoices simplified and hardened: fee = ACV × fee% (minimum fee, Stripe integration, and 30-day refund credits removed). The daily billing job is self-healing — any run after the billing day drafts the missing period, so a missed cron never skips a month.
* Security dashboard beautified (Inter typography, refreshed cards and score hero) and extended with two new sections: Data Processing Safety (validates the host is safe for processing ads + CRM data) and Speed & Performance (TTFB, caching, PHP/OPcache, DB latency, autoload weight).
* New "Hand the fixes to your Claude Code" box: copies a complete diagnostic + prescriptions report for the AI agent managing the server, including how to re-run the audit until all checks pass.
* Sidebar reordered: Ads, Analytics, Security, Leads, Invoices, Settings.

= 1.3.0 =
* Pay-per-customer billing: ACV×15% ($100 min) fee engine, per-customer invoice lines with Salesforce record + attribution, monthly billing cron with draft review, Stripe draft invoices + webhook status sync, 30-day refund credits, immutable audit log.

= 1.2.0 =
* Animated, dismissible walkthroughs on every page — big-text, step-by-step instructions for imports, invoicing, ad analysis, and security.
* Lead Conversion Path redesigned as clean horizontal bars with per-stage survival rates.
* Post-import analysis: every Salesforce import ends with an instant read-out — conversion rate, biggest funnel drop-off, strongest/weakest sources, leads needing attention, upcoming tours, invoice readiness. Re-run anytime with "Analyze My Leads".
* Invoices radically simplified: one big live total, set-your-numbers-once setup, advanced adjustments tucked away; collected/outstanding money summary absorbed from the removed Financials page.
* Financials page removed — the Invoices page now carries the money summary.
* Google Ads: campaign verdicts (Profitable / Break-even / Overpriced) judged by true CRM cost-per-lead vs lead value, spend-share bars, clearer export instructions.
* Analytics: per-source reality-check verdicts (Star source / Steady / Quality problem) plus a computed "What to do next" action list.
* Security moved to the top of the menu; dashboard redesigned with an animated security score and checks grouped by category, each with a plain-English "why it matters".
* Salesforce "synced" indicators removed across the app.

= 1.1.0 =
* Navigation moved fully into the WordPress admin sidebar; internal app sidebar removed.
* CRM simplified to Leads only — Accounts, Contacts, Opportunities, Calendar, Pricing Tool, Data Transfer and Migrate DB pages removed.
* New Invoices module: Customer-stage lead count x financially-grounded per-customer rate, with transparent math and printable invoices.
* Salesforce leads CSV import/export now lives directly on the Leads page.
* Fixed fatal on Settings (WordPress global $current_user collision).

= 1.0.0 =
* Initial release: embedded CRM app, Google Ads/GA4 CSV analysis, Salesforce CSV import/export, security module.
