FAQ

I used this plugin when it was called Turtlelytics. What do I do?

Install and activate TurtleReport first, then delete Turtlelytics. On activation TurtleReport switches Turtlelytics off and moves everything over on each site: settings, sites, Google connections, schedules, recipients, delivery history, viewer access and display preferences. Saved secrets stay readable, the OAuth redirect URI already registered in Google Cloud keeps working, and secure report links you already sent stay valid until they expire. Don’t delete Turtlelytics before TurtleReport has been activated: deleting it removes its data.

Does this add tracking to my website?

No. TurtleReport reads data you already collect in Google’s products. It adds nothing to your public pages and collects nothing from visitors.

Which connection type should I use?

Google sign-in is quickest if your Google account already has access to the properties, and it’s the only option that supports Business Profile. A service-account key never expires and doesn’t depend on a person’s account, which suits agencies; you add its email as a user in each Search Console and GA4 property.

The Search Console or GA4 list on “Add site” only shows “None”.

Read the message under the list. “Can’t see any yet” means the Google account on that connection (its email is shown on the Connections screen) has no access to any property: sign in with the account that owns them, or add it as a user in Search Console or GA4. A permission message means a box was left unticked on Google’s consent screen, so sign in with Google again and tick every box. If an “API is not enabled” message appears, enable that API in your Cloud project. Then click “Reload lists from Google”.

My Google sign-in stops working after a week.

Your OAuth app is still in “Testing”, where Google expires sign-ins after 7 days. In Google Cloud, open Google Auth Platform → Audience and click Publish app, then reconnect.

Business Profile says it’s waiting for approval.

Google keeps the Business Profile APIs closed until it approves your Cloud project. Apply with Google’s form and choose “Application for Basic API Access”. The setup guide has the details.

Can a client see another client’s report?

No. Unless they’re an administrator, a user sees only the sites granted to them or their role. The REST API checks this for every request.

Why do numbers differ slightly from Google’s own screens?

Search Console runs about two days behind and hides rare queries. Conversion counts follow the channel setting chosen for each site. Reports are cached for up to three hours (a day for older periods); “Refresh data” fetches fresh numbers.

What happens to my data if I delete the plugin?

Deleting the plugin revokes Google sign-ins where possible and removes all connections, credentials, sites, access grants, cached data and the Report viewer role.

Who receives scheduled emails?

You choose per site, under “Scheduled email report → Send to”: everyone who can view that site (the users and roles granted it, so new clients are included automatically and removed ones stop receiving it), specific WordPress users, and other addresses. Administrators only receive it if you add them. Each person gets their own email, so recipients never see each other’s addresses.

Do scheduled emails need anything special?

They use WP-Cron, which runs when your site gets visits, so on a quiet site a report can go out late (never twice: if several sends were missed, only the latest is sent). For on-time delivery, add a server cron job that calls wp-cron.php every 15 minutes and set DISABLE_WP_CRON to true in wp-config.php. TurtleReport → Settings shows when background jobs last ran and the exact command. An SMTP plugin is recommended so emails don’t land in spam.

“Accepted by the mail system” means WordPress handed the email to your mail server without an error. It can’t confirm the email reached the inbox; your SMTP or mail provider’s logs can.

How can I check the weekly founder summary?

Settings → Client Monitor shows the last scheduled summary attempt and whether WordPress accepted, rejected or partly accepted its messages. An interrupted attempt has an unknown outcome; check your mail provider before sending a test. Scheduled summary attempts are claimed before sending and are not retried automatically, to avoid duplicate mail. A test send is separate and does not replace the recorded scheduled outcome.

Can I attach the PDF to scheduled emails?

Yes. Scheduled reports can attach a PDF made on your server, with headline numbers, highlights, a trend chart, conversions and top pages. Choose “Attach a two-page PDF of the report” in the site’s email settings. Existing sites keep their saved delivery choices. The “Download PDF” button on the report screen makes the full, longer PDF in the browser.

You can also add a secure link to the PDF (valid 1–90 days) for recipients without a login. Links are signed for one site and one report, stop working when they expire, and can all be cancelled with “Revoke every link sent so far for this site”.

What happens to a report when Google data is missing?

Each scheduled report is checked before sending. If a part failed (for example an expired sign-in), the report is held and administrators are emailed with the reason and a link to the Deliveries screen, or, if you chose “Send it anyway, with a clear warning”, it goes out with a short note explaining what is missing. Genuine zero results and organically unavailable sections are not errors by themselves. Existing sites keep their saved delivery choices.

How do brand and non-brand segments work?

Add the “Brand searches” segment and enter your brand names. Choose “Brand” or “Not Brand” on the report. Google hides very rare queries for privacy, so the two add up to slightly less than total clicks.

How does the Client Monitor decide a client needs attention?

Once a day it compares each client’s last 28 days with the 28 days before, using the same Search Console and GA4 data as the reports. A client is flagged when Google clicks fall 20% or more (with at least 100 clicks before), leads fall 25% or more (with at least 10 before), an important page (a top page by clicks, or one that brought leads) loses 30% or more of its clicks, keywords that brought clicks drop 3 or more places (at least three of them, or 30+ clicks lost), or a conversion event records nothing for 7 days after a steady month while visitors keep arriving. “Only big drops” in Settings raises these thresholds. An alert clears by itself once the numbers recover past a lower level, so it doesn’t flicker on and off.

Does the Client Monitor use AI or send data anywhere?

The Client Monitor itself doesn’t use AI: its checks and “what to check” lists are fixed rules applied to your own numbers, on your server. Nothing leaves your site unless you press “Send to Slack”, which posts that one issue to the Slack webhook you saved, or you use the optional AI Advisor.

What does the AI Advisor send to the AI provider, and what does it cost?

It’s off until an administrator switches it on and saves their own API key for the provider they pick (OpenAI, Anthropic Claude, Google Gemini or xAI Grok), and it only sends anything when someone asks a question. Then it sends the question, the earlier questions and answers in that conversation, and for the clients it’s about: their name and website, Search Console, GA4 and Business Profile totals for the dates asked, the pages and keywords that changed most, and their Client Monitor issues. It never sends email addresses, user names, Google account details, tokens or keys. Requests are made from your server, only to the provider you picked (OpenAI requests use “store” switched off). Questions are billed to your account with that provider; a question typically uses 2,000 to 8,000 tokens. Settings → AI Advisor shows this month’s usage and lets you limit questions per day and per month.

Can the AI Advisor change anything?

No. It only reads report data and writes answers. Slack drafts are put into the issue’s Slack box for you to review, edit and send yourself.

Can I keep the encryption key out of the database?

Yes. Define TURTLEREPORT_ENCRYPTION_KEY in wp-config.php before adding connections. By default the key is derived from your site’s security salts, so changing those means reconnecting.