=== Plugin Name ===
Contributors: GetCost
Tags: leads, lead form, contact form, embed, contractor
Requires at least: 4.7
Tested up to: 6.8
Stable tag: 2.0.0
Requires PHP: 7.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Embed a GetCost lead form on your WordPress site and receive the submissions directly in GetCost.

== Description ==

The easiest way to add a lead form to your WordPress website and receive the submissions directly in GetCost Leads.

You can get your pre-generated shortcode from the Settings | Leads screen of the application.

Shortcode example (the business value is your activation token from Settings | Leads):

  [getcost template="123" business="YOUR-ACTIVATION-TOKEN" height="660px"]


== Installation ==

1. Upload the plugin to your `/wp-content/plugins/` directory, or install it from the WordPress plugin directory.
2. Activate the plugin through the "Plugins" screen in WordPress.
3. In GetCost, open Settings | Leads and click "Activate lead plugin" to get your activation token.
4. Add the `[getcost]` shortcode to any page or post, using the template id and activation token shown on that screen.


== Frequently Asked Questions ==

= What do I need to receive my leads? =

Create an account at https://www.getcost.com and fill in your business information.

= Can I receive an email when I receive a lead? =

Yes, an email with the lead's information will be sent to your GetCost's account email.

== Upgrade Notice ==

= 2.0.0 =
BREAKING: the lead form now requires a per-business activation token. After updating, open Settings | Leads in GetCost, click "Activate lead plugin", and replace the business="..." value in your shortcode with the new token. Shortcodes using the old numeric business id will stop receiving leads until updated.

== Changelog ==

= 2.0.0 =
* SECURITY (breaking): the "business" attribute now takes a per-business activation token (a GUID) instead of the numeric business id. The server resolves the business by this unguessable token, so bots can no longer harvest leads by POSTing incremental business ids. Activate the lead plugin from Settings | Leads to get your token, then update your shortcode.

= 1.3.2 =
* Allow the form's Address field to use the browser location (allow="geolocation" on the iframe).
* Add a getcost_embed_base filter so the embed URL can be overridden for local/staging installs.
* Make the shortcode's messages translatable (text domain "getcost").
* Rename the "form" attribute to "template" (the embed targets a template); "form" still works as a backward-compatible alias.

= 1.3.1 =
* Fix the embedded form height: the size is now applied to the iframe itself (previously only the wrapper was sized, so the form was stuck at the 150px iframe default).
* Make the embed responsive (max-width:100%) so it no longer overflows on small screens.
* Harden the shortcode: form/business are cast with absint(), the URL is escaped with esc_url(), and width/height are validated as CSS lengths.

= 1.0 =
* Initial version.

