Gnowise Property Valuation & Rent Lead Widgets

Gnowise Property Valuation & Rent Lead Widgets lets real estate, mortgage, and property-service websites add branded lead-capture widgets for automated property value and rent estimate workflows.

The plugin includes configurable branding, lead notification emails, optional CRM webhook posting, optional Google Maps address/geocoding support, optional email verification providers, and optional AI-generated property summaries.

This plugin requires an approved Gnowise API key to generate valuation and/or rent estimate results. Optional integrations require separate API keys from the relevant providers.

Version 1.2.73 scope

Polishes AI Summary output so JSON/code-fence responses render as clean homeowner text, refreshes summary cache keys, and removes backend routing wording from agent-facing widget setup screens.

Version 1.2.72 scope

Scenario Snapshot valuation-powered mode now performs capped additional Gnowise API calls when enabled, with fast-mode fallback and clear mode/API-call messaging.

Version 1.2.70 scope

Plugin Check cleanup: shortened the 1.2.69 upgrade notice to stay under the WordPress.org 300-character limit. No runtime behavior changed.

Version 1.2.68 scope

Lead Momentum / Likely-to-List: optional agent dashboard readiness badge that ranks leads using initial intent, timeline, monthly updates, lead score, equity/HELOC signals, and value/rent movement. Adds dashboard/export fields and monthly-update refresh support while staying disabled by default.

Version 1.2.63 scope

Plugin Check metadata/IP sanitization fix: updated Tested up to header and unslashed/sanitized REMOTE_ADDR in the trusted-proxy IP helper.

Version 1.2.62 scope

Security correctness hardening: trusted proxy IP handling, stronger signed tokens/unsubscribe stability, safer HMAC/webhook/retry handling, and result/security hardening.

Version 1.2.61 scope

• Added a comprehensive docs/ developer handoff package covering architecture, requirements, public-widget flows, settings, database schema, emails, monthly updates, QA, deployment, and maintenance.
• Added generated function/class inventory for faster developer onboarding and safer future changes.
• Added high-level class documentation comments across widget class files without changing runtime behavior.

Version 1.2.58 scope

• Upgraded the admin Setup Assistant into a smarter local guide with state-aware answers for API credentials, Google Maps, form builder, range-only display, monthly update consent/unsubscribe, SendGrid/SMTP deliverability, CRM/webhooks, security checks, deployment checks and full launch QA.
• Added a new Guide & QA admin page with copy-paste user guidance, shortcode/deployment instructions, monthly-update opt-out best practices, email deliverability notes, and an end-to-end retest checklist.
• Kept the current public widget behavior unchanged unless the administrator changes settings.

License and bundled assets

This plugin is licensed under the GNU General Public License v2 or later. The plugin package does not bundle third-party PHP libraries, JavaScript libraries, CSS frameworks, fonts, images, icons, or other binary assets. The included JavaScript, CSS, PHP templates, and default HTML email templates are plugin project files distributed under the same GPLv2-or-later license.

External services such as Gnowise API, Google Maps, OpenAI, and optional email verification providers are not bundled libraries or included assets; they are remote services called only when configured/enabled by the site administrator, as disclosed in the External services section.

External services

This plugin can connect to external services depending on administrator configuration.

Gnowise API
Purpose: Generate property valuation and/or rent estimate results.
When called: When a visitor submits a widget form or resubmits property attributes.
Data sent: Property address, optional unit number, postal code, province, city/municipality, latitude/longitude when available, selected property attributes, and requested report type.
Endpoint: https://agent.gnowise.xyz/wp-json/gnowise-agent/v1/estimate
Terms: https://gnowise.com/terms-of-use/
Privacy: https://gnowise.com/privacy-policy/

Google Maps APIs
Purpose: Address autocomplete, geocoding, JavaScript map loading, and embedded maps.
When called: When a page containing the widget loads and/or when a visitor enters or selects an address.
Data sent: Address query or latitude/longitude coordinates, depending on the feature used.
Endpoint: https://maps.googleapis.com/
Terms: https://cloud.google.com/maps-platform/terms
Privacy: https://policies.google.com/privacy

OpenAI API
Purpose: Optional AI-generated plain-language property summaries.
When called: Only when the administrator enables AI summaries and provides an OpenAI API key.
Data sent: Property address and available result JSON/insight data for the submitted lead.
Endpoint: https://api.openai.com/
Terms: https://openai.com/policies/terms-of-use
Privacy: https://openai.com/policies/privacy-policy

Email verification providers
Purpose: Optional email deliverability validation.
When called: When a visitor submits a lead form, if the administrator enables a supported provider and provides that provider’s API key.
Data sent: The submitted email address only.
Supported providers/endpoints and legal links:
– AbstractAPI Email Validation API: endpoint https://emailvalidation.abstractapi.com/; terms and privacy: https://www.abstractapi.com/legal/legal
– ZeroBounce Email Validation API: endpoint https://api.zerobounce.net/; terms: https://www.zerobounce.net/terms-of-use; privacy: https://www.zerobounce.net/privacy-policy
– Kickbox Email Verification API: endpoint https://api.kickbox.com/; terms: https://kickbox.com/terms; privacy: https://kickbox.com/privacy
– MailboxLayer/APILayer Email Validation API: endpoint https://apilayer.net/; terms: https://mailboxlayer.com/terms; privacy: https://mailboxlayer.com/privacy

CRM webhook
Purpose: Optional posting of lead details to the administrator’s CRM or automation endpoint.
When called: When a lead notification is dispatched and a secure HTTPS webhook URL is configured.
Data sent: Lead contact fields, address, status, estimate fields, and result/admin URLs.
Supported connection style: Generic HTTPS webhook. The CRM/integration preset in the admin is a helper label only; the administrator must paste the HTTPS webhook/import URL supplied by their CRM, Zapier, Make, API Nation, or similar integration provider. No CRM passwords or OAuth tokens are stored by this plugin.

Privacy

This plugin stores submitted lead data in the WordPress database, including name, email, phone number, address, optional unit number, property attributes, IP address, browser user agent, result status, and response metadata.

Depending on administrator settings, lead and property information may be sent to the valuation API, Google Maps, OpenAI, selected email verification providers, and a configured CRM webhook. Site owners should update their privacy policy to disclose these data flows before using the plugin publicly.

Security notes

Version 1.2.28 removes non-Gnowise Quebec provider references and adds the admin setup assistant. Version 1.2.26 updates the API account link to agent.gnowise.xyz, adds provider diagnostics, Google Maps API guidance, CRM webhook preset notes, and a Quebec approval note. Version 1.2.18 restores value+rent result behavior after Plugin Check hardening, improves email diagnostics/test visibility, adds broader rent-field extraction, hides the more-info panel when a usable estimate exists, and fixes the cache-busting version constant. Version 1.2.13 addresses Plugin Check findings for escaping, prepared SQL handling, deprecated functions, domain path packaging, and external SMTP preset false positives. Version 1.2.12 replaces empty/missing logo areas with a neutral “Logo” placeholder and keeps uploaded logos optional. Version 1.2.11 restores direct browser loading for the Google Maps JavaScript Places library so address suggestions work reliably with browser-restricted Google Maps keys. Version 1.2.10 includes the v1.2.9 hardening and adds final QA packaging fixes. Version 1.2.9 adds stricter public endpoint handling, nonce checks for Google Maps JSON proxy routes, rate limiting for public AJAX/REST actions, public notification hardening, OpenAI regeneration restrictions, HTTPS-only CRM webhook handling, and CSV formula-injection protection.

1.2.72

• Implemented Scenario Snapshot valuation-powered mode for the widget plugin.
• When enabled, scenario cards run capped additional Gnowise API calls using simulated improvement attributes.
• Added fallback messaging when the original payload is unavailable or the provider returns no usable adjusted values.

1.2.71

• Added local housekeeping controls for alert/scenario event pruning and cleaner scale/admin guidance.

1.2.70

• Shortened the 1.2.69 upgrade notice for Plugin Check compliance. No runtime behavior changed.

1.2.61

• Changed default lookup-form disclaimer to “Estimates are automated and informational only.” with Privacy/Terms links.
• Hide lookup-form disclaimer/marketing consent blocks after AJAX result display so result views do not repeat pre-submit form copy.

1.2.57

• Added monthly-update consent/preference copy and unsubscribe link support for local monthly update emails.

1.2.56

• Removed the duplicate public map/Street View rendering so the post-submit and result-page screens show one map only.
• Added a Public Estimate Display setting so agents can choose point estimate + range or range-only display.
• Range-only mode hides public point value/rent estimates from result cards, on-page AJAX estimate payloads, default homeowner email estimate blocks, and AI summary input.

1.2.54

• Added Widget Form Builder controls so agents can shorten the public widget by enabling/disabling optional fields.
• Added toggles for Unit/Apt, Property Type, Phone, Seller/Landlord/Refinance Intent, Decision Timeline, and Monthly Homeowner Update opt-in.
• Automatically disables dependent behavior when related fields are hidden: hidden intent skips intent-required validation, hidden timeline is ignored, hidden phone is not stored/scored, hidden property type/unit are ignored, and hidden monthly opt-in prevents new monthly-update activation.

1.2.50

• Plugin Check cleanup: scoped direct-database no-caching annotation for the custom lead table update.
• Kept CRM payload presets, lead dashboard, CSV export, monthly homeowner update email template, intent capture, lead scoring, and white-label flow intact.

1.2.28

• Removed non-Gnowise Quebec provider references from UI/code/readme.
• Added an admin-only directional setup assistant with step-by-step guidance, progress percentage, troubleshooting, requirements, and best-practice answers.

1.2.26

• Updated API account destination to agent.gnowise.xyz and made the admin account link more prominent.
• Added Diagnostics actions for live Gnowise API and Google Maps API tests, plus clearer Google Maps API enablement notes.
• Added explanatory admin help for optional email-verification providers.
• Added lightweight CRM webhook presets/notes without adding CRM-specific OAuth complexity.
• Added Quebec/QC approval note in settings.

1.2.25

• Addressed WordPress.org pre-review findings: moved admin/landing inline JS/CSS to enqueue APIs, sanitized custom CSS before inline output, aligned text domain with the plugin slug, updated contributor metadata, and expanded external-service disclosures with terms/privacy links.

1.2.24

• Corrected gateway HMAC route signing to match the Gnowise Agent API Gateway REST route.

1.2.23

• Added API-key request link in admin.
• Updated default endpoint to the Gnowise gateway endpoint.
• Added optional gateway HMAC signing headers using Gnowise Site Secret and Install ID.

1.2.22

• Added explicit GPL/bundled-assets disclosure and full GPLv2 license text file for WordPress.org submission clarity.

1.2.21

• Restored Gnowise naming for the plugin listing and administrator-only API settings while keeping visitor-facing widget/result UI neutral.

1.2.20

• Removed provider-brand references from visitor-facing UI labels/placeholders while preserving server-side option compatibility.

1.2.19

• Masked server-side API key fields in admin so saved secrets are not printed back into the page HTML.
• Added safe keep-existing behavior when masked secret fields are left blank.
• Added Diagnostics security checklist for Google Maps browser-key restrictions and server-side secret handling.

1.2.18

• Added clearer email diagnostics showing the last homeowner/admin notification dispatch, whether owner/admin emails were attempted, and whether wp_mail returned success.
• Restored combined value + rent flow behavior after Plugin Check hardening.
• Added broader API response extraction for rent fields returned as rent_estimate, estimated_rent, monthly_rent, provider-specific rent aliases, rent_low/rent_high, and similar aliases.
• Prevented the more-information panel from showing when at least one requested estimate is already available.
• Fixed WLPW_VERSION cache-busting constant to match the plugin release version.

1.2.16

• Fixed remaining Plugin Check prepared SQL error by using WordPress identifier placeholders for custom table queries.
• Further normalized request sanitization for AJAX/admin parameters.

1.2.13

• Addressed WordPress Plugin Check findings for escaped output in templates/admin views.
• Added an existing languages directory for Domain Path compliance.
• Added safer prepared-SQL handling/suppressions for custom-table queries.
• Replaced deprecated page lookup usage.
• Removed inline SMTP preset host autofill that could be flagged as offloaded remote content.

1.2.12

• Replaced empty/missing logo areas with a neutral “Logo” placeholder.

1.2.11

• Restored direct Google Maps JavaScript API loading for Places autocomplete to fix missing address suggestions on some sites.
• Kept nonce/rate-limit protection for JSON Google Maps proxy routes used for geocoding and Street View metadata.

1.2.10

• Aligned plugin name, slug, and text domain for WordPress.org packaging.
• Updated external-service documentation for public submission.
• Updated Tested up to value for WordPress.org Plugin Check compatibility.
• Added license.txt.
• Removed duplicate array assignments found during QA.

1.2.9

• Added WordPress.org-ready readme and GPL metadata.
• Added nonce and rate-limit protection for Google Maps proxy routes.
• Removed public lead-ID notification resend access.
• Added public notification idempotency to reduce duplicate sends.
• Restricted AI summary force-regeneration to administrators.
• Added OpenAI and resubmission rate limiting.
• Added HTTPS-only CRM webhook sanitization and dispatch validation.
• Added CSV export formula-injection protection.

1.2.8

• Initial reviewed build.

1. Upload the plugin folder to /wp-content/plugins/, or install it through the WordPress Plugins screen.
2. Activate the plugin.
3. Go to Property Widgets in the WordPress admin.
4. Request your API key at https://agent.gnowise.xyz/agent-api, then add your Gnowise API key and optional site secret.
5. Configure branding, email recipients, page flow, and optional integrations.
6. Add [wlpw_widget type="valuation"], [wlpw_widget type="rent"], or [wlpw_widget type="both"] to a page.

Does this plugin generate estimates by itself?

No. The plugin connects to the server-side Gnowise API. A valid Gnowise API key is required for valuation and rent estimate generation.

Can I use my own branding?

Yes. The admin settings include brand name, logo, colour, text, consent text, email templates, and page flow controls.

Does the plugin store leads?

Yes. Submitted lead details and result metadata are stored in the WordPress database so administrators can review and export leads.

Are Google Maps and OpenAI required?

No. They are optional. Google Maps can be used for address autocomplete, maps, and geocoding. OpenAI can be used to generate an optional property-summary section.