For every public page view, the plugin sends a signed event containing:

• Page URL — the full URL the visitor loaded.
• Page title — the rendered <title> tag.
• Visitor ID — a random first-party cookie value (laureo_vid). New visitors get a fresh ID; returning visitors keep theirs across pages.

Logged-in WordPress users and admin pages are skipped to keep activity volume focused on real visitors. The plugin makes the request non-blocking so it never slows the page load.

• Active — The site is registered and the receiver will accept signed events from it.
• Deactivated — The site has been turned off. The receiver rejects events from this tracking key. Past activities remain in the CRM.
• Last seen [date] — The most recent event the receiver accepted from this site.
• No events yet — The site is registered but the receiver has not yet seen a valid event. Common causes: plugin not activated, plugin pasted but pointing at the wrong site origin, or events are failing signature verification.

Every event the receiver accepts must pass four checks:

• Origin header match — The request's Origin must equal the site URL you registered. A stolen tracking key used from a different origin is rejected.
• Tracking key match — The receiver hashes the tracking key in the header and compares it to the hashed key on record. Plaintext keys are never stored server-side.
• HMAC signature match — The plugin signs timestamp.payload with the per-site HMAC secret. The receiver re-computes the signature with the matching server-side secret and compares them in constant time.
• Replay window — Events with a timestamp more than 5 minutes old or 5 minutes in the future are rejected. This prevents an attacker who captured one signed request from replaying it indefinitely.

• “No events yet” persists after the plugin is activated. Check that the LAUREO_SITE_ORIGINconstant in the plugin file matches the Site URL you registered exactly (protocol included). The receiver rejects events whose Origin header doesn't match.
• Events arrive but only sporadically.WordPress page caching plugins can serve cached HTML without firing the wp_footer hook on every request. Confirm your cache plugin doesn't strip the snippet.
• Receiver returns 401. Almost always a tracking-key, HMAC-secret, or Origin mismatch. If you copied the credentials into a placeholder before the plugin was final, deactivate and re-register to get a fresh pair.
• Receiver returns 429.A per-organization rate limit kicks in if you exceed the burst budget. Page-view traffic at normal levels won't hit it; very high-traffic sites should contact support to raise the cap.
• I lost the credentials.They're unrecoverable by design. Deactivate the site, register it again, and update the plugin file with the new key + secret.