Maxooh

Description

Maxooh is a paid service for small local businesses: it writes the pages a
plumber, an electrician or a florist needs to be found in their own town, keeps
their Google Business Profile in order, and reports on what it brings in.

This plugin is the bridge for people who already have a WordPress site. Instead
of moving to a Maxooh-hosted site, the content Maxooh produces lands in the
site they already own, in their own theme, as ordinary WordPress pages and
posts.

What it does

• Connects the site to a Maxooh account with a single 8-character code. No
  application password to create, no credentials to copy between two screens.
  If an administrator has already approved Maxooh with an application password,
  Maxooh can install and connect the plugin itself (see the FAQ).
• Creates and updates pages sent by Maxooh: local landing pages, question and
  answer pages, blog posts. They are native WordPress pages, built from core
  blocks only, so the site’s theme applies to them without any styling of ours.
• Writes the SEO title, meta description, canonical URL and robots directives
  into the SEO plugin already installed on the site (Yoast, Rank Math, SEOPress
  are detected automatically). If no SEO plugin is present, the plugin outputs
  those tags itself, on its own pages only.
• Adds JSON-LD structured data to its own pages, and only when no other plugin
  is already publishing the same type on that page.
• Provides a quote request form (block and [maxooh_devis] shortcode) whose
  requests reach your Maxooh inbox, or your e-mail if Maxooh is unreachable.
• Optionally counts visits to the pages Maxooh created, for your Maxooh
  dashboard. This is off by default: only an administrator can turn it on.
• Shows a status screen in the WordPress admin: what is connected, which pages
  are managed, which of them were edited by hand, what failed and why.

What it never does

• It never touches a page Maxooh did not create. A post without Maxooh’s own
  identifier is left alone, unless Maxooh proves it published that exact page
  itself before the plugin was installed (see the FAQ).
• It never deletes anything. A removal request turns the page into a draft.
• It never overwrites your own edits. If you change a Maxooh page in the
  WordPress editor, the plugin notices and stops updating it. You can also lock
  a page from the admin screen.
• It does not change your theme, your design, your existing pages, or your
  home page.

What it is not

Not a page builder, not an SEO analysis plugin, not a standalone tool. Without
a Maxooh account it does nothing at all. It does not support WooCommerce,
multisite or multilingual setups.

External services

This plugin connects your site to Maxooh, an external service operated at
maxooh.com. The plugin cannot work without it: Maxooh is where the content is
written and where the reporting lives.

Nothing is sent anywhere until the site is paired with a Maxooh account: either
you type a pairing code on the plugin’s admin screen, or Maxooh submits that
code for you, which it can only do with the application password an
administrator approved for it (see the FAQ). Pairing is what grants consent to
the exchanges below, with two exceptions. Visit counting (4) needs a second,
separate consent: it is off by default and starts only if an administrator
ticks its box on the same screen.
Quote requests (5) are sent only when a visitor submits the form. Disconnecting
from the admin screen stops every exchange described below and turns visit
counting back off. Below is every call the plugin makes, without exception.

All calls go to https://maxooh.com (this can be overridden by the site
owner with the MAXOOH_APP_URL constant, for staging environments).

1. Pairing: once, when you enter your code (or when Maxooh submits it for
you)
Sent to POST https://maxooh.com/api/wp/pair: the pairing code, a
random token generated on your site, your site URL and home URL, the plugin
version, your WordPress version, your PHP version, and a technical diagnostic
(whether the site is served over HTTPS, the permalink structure, the name of the
active theme and whether it is a block theme, which SEO plugin is installed and
whether its fields can be written, whether an administrator or editor account
exists to publish under, whether scheduled tasks run, the number of pages
Maxooh manages, the date of the last synchronisation, and whether visit
counting is turned on).
Why: to attach this site to your Maxooh account and to tell you, before anything
is published, whether the site can actually receive content.

2. Status report: right after pairing, then hourly
Sent to POST https://maxooh.com/api/wp/heartbeat: the same technical
diagnostic, plus the number of pages you have edited by hand. Why: so your
Maxooh dashboard can show whether the site is reachable, and so the plugin
learns whether content is waiting for it.

3. Fetching content: every 15 minutes, and when you open the Maxooh admin
screen
Sent to GET https://maxooh.com/api/wp/pull: your site identifier and token,
in request headers. Then, if pages were applied, to
POST https://maxooh.com/api/wp/ack: the result of each page (created,
updated, unchanged, modified locally, failed) with its address on your site.
When: every 15 minutes, when you open the Maxooh admin screen (at most once
every 5 minutes), and right after a status report that says content is waiting.
Why: many hosts and firewalls block incoming requests; this way the site
fetches its own content instead of waiting for it.

4. Visit counting: off by default, only if an administrator turns it on,
only on pages created by Maxooh
Nothing is counted until an administrator ticks “Compter les visites des pages
Maxooh pour votre tableau de bord Maxooh” (count visits to Maxooh pages for your
Maxooh dashboard) on the Maxooh admin screen. Pairing does not turn it on, and
disconnecting turns it back off. Once it is on, a small script is loaded only on
the published pages and posts that Maxooh created: never on your other pages,
and never for logged-in users. For each visit, your server relays exactly three
values to POST https://maxooh.com/api/wp/visit: the slug of the Maxooh page
viewed, the domain of the referring site (for example https://www.google.com/,
never the full address), and a random session identifier drawn by the browser
tab and forgotten when the tab is closed. No cookie is set, no IP address is
sent or stored, no advertising identifier or third-party script is used, and
browsers sending Do Not Track or Global Privacy Control are not counted. Why:
to show in your Maxooh dashboard how many people reach the pages Maxooh
produced. Untick the box at any time to stop.

5. Quote requests: only when a visitor submits a Maxooh quote form
Sent to POST https://maxooh.com/api/wp/lead: the name, phone number,
e-mail address and message the visitor typed, and the page the form was
submitted from (its address and slug). Why: to deliver the request to your
Maxooh inbox. If Maxooh cannot be reached, or the site is not connected,
nothing is sent to Maxooh and the request is e-mailed to the site
administrator instead, so it is never lost. The visitor’s IP address is never
sent: a salted hash of it is kept on your own site for at most an hour, only to
limit submissions to five per hour.

6. Disconnection: once, when you click “Disconnect”
Sent to POST https://maxooh.com/api/wp/disconnect: your site identifier,
site URL and token, so the account knows the site is no longer connected. The
local settings are then erased. No content is removed on either side.

Images of Maxooh pages: each time Maxooh creates or updates a page
Downloaded by your server from Maxooh’s storage, at the address Maxooh gives for
each image: the page’s featured image and the images placed inside its content
(up to 15 per page). These are plain file downloads: no token and no visitor
data are sent (like every request WordPress makes, they carry your site URL in
their user agent). Why: each image is copied once into your own Media Library
and the page points to that copy, so your pages never load images from Maxooh
and keep them if you stop using the service.

Requests Maxooh makes to your site: only while it is connected
Maxooh calls the plugin’s own routes on your site (/wp-json/maxooh/v1/...),
with the token, to deliver or unpublish its pages and their images, to
read the list of pages it manages and the technical diagnostic described in 1,
and to read the business name, phone number, address and opening hours your
site already publishes (WordPress settings, your SEO plugin’s local business
details, or the structured data of your home page), so that they can be
compared with your Google Business Profile. These answers contain nothing about
your visitors. Without the token, every one of these routes refuses to answer.

Pairing on your behalf: only if an administrator approved Maxooh
One route takes no token, because it is the one that creates it:
POST /wp-json/maxooh/v1/connect receives a pairing code and runs exactly the
pairing described in 1. It only accepts requests made as an administrator of
the site: Maxooh calls it with the application password an administrator
approved for Maxooh. If the site is already paired, it changes nothing.

Your API token never appears in a URL, in a log, in a page served to a visitor,
or in an error message.

Terms of use: https://maxooh.com/legal/cgv
Privacy policy: https://maxooh.com/legal/confidentialite