=== MariaCare CRM ===
Contributors: mariacare
Tags: crm, google ads, analytics, salesforce, security, seo, performance
Requires at least: 6.0
Tested up to: 6.6
Requires PHP: 8.0
Stable tag: 2.9.0
License: GPL-2.0-or-later

Live Google Ads, GA4 & Search Console data (via API) fused with Salesforce leads into timestamp-based attribution and lead scoring — plus WordPress security, website-performance audits, and a read-only MCP server for Claude.

== Description ==

MariaCare CRM runs inside your existing WordPress admin — no third login to manage. It combines:

* Live Google Ads & GA4 data via their official APIs, synced hourly — connect once, never export a marketing CSV again. Salesforce leads remain a simple CSV import (no paid SF API required).
* Timestamp attribution: Lead Source is unreliable, so campaigns are credited by correlating their daily click timestamps with each lead's Created Date — fractional, decay-weighted, and honest.
* Campaign verdicts (Profitable / Break-even / Overpriced) judged by true cost per attributed CRM lead vs what a lead is worth, plus concrete next steps for copy, locations, and budget.
* Lead scoring: a ranked "who needs attention soonest" list built from recency, overdue actions, upcoming tours, funnel position, ad attribution, and value — plus per-lead call/text/email outreach guidance.
* Customer confirmation: the moment a lead reaches the qualifying Salesforce stage it is stamped as a confirmed customer — conversion date, campaign credit, and Salesforce record ID frozen in an immutable audit trail.
* WordPress & server security: pen-test style checks with one-click remediations — HTTPS/certificate health, file permissions, directory browsing, XML-RPC, DB prefix, custom login URL, enforced 2FA, failed-login limiting, daily malware scans, malicious-IP blocking before PHP, and Cloudflare traffic analysis.
* Data-processing safety: validates the hosting environment is safe for processing ads + CRM data on this server, and says exactly what to change if it isn't.
* Server resource monitor: live CPU, memory, disk, I/O, network, and top-process tiles with 24h/7d/30d history, sampled from /proc every 5 minutes — no external service or API key. Alert thresholds feed the security findings, and a sustained-CPU anomaly check catches cryptojacking. Site self-checks cover TTFB, page/object caching, PHP + OPcache, database size/health/overhead, WP-Cron, the PHP error log, autoloaded-options weight, plugin count, and image weight.
* Search Console SEO: daily organic-search sync with striking-distance queries, CTR-underperformer rewrite candidates, movers, and brand vs. non-brand split.
* Ads account health: a skeptical audit verified against Salesforce — tracking reconciliation, target drift, keyword hygiene, wasted spend, asset coverage, and budget facts with break-even framing instead of "spend more" advice.
* Claude hand-offs: one click copies a diagnostic + prescription report (security) or a "fix it" prompt with your site's actual numbers and file names (performance) to paste into Claude or the Claude Code agent managing your server.
* MCP server: 17 read-only, insight-shaped tools over everything above, so Claude can answer "what should I focus on this week?" against your real data.

== Installation ==

1. Download the plugin zip from https://maria.care/crm/
2. In wp-admin, go to Plugins → Add New → Upload Plugin, and upload the zip.
3. Activate MariaCare CRM.
4. Open the new "MariaCare CRM" menu in wp-admin.

== Changelog ==

= 2.9.0 =
* PageSpeed Insights is fully removed — no more external API, key, or quota. The upgrade cleans up automatically (audit table, crons, stored key).
* New server resource monitor on the Performance page: live tiles for CPU (with per-core bars), load, memory + swap, disk, uptime, PHP/OPcache, and top processes, polling every 8 seconds, plus 24h / 7 day / 30 day history charts from a 5-minute sampler (5-minute detail kept 48 hours, hourly rollups for 90 days). On hosts without a readable /proc, each unavailable metric says so plainly instead of showing broken tiles.
* Alert thresholds (CPU, memory, disk, I/O — configurable in Settings) turn sustained breaches into security findings, and a new CPU-anomaly check alarms when load holds at twice the 7-day baseline for 15 minutes — the signal that would have caught the 2026 cryptominer on day one.
* New site health checks: database size with biggest tables, MySQL/MariaDB server health (buffer-pool hit rate, slow queries), WP-Cron health, and a PHP error-log digest. Database overhead now counts orphaned postmeta too.
* The "Fix it with Claude" prompts now embed live resource numbers and every failing check with its real measurements.
* MCP tools updated: get_performance_report returns the server verdict + resources + checks; get_performance_trend returns CPU/memory/load trends with regression callouts; cross-module tools no longer reference page scores.

= 2.8.1 =
* Security headers are now also written as Apache `Header always set` directives in .htaccess, so cached and static responses carry them too — the PHP-level hooks alone miss page-cache hits that never reach WordPress.

= 2.8.0 =
* Three new one-click hardening toggles, each with status, apply, and revert: security headers (X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy), user-enumeration hiding (?author=N and the REST users list stop leaking usernames), and a PHP-execution block for wp-content/uploads (with the nginx snippet shown where .htaccess doesn't apply).
* The uploads check is honest: it writes a harmless probe file, requests it, and verifies the server actually refuses to execute PHP there — then cleans up.
* New abandoned-plugins check flags wordpress.org plugins without an update in 2+ years. (Full vulnerability-feed matching arrives with MariaCare Center pairing.)

= 2.7.0 =
* Compromise detection: the daily scan now also carries cryptominer signatures (XMRig, Kinsing, stratum pools and friends) in an updatable definitions file, scans JavaScript for them too, flags every executable-PHP variant (.phtml, .phar, .php5…) in uploads, and verifies plugin files against wordpress.org checksums (non-repo plugins get a local hash baseline).
* Process watch: reads /proc directly for miner process names, web-user processes executing from temp directories, and deleted-binary tricks — the exact pattern of real-world cryptojacking. Degrades gracefully where /proc isn't readable.
* Integrity watch: daily diff of administrators, siteurl/home, scheduled cron events, and .htaccess/wp-config fingerprints against a baseline you control, plus detection of injected directives like auto_prepend_file. New admins and URL hijacks are critical alerts.
* Findings now carry a severity and last-seen timestamp, can be resolved without touching disk, and each one generates a copy-able Claude fix prompt tailored to that specific finding.

= 2.6.0 =
* Credentials are now encrypted at rest: the Google OAuth client secret, refresh token, Ads developer token, and PageSpeed API key are stored with libsodium, keyed by a MARIACARE_ENC_KEY constant in wp-config.php. Existing credentials are migrated automatically; without the constant the plugin refuses to store new credentials and shows exactly what line to add.
* After migration, a notice recommends rotating the Google client secret, since the old values were stored unencrypted.
* New manage_mariacare capability gates every plugin screen and action (granted to administrators automatically), so access can be delegated without handing out full admin rights.
* Lead creation from the New Lead modal now carries a CSRF nonce.
* Uninstall is complete: every cron event, option, transient, and credential is removed. Business data (leads, marketing history) is kept unless you opt into the new "delete all data on uninstall" setting.
* The whole codebase passes the WordPress.Security coding-standard sniffs (phpcs.xml.dist included).

= 2.5.0 =
* Every page loads roughly twice as fast: the app now renders natively inside wp-admin instead of an iframe that booted WordPress a second time on every view; the heavy analyses (campaign attribution, lead scoring, the ads audit) are computed once per data refresh instead of on every page view; and the external webfont request is gone.
* Simpler, larger interface: system fonts at a bigger size, tutorial walkthroughs removed, long tables (campaigns, leads, pages) fold to the top rows with one "Show all" click.
* Performance page is now the site's task manager: a "What to do this week" list ranks everything the plugin's audits find — security, speed, ads, and SEO — by impact × confidence ÷ effort, with effort estimates and a Done button (14-day snooze).
* PageSpeed key is verified with Google the moment you save it — a bad key is refused with Google's actual error instead of silently never producing results. Queued/running/failed audit status is visible per page, and failures show their real reason on the dashboard. Fixed a URL-encoding bug that would have failed every audit.
* Analytics page gains an Organic Search section: Search Console clicks/impressions/CTR/position, brand vs. non-brand share, page-2 queries worth pushing to page 1, title-rewrite candidates ranked by missed clicks, and rising/declining queries.
* Lead Conversion Path now follows the Salesforce Lifecycle Stage field (Marketing Qualified Lead → Sales Qualified Lead → Opportunity → Customer), imported from your Leads CSV; customer confirmation also triggers when Lifecycle Stage reaches Customer. The per-lead drill-down page is removed — leads are worked in Salesforce; the attention list and analysis remain.
* Ads page: the Won Value KPI is retired from the header row.

= 2.4.0 =
* Website Performance module: weekly Google PageSpeed Insights audits (mobile Lighthouse) of the homepage, your busiest landing pages, and any pinned URLs — scores, Core Web Vitals from lab and real-visitor data, and issues ranked by estimated impact, on a new Performance dashboard with a plain-English "State of things" verdict. New server self-checks: active plugin count, oversized/unscaled images on key pages, and database overhead. The speed checks moved from the Security page to their new home here.
* "Fix it with Claude": one click copies a prompt containing your site's actual diagnostics — scores, failing vitals, the named images and scripts slowing things down, and your WordPress environment — in two variants: advice for chatting with Claude, or hands-on instructions for the Claude Code session managing your server.
* Google Search Console: one reconnect of your existing Google account grants the new read-only scope; pick a property and organic-search data syncs daily — 13 months of queries, pages, and devices. Insights: striking-distance queries (page 2, worth on-page work), CTR underperformers (title/meta rewrite candidates ranked by missed clicks), movers, and brand vs. non-brand split.
* Google Ads account health: a skeptical audit verified against Salesforce, not Google's claims — conversion-tracking health, Google-vs-Salesforce reconciliation, tCPA/tROAS drift vs 28-day reality, keyword hygiene (free wins), wasted spend with zero verified outcomes, ad strength & asset coverage, and budget-limited status reported as fact with break-even framing, never as "spend more". Auto-Applied Recommendations being ON is flagged as a warning; Google's spend-serving recommendation types are listed neutrally and never relayed as advice.
* MCP server grown from 6 to 17 read-only tools: performance report & trend, organic-search performance & SEO opportunities, ads health check & wasted spend, landing-page health ("are we paying to send traffic to a slow page?"), a unified ranked priority list (impact × confidence ÷ effort), a weekly digest, anomaly detection vs. trailing baselines, and a one-call client-report payload.

= 2.3.0 =
* MCP server: Claude (Claude Code or any MCP client) can now query this CRM's data read-only over a new stateless Streamable HTTP endpoint at /wp-json/mariacare/v1/mcp. Six insight-shaped tools: instance/integration health, funnel summary (spend → clicks → leads → customers with cost per lead/customer), per-campaign performance with time-based attribution, stale-lead detection, security report, and period-over-period comparison. Authenticated with a per-site API key generated on the Settings page (stored hashed, revocable, shown once) or a WordPress Application Password; rate-limited; every tool call logged to crm_mcp_log with a 30-day retention cap. PII is minimized by default — contact details only on explicit request.

= 2.2.0 =
* Invoicing moved out of the plugin: monthly pay-per-customer invoices are now generated by MariaCare account executives at maria.care from the Salesforce Customers report, so the client-facing app focuses on ads, analytics, leads, and security. The Invoices page, billing settings, and daily billing cron are removed (the cron is unscheduled automatically on upgrade); existing invoice history tables are left untouched. Customer confirmation is unchanged — leads reaching the Customer stage are still stamped with conversion date and campaign attribution, audit-logged.

= 2.1.4 =
* Google Ads API pinned to v25 instead of v26: the v26 endpoint exists but its methods are not yet served ("Method not found"), so v25 is the newest fully working version. With this, sync errors surface Google's real authorization messages (e.g. developer-token access level) instead of "Method not found".

= 2.1.3 =
* Google Ads sync fixed: the pinned Google Ads API version (v19) has been sunset by Google and now returns a bare HTTP 404 — bumped to the current version (v26, verified live). A sunset version is now reported with a clear message instead of "HTTP 404".

= 2.1.2 =
* Fixed "Sorry, you are not allowed to access this page" after connecting Google. The hidden wp-admin landing page for the OAuth callback was registered under the plugin menu and then removed from it, which broke WordPress's page-access resolution; it is now registered as a proper hidden page (no parent menu), so the round-trip lands back in the app with the "connected" banner.

= 2.1.1 =
* Fixed the Google OAuth redirect URI containing a doubled path segment (app/app/), which 404'd the callback after Google's consent screen. Re-copy the redirect URI from the Google Connection page into your OAuth client in Google Cloud Console, then connect again.

= 2.1.0 =
* Google connection fixed: the OAuth consent screen now opens in the top window (Google returns a bare "403. That's an error" page when the consent screen is framed, and the app runs inside a wp-admin iframe). After connecting, the browser lands back inside wp-admin automatically, and OAuth errors come back with plain-English explanations — including the "add yourself as a test user" case.
* Pass-through expense reimbursement on invoices: the agency fronts Google Ads spend, WordPress hosting, and Salesforce licenses; each invoice now adds them back at cost for full reimbursement. Ads spend is computed automatically from the synced Google Ads daily series for the billing period (never double-billed across invoices); hosting and Salesforce are flat monthly amounts set once on the Invoices page. Printable invoices group performance fees and expense reimbursements with subtotals. Expense-only periods (spend but no customers won) still invoice.
* Journey polish across the app: one-click Call / Text / Email action buttons on the lead outreach recommendation, "Customer stage = billable" hint on the lead editor, and every empty state now points to the right next step (connect Google → import Salesforce leads → work leads → invoice).
* Unified styling: shared design-system colors and button classes replace one-off inline styles on the lead detail and Leads pages; fixed a double-escaped "&" in walkthrough titles.

= 2.0.0 =
* Google Ads & GA4 now pull LIVE data via their official APIs (hourly WP-Cron sync + manual refresh) — all marketing CSV uploads removed. New Google Connection page owns the OAuth flow, API configuration, and per-source pipeline status.
* Attribution rebuilt around timestamps: daily campaign click series correlated with Salesforce lead Created Dates (7-day lookback, per-day decay, fractional credit). Lead Source is no longer used for attribution anywhere.
* New clicks→leads and sessions→leads day-by-day timeline charts, plus a clicks/leads correlation sanity check.
* Leads page: "Who needs attention soonest" — scored, ranked, with human-readable reasons. Outreach recommendations now use click-timestamp attribution.
* Invoices simplified and hardened: fee = ACV × fee% (minimum fee, Stripe integration, and 30-day refund credits removed). The daily billing job is self-healing — any run after the billing day drafts the missing period, so a missed cron never skips a month.
* Security dashboard beautified (Inter typography, refreshed cards and score hero) and extended with two new sections: Data Processing Safety (validates the host is safe for processing ads + CRM data) and Speed & Performance (TTFB, caching, PHP/OPcache, DB latency, autoload weight).
* New "Hand the fixes to your Claude Code" box: copies a complete diagnostic + prescriptions report for the AI agent managing the server, including how to re-run the audit until all checks pass.
* Sidebar reordered: Ads, Analytics, Security, Leads, Invoices, Settings.

= 1.3.0 =
* Pay-per-customer billing: ACV×15% ($100 min) fee engine, per-customer invoice lines with Salesforce record + attribution, monthly billing cron with draft review, Stripe draft invoices + webhook status sync, 30-day refund credits, immutable audit log.

= 1.2.0 =
* Animated, dismissible walkthroughs on every page — big-text, step-by-step instructions for imports, invoicing, ad analysis, and security.
* Lead Conversion Path redesigned as clean horizontal bars with per-stage survival rates.
* Post-import analysis: every Salesforce import ends with an instant read-out — conversion rate, biggest funnel drop-off, strongest/weakest sources, leads needing attention, upcoming tours, invoice readiness. Re-run anytime with "Analyze My Leads".
* Invoices radically simplified: one big live total, set-your-numbers-once setup, advanced adjustments tucked away; collected/outstanding money summary absorbed from the removed Financials page.
* Financials page removed — the Invoices page now carries the money summary.
* Google Ads: campaign verdicts (Profitable / Break-even / Overpriced) judged by true CRM cost-per-lead vs lead value, spend-share bars, clearer export instructions.
* Analytics: per-source reality-check verdicts (Star source / Steady / Quality problem) plus a computed "What to do next" action list.
* Security moved to the top of the menu; dashboard redesigned with an animated security score and checks grouped by category, each with a plain-English "why it matters".
* Salesforce "synced" indicators removed across the app.

= 1.1.0 =
* Navigation moved fully into the WordPress admin sidebar; internal app sidebar removed.
* CRM simplified to Leads only — Accounts, Contacts, Opportunities, Calendar, Pricing Tool, Data Transfer and Migrate DB pages removed.
* New Invoices module: Customer-stage lead count x financially-grounded per-customer rate, with transparent math and printable invoices.
* Salesforce leads CSV import/export now lives directly on the Leads page.
* Fixed fatal on Settings (WordPress global $current_user collision).

= 1.0.0 =
* Initial release: embedded CRM app, Google Ads/GA4 CSV analysis, Salesforce CSV import/export, security module.
