MyVitalAssistant

This is the companion plugin for MyVitalAssistant, a marketing attribution service for businesses that run Keap or HighLevel alongside Google and Meta ads. It requires a MyVitalAssistant account and does nothing until you connect one on its settings page. It does three things. Serves tracking from your own domain. The MyVitalAssistant tracking script normally loads from a tracking subdomain. Safari treats a first party name answering from a third party network as cloaking and caps its cookie at seven days, which quietly erases the ad click that earned each visitor. This plugin claims one path on your site, /vt/, and forwards it to the MyVitalAssistant collector, so the browser only ever talks to your own domain and the attribution cookie lives its full term. Carries attribution into your forms. When a visitor submits a form built with Contact Form 7, WPForms, Gravity Forms, Fluent Forms, Ninja Forms, Formidable, Elementor Pro, or Keap Opt-in Forms, the plugin sends the submitted email, name, and phone along with the visitor's attribution cookie to your MyVitalAssistant account, which writes the attribution onto the contact in your connected CRM, Keap or HighLevel. No hidden fields to wire. Optionally syncs WooCommerce orders. If you paste an order sync key from your MyVitalAssistant account, paid orders, status changes, and refunds are sent across so your sales reach your CRM and your books with the ad that earned them already attached. This is off until you paste the key. The payload is built field by field on an allow list; order meta beyond WooCommerce's own attribution fields and known CRM ids never leaves your server. Nothing is stored on your site beyond the plugin settings and a small activity log of the last 100 captures. No database tables are created.

1.5.4

• The daily heartbeat sends its commerce plugin list only on sites actually running WooCommerce. It used to send it everywhere, including sites with no shop at all, where the warning it feeds could never apply. The External services section now describes exactly what the heartbeat carries.
• The tracking path now forwards only its own attribution cookie to the collector. It used to forward the whole cookie header, which on a signed in session included the WordPress login cookie, and nothing on the receiving side ever used it. Attribution is unchanged: the one value it depends on still crosses exactly as before.
• Cookies coming back from the collector are checked by name before they are set, because they are written under your own domain rather than ours.
• Proxied responses always carry a nosniff header, so a mislabelled body cannot be treated as script running with your site's authority.

1.5.3

• The Form leads switch names Keap's Opt-in Forms among what it controls. It always did control them, and the description listed the other seven, so turning it off did more than it said.

1.5.2

• The Keap Opt-in Forms listener now verifies the request's nonce before it reads anything, using the same check and the same action string that plugin's own handler runs as its first statement. This plugin accepts exactly the set of requests Keap accepts and never one Keap would reject.
• That listener is only registered when the Keap Opt-in Forms plugin is actually installed. On every other site the endpoint does not exist at all.
• Leads from Keap opt-in forms carry the person's name again. The payload sends the Keap application's name ahead of the contact's, and the older code took the first one it saw.
• Formidable Forms submissions are read through Formidable's own entry API instead of the raw request. No superglobal is touched, and the values arrive keyed by the field's real name, so the name and phone number recorded alongside a Formidable capture are the submitted ones rather than blank.

1.5.1

• A failed order send now retries once, two minutes later. The collector stores orders under one key per order, so a retry can never duplicate a sale.
• Deactivating the plugin clears any pending retry.

1.5.0

• Review round from the wordpress.org plugins team, applied in full. Every function, option, hook, and constant now carries the myvita prefix; live sites migrate their stored settings automatically and clean both prefixes on uninstall.
• The Keap Opt-in Forms listener refuses crafted requests: it captures nothing unless the Keap plugin's own handler is registered behind it, holds a burst cap so admin-ajax floods cannot pollute the capture log, and accepts only scalar form values.
• The Update URI header is gone, per directory policy for hosted plugins.

1.4.0

• Settings panel for what this plugin sends: visitor tracking, form leads, and WooCommerce order sync each get their own switch.
• The daily heartbeat reports the store environment (WooCommerce version, currency, commerce extensions by name and version only) so the dashboard can warn when an extension changes what order data means.

1.3.2

• The enqueued script carries the plugin version, so Plugin Check runs completely clean.

1.3.1

• Plugin Check pass. The tracking script is enqueued through the script strategy API with async, superglobal reads are unslashed, and the form listener hooks document why another plugin's nonce is not ours to verify.
• Now requires WordPress 6.3, where the script strategy API arrived.

1.3.0

• First release in the WordPress.org directory. Earlier versions were distributed directly by MyVitalAssistant.
• First party tracking path with full cookie lifetime in Safari.
• Form capture for Contact Form 7, WPForms, Gravity Forms, Fluent Forms, Ninja Forms, Formidable, Elementor Pro, and Keap Opt-in Forms.
• Optional WooCommerce order sync with an allow listed payload.
• Daily heartbeat and stray tag detection.