=== MetricMint ===
Contributors: designbyjm
Tags: analytics, google analytics, google tag manager, statistics, tracking
Requires at least: 6.4
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.2.1
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

MetricMint: WP analytics tags for GA4, GTM, Clarity, Hotjar, Search Console, and Bing.

== Description ==

MetricMint lets you connect common analytics and verification services from **Settings → MetricMint**. No separate tracking plugin required for each service.

**Free (Active) services**

* Google Analytics 4
* Google Tag Manager
* Microsoft Clarity
* Hotjar
* Google Search Console (HTML meta verification)
* Bing Webmaster Tools (HTML meta verification)

**Coming soon (Pro teasers)**

Advertising pixels (Meta, TikTok, LinkedIn, Pinterest, X) appear in the Tracking Tools grid as Pro (Coming Soon). They are not injected by this free plugin. Free analytics and verification remain fully usable under GPLv2 or later.

**Admin features**

* Four tabs: General, Tracking Tools, Settings, Premium
* Global master switch to pause all injections
* Role exclusions so logged-in team roles are not tracked
* Optional Google Consent Mode v2 Denied defaults before GA4 / GTM
* Founder’s Club waitlist (optional email via getmetricmint.com / MailerLite)

MetricMint is theme-agnostic and works with any WordPress theme that supports standard `wp_head` / `wp_body_open` hooks. Google Tag Manager’s noscript fallback uses `wp_body_open`; if your theme does not call that hook, the GTM iframe noscript snippet may not appear (the GTM head script still loads).

**Privacy**

When you enable a third-party service, that provider’s scripts or meta tags run on your site and may collect visitor data under that provider’s terms. See the FAQ and suggested privacy policy text (Settings → Privacy) for details. Joining the Founder’s Club waitlist is optional and separate from site visitor tracking.

The plugin also communicates with the MetricMint platform itself. See **External services** below for exactly what is sent and when.

== External services ==

This plugin can connect to the MetricMint platform at getmetricmint.com so a site can be linked to a MetricMint account, receive the configuration assigned to it, and be identified when you contact support.

**No data is sent to MetricMint unless you connect the site.** Requests 1 and 2 below happen only after you enter a MetricMint license key under **Settings → MetricMint → Settings**. Until then the plugin makes no requests to getmetricmint.com and reports nothing about your site. Every local feature works fully without connecting: tag and pixel injection, Consent Mode defaults, role exclusions, the master switch. Removing the license key stops the requests again.

**1. Site registration (after you enter a license key)**

*What it does:* registers this site with the MetricMint platform and keeps its record current.

*When:* shortly after you connect the site, once per day via WP-Cron, after you save the plugin settings, and when the plugin’s REST routes are accessed if the last successful contact was more than 12 hours ago.

*What is sent:* the site address (home URL); the WordPress administration email address (`admin_email`); the plugin version; whether the master switch is enabled; the list of enabled tracking tool IDs; the Google Analytics measurement ID, if one is configured; your MetricMint license key, if you have entered one; and a random per-site token that the plugin generates on first run and stores in the site’s options to identify this installation.

**2. Configuration sync (after you enter a license key)**

*What it does:* retrieves the tracking tool settings assigned to this site in MetricMint and applies them locally.

*When:* as part of the response to the registration request above, and when the plugin’s `metricmint/v1/pull-config` REST route is requested.

*What is sent:* the site address (home URL) and the per-site token described above.

**3. Founder’s Club waitlist (only when you submit the form)**

*What it does:* adds an email address to the MetricMint product waitlist, delivered via MailerLite.

*When:* only when you submit the waitlist form inside the plugin.

*What is sent:* the email address you enter in that form.

**4. Connection test (only when you enable a tracking tool)**

When you enable a tracking tool, the plugin may make a single request to the third-party provider you are configuring to check that the details you entered work. That request goes to that provider, not to MetricMint, and identifies itself with a user agent containing this site’s address.

Requests 1–3 go to the MetricMint platform, operated by MetricMint: [Terms of Service](https://getmetricmint.com/terms) and [Privacy Policy](https://getmetricmint.com/privacy).

The platform address can be changed for self-hosted or staging setups with the `METRICMINT_PLATFORM_BASE` constant in `wp-config.php`.

**Endpoints this plugin adds to your own site**

The plugin registers two REST routes on your site so MetricMint can check the plugin's health and apply a configuration you set in your dashboard. Neither route sends anything anywhere on its own.

* `GET /wp-json/metricmint/v1/diagnostics` returns a non-secret health summary: the plugin version, your WordPress and PHP versions, whether the site uses HTTPS and is a multisite, the site address, whether the master switch is on, which tracking tools are enabled, any caching plugin detected, and the Google Analytics measurement ID if one is configured. It never returns API keys, verification tokens, your license key, or any visitor data.
* `POST /wp-json/metricmint/v1/pull-config` asks this site to fetch its own configuration from MetricMint (request 2 above) and apply it locally.

Both routes reject unauthenticated requests. A request is accepted only from a signed-in WordPress administrator, or one carrying an `X-MetricMint-License` header matching the license key saved on this site, or an `X-MetricMint-Diagnostics-Secret` header matching a `METRICMINT_DIAGNOSTICS_SECRET` constant you define in `wp-config.php`. getmetricmint.com uses the license key. If you have not connected the site, only your own administrators can reach either route.

== Installation ==

1. Upload the `metricmint` folder to `/wp-content/plugins/`, or install the zip via Plugins → Add New → Upload Plugin.
2. Activate MetricMint through the Plugins screen.
3. Go to **Settings → MetricMint**.
4. Open Tracking Tools, enable a free service, paste the required ID or token, and Save Changes.

== Frequently Asked Questions ==

= Where are the settings? =

**Settings → MetricMint** in the WordPress admin (General, Tracking Tools, Settings, Premium tabs).

= Does the plugin send anything to MetricMint? =

Not unless you connect the site. If you never enter a MetricMint license key, the plugin makes no requests to getmetricmint.com and every feature still works.

Once you enter a license key, the plugin registers the site with the platform and keeps that record current, sending your site address and WordPress administration email address among other details, and retrieves the configuration assigned to the site. Every request, what it contains, and when it happens is listed in full under **External services**. Removing the license key stops it.

= Does MetricMint store visitor analytics itself? =

No. MetricMint only stores your configuration in the WordPress database. Analytics, heatmaps, and verification are handled by the third-party services you enable.

= What is Google Consent Mode v2 in Settings? =

When enabled, MetricMint prints Consent Mode defaults with analytics and ads storage set to Denied before GA4 / GTM load. A consent management platform can grant storage later. When off, Google scripts load without those defaults (previous behavior).

= What third-party services may load? =

Depending on what you enable (free Active tools only):

* Google Analytics 4 / gtag: Google (see [Google Analytics Terms](https://marketingplatform.google.com/about/analytics/terms/us/) and [Google Privacy Policy](https://policies.google.com/privacy))
* Google Tag Manager: Google ([Tag Manager Terms](https://www.google.com/analytics/terms/tag-manager/))
* Microsoft Clarity: Microsoft ([Clarity Terms](https://clarity.microsoft.com/terms) / Microsoft privacy policy)
* Google Search Console / Bing Webmaster: verification meta tags only
* Hotjar: Hotjar ([Hotjar Privacy Policy](https://www.hotjar.com/legal/policies/privacy/))

You are responsible for informing visitors and obtaining consent where required by law (e.g. GDPR/CCPA) before enabling tracking scripts.

= What REST endpoints does the plugin add? =

Two, both on your own site and both authenticated: `metricmint/v1/diagnostics` (a non-secret health summary) and `metricmint/v1/pull-config` (applies the configuration you set in MetricMint). See **External services** for what each returns and who can call them.

= Will Google Tag Manager work if my theme lacks wp_body_open? =

The Tag Manager script is enqueued into the document head by WordPress and still loads. Only the noscript iframe uses `wp_body_open`, so a theme without that hook misses the noscript fallback alone.

= I used AndPixels Integrations before. Are my settings kept? =

Yes. On first load MetricMint copies the legacy `apx_integrations` option into `metricmint_integrations` when the new option is empty.

== Screenshots ==

1. General — whether injection is live, and which caching plugins were detected.
2. Tracking Tools — the six free tools, each switched on or off independently.
3. Settings — connect a licence key, exclude logged-in roles, and set Google Consent Mode v2 defaults.
4. Premium — what is coming, and the Founder's Club waitlist.
5. Optional: connect a free MetricMint account to see the tools you enabled reporting in one place.
6. Google Analytics figures from the tools this plugin switched on, without leaving your dashboard.
7. Week-over-week changes called out as wins or things worth a look.
8. Your account, where the licence key lives. Paste it into Settings to connect a site. The plugin works fully without one.

== Changelog ==

= 1.2.1 =
* The plugin no longer ships brand files it never loads. Only the mark used by the settings screen remains.

= 1.2.0 =
* Tracking tags for Google Tag Manager, Microsoft Clarity, and Hotjar now load through the standard WordPress script queue instead of being written into the page, so caching, consent, and optimisation plugins can see and manage them.
* Google Consent Mode defaults now always run before Google Analytics and Tag Manager. With Analytics, Tag Manager, and Consent Mode all enabled, Tag Manager previously loaded before the defaults were set.
* The diagnostics and pull-config REST endpoints now require a site administrator, a matching license key, or a diagnostics secret you configure. They were previously reachable by anyone who knew the address.

= 1.1.12 =
* The Settings tab now tells you whether your licence key was recognised, not just whether your site could reach MetricMint.
* A key with a typo previously showed as connected. It now says so, and explains where to copy the key from.

= 1.1.11 =
* The Integrations tab is now called Tracking Tools. Existing links and bookmarks still work.
* The license key field has moved from Premium to the Settings tab, alongside role exclusions and Consent Mode.

= 1.1.10 =
* Adds a Connect to MetricMint panel under Settings → MetricMint → Premium for entering, updating, or removing your license key.
* Shows connection status and the last contact time, with a one-click disconnect that stops all requests to getmetricmint.com.

= 1.1.9 =
* Requests to the MetricMint service now happen only after you enter a license key. Without one the plugin contacts no external service, and all local features still work.
* Each connected install generates its own credential and includes it with those requests. Site registration is bound to that credential, so only the installation itself can update its own record.
* Documented every request the plugin makes to an external service (see External services).

= 1.1.8 =
* Remote activation: pull desired integrations from the MetricMint app (heartbeat response + POST /wp-json/metricmint/v1/pull-config).
* App can enable GTM, Hotjar, and Bing without requiring WP Admin as the only path.

= 1.1.6 =
* Distinct Plugin URI and Author URI for Plugin Check compliance.

= 1.1.5 =
* Site registration with the MetricMint platform (daily cron + activation hook).
* REST diagnostics endpoint for support / health checks.
* Loader includes site-register and rest-diagnostics modules.

= 1.1.4 =
* Brand styling for role-exclusion checkboxes, CTAs, badges, and links.
* Require valid IDs before enabling integrations; connection test on activate.
* Directions open by default with external links in a new tab.
* Plugins screen action links for Integrations, Settings, and Premium.

= 1.1.0 =
* Four-tab admin: General, Integrations, Settings, Premium.
* Global master switch, role exclusions, Google Consent Mode v2 Denied defaults.
* Free/Pro integration grid; Pro advertising pixels are Coming Soon teasers (not injected).
* Founder’s Club waitlist form (getmetricmint.com → MailerLite group).
* System health indicators and Developer Spotlight on General.

= 1.0.0 =
* Initial release as MetricMint (GPLv2 or later).
* Settings under Settings → MetricMint.
* Privacy policy suggested text for enabled third-party services.
* Hardened filtered registry icon output (SVG allowlist via wp_kses).
* Option key `metricmint_integrations` with one-time migration from `apx_integrations`.

== Upgrade Notice ==

= 1.2.1 =
Housekeeping only. Removes brand files the plugin never loaded; no functional change.

= 1.2.0 =
Security and correctness. The diagnostics endpoint is no longer public, Consent Mode defaults now run before Tag Manager, and tracking tags load through the normal WordPress script queue, so caching and consent plugins can finally see them.

= 1.1.12 =
Shows whether your licence key was actually recognised. A mistyped key used to look connected.

= 1.1.11 =
Renames the Integrations tab to Tracking Tools and moves the license key field to the Settings tab.

= 1.1.10 =
Adds the Connect to MetricMint panel so you can enter or remove your license key, see connection status, and disconnect at any time.

= 1.1.9 =
Recommended for all sites. The plugin now contacts MetricMint only after you enter a license key, adds a per-site credential so only your installation can update its own registration, and documents every external request it makes.

= 1.1.8 =
Enables activating GTM and other free tools from the MetricMint app (pull-config + heartbeat).

= 1.1.6 =
Plugin Check: Plugin URI and Author URI are now distinct.

= 1.1.5 =
Platform site registration and REST diagnostics.

= 1.1.4 =
Stable tag aligned with plugin header. Validation and connection checks when enabling integrations; mint UI polish.

= 1.1.0 =
New tabbed Settings UI, master switch, role exclusions, Consent Mode option, and Pro Coming Soon teasers. Free analytics remain fully usable. Meta Pixel is no longer injected until Pro ships (saved values are kept).
