Maxooh

Maxooh is a paid service for small local businesses: it writes the pages a

plumber, an electrician or a florist needs to be found in their own town, keeps

their Google Business Profile in order, and reports on what it brings in.

This plugin is the bridge for people who already have a WordPress site. Instead

of moving to a Maxooh-hosted site, the content Maxooh produces lands in the

site they already own, in their own theme, as ordinary WordPress pages and

posts.

What it does

• Connects the site to a Maxooh account with a single 8-character code. No

application password to create, no credentials to copy between two screens.

If an administrator has already approved Maxooh with an application password,

Maxooh can install and connect the plugin itself (see the FAQ).

• Creates and updates pages sent by Maxooh: local landing pages, question and

answer pages, blog posts. They are native WordPress pages, built from core

blocks only, so the site’s theme applies to them without any styling of ours.

• Writes the SEO title, meta description, canonical URL and robots directives

into the SEO plugin already installed on the site (Yoast, Rank Math, SEOPress

are detected automatically). If no SEO plugin is present, the plugin outputs

those tags itself, on its own pages only.

• Adds JSON-LD structured data to its own pages, and only when no other plugin

is already publishing the same type on that page.

• Provides a quote request form (block and [maxooh_devis] shortcode) whose

requests reach your Maxooh inbox, or your e-mail if Maxooh is unreachable.

• Optionally counts visits to the pages Maxooh created, for your Maxooh

dashboard. This is off by default: only an administrator can turn it on.

• Shows a status screen in the WordPress admin: what is connected, which pages

are managed, which of them were edited by hand, what failed and why.

What it never does

• It never touches a page Maxooh did not create. A post without Maxooh’s own

identifier is left alone, unless Maxooh proves it published that exact page

itself before the plugin was installed (see the FAQ).

• It never deletes anything. A removal request turns the page into a draft.

• It never overwrites your own edits. If you change a Maxooh page in the

WordPress editor, the plugin notices and stops updating it. You can also lock

a page from the admin screen.

• It does not change your theme, your design, your existing pages, or your

home page.

What it is not

Not a page builder, not an SEO analysis plugin, not a standalone tool. Without

a Maxooh account it does nothing at all. It does not support WooCommerce,

multisite or multilingual setups.

External services

This plugin connects your site to Maxooh, an external service operated at

com. The plugin cannot work without it: Maxooh is where the content is

written and where the reporting lives.

Nothing is sent anywhere until the site is paired with a Maxooh account: either

you type a pairing code on the plugin’s admin screen, or Maxooh submits that

code for you, which it can only do with the application password an

administrator approved for it (see the FAQ). Pairing is what grants consent to

the exchanges below, with two exceptions. Visit counting (4) needs a second,

separate consent: it is off by default and starts only if an administrator

ticks its box on the same screen.

Quote requests (5) are sent only when a visitor submits the form. Disconnecting

from the admin screen stops every exchange described below and turns visit

counting back off. Below is every call the plugin makes, without exception.

com (this can be overridden by the site

owner with the MAXOOH_APP_URL constant, for staging environments).

1. Pairing: once, when you enter your code (or when Maxooh submits it for

you)

com/api/wp/pair: the pairing code, a

random token generated on your site, your site URL and home URL, the plugin

version, your WordPress version, your PHP version, and a technical diagnostic

(whether the site is served over HTTPS, the permalink structure, the name of the

active theme and whether it is a block theme, which SEO plugin is installed and

whether its fields can be written, whether an administrator or editor account

exists to publish under, whether scheduled tasks run, the number of pages

Maxooh manages, the date of the last synchronisation, and whether visit

counting is turned on).

Why: to attach this site to your Maxooh account and to tell you, before anything

is published, whether the site can actually receive content.

2. Status report: right after pairing, then hourly

com/api/wp/heartbeat: the same technical

diagnostic, plus the number of pages you have edited by hand. Why: so your

Maxooh dashboard can show whether the site is reachable, and so the plugin

learns whether content is waiting for it.

3. Fetching content: every 15 minutes, and when you open the Maxooh admin

screen

com/api/wp/pull: your site identifier and token,

in request headers. Then, if pages were applied, to

com/api/wp/ack: the result of each page (created,

updated, unchanged, modified locally, failed) with its address on your site.

When: every 15 minutes, when you open the Maxooh admin screen (at most once

every 5 minutes), and right after a status report that says content is waiting.

Why: many hosts and firewalls block incoming requests; this way the site

fetches its own content instead of waiting for it.

4. Visit counting: off by default, only if an administrator turns it on,

only on pages created by Maxooh

Nothing is counted until an administrator ticks “Compter les visites des pages

Maxooh pour votre tableau de bord Maxooh” (count visits to Maxooh pages for your

Maxooh dashboard) on the Maxooh admin screen. Pairing does not turn it on, and

disconnecting turns it back off. Once it is on, a small script is loaded only on

the published pages and posts that Maxooh created: never on your other pages,

and never for logged-in users. For each visit, your server relays exactly three

com/api/wp/visit: the slug of the Maxooh page

com/,

never the full address), and a random session identifier drawn by the browser

tab and forgotten when the tab is closed. No cookie is set, no IP address is

sent or stored, no advertising identifier or third-party script is used, and

browsers sending Do Not Track or Global Privacy Control are not counted. Why:

to show in your Maxooh dashboard how many people reach the pages Maxooh

produced. Untick the box at any time to stop.

5. Quote requests: only when a visitor submits a Maxooh quote form

com/api/wp/lead: the name, phone number,

e-mail address and message the visitor typed, and the page the form was

submitted from (its address and slug). Why: to deliver the request to your

Maxooh inbox. If Maxooh cannot be reached, or the site is not connected,

nothing is sent to Maxooh and the request is e-mailed to the site

administrator instead, so it is never lost. The visitor’s IP address is never

sent: a salted hash of it is kept on your own site for at most an hour, only to

limit submissions to five per hour.

6. Disconnection: once, when you click “Disconnect”

com/api/wp/disconnect: your site identifier,

site URL and token, so the account knows the site is no longer connected. The

local settings are then erased. No content is removed on either side.

Images of Maxooh pages: each time Maxooh creates or updates a page

Downloaded by your server from Maxooh’s storage, at the address Maxooh gives for

each image: the page’s featured image and the images placed inside its content

(up to 15 per page). These are plain file downloads: no token and no visitor

data are sent (like every request WordPress makes, they carry your site URL in

their user agent). Why: each image is copied once into your own Media Library

and the page points to that copy, so your pages never load images from Maxooh

and keep them if you stop using the service.

Requests Maxooh makes to your site: only while it is connected

Maxooh calls the plugin’s own routes on your site ( /wp-json/maxooh/v1/... ),

with the token, to deliver or unpublish its pages and their images, to

read the list of pages it manages and the technical diagnostic described in 1,

and to read the business name, phone number, address and opening hours your

site already publishes (WordPress settings, your SEO plugin’s local business

details, or the structured data of your home page), so that they can be

compared with your Google Business Profile. These answers contain nothing about

your visitors. Without the token, every one of these routes refuses to answer.

Pairing on your behalf: only if an administrator approved Maxooh

One route takes no token, because it is the one that creates it:

POST /wp-json/maxooh/v1/connect receives a pairing code and runs exactly the

pairing described in 1. It only accepts requests made as an administrator of

the site: Maxooh calls it with the application password an administrator

approved for Maxooh. If the site is already paired, it changes nothing.

Your API token never appears in a URL, in a log, in a page served to a visitor,

or in an error message.

com/legal/cgv

com/legal/confidentialite