Monday, October 26, 2026

Client Microsite — Forms, Firewall & PHP-Managed Copy

Rebuilt the client microsite shell so every enquiry posts to submit_lead.php, stripped third-party tracking (tag manager, Clarity, Make.com), added the thin-client firewall, fixed the WhatsApp lead flow, made all home-page copy PHP-editable and deployed the verified staging build.

Frontend Backend Security Ops

41/41

E2E Checks

Tracking Calls

Files Deployed

Task Summary

Removed the tag-manager container, Microsoft Clarity, /track.php, /submit.php, dataLayer, the Facebook event id and Make.com hooks
Wired contact, popup and floating WhatsApp forms to /submit_lead.php with cta_source tags; WhatsApp now posts the lead before opening wa.me
Added the thin-client firewall (bus.php / bus_config.php) under a registered site id, max_visits 5
Made every home-page heading, intro, contact, FAQ and footer line editable from PHP via includes/site-content.php + #site-content JSON
Investigated the “black screen after 5 seconds” report: auto popup moved 15 s → 30 s and both overlays lightened with no blur
Deployed to the staging host; production remains blocked for lack of host access

Technical Details

Lead Capture

Every form posts URL-encoded to /submit_lead.php with X-Requested-With: XMLHttpRequest, awaits JSON, shows an inline error on failure, and redirects to /thank-you only on {"success":true}. The WhatsApp modal posts name=Whatsapp Lead, blank email and the entered phone before opening WhatsApp.

contact_section / popup / whatsapp_chat | WhatsApp link | test lead verified in DB and CRM

PHP-Managed Copy

The React app stays the renderer. index.php injects safe JSON blocks before </head> using JSON_HEX_*, and each of the ten section chunks reads them with the original JSX as fallback — so copy can change without a React rebuild.

#highlights-content + #site-content | 10 section chunks | fallback to built-in copy

Thin-Client Firewall

The firewall pattern was copied to the client microsite and registered in the firewall registry. Runtime logs are gitignored, the old blocked-IP list was not carried over, and .htaccess routes deep links through index.php so the firewall cannot be bypassed.

registered site key | max_visits 5 | /index.html 301 to / | deep links to index.php

Verification

Headless Chrome rendered the React app with no Access Denied and no tracking calls. Playwright passed 41/41 checks (endpoint mocked), the footer/phone/logo audit passed 40/40, and the PHP edit-to-render test changed a heading, FAQ, footer and submit label then restored the file.

41/41 E2E | 267 requests 0 failed | 0 console errors | SHA-256 logo match

Work Done Using Premium AI Chatbot

Premium AI chatbot rebuilt the shell cleanup, the three form chunks and the thin-client wiring
AI-assisted PHP JSON injection, the site-content reader and the ten chunk patches
AI root-cause analysis of the black-screen report and the popup/overlay behaviour across browsers

AI-Assisted Tools

Claude Pro Gemini Advanced GPT-4 Turbo