=====================================================================
  OfferZono Site Script  v3.2.6   —   FREE
  Your own offerwall earning website, licensed by offerzono.com
=====================================================================

WHAT IT DOES
------------
Your own earning website on your own domain:
- Home page for visitors (hero, how to join, features, FAQ, legal pages).
- User panel after Google login (same design as the OfferZono Earn panel):
  Dashboard, Window PTC, Iframe PTC, Bitco PTC, AdsLab PTC, Withdraw (FaucetPay)
  and History, with live balance and one SweetAlert per reward.
- Admin panel  /admin  (PIN login):
  Dashboard (Today Earn, Today Leads, Total Earn, Total Leads, latest
  leads), Settings, OfferZono Settings, Ads Setup, Logout.
- Faucet: free reward every few minutes (2 short steps + captcha), with
  its own page in the user panel. Settings come from OfferZono.
- Your own ads: rotating 728x90 / 300x250 / 468x60 banners, popup code
  and head code, plus 4 embed codes you can paste on any page.
- Automatic updates.

REQUIREMENTS
------------
- PHP 8.1 or newer (8.3 recommended) with curl, pdo_mysql and zip
- MySQL or MariaDB database
- Apache / LiteSpeed (.htaccess) or Nginx (see below), HTTPS
- An APPROVED website in your OfferZono publisher panel. This script only
  works on that website's domain (or a sub-domain of it).

INSTALL
-------
1. Upload and extract the zip into your domain root (public_html) or a
   sub-folder. Make the "data" folder writable (chmod 775 data).
2. Create a database + user in your hosting panel (Hestia -> DB).
3. Open https://your-domain.com — the installer asks for the database
   and creates the tables. (You can also import database.sql in
   phpMyAdmin first; the installer then only writes data/config.php.)
4. Log in at  https://your-domain.com/admin  with PIN  123456
   and change the PIN in Settings.
5. Settings: website name, description, URL, contact email.
6. OfferZono Settings: API Key + Secret Key (Publisher -> Offerwall List
   -> Copy API / Copy Secret) and "Save & test connection". The server
   IP is shown there — add it to "Whitelist IPs" of your website in the
   publisher panel, then test again.
7. Ads Setup: add your banners, popup code and head code. Done!

UPDATING FROM v2
----------------
Upload the v3 files over the old ones (keep the "data" folder) and open
your site. The installer finds your old settings and imports them
(name, keys, head code; the old "body code" becomes the popup code).

AUTOMATIC UPDATES + LICENSE
---------------------------
- Every 6 hours (and when you open /admin) the script checks
  offerzono.com. A new version installs by itself.
- Core files that were edited are restored to the original version.
  Only the "data" folder (database login, logs) is never touched, so
  please do not edit the script files — use the admin panel instead.
- The API key only works on its own approved domain.

YOUR ADS (Admin -> Ads Setup)
-----------------------------
- Banners rotate: every page load shows a random banner of that size
  (another one than last time when there are more). Optional daily
  view limit per banner.
- Home page: 728x90, 300x250 and 468x60 under the stats (one below the
  other, centered). User panel: 728x90 at the top, 300x250 on the
  dashboard, 468x60 at the bottom. Popup + head code on every page.
  Ads Setup -> "Show ads on these pages": switch ads on/off for every page
  (home, legal pages, dashboard, faucet, each PTC page, withdraw, history).
- Embed codes: copy the script (or iframe) code of a size and paste it
  on any page of any website — the banner shows centered and the
  script version scales down on phones.

NGINX
-----
location / { try_files $uri $uri/ /index.php?$query_string; }
location ~ ^/(data|includes|pages)/ { deny all; }
location ~ /\. { deny all; }
location ~ \.(sql|log|txt|lock|zip)$ { deny all; }

SECURITY
--------
- Every API call is signed with your Secret Key (HMAC-SHA256), expires
  after 5 minutes, can only be used once, is accepted only from the
  whitelisted server IP and only for your licensed domain.
- Admin PIN: 5 wrong tries lock the login for 15 minutes.
- data/config.php holds your database login. It is a PHP file protected
  by .htaccess, so it can never be downloaded.

TROUBLESHOOTING
---------------
"Server IP x.x.x.x is not whitelisted" -> add that IP in your publisher panel.
"Invalid signature"                    -> wrong Secret Key in OfferZono Settings.
"License error ... belongs to ..."     -> the API key is for another domain.
"Request expired"                      -> your server clock is wrong (enable NTP).
Updates fail "not writable"            -> give PHP write access to the script folder.
Forgot the admin PIN                   -> in phpMyAdmin run:
   UPDATE ozs_settings SET svalue = '$2y$10$nxbaEUGL.BdKjo.3oSuE3upw/V17EvXyL.1azXZEM51.rS/5/AB4W' WHERE skey = 'admin_pin_hash';
   (the PIN is 123456 again)

Support: open a ticket in your OfferZono publisher panel.
