# MyBathroomConversion.com: Elementor Opt-In → SalesPromis, then I deleted the xdebug_info() probe

Source: https://www.michaelchurley.com/blog/mybathroomconversion-elementor-salespromis-xdebug-purge  
Published: 2026-02-27  
Author: Michael C. Hurley  
Tags: mybathroomconversion, wordpress, elementor, wp-engine, salespromis, remodelingloans, leadgen, bathroom-remodel, security, xdebug, hustle-launch

![Illustrative home composite from indexed marketing copy](/blog/mybathroomconversion-elementor-salespromis-xdebug-purge/screenshots/home-composite.png)

## Who

I keep meeting bathroom remodel landers that look expensive and behave like a mailto form.

Homeowners need a one-day tub-to-shower path, a phone that answers, and financing language that does not invent a bank. Operators need the Opt In record to leave WordPress and hit an intake API. Agencies that inherit WP Engine content+plugins repos need to find the money path in the child theme, not in another aspirational PLAN checkbox.

If you have ever found `xdebug_info()` at the webroot of a client site, this is the audit trail.

## What

I maintain **www.mybathroomconversion.com**. Private **HurleyUS/www.mybathroomconversion.com**, GPL-3.0, five commits, HEAD `dc5a091`.

README fact: commissioned by **SalesPromis** through **Hustle Launch** for **RemodelingLoans.com**. Marketing surface (search index; live TLS failed here): dream bath/shower in as little as one day; phone **888-859-8916**; free in-home design consultation.

Stack: Hello Elementor **3.1.1** + child **2.0.0**, Elementor **3.23.4**, Elementor Pro **3.23.3**, Dynamic.ooo **3.0.11**, Rank Math **1.0.225**, MonsterInsights **9.0.0**, Meta pixel **3.0.16**. WP Engine ignore strips core/uploads/config.

Operator spine: `elementor_pro/forms/new_record` to `my_bathroom_conversion_lead` to Opt In to POST `https://api.salespromis.com/endpoint/intake/` with `API-KEY` header; success writes `ABSPATH/.log/salespromis-$now-$id.log`. Hardcoded SalesPromis API key still in child theme. Value redacted here; rotate it.

![Lead pipe composite](/blog/mybathroomconversion-elementor-salespromis-xdebug-purge/screenshots/lead-pipe-composite.png)

## Where

Code private on HurleyUS (local remote still michaelmonetized; same HEAD). Product: **https://www.mybathroomconversion.com**.

Pack-day: DNS **141.193.213.10 / .11**; HTTPS TLS handshake alert; HTTP Cloudflare **409**. Composites labeled. WP File Manager **7.2.9** still vendored (906 files).

![Stack composite](/blog/mybathroomconversion-elementor-salespromis-xdebug-purge/screenshots/stack-composite.png)

## When

**August 15, 2024, 4:03 PM ET:** `8324926` init. Plugins, themes, SalesPromis logs, `.htaccess`, `local-xdebuginfo.php`.

**4:06 PM ET:** `17627c2` README commission chain.

**4:19 PM ET:** `ad06651` untrack `.htaccess` + `.log/salespromis-*.log`.

**January 8, 2026, 12:21 PM ET:** `eb7581e` PLAN.md claims lead capture Not Started while the hook already posts.

**February 27, 2026, 5:18 AM ET:** `dc5a091` PR #2. Delete `<?php xdebug_info();`, add SECURITY-VERIFICATION.md, closes Issue #1 `[Launch Week][P0]`. Checklist boxes remain open on purpose.

**September 8, 2026:** pack day. Draft and assets only. Do not publish.

![Security composite](/blog/mybathroomconversion-elementor-salespromis-xdebug-purge/screenshots/security-composite.png)

![PLAN drift composite](/blog/mybathroomconversion-elementor-salespromis-xdebug-purge/screenshots/plan-drift-composite.png)

## Why

A bathroom lead lander that cannot POST an Opt In into intake is a brochure with nicer tile photography.

`xdebug_info()` at the webroot was a labeled P0 with a one-line PHP file and a merged PR.

PLAN.md denying lead capture while `my_bathroom_conversion_lead` posts to SalesPromis is document drift. Believe the hook, not the checkbox.

Deleting the probe while leaving WP File Manager and a hardcoded API key means the security story is a chapter, not a finale.

Would you rotate the hardcoded SalesPromis API key first, or uninstall WP File Manager before the next launch-week checklist?