Who
I keep meeting bathroom remodel landers that look expensive and behave like a mailto form.
Homeowners need a one-day tub-to-shower path, a phone that answers, and financing language that does not invent a bank. Operators need the Opt In record to leave WordPress and hit an intake API. Agencies that inherit WP Engine content+plugins repos need to find the money path in the child theme, not in another aspirational PLAN checkbox.
If you have ever found xdebug_info() at the webroot of a client site, this is the audit trail.
What
I maintain www.mybathroomconversion.com. Private HurleyUS/www.mybathroomconversion.com, GPL-3.0, five commits, HEAD dc5a091.
README fact: commissioned by SalesPromis through Hustle Launch for RemodelingLoans.com. Marketing surface (search index; live TLS failed here): dream bath/shower in as little as one day; phone 888-859-8916; free in-home design consultation.
Stack: Hello Elementor 3.1.1 + child 2.0.0, Elementor 3.23.4, Elementor Pro 3.23.3, Dynamic.ooo 3.0.11, Rank Math 1.0.225, MonsterInsights 9.0.0, Meta pixel 3.0.16. WP Engine ignore strips core/uploads/config.
Operator spine: elementor_pro/forms/new_record to my_bathroom_conversion_lead to Opt In to POST https://api.salespromis.com/endpoint/intake/ with API-KEY header; success writes ABSPATH/.log/salespromis-$now-$id.log. Hardcoded SalesPromis API key still in child theme. Value redacted here; rotate it.
Where
Code private on HurleyUS (local remote still michaelmonetized; same HEAD). Product: https://www.mybathroomconversion.com.
Pack-day: DNS 141.193.213.10 / .11; HTTPS TLS handshake alert; HTTP Cloudflare 409. Composites labeled. WP File Manager 7.2.9 still vendored (906 files).
When
August 15, 2024, 4:03 PM ET: 8324926 init. Plugins, themes, SalesPromis logs, .htaccess, local-xdebuginfo.php.
4:06 PM ET: 17627c2 README commission chain.
4:19 PM ET: ad06651 untrack .htaccess + .log/salespromis-*.log.
January 8, 2026, 12:21 PM ET: eb7581e PLAN.md claims lead capture Not Started while the hook already posts.
February 27, 2026, 5:18 AM ET: dc5a091 PR #2. Delete <?php xdebug_info();, add SECURITY-VERIFICATION.md, closes Issue #1 [Launch Week][P0]. Checklist boxes remain open on purpose.
September 8, 2026: pack day. Draft and assets only. Do not publish.
Why
A bathroom lead lander that cannot POST an Opt In into intake is a brochure with nicer tile photography.
xdebug_info() at the webroot was a labeled P0 with a one-line PHP file and a merged PR.
PLAN.md denying lead capture while my_bathroom_conversion_lead posts to SalesPromis is document drift. Believe the hook, not the checkbox.
Deleting the probe while leaving WP File Manager and a hardcoded API key means the security story is a chapter, not a finale.
Would you rotate the hardcoded SalesPromis API key first, or uninstall WP File Manager before the next launch-week checklist?