1.5.0

Bypass WP REST cookie/nonce for leads

Short-circuit WP's REST cookie/nonce auth for this plugin's mct/leads routes by adding a rest_authentication_errors filter at priority 5 and implementing bypass_rest_cookie_auth_for_plugin_routes(). The new method detects both pretty (/wp-json/{ns}/leads...) and query (?rest_route=/{ns}/leads...) REST URIs and returns true to skip core's rest_cookie_check_errors, preventing cached nonces from causing 403s while preserving server-side validation and API token protection. Also bump plugin version to 1.5.0 (MCT_VERSION and header).

1.4.0: attribution cookie bridge + expanded source resolution

Brings the lead-source logic in line with cars4us-laravel and
mct-motorsport-brisbane so attribution survives cross-page navigation
and full-page caching (W3 Total Cache / WP Rocket / CloudFront).

class-form.php
 - get_tracking_data(): resolve source in priority order
   utm_source -> referrer-host mapping -> paid click-ID inference ->
   Organic. Previously only utm_source or 'Organic'.
 - New private helpers: first_scalar() (collapses bracketed-array query
   params like ?utm_source[0]=bing), infer_source_from_paid_click_ids()
   (gclid->google, msclkid->bing, fbclid->fb),
   detect_source_from_referrer() (host map for AI assistants, search
   engines, marketplaces, socials).
 - gclid / fbclid / msclkid now captured from both $_GET and the
   referrer query string, and passed through to the CRM.
 - route_create_lead() now forwards fbclid and msclkid (previously
   only gclid).
 - New wp_enqueue_scripts hook loads the attribution bridge on every
   page, not just pages rendering the shortcode.

assets/(src|dist)/js/attribution-cookies.js (new)
 - Plain ES5 vanilla JS, no build step required.
 - Captures utm_* / gclid / fbclid / msclkid from window.location.search
   (handles normal and bracketed-array shapes) into mct_* cookies for
   1 hour.
 - On form pages, syncs cookie values into the form's hidden inputs
   at DOMContentLoaded, overriding the PHP-baked values - which keeps
   attribution correct even when the HTML is served from a cache.

mct-lead-form.php
 - Version: 1.3.12 -> 1.4.0.
 - MCT_VERSION: 1.0 (float) -> '1.4.0' (string) so wp_enqueue_script
   cache-busting picks up the new release.

Made-with: Cursor

1.3.12

improve form validation

1.3.11

build assets, update readme

1.3.10

push new custom events, update version number, update readme

Add google tracking data

1.1.1

Capture lead tracking data