=== FlowMail Campaigns ===
Contributors: flowpressuk
Tags: email-marketing, automation, newsletter, forms, email
Requires at least: 6.3
Tested up to: 7.0
Requires PHP: 7.4
Stable tag: 1.2.44
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Create email campaigns, manage subscribers, add forms, schedule sending, and view reports from WordPress.

== Description ==

FlowMail Campaigns helps site owners create, send, and measure email campaigns directly from WordPress. It includes subscriber management, forms, queued sending, templates, email logs, content update emails, scheduled campaigns, list-based automations, and optional WooCommerce automations when WooCommerce is installed and active.

All features described here are included and functional in this plugin.

**Core features**

* Email campaigns with templates and placeholders.
* Subscriber forms and subscriber management.
* Internal Bot Shield for public forms with no third-party CAPTCHA service.
* Native block editor blocks for FlowMail forms and subscriber update content.
* Contact forms and selling enquiry forms.
* Email queue, sent email history, and email results.
* Subscriber preferences and unsubscribe handling.
* Content publishing logs and content update emails.
* Scheduled one-time and recurring campaigns.
* Starter campaign sets for weekly emails and UK seasonal dates.
* Optional WooCommerce automations when WooCommerce is installed and active.
* WooCommerce product alerts for back-in-stock, price-drop, and product category new-arrival subscriptions.
* Product alert automations management inside Automations, including category subscription overview and editable alert email templates.
* Manual Google-style review badge and no-API copy/paste review imports.
* Health check and setup tools.


== Installation ==

1. Upload the `flowmail-campaigns` folder to `/wp-content/plugins/`, or upload the ZIP through **Plugins → Add New → Upload Plugin**.
2. Activate **FlowMail Campaigns** from **Plugins → Installed Plugins**.
3. Open **FlowMail Campaigns → Settings** to configure sender details, SMTP options, forms, and safety settings.
4. Create your first campaign under **FlowMail Campaigns → Campaigns**.

== Frequently Asked Questions ==


= Does this use a third-party email service? =

No external email platform is required by default. Emails are sent through your WordPress mail configuration. If you configure SMTP, email delivery is handled by the SMTP provider you choose.

= What data is sent to external services? =

FlowMail Campaigns does not send operational data to FlowPress. If SMTP is enabled, email data is sent to the configured SMTP provider when an email is sent. This can include recipient email addresses, sender details, subject lines, message content, and email headers.

= Does FlowMail Campaigns connect to FlowPress? =

No external FlowPress connection is required for plugin functionality. Links to FlowPress are provided for documentation, support, and product information only.

== External services ==

FlowMail Campaigns does not send operational data to FlowPress or to a fixed external API.

By default, emails are sent through WordPress using `wp_mail()`, which uses the site's own mail configuration. If the site administrator enables the optional custom SMTP setting, outgoing email is sent to the SMTP server entered by that administrator when an email is sent. Depending on the email being sent, this can include recipient email addresses, sender details, subject lines, message content, and technical email headers.

The SMTP server is not supplied by FlowMail Campaigns and is not required for the plugin to work. Site administrators who enter their own SMTP server details should review the terms and privacy policy for that chosen mail provider.

The plugin also includes an admin-only WP-Cron loopback diagnostic. When an administrator runs that diagnostic, the site sends a request to its own `wp-cron.php` URL to confirm that scheduled tasks can run. No FlowPress service is contacted for this check.

The Reviews screen includes a manual Google-style review badge and a copy/paste importer for reviews that an administrator chooses to copy from their public Google review page. This feature does not contact Google, does not scrape Google, and does not use a Google API key.

== Changelog ==

= 1.2.44 =
* Security review follow-up: tightened request handling around product alert forms, subscriber CRM updates, and inbox seen-state updates.
* Hardened review and product-alert SQL construction and removed legacy query-string tracking handlers.

= 1.2.43 =
* Full request-handling pass for state-changing actions: tightened nonce ordering for product alert account/admin actions and update comment admin actions.
* Added nonce protection for dashboard refresh-cache actions and reviewed public token-based tracking/unsubscribe endpoints.

= 1.2.42 =
* Tightened nonce handling for product alert account preferences, campaign toggles, inbox seen-state updates, and product alert unsubscribe confirmation.
* Changed product alert unsubscribe links so GET requests show a confirmation screen and the state-changing cancellation runs through a nonce-protected POST request.

= 1.2.40 =
* Fixed undefined settings page context title/description warnings shown when opening global settings pages directly.
* Ran a syntax and context variable pass after the fix.

= 1.2.39 =
* Security scan cleanup: made subscribe popup settings helpers verify the settings nonce and capability directly before reading posted values, so settings POST handling is protected and clearer to Plugin Check.

= 1.2.38 =
* Tightened settings-page and subscriber-maintenance nonce verification around the review feedback examples.
* Escaped product-review and popup form markup at final output using contextual wp_kses allowlists.
* Reworked review database reads to use prepared table identifiers and prepared value placeholders.
* Hardened additional dashboard/automation queue SQL patterns found during a full plugin scan.

= 1.2.37 =
* Simplified the native WordPress FlowMail hover menu so it only shows top-level workspace categories.
* Kept the full child-page navigation inside the FlowMail app sidebar, where there is more space.
* Added Reviews to the native top-level FlowMail menu and combined Campaigns/Automations into a single native entry.

= 1.2.36 =
* Fixed the native WordPress FlowMail hover menu so it uses the same grouped/child navigation tree as the in-app sidebar.
* Corrected the submenu selector so child pages appear properly in the WordPress admin flyout.

= 1.2.35 =
* Aligned the native WordPress FlowMail flyout menu with the in-app sidebar structure.
* Kept native WordPress flyout groups expanded so child pages are visible at a glance.
* Added missing feature settings links to the native FlowMail menu tree.

= 1.2.34 =
* Reorganised feature-specific settings so audience forms/popup, lifecycle segments, email sending, protection, and advanced settings are reachable beside the relevant workspace menu areas.
* Added local settings pages for Forms & Popup, Lifecycle & Segments, Sending Settings, Protection & Security, and Advanced Settings.
* Kept the main Settings area focused on shared/global plugin defaults while preserving existing settings values and save handling.


= 1.2.32 =
* Split Reviews into All Reviews, Google Reviews, and Badges & Display pages so moderation, Google import/settings, and display tools are no longer crowded together.
* Moved Google copy/paste import and manual Google score controls to the Google Reviews page.
* Moved shortcode and badge preview guidance to the Badges & Display page.
* Reduced the global Settings review section to a pointer so feature-specific review settings now sit with the Reviews feature.

= 1.2.31 =
* Campaigns page: made the moved dashboard detail checks visible inside Help & Shortcuts as Scheduling, Recent results, and Drafts.
* Automations page: made the moved dashboard detail checks visible inside Help & Shortcuts as Coverage, Performance, and Action needed.
* Replaced generic page help copy with clearer page-specific checking cards so the dashboard can stay KPI-only while the individual pages handle investigation.

= 1.2.27 =
* Refined the workspace menu so Campaigns and Automations sit together under Campaigns & Automations.
* Moved Reviews out of Audience so review management is clearer as its own workspace destination.
* Renamed the Settings child item to General Settings to avoid duplicate Settings labels.
* Added concise page overview panels to individual workspace pages so the dashboard can stay KPI-only while each page explains its detailed checks and action links.

= 1.2.26 =
* Dashboard: clarified the Detailed Insights hierarchy with clear labels and styling for the main dashboard group, main insight panels, child automation sections, and nested coverage detail tables.
* Dashboard: updated nested automation expand/collapse labels so child sections and detail tables are easier to understand.

= 1.2.22 =
* Dashboard: unified the Detailed Insights nested accordion styling so automation coverage panels and coverage checklists use the same clear expand/collapse layout.

= 1.2.22 =
* Dashboard: keeps the Detailed Insights group collapsed on every dashboard load so the main control centre remains quick to scan.

= 1.2.20 =
* Dashboard: simplified automation tables so the essential view no longer needs a wide horizontal scroll. Trigger/revenue details now sit inside the automation row metadata.
* Dashboard: changed automation coverage into an expandable full coverage checklist while keeping created workflow performance visible.
* Automations page: added status summary cards and status filters so all automations remain visible but can be reviewed by live, needs-setup, or inactive/not-created state.

= 1.2.19 =
* Dashboard: improved Automation Coverage so recommended WooCommerce, WordPress/core, and scheduled automation rows are all shown in grouped coverage tables instead of being hidden when workflow performance cards exist.
* Dashboard: kept inactive/not-created automation rows automatically collapsed while active/scheduled/needs-setup rows remain visible with key metrics.


= 1.2.18 =
* Reworked the dashboard Automation Performance panel into grouped workflow tables.
* Shows created workflows and recommended automation coverage by Core, Scheduled, and WooCommerce groups.
* Active, partial, scheduled, and needs-setup rows stay visible; inactive or not-created automations collapse automatically.
* Added workflow table metrics for status, trigger, sent 30 days, open rate, click rate, revenue, and last sent/next run.

= 1.2.17 =
* Tidied the dashboard/workspace navigation labels so Overview remains the main dashboard and Campaigns/Automations sit under a clearer Campaign Tools group.
* Updated dashboard KPI card category labels from Workspace to Campaign Tools for clearer wording.
* Renamed the workspace sidebar eyebrow to Control Centre for a more logical admin layout.

= 1.2.16 =
* Refined the Overview dashboard into a cleaner control centre.
* Kept the top KPI cards and compact Latest Activity feed on the dashboard.
* Moved deeper store, campaign, automation, and audience investigation back to their matching menu pages to avoid duplicate reporting sections.
* Updated WooCommerce card actions so store detail opens WooCommerce orders instead of a removed dashboard anchor.

= 1.2.14 =
* Reworked the Overview dashboard into a menu-based KPI control centre with cards for Campaigns, Automations, Audience, Emails, Reviews, Content, Settings, and WooCommerce when active.
* Added direct action buttons from each dashboard card to the matching admin section for deeper investigation.

= 1.2.13 =
* Removed remaining legacy live Google review setting keys from the manual Google review badge code path.
* Tightened admin nonce handling around automation testing GET filters and subscriber maintenance actions.
* Kept Google reviews as manual score/count or administrator copy/paste import only; no Google API request is made.

= 1.2.7 =
* Improved copied Google review import compatibility with Firefox / Google Maps private-use star icons.
* Improved whole-page Google Maps review paste parsing so owner replies and review text lines are not mistaken for reviewer names.
* Preserved copied review order when importing a Google reviews page sorted newest to oldest.
* Added a safe clear button for copied Google reviews so an import can be reset and re-run.

= 1.2.5 =
* Improved the manual Google review copy/paste importer so it can handle noisy full Google Maps page text.
* Added fallback rating handling for browsers that do not copy Google star icons as text.
* Improved importer instructions and error messages for whole-page copy/paste.

= 1.2.4 =
* Removed the optional live Google review controls from the Reviews screen.
* Changed Google review handling to manual/no-API mode only.
* Added bulk copy/paste Google review importing that automatically splits detected pasted reviews into separate review records and skips duplicates.

= 1.2.3 =
* Added a no-API copy/paste Google review import panel on the Reviews screen.
* Added copied Google review source filtering and shortcode support for `[pmcpc_all_reviews source="google_manual"]`.
* Kept Google badge manual mode separate from live API mode and prevented combined badges from double-counting copied Google reviews.

= 1.1.81 =
* Added stronger signup spam guard for dotted Gmail aliases and obvious fake pending signups.
* Added a maintenance tool to delete obvious pending signup spam without affecting active subscribers.
* Added an option to keep Subscriber Update pages as one FlowMail interface by hiding native WordPress/Jetpack subscription and comment areas on update posts only.

= 1.1.78 =
* Updated Content Results into a full engagement dashboard with likes, comments, post/topic subscriptions, topic performance, engagement rate, and comment review shortcuts.

= 1.1.77 =
* Reworked Subscriber Update engagement actions to avoid nested/front-end form issues.
* Added an external update-interactions script plus a no-JavaScript like fallback link.
* Like, subscribe and comment actions now submit through a wrapper-based interaction system rather than relying on visible forms.
* Fixed Subscriber Update engagement buttons by switching Like, Subscribe, and Comment to normal WordPress admin-post form submissions.
* Removed inline engagement script output from the public update template to stop JavaScript text appearing on the page.
* Kept a simple honeypot on public subscribe/comment forms without relying on strict challenge JavaScript inside the content area.

= 1.1.73 =
* Fixed public Subscriber Update like/subscribe/comment security checks on cached pages by adding a stable public token fallback alongside WordPress nonces.

= 1.1.56 =
* Fixed Bot Shield mode saving so Strict protection is preserved even if a browser/plugin interferes with the settings tab field.

= 1.1.56 =
* Added an internal Bot Shield for public FlowMail forms with silent protection and optional strict browser challenge, without using external CAPTCHA services.
* Applied Bot Shield checks before subscriber creation, inbox/product-alert saving, email sending, and automation triggers.
* Fixed the spam test timing setting so it matches the real minimum submit time setting.
* Addressed WordPress.org review feedback for nonce handling, input sanitisation, escaped admin output, SQL preparation patterns, and automation cron hook registration.

= 1.1.51 =
* Made selected row actions consistent for automation rows by adding safe test, preview, audience-test, duplicate, toggle, and delete actions alongside edit workflow.
* Kept Add to Queue limited to manual/scheduled campaigns because trigger-based automations should not be queued as broadcasts.

= 1.1.50 =
* Clarified campaign test actions so the normal test button is labelled as an admin test.
* Campaign admin tests now send to the site admin email address, ignoring audience filters.
* Added the test recipient email address to the admin confirmation notice.
* Prevented admin test sends from overwriting an existing subscriber profile that happens to use the same email address.

= 1.1.48 =
* Added Product & category alerts to the front-end Email preferences / WooCommerce My Account area.
* Customers can now see and cancel active category new-arrival subscriptions, back-in-stock alerts, and price-drop alerts from their account email preferences page.
* Kept product/category alerts separate from general marketing email preferences so one-off alert requests do not imply marketing consent.
* Cancelling a category subscription now updates the linked product/category context used for subscriber filtering.

= 1.1.43 =
* Removed the separate Growth Tools workspace page from the main FlowMail navigation to avoid duplicating links and settings.
* Moved product alert settings, editable product alert email templates, and the category subscription overview into Automations.
* Added editable email subject/body templates for back-in-stock, price-drop, and product category new-arrival alert emails.
* Legacy Growth Tools URL now redirects to the Product alert automations section on Automations.

= 1.1.42 =
* Simplified the subscriber profile so product/category subscription context no longer appears in the top source-context card.
* Renamed the subscriber product alerts card to Product & category subscriptions and made it the single admin-facing view for those requests.
* Added a direct link from the subscriber profile to the global category subscription overview in Growth Tools.

= 1.1.40 =
* Improved product alert automation status so built-in system automations show as active/off instead of not created.
* Added a category subscription overview on Growth Tools so admins can see who subscribed to each product category.
* Kept product/category alert context out of the manual preference tag display on subscriber profiles.

= 1.1.39 =
* Fix Growth Tools admin route being removed by the workspace submenu whitelist/reorder logic.
* Clarify subscriber profile language around interests, automatic context, and product/category subscriptions.
* Add a clearer product/category interests summary on subscriber profiles.

= 1.1.37 =
* Added free native block editor blocks for subscribe, contact, selling enquiry, email preferences, and subscriber updates.
* Added a free Growth Tools page with practical setup paths and smart next-step recommendations.
* Fixed Growth Tools visibility inside the custom FlowMail admin sidebar.
* Added free WooCommerce product alerts for back-in-stock and price-drop interest capture.
* Added free WooCommerce product category subscriptions for new-arrival emails.
* Listed product alert email types inside Automations as system automations.
* Kept product alert marketing opt-in optional and separate from the transactional alert request.


= 1.1.33 =
* Fixed internationalisation translator comments and replaced restricted date() usage reported by Plugin Check.

= 1.1.32 =
* Tightened nonce handling for admin row actions, shortcode-page creation, queue cleanup, campaign actions, review actions, and subscriber updates.
* Sanitised reported POST/JSON/array inputs more explicitly and tightened hidden filter output.

= 1.1.31 =
* Added automatic logging for immediate WordPress mail send failures via wp_mail_failed, shown in subscriber bounce/deliverability activity without suppressing subscribers by itself.

= 1.1.30 =
* Improved the automatic double opt-in follow-up layout and added clearer bounce handling guidance in Maintenance tools.

= 1.1.29 =
* Added editable copy for the automatic double opt-in reminder email in Email & Login settings.

= 1.1.28 =
* Added automatic double opt-in follow-up: one reminder for pending subscribers, automatic old pending cleanup, maintenance settings, and a system automation row.

= 1.1.27 =
* Added first-pass bounce handling: manual bounce/complaint recording, suppression tags, queue suppression checks, subscriber deliverability summary, and hard-bounce cleanup tools.

= 1.1.26 =
* Added pending confirmation cleanup tools and improved the opt-in activity card layout.

= 1.1.25 =
* Added double opt-in activity tracking for confirmation email sent, detected open, confirmation click, and confirmed time on subscriber profiles.

= 1.1.24 =
* Fixed dashboard scheduled-campaign date queries to avoid database warnings when blank schedule values are present under stricter MySQL/MariaDB settings.

= 1.1.23 =
* Fixed remaining Plugin Check findings from the WordPress.org review sweep, including readme wording, request unslashing, SQL placeholders, and dynamic POST sanitisation annotations.

= 1.1.22 =
* Additional full-plugin review sweep for WordPress.org submission: tightened remaining superglobal unslashing, SQL placeholders, preview nonce handling, and late escaping patterns.

= 1.1.21 =
* Hardened REST subscribe handling for public forms while preventing unauthorised status changes.
* Strengthened admin nonce validation, request sanitisation, output escaping, and SQL placeholders for WordPress.org review.

= 1.1.18 =
* Added starter sets for weekly recurring campaigns and upcoming UK seasonal campaign dates.
* Kept WooCommerce automations available when WooCommerce is installed and active.
* Updated automation setup defaults so starter rows and reset defaults stay aligned.

= 1.1.16 =
* Aligned automation starter defaults with the campaign editor reset defaults.

= 1.1.15 =
* Restored WooCommerce automation catalogue rows as included functionality when WooCommerce is installed.

= 1.1.13 =
* Updated automation editor helper text for clearer trigger and timing setup.

= 1.1.7 =
* Tightened WordPress.org submission wording, external service disclosure, transient key handling, and shortcode output sanitization.

= 1.1.6 =
* Cleaned submission wording, removed old edition labels, and refreshed internal automation labels.

= 1.1.4 =
* Fixed the Email & Login login preview so translator notes are no longer printed on screen.


= 1.1.3 =
* WordPress.org-ready build based on the full plugin feature set.
* Removed external distribution code and access checks.
* Refined the automation catalogue for the WordPress.org build.
