How I would build the acquisition funnel for Evantage Media’s Managed WordPress Security plans. Two kinds of owner arrive: one wants a check-up, one has just been hacked. Both ride to the same place, and every hand-off is named down to the event, API and safeguard.
Line P is the owner who asks for a free scan. Line E is the owner whose site is already infected. E runs express past the scan, reaches Station 04 first, and from there both ride together to the end. Hover a tool to see why it was chosen.
Posts on WordPress risks rank in search; past visitors are retargeted with the free scan.
Bids on searches like “WordPress site hacked”, where the owner needs help today.
Name, website URL, email, and a separate unticked box for marketing consent.
Same fields plus “what are you seeing?”. Opens a priority ticket instead of a scan.
form webhook → n8n, self-hosted in Toronto ├ Wordfence feed · vulnerable core, plugins ├ Google Web Risk · blocklist status ├ PageSpeed Insights · speed ├ Claude API · writes the summary └ Gotenberg → PDF → emailed
A hacked site needs a person, not a report. The ticket rides straight through to Station 04.
n8n scores each lead by severity, raises a Slack alert with a Claude-drafted triage note, and sends a book-a-specialist link.
What the findings mean · a client story · plan comparison · last call. Consent and history live in HubSpot.
WHMCS order → Stripe charge → InvoicePaid hook → n8n
└ HubSpot deal won → native conversion sync
Google Ads (leads) · Meta Conversions API
Tax follows the client’s business address: 13% HST in Ontario. Evantage’s GST/HST number goes on every invoice.
Unhappy path: unpaid order → one recovery email, only if the visitor consented.
ModuleCreate ├ cPanel account ├ Imunify360 licence └ WordPress via WP Toolkit
AfterModuleCreate → n8n ├ MainWP · add client + site ├ Cloudflare · proxy + WAF ├ UptimeRobot · monitor └ backup + welcome email
Fort Knox clients are also migrated to the optimised server.
MainWP Pro Reports: monthly, bi-weekly or weekly, as each plan promises. MainWP has no bi-weekly schedule, so two monthly schedules run 14 days apart, tested before launch.
WooCommerce detected or traffic rising → offer Fort Knox. Revenue-critical sites → hardware firewall or real-time site mirroring.
WHMCS sends payment reminders and suspends or restores service automatically. Renewals that need 3-D Secure go to the client portal.
Loops back: an infection caught by monitoring re-enters at Station 04 as an emergency, already covered by the plan.
A security agency’s own funnel should pass its own audit. Each flag on the map points to one of these notes.
Banner with equal Accept and Refuse. Consent Mode v2: Quebec and EEA/UK default off, rest of Canada notice plus opt-out. Hashed-email conversion data is sent only after consent.
A scan request is an inquiry, which gives implied consent for 6 months. A separate unticked box records express consent beyond that.
Elementor form webhooks are unsigned, so n8n checks a shared secret and re-validates the Turnstile token server-side.
Rate-limited per IP, email and domain. The full report goes only to an email on the scanned domain. Deep scans need DNS, meta tag or file verification plus written consent.
Every email names the sender with a mailing address. Unsubscribes take effect within 10 business days.
Stripe events verified by signature; WHMCS → n8n hooks HMAC-signed; every event de-duplicated by ID before anything runs.
Only one-time 1Password links or revocable WordPress Application Passwords.
AI only writes and summarises. Payments, tax, provisioning and DNS changes stay deterministic.
WHMCS admin behind an IP allow-list and patched within 72 hours; a critical no-login flaw, CVE-2026-67399, was fixed in September 2026.
Move the sliders to set how many clients are on each plan. The example mix below is illustrative, not a forecast.
The stack is covered, with $612 a month left over.
Fixed stack uses the midpoint of $230–270. Labour, servers Evantage already runs, Cloudflare and Imunify360 are not included. Evantage’s site doesn’t state the currency of its plan prices, while vendor costs are in USD; if plans are billed in CAD, the break-even point rises by the exchange rate.
Free: n8n Community Edition, Wordfence feed, Web Risk up to 100,000 lookups a month, PageSpeed Insights, Turnstile, Gotenberg. Usage-based: Claude API per summary.
Each slot was compared before anything was drawn. Open a row to see the runner-up and what ruled the others out.
One scan run counts as one execution, Stripe signatures are verified natively, and HubSpot, Slack and UptimeRobot nodes exist. The licence allows client automations on your own instance.
Activepieces: MIT core and one credit per run, but no Cloudflare piece and no documented Stripe signature check.
Zapier (US-only, per-action pricing), Make (no Canadian region), Pipedream (Workflows shutting down 31 Mar 2027), Hermes Agent (an AI agent framework, not a workflow engine).
Canadian data centre, subscription types with consent history for CASL, and native Google Ads and Meta conversion sync on Starter.
GoHighLevel: all-in-one with a white-label resale line, but US-only hosting and a consent trail you build by hand.
Pipedrive + Brevo: consent split across two tools and no native ad sync.
Official modules for cPanel, Imunify360 licences and WP Toolkit, plus upgrades, add-ons and automatic suspension. Stripe stays the card gateway.
Stripe Billing alone: best tax automation, but provisioning, suspension and add-on upgrades would all be custom code.
WHMCS is self-hosted: IP allow-list on admin and patches within 72 hours.
Sites added by API or CLI, which makes onboarding automatic; UptimeRobot integration; self-hosted in Canada.
WP Remote: the strongest API, but priced per site.
ManageWP (no public API, so onboarding stays manual), WP Umbrella (no add-site API).
Wordfence’s vulnerability feed is free for commercial use with attribution; Web Risk is Google’s commercial blocklist API.
Google Safe Browsing API (non-commercial only), WPScan free tier (commercial use needs a licence), SSL Labs API (owner permission required).
A remote scan only sees what is in the public page source, and the report says so.