Settings

The Settings page sits at Dino Discover → Settings in the admin sidebar. It carries the site-wide settings that aren’t bound to a single quiz — defaults, fallback keys, retention windows, and a small set of styling tokens.

This page documents what each setting does and what it defaults to.

[SCREENSHOT: The Settings page with the section tabs across the top.]

What’s in Settings

The settings live in wp_options rows under the dd_settings_* prefix. The typed schema (with default values, bounds, and validation rules) lives in includes/Settings/SettingsSchema.php.

The settings exposed in 0.1.0:

Attribution window

How many days after a quiz completion should a subsequent order be attributed to that quiz?

• Key: attribution_window_days
• Type: integer
• Default: 30
• Bounds: 0 – 365

The default is filterable globally via dino_discover_attribution_window_days for programmatic overrides.

Event retention

How many days of raw storefront events to keep before the daily prune job removes them. The rolled-up aggregates that power the dashboard are kept longer.

• Key: event_retention_days
• Type: integer
• Default: 90

The prune job (EventPruneJob) runs nightly via Action Scheduler.

Lead consent template

Default consent text that pre-fills new quizzes’ lead-capture form. A per-quiz consent template overrides this default.

• Key: lead_consent_template
• Type: string, ≤2000 chars

Lead default placement

Where new quizzes’ lead-capture form appears by default. Per-quiz configuration overrides this.

• Key: lead_default_placement
• Type: enum
• Values: inline, modal, after_results
• Default: after_results

Klaviyo fallback API key

A site-wide Klaviyo API key. Per-quiz integrations that don’t set their own key fall back to this one.

• Key: klaviyo_fallback_api_key
• Type: secret, encrypted at rest, wire-masked
• Bounds: ≤256 chars

Also overridable via the dino_discover_klaviyo_fallback_api_key filter for environments that source secrets from environment variables.

Mailchimp fallback API key

The same pattern as Klaviyo, for Mailchimp.

• Key: mailchimp_fallback_api_key
• Type: secret, encrypted at rest, wire-masked
• Bounds: ≤256 chars
• Filter: dino_discover_mailchimp_fallback_api_key

Design tokens

A small allowlisted set of CSS custom properties exposed to the storefront bundle as --dino-discover-* variables. Use these to match the quiz styling to your theme without touching the storefront templates.

• Key: design_tokens
• Type: keyed object (allowlist enforced)
• Per-value bound: ≤64 chars
• Rejected characters: punctuation that could break out of a CSS declaration (semicolons, braces, angle brackets, quotes, slashes, asterisk, backslash) — basic injection guard.

The 13 keys in the allowlist (defined in SettingsSchema::ALLOWED_TOKEN_KEYS):

Key	What it controls
color-text	Body text colour.
color-text-muted	Helper / hint text colour.
color-error	Error message colour.
color-border	Card and input border colour.
color-border-subtle	Divider line colour.
color-badge-bg	Tag / category badge background.
radius-sm	Small border radius (chips, input).
radius-pill	Pill-shaped element radius.
font	Font family stack.
font-size-sm	Small text size token.
results-max-width	Maximum width of the results panel.
content-min-column	Minimum column width before stacking.
gate-blur	Backdrop blur amount on the lead-capture gate.

Regenerating the experiment salts

The activator creates a per-site email-hash secret, a sodium crypto secret (for encrypting integration API keys at rest), and a variant-assignment HMAC key. Beyond those, per-quiz experiment salts are lazily generated the first time a visitor hits each quiz — they key the weighted-hash variant assignment so the same visitor always lands in the same variant.

The Settings page exposes a Regenerate experiment salts action that calls POST /wp-json/dino-discover/v1/settings/regenerate-salt. This rotates every per-quiz experiment salt in one pass.

This reshuffles every active experiment

After rotation, every visitor’s variant assignment for every quiz is reassigned. Anyone mid-experiment may switch buckets the next time they hit a quiz. Only rotate when you’re starting a new round of experiments or have a specific reason to invalidate the existing assignments — the UI guards this with a strong confirmation.

Privacy retention listing

A small read-only panel on the Settings page (and the corresponding REST endpoint GET /settings/privacy/quizzes) lists every quiz with its retention metadata:

• Total stored events.
• Total stored leads.
• Days since oldest event.
• Whether retention is at the default or has been customised.

Useful for GDPR Article 30 audits.

Capability scoping

The admin capability is manage_dino_discover. It’s granted by default to the administrator and shop_manager roles by the activator. To extend access to other roles, two paths:

• Via a role-management plugin. Add the manage_dino_discover capability to the role you want.
• Via the dino_discover_capability filter. Replace the gate with a capability your existing role hierarchy already has (e.g. manage_woocommerce).

There’s no in-product role assignment UI; the capability lives in WordPress’s standard role system.

What’s not in Settings

Settings are deliberately small. A few things you might expect to find that live elsewhere:

• Per-quiz styling — in each quiz’s Style panel inside the Builder.
• Per-quiz integration keys — on the Connect tab in the Builder. Site-wide fallbacks live here in Settings; per-quiz keys override them.
• Licence configuration — the Licence panel will appear in Settings once 1.0 ships. The PHP namespace exists already; the Beta runs without a licence.

What’s next

• Lead Capture Panel — per-quiz consent and placement; this Settings page sets the site-wide defaults.
• History & Snapshots — retention applies to events, not to publish snapshots.
• Engine Interfaces — the engine filters that override site-wide defaults programmatically.
• Hook Reference — the capability, attribution-window, and fallback-key filters.