=== SMS Abandoned Cart Recovery - CartBoss ===
Contributors: cartboss
Tags: abandoned cart, cart recovery, cart abandonment, sms, text messages
Requires at least: 6.0
Tested up to: 7.1
WC requires at least: 8.0
WC tested up to: 11.0
Stable tag: 4.5.5
Requires PHP: 7.4
License: GPL-3.0-or-later
License URI: https://www.gnu.org/licenses/gpl-3.0.html

Win back abandoned carts with automatic SMS reminders in 30+ languages, with a single-use discount applied when the shopper taps through.

== Description ==

**Win back abandoned carts with automatic SMS reminders and a discount already applied!**

Turn abandoned carts into orders with text reminders that send themselves. Connect your store and CartBoss texts each shopper in their own language, with a discount waiting in their cart. Adjust messages, timing and discounts to match your brand. Curious how it performs? See every message and recovered cart in your CartBoss dashboard. Do you have any questions? Our support team is one message away.

* Messages already written in 30+ languages, matched to each shopper.
* Single-use discount codes, applied the moment the shopper taps through.
* One tap restores the cart with the shopper's details filled in.
* Works on WooCommerce Blocks and classic checkout, nothing to configure.
* Pay per message sent, no subscription & helpful customer support.

== Installation ==

1. Install and activate CartBoss from Plugins -> Add New.
2. Create a free account at [CartBoss.io](https://www.cartboss.io/) and add your store.
3. Copy your store's key into CartBoss -> Settings. That's it, reminders start right away.

== Frequently Asked Questions ==

= Is the plugin free? =

Yes. You pay only for the text messages you send, at a rate per country. No subscription and no monthly fee. See [pricing](https://www.cartboss.io/pricing/).

= Do I have to write the messages? =

No. Messages come already written in 30+ languages, and each shopper gets them in their own language. You can edit them anytime.

= Do I need to create discount codes? =

No. CartBoss creates a single-use code and applies it to the cart when the shopper taps the link.

= Which carts can CartBoss recover? =

Carts where the shopper entered a phone number before leaving. Keep the phone field on at checkout.

= Does it work with the WooCommerce Cart & Checkout Blocks? =

Yes, and with the classic checkout. Nothing to set up.

= Will it slow down my store? =

CartBoss makes no changes to your theme or checkout, and on most hosts its work runs in the background, after the page has loaded.

= How long is cart data kept? =

Abandoned-cart data is removed automatically after 31 days. You can export or erase it with WordPress's own privacy tools.

== Changelog ==

= 4.5.5 =
* Fixed: on WordPress 6.8 and older the one-time database setup could never finish. CartBoss created its tables as before, but the follow-up check kept reading them as out of date, so the setup retried, reported a failure to us each time, and never completed. Stores kept working normally throughout. WordPress 6.9 and newer were never affected, and no action is needed — updating finishes the setup on the next visit.

= 4.5.4 =
* Fixed: while WordPress was replacing the plugin's files during an update, a request that caught it mid-swap could be reported to CartBoss as a plugin error. That is an update in progress, not a broken store, so CartBoss no longer reports it. Genuine errors are still reported.

= 4.5.3 =
* Fixed: when saving a cart failed unexpectedly, CartBoss told the browser it had succeeded anyway. A store owner testing the checkout saw a clean result even though the save had not finished, so a store that was quietly sending nothing looked healthy. The failure is now reported as a failure.

= 4.5.2 =
* Fixed: a shopper who types their phone number slowly, pauses, backspaces or corrects a typo no longer uses up the allowance 4.5.1 introduced of three different phone numbers per hour. While the phone field is being edited CartBoss waits; it saves the cart once the shopper leaves the field, or after ten quiet seconds. This works on both the classic and the block checkout; on the block checkout CartBoss saves the cart itself once the number settles, so a shopper who fills the phone field last is still saved.
* Fixed: `040 123 456` and `+386 40 123 456` are now recognised as the same number in countries that drop the leading zero when the number is written internationally, so a browser or plugin that reformats the field on the way out no longer costs the shopper one of those three phone numbers. Italy is excluded on purpose — there the leading zero is part of the number.
* Fixed: eight-digit national phone numbers — Denmark, Norway and other countries — are captured while the shopper types. They previously had to be typed with a country code to be picked up.
* Changed: a formatted but incomplete number, such as one an input mask has filled with brackets and dashes, is no longer treated as a finished phone number.
* Developers: the `cartboss_server_capture_enabled` filter now receives `store_api_customer`, `store_api_draft` or `store_api_order` instead of a single `store_api`. Update any filter that matched the old value.

= 4.5.1 =
* Fixed: a security hardening of abandoned-cart capture. Capture is now tied to the shopper's own WooCommerce session, and each session can save carts for at most three different phone numbers per hour. This stops an abusive script from feeding your store a stream of made-up phone numbers and running up your SMS bill. Normal shoppers — guest or logged in, classic or block checkout — are unaffected, and there is nothing to configure.
* Changed: after updating, purge your page cache and any CDN cache. Pages cached before the update keep serving the old checkout script, and captures from those pages are refused until they are purged. Nothing breaks — capture resumes on the next fresh page load. Pages that carry the checkout form now tell cache plugins not to store them.
* Added: a `cartboss_is_capture_checkout_page` filter for checkout page builders. If your checkout is built with a page builder and WooCommerce does not recognise it as the checkout page, return true from this filter for that page to restore capture while the shopper types. Even without it, capture still happens when the address changes and when the order is submitted.

= 4.5.0 =
* Added: error reports — when something in the plugin fails, a short masked technical report is queued locally and sent to CartBoss once an hour so we can fix it. Default on; switch it off under CartBoss → Settings → "Send error reports to CartBoss". Customer details are masked out before anything is sent.
* Added: `wp cartboss errors list|flush|purge` for hosts and support.
* Changed: plugin errors are no longer mirrored to CartBoss during the shopper's request (the old `/log` call, which could hold a checkout for up to 15 s on a slow connection).
* Added: Site Health now checks the error-report table.
* Fixed: if a second copy of CartBoss is installed by mistake, the notice now offers a one-click way to switch the extra copy off, and WooCommerce no longer flags it as an incompatible plugin.

= 4.4.0 =
* Added: full support for the WooCommerce Cart & Checkout blocks — abandoned-cart capture works the same on both checkouts, no setup needed (incl. the marketing-consent checkbox on WooCommerce 8.9+).
* Added: GDPR tools — export or erase a shopper's abandoned-cart data straight from WordPress's own privacy tools.
* Added: Site Health checks so you can see at a glance that your API key, cron, and CartBoss connection are healthy.
* Added: WP-CLI commands for admins and hosts: `wp cartboss status|ping|purge`.
* Added: purchase reconciliation — a background job sweeps the last 7 days of orders for purchases whose checkout hooks never fired and reports them, improving recovery-stats accuracy.
* Added: server-side checkout capture fallback — carts are captured even when the browser-side script is blocked.
* Improved: cart events are queued and retried in the background — a momentary connection hiccup no longer drops the capture on the spot.
* Improved: logging now goes to WooCommerce's own log viewer (channel `cartboss`).
* Improved: safer database updates — versioned migrations; the 4.4.0 upgrade preserves all stored carts.
* Improved: redesigned settings screen with an at-a-glance connection status.
* Improved: orders placed by excluded roles (staff, test accounts) are no longer reported as purchases.
* Improved: a second copy of the plugin installed beside this one shows a notice instead of breaking the site.
* Security: rate limits and payload caps on public checkout endpoints; hardened request validation.

= 4.3.0 =
* Security: hardened the whole plugin — strict session-token checks, constant-time coupon signature checks, same-origin redirect validation, HttpOnly + SameSite cookies, full input sanitizing and output escaping.
* Fixed: deactivating the plugin no longer deletes settings, stored carts, or the API key — cleanup happens only on uninstall.
* Fixed: cart restore links now work on sites with plain permalinks; settings save no longer adds backslashes; admin assets load only on the CartBoss screen.
* Improved: bundled libraries are namespace-prefixed — no more conflicts with other plugins shipping Symfony.
* Improved: admin UI fully translatable (text domain `cartboss`); clean notice instead of a fatal when WooCommerce is missing.
* Requirements: WordPress 6.0+, PHP 7.4+, WooCommerce 8.0+.
