Questions agencies ask.
Short answers about data, the Client Monitor, the AI Advisor and setup.
Does it add anything to my website or slow it down?
No. TurtleReport reads data you already collect in Google's products. It adds nothing to your public pages and collects nothing from visitors. Its screens and scripts load only inside WordPress admin.
Which data does it read?
Google Search Console (clicks, impressions, CTR, position, pages and keywords), GA4 conversions and traffic, visits from AI assistants such as ChatGPT and Perplexity, and Google Business Profile calls, website clicks, directions and views. Parts you switch off are never fetched from Google.
Where does my data go?
Requests are made from your server with your own Google credentials. Nothing is sent to the plugin author or any other party. Credentials are stored encrypted, and you can keep the encryption key out of the database by defining TURTLEREPORT_ENCRYPTION_KEY in wp-config.php.
Slack is only contacted when someone presses "Send to Slack", and an AI provider only when someone asks the AI Advisor a question.
How does the Client Monitor decide a client needs attention?
Once a day it compares each client's last 28 days with the 28 days before. A client is flagged when Google clicks fall 20% or more (with at least 100 before), leads fall 25% or more (with at least 10 before), an important page loses 30% or more of its clicks, keywords that brought clicks drop 3 or more places, or a conversion event records nothing for 7 days after a steady month while visitors keep arriving. "Only big drops" raises these thresholds.
Does the Client Monitor use AI?
No. Its checks and next steps are fixed rules applied to your own numbers, on your server. The AI Advisor is separate and optional.
What does the AI Advisor send, and what does it cost?
Only when someone asks: the question, earlier turns of that chat, and for the clients it's about their name, website, totals for the dates asked, the pages and keywords that changed most, and their Client Monitor issues. Never email addresses, user names, Google account details, tokens or keys. A question typically uses 2,000 to 8,000 tokens, billed to your provider account.
Can a client see another client's report?
No. Unless they're an administrator, a user sees only the sites granted to them or their role. The REST API checks this for every request.
Which connection type should I use?
Google sign-in is quickest if your account already has access to the properties, and it's the only option that supports Business Profile. A service-account key never expires and doesn't depend on a person's account.
Why do numbers differ slightly from Google's own screens?
Search Console runs about two days behind and hides rare queries. Reports are cached for up to three hours (a day for older periods); "Refresh data" fetches fresh numbers.
Do scheduled emails need anything special?
They use WP-Cron, which runs when your site gets visits, so on a quiet site a report can go out late, never twice. For on-time delivery, add a server cron job and set DISABLE_WP_CRON. An SMTP plugin is recommended so emails don't land in spam.
What happens if I delete the plugin?
Deleting it revokes Google sign-ins where possible and removes all connections, credentials, sites, access grants, cached data and the Report viewer role.
What do I need to run it?
WordPress 6.3 or later, PHP 7.4 or later, and a free Google Cloud project with the Search Console and Google Analytics APIs turned on.