PONNOBICHITRA - Vaseline landing page (PHP, no database, no Composer, no CDN)
Premium checkout update: selected bundle preview (uses the uploaded Hero image), dynamic bundle/add-on details, and green Order Now buttons.
=============================================================================
Requirements: PHP 8.0+ with curl (cPanel default). Apache/LiteSpeed (.htaccess included).

INSTALL
1. Upload everything to public_html (or a sub-folder) and extract.
2. Make data/ and images/ writable (chmod 755; 775 if uploads fail).
3. Open /admin.php   user: admin   password: ChangeMe123   -> change it immediately.
4. Meta Pixel & Token Setup: paste Pixel ID + Conversions API token, tick "Server-side events".
5. Optional Google Sheets: open google-sheets/Code.gs, set SPREADSHEET_ID and SECRET, then deploy it as a Web App (execute as you; access for the website). Paste the /exec URL and the same secret into Admin > Meta Pixel & Token Setup. Until configured, orders are stored locally as usual.
6. Meta Events Manager > Test events: put the code in "Meta CAPI Test" and send a test Purchase.
7. Upload hero / before-after images, set prices, replace sample review with REAL reviews.

SERVER-SIDE TRACKING (all deduplicated with the browser pixel via shared event_id)
  PageView, ViewContent ........ fired by index.php after the page has been sent (no added load time)
  AddToCart, InitiateCheckout .. browser -> track.php relay
  Contact (WhatsApp), ScrollDepth 50/90%
  Purchase ..................... order.php, value computed on the server (browser total is ignored)
  Google Sheets ................ optional order webhook; configure its Apps Script Web App URL in Admin
  Match quality: fbp/fbc (also created server-side from fbclid), IP, user-agent,
  hashed phone/name/city/country, hashed external_id.
  Attribution: first-touch UTM + fbclid + referrer saved on every order.

SECURITY & PRIVACY HARDENING
  Order endpoint: server-side price validation, honeypot, request-size guard, duplicate-order detection, and rate limits (12 requests/IP and 4 orders/phone per 10 minutes).
  Tracking relay: per-IP throttling; proxy headers are not trusted for IP identification unless a trusted proxy is configured server-side.
  Minimized stored data: raw visitor IP is not saved in each order; Meta CAPI may still receive the request IP for event matching.
  Security headers: MIME sniffing, clickjacking, referrer, permissions and cross-origin opener protections. HTTPS is strongly recommended; enable redirect-to-HTTPS in your hosting panel.
  data/ holds orders and your token: blocked by .htaccess. After install open /data/orders.json
  in a browser - it must show 403/404. If it downloads, your server ignores .htaccess (e.g. Nginx):
  block /data/ in the server config.
  Admin: CSRF tokens, login throttling (6 tries / 15 min), hashed password, image type validation,
  no PHP execution inside images/.

Lifetime analytics update:
- Admin dashboard Page Views and Checkout Starts sum all daily stats stored in data/stats.json.
- New daily statistics are retained indefinitely; automatic 90-day pruning has been removed.
- Lifetime totals only include data that still exists in stats.json; any previously deleted historical days cannot be reconstructed. Back up data/stats.json regularly.
