=== Figgle — A/B Testing for Conversions ===
Contributors: figgle
Tags: a/b testing, conversion, optimization, split testing, landing page
Requires at least: 6.0
Tested up to: 7.1
Stable tag: 0.7.3
Requires PHP: 7.4
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Find out which headline, button or image brings you more enquiries. Figgle tests it for you and shows the better version more often.

== Description ==

**Stop guessing what works on your website.**

Figgle runs A/B tests on your WordPress site: two versions of a headline, a
button or an image compete, and Figgle shows the better one to more and more
visitors. No developer needed, no editor to learn.

**How it works**

1. Install the plugin and click **Connect to Figgle**.
2. Figgle suggests what to test: headlines, calls to action, forms, images, content sections.
3. You review a suggestion and approve it. Nothing starts without your approval.
4. The better version is shown more and more often. You follow the result in your Figgle dashboard.

**Made for small businesses**

* Coaches, consultants, tradespeople, local services and small shops
* Works with your existing theme and the common page builders
* Your visitors' data is processed in Germany
* No third-party cookies, no advertising profiles, no heatmaps, no session recordings

**Fast and light**

The main browser script is approximately 16 KB Brotli, and optional features
load only when a running test needs them. The recommended synchronous `<head>` installation
puts the new text in place before the page is shown, so visitors do not see the
original flash up first. An asynchronous fallback remains available for platforms
that require it.

**Free to start**

Figgle is a subscription service with a free tier. A Figgle account is required
to connect a site; signing up does not need a credit card. The plugin is the
WordPress connection to that service, and your tests are managed at
[app.figgle.de](https://app.figgle.de/). The plugin interface is currently
available in German.

**What this plugin does**

After an administrator explicitly approves the connection, the plugin links one
WordPress site to one Figgle site and adds the Figgle browser snippet to the
page `<head>`. The connection uses a secure PKCE handshake; the access
credential stays on your WordPress server, can be revoked at any time, and is
never exposed to browser JavaScript. Tests are never started automatically
without your approval. The only exception is the optional Auto-Pilot, which is
off by default, only available on some Figgle plans, and must be switched on by
you in Figgle.

**Please note**

The plugin does not provide heatmaps, session replay, cross-site tracking, or an
advertising profile. It is not legal advice or a compliance guarantee: whether
you need a consent banner depends on the Figgle features you use and on your
website setup.

== Installation ==

1. Install Figgle from the WordPress plugin directory or upload the plugin ZIP.
2. Activate the plugin.
3. Open **Figgle** in WordPress and select **Connect to Figgle**. Before this click, the new connection flow sends no data to Figgle.
4. Sign in to the Figgle dashboard, verify the detected domain, and explicitly approve it.
5. Return to WordPress. The plugin completes the server-side credential exchange and checks the connection.

The legacy Site ID and token form remains available under **Advanced: manual
setup** as a fallback. Existing installations are not migrated silently.

== Frequently Asked Questions ==

= Do I need technical knowledge? =

No. Install the plugin, click **Connect to Figgle**, confirm your domain, done.
Figgle suggests what to test; you only approve.

= Does it slow down my website? =

Figgle is built to stay out of the way: the main script is approximately 16 KB
Brotli and optional parts load only when a running test needs them. Real-world
speed still depends on your theme, hosting and cache setup.

= What does it cost? =

You can start on a free tier. Current plans and prices are listed on
[figgle.de](https://figgle.de/). A Figgle account is required; signing up does
not need a credit card.

= Can I stop at any time? =

Yes. Disconnecting or deleting the plugin removes the Figgle snippet from your
pages and revokes the connection. Your original content is never overwritten:
Figgle only changes what visitors see in their browser while a test is running.

= Do I need a consent banner? =

There is no universal answer. Figgle does not set third-party cookies, but some
optional measurement modes use browser storage or other signals. The legal and
consent assessment depends on the enabled features and your specific setup.

= Does it work with Gutenberg, Elementor, WooCommerce, and cache plugins? =

The plugin detects the common page builders and cache plugins and tells you
about any limitation it finds for your setup, rather than promising every
combination. Compatibility still depends on your theme, builder version, security
headers and cache configuration.

= What is synchronous mode? =

In synchronous mode Figgle's current configuration is embedded in the page
`<head>` and the script loads synchronously. This is the verified installation
path for minimizing original-content flashes. Cached pages keep the embedded
configuration until your website cache expires or is purged.

= Where is my data processed? =

Figgle processes product data in Germany. The browser script is served through
an EU content-delivery network (bunny.net, EU points of presence). Depending on
the enabled measurement mode it processes pseudonymous visitor identifiers,
experiment assignments, exposures, conversions and technical quality events.
Raw events are kept for 30 days; after that only aggregated counts remain. The
subprocessors are listed at
[https://figgle.de/legal/subprozessoren](https://figgle.de/legal/subprozessoren).
A data-processing agreement is available in the Figgle dashboard for account
owners.

= Can I use the plugin without a Figgle account? =

No. An account is required to connect a website.

== External services and privacy ==

Before the administrator clicks **Connect to Figgle**, the new connection flow
sends no data to Figgle. The intentionally selected manual fallback begins when
the Figgle Site ID is saved.

= Requests your WordPress server makes =

Starting the connection sends the site origin, a random installation ID, a PKCE
challenge, the plugin version, and a callback URL of this site to
`https://api.figgle.de/`, and opens `https://app.figgle.de/` in your browser so
you can approve the domain. No WordPress account, email address, or post content
is part of that request.

While a site is connected, the WordPress server also contacts `https://api.figgle.de/`.
Some of these requests carry a signed installation credential: the once-a-day
connection check, reading the conversion goals, and — only with the WooCommerce
integration enabled — reporting order and refund events. Disconnecting or deleting
the plugin sends one final signed request that revokes the credential.

The other requests go to public Figgle endpoints and carry no credential: the server
refreshes the embedded configuration for synchronous mode and reads this site's
public configuration from `https://api.figgle.de/api/config/<your-site-id>` to check
whether a sorting test is running; it verifies the installation when you press the
button on the settings screen; and, for the WooCommerce product-sorting feature, it
verifies a short-lived edit token.

The WooCommerce product-sorting experiment additionally makes your server load a
page of your own shop — a loopback request to your own site, not to Figgle — to
check whether your page cache serves both test groups the same product order.

= Requests the visitor's browser makes =

After connection, the browser loads the snippet from `https://cdn.figgle.de/` and
talks to `https://api.figgle.de/`. Depending on the enabled configuration, it can:

* send approved exposure, conversion, and technical events;
* look up the approximate visitor location, for location-dependent tests or content;
* store the entries listed below.

In the default consent mode, exposure and conversion events and location lookups
happen only after the visitor has agreed in your cookie banner.
Before or without consent, the browser sends at most two anonymous signals: a
sampled technical status ("loaded" or "error", with the snippet version) and,
only if you switch it on, one anonymous page count with a coarse referrer and
device class. Neither contains a visitor ID or the page address, nothing is
stored on the device for them, and Figgle keeps only daily totals.

If the Google Analytics 4 link is switched on for your site in Figgle, the
browser also adds an `experience_impression` event (test and variant ID and
name) to your page's own `dataLayer` for each measured exposure. Figgle sends
nothing to Google itself; whether that event leaves the page is decided by your
Google Analytics or Google Tag Manager setup and its consent settings.

Every one of these requests carries technically necessary connection metadata,
such as the IP address and the browser's user agent.

= What Figgle stores on the visitor's device =

This list is complete for the snippet this plugin loads. None of these entries is
readable by another website: Figgle sets no third-party cookies and builds no
cross-site profiles. Which entries actually appear depends on what is switched on
for your website.

In the default consent mode, Figgle shows variants and content rules from the
first visit but writes the measurement entries below (`_fg`, `_fgp`, `_fg_srv`,
`_fg_sid`, `_fg_sticky`, `_fg_apply`, `_fgq…`) only after the visitor has agreed
in your cookie banner. Without consent, existing `_fg_srv` and `_fg_plp` cookies
are deleted.

Consent bookkeeping (consent mode only):

* `_fgcm` (browser storage, 13 months): set only after the visitor has agreed,
  so that measurement can start on the next page even when your cookie banner's
  choice cannot be read immediately. Contains the date and the detected banner
  tool, no visitor data. Deleted when the visitor refuses or withdraws consent.
* `_fgdel` (browser storage, only after a withdrawal whose deletion request could
  not be delivered): keeps the visitor's pseudonymous ID and its secret only so
  that the deletion can be retried on the next visit. Removed once the deletion
  succeeded or after repeated failed attempts.

Recognising a returning visitor:

* `_fg` (browser storage, stays until the visitor clears their browser data; some
  browsers delete it automatically after a longer period of inactivity): a
  random, pseudonymous ID so a returning visitor keeps seeing the same variant
  instead of a different one on every visit.
* `_fgp` (browser storage, stays as long as `_fg`): a random secret belonging to
  `_fg`. It leaves the device only when the visitor personally requests a data
  export or deletion, where it proves that the request is theirs.
* `_fg_srv` (first-party cookie, lifetime one year, `SameSite=Lax`, `Secure` on
  HTTPS): mirrors `_fg` so conversions reported by your server can be attributed
  to the same visitor. It is set as soon as the site has an active server
  credential — the secure WordPress connection creates one, so this applies to
  every connected site, not only to shops. Cleared once the credential is revoked.
* `_fg_sid` (session storage, deleted when the browser tab is closed): a random
  ID that groups the events of a single visit.

Approximate location, only on websites that use location-dependent tests or content:

* `_fgc` (browser storage, 30 days): the approximate location Figgle determined
  for this visitor — city, region name, region code, and the time it was stored.
  A later visit over a mobile connection, where the location cannot be determined
  reliably, then still shows the matching regional content. This entry stays on
  the device and is never sent back to Figgle.

Which variant a visitor sees, and showing it without flicker:

* `_fg_plp` (first-party cookie, lifetime 30 days, `SameSite=Lax`, `Secure` on
  HTTPS): the A/B group of the WooCommerce product-sorting experiment, and only
  while such an experiment is running. The cookie is cleared automatically when
  the experiment ends.
* `_fg_sticky` (browser storage, 7 days, one entry per running test): the
  variant this visitor was assigned, so the page does not switch between visits.
* `_fg_apply` and `_fg_hide_…` (browser storage, 7 days each): the text and
  image changes of the last visit, so the correct version appears immediately
  instead of the original flashing up first.
* `_fg_bm:…` (browser storage, no expiry): records which measurement mode this
  website uses. Contains no visitor data.

Technical helpers:

* `_fgq…` (browser storage, until delivered): events that could not be sent yet,
  for example because the connection dropped. Deleted once Figgle confirms
  receipt.
* `_fg_cart` (session storage, 30 seconds): a short-lived copy of the WooCommerce
  cart totals, so cart-dependent content rules do not query the shop repeatedly.

Figgle is an external service operated by Sebastian Klenk (Germany); the full
provider details are in the imprint at
[https://figgle.de/impressum](https://figgle.de/impressum). The website owner
remains responsible for the legal basis, notices, and consent configuration for its
specific use. A data-processing agreement is available in the Figgle dashboard
(account owners only).

Privacy policy: [https://figgle.de/datenschutz](https://figgle.de/datenschutz)

Terms: [https://figgle.de/agb](https://figgle.de/agb)

== Screenshots ==

1. One clear task after activation: connect the WordPress site to Figgle.
2. Explicit domain confirmation in the authenticated Figgle dashboard.
3. Connection status and focused cache, CSP, loopback, and builder guidance.
4. Test management in Figgle; no draft is launched automatically.

== Changelog ==

= 0.7.3 =
* Instant mode now also recognizes visitors who already agreed in your cookie banner on their very first page view. Only sites with consent mode enabled are affected; no new cookie or storage entry.
* If the optional Google Analytics 4 link is switched on in Figgle, it now works in instant mode too.
* The readme now lists which storage entries are written only after consent, the anonymous signals sent before consent, and the optional Google Analytics 4 `dataLayer` event.

= 0.7.2 =
* Internal reliability improvements; no change for site owners.

= 0.7.1 =
* Maintenance release: script output now uses WordPress's built-in script functions, translations come from WordPress.org language packs, and admin notices appear only where needed.

= 0.7.0 =
* One-click PKCE connection without Site ID or credential copy and paste. The credential is stored server-side, never exposed to browser JavaScript.
* Requests are signed and bound to the installation, site, and origin. Goal sync and WooCommerce requests use the same revocable credential.
* Reconnecting rotates the credential. Clone, domain, or protocol changes fail closed until an administrator reconnects.
* External-service and data disclosures now sit directly next to the connection action, including the lifetime and trigger of the `_fg_srv` and `_fg_plp` cookies.
* Removed the Gutenberg conversion-goal block. Conversion goals are defined in the Figgle dashboard; existing `data-figgle-goal` markup keeps working unchanged.

= 0.6.1 =
* Fixed installation verification; clearer domain, throttling, and backend errors.

= 0.6.0 =
* Read-only WooCommerce bestseller source; server-side product-sort experiment with a fail-closed cache self-test.

= 0.5.0 =
* Signed WooCommerce order and refund events with retry handling and HPOS support.

= 0.4.0 =
* Synchronous inline-configuration mode with cache-aware fallback.

= 0.3.0 =
* Read-only conversion-goal synchronization with the Figgle dashboard.

= 0.2.0 =
* Gutenberg conversion-goal block (removed again in 0.7.0).

= 0.1.0 =
* Initial release.

== Upgrade Notice ==

= 0.7.3 =
Instant mode now recognizes visitors who already agreed in your cookie banner on their first page view, and the optional GA4 link works there too. No new cookies; no settings change needed.

= 0.7.1 =
Maintenance release. No changes to test delivery or the connection flow.

= 0.7.0 =
Secure WordPress connection without credential copy and paste. Existing installations stay unchanged until an administrator starts the new connection. The Gutenberg conversion-goal block has been removed; define conversion goals in the Figgle dashboard.
