=== Easy Install Solar Forms ===
Contributors: easyinstallsolar
Tags: booking forms, service requests, crm, shortcode
Requires at least: 5.8
Tested up to: 7.0
Requires PHP: 7.4
Stable tag: 1.1.1
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Embed booking and service-request forms from an Easy Install Solar CRM workspace in WordPress.

== Description ==

Easy Install Solar Forms connects a WordPress site to an Easy Install Solar CRM workspace. Administrators can load forms created in the workspace and embed a selected booking or service-request form in a page or post with the `[easyinstallsolar_form]` shortcode.

An Easy Install Solar CRM account, a workspace with the WordPress integration enabled, and an API key are required. The plugin does not create a CRM account or forms by itself.

Configure the connection under Settings > Easy Install Solar Forms. Successful form manifests are cached for 15 minutes. Administrators can refresh the cache manually from that settings screen.

Learn more at [Easy Install Solar CRM](https://easyinstallsolar.com/)

== External service ==

This plugin connects to the Easy Install Solar CRM service, which is provided and operated by Easy Install Solar.

The service is used for two purposes:

1. When an administrator saves connection settings, manually refreshes forms, views the plugin settings screen without a cached manifest, or a shortcode needs an expired manifest, WordPress sends an HTTPS POST request to the configured workspace. The request includes the workspace API key in the `X-Easy-Install-Solar-API-Key` HTTP header and normal request metadata generated by the web server and WordPress HTTP API, such as the requesting server IP address and user agent. The service returns active form IDs, names, types, and secure embed URLs. The API key is not placed in the request URL.
2. When a visitor views a page containing an embedded form, the visitor's browser loads that form from the configured Easy Install Solar CRM workspace. A submission sends the fields displayed by the form to the service. Depending on the form type, this can include the visitor's full name, email address, phone number, company name, job address, preferred date, preferred time, and message. Normal web requests may also expose the visitor's IP address and browser user agent to the service and its hosting infrastructure. A successful submission is stored as a job record in the connected CRM workspace.

The service requires an Easy Install Solar CRM account and API key. If it is unavailable, cached manifests continue to work until WordPress expires them; refreshes fail with a generic error, and the embedded form may be unavailable. The plugin does not control web-server log retention. Submitted records remain in the connected CRM workspace until the workspace operator deletes them or applies its own retention practices.

Service website: https://easyinstallsolar.com/

Privacy policy: https://easyinstallsolar.com/privacy-policy/

Terms of service: https://easyinstallsolar.com/terms/

== Installation ==

1. Upload the `easy-install-solar-forms` folder to `/wp-content/plugins/`, or install the ZIP through Plugins > Add New > Upload Plugin.
2. Activate Easy Install Solar Forms.
3. Go to Settings > Easy Install Solar Forms.
4. Enter the HTTPS CRM workspace URL and API key from the workspace App Marketplace.
5. Save the settings and confirm that the available forms appear.
6. Add `[easyinstallsolar_form id="123"]` to a page or post, replacing `123` with an available form ID.

== Frequently Asked Questions ==

= Where do I get the workspace URL and API key? =

Sign in to the Easy Install Solar CRM workspace and open its WordPress integration in the App Marketplace. The integration must be available on the workspace plan.

= Is the API key displayed after it is saved? =

No. The settings screen shows only that a key is saved. Leave the password field blank to keep it, enter a new key to replace it, or select the explicit removal checkbox.

= Does the plugin send the API key in a URL? =

No. Version 1.1.1 and later send it in a dedicated HTTP request header over HTTPS. Query-string authentication is not supported.

= What happens if the service is unavailable? =

The plugin uses the most recent successful manifest for up to 15 minutes. A manifest refresh then shows a generic error without exposing the API key. An embedded service form cannot submit while its CRM workspace is unavailable.

= Does it support WordPress Multisite? =

Yes. Each site configures its own workspace URL and API key. Network activation does not copy one site's credentials to other sites.

= Does it support WordPress.com? =

It can be installed on WordPress.com plans that allow third-party plugins. Plan availability is controlled by WordPress.com.

== Privacy ==

The plugin adds suggested text to WordPress's Privacy Policy Guide. Site owners should review and adapt that text to disclose the embedded form, their purpose for collecting submissions, their retention period, and the Easy Install Solar service.

The plugin stores the CRM workspace URL and API key in the WordPress options table and caches the non-secret form manifest in a WordPress transient for 15 minutes. It does not create tracking cookies or analytics. See the External service section for data sent to Easy Install Solar CRM.

== Changelog ==

= 1.1.1 =

* Send API credentials only in a dedicated HTTPS request header.
* Add strict service URL, response-size, JSON, manifest, and embed URL validation.
* Cache successful form manifests for 15 minutes.
* Add a capability- and nonce-protected manual refresh action.
* Stop displaying saved API keys and add explicit replacement and removal controls.
* Move configuration under the WordPress Settings menu.
* Add iframe accessibility and security attributes.
* Add Privacy Policy Guide text and a complete external-service disclosure.
* Improve multisite uninstall cleanup and migrate settings from version 1.0.0.

= 1.0.0 =

* Initial release.

== Upgrade Notice ==

= 1.1.1 =

The Easy Install Solar manifest service must be updated before this plugin version. Older service versions that require an API key in the URL are intentionally unsupported.
