Covers June 16–19, 2026 (since the last digest). Receipts, not lessons.
Headline
The NordVPN funnel got rebuilt end-to-end and went live on prod. Every NordVPN link now forces visitors onto the review page → pick a plan there → through a redesigned /out gateway before they leave. Goal: send fewer but better-informed people to NordVPN — kill price sticker-shock, compatibility doubt, and jargon at the point of decision. This was the big, tough one — review-page hero, the plan cards, and the /out page all rebuilt and shipped to www.vpn.com.
Shipped
The funnel: provider hero → plan cards → /out gateway (the big one)
Hero CTA → "See plans" — on provider pages with plans, the hero now anchors down to the pricing cards instead of going straight out (Jun 17).
All NordVPN links internalized site-wide → /vpn/nordvpn review page (623 content links / 432 files, all languages, + component CTAs). No more straight-to-Nord (Jun 16).
Review-page plan cards — 3 tier cards (Basic/Complete/Prime), each with a billing-duration radio. One mutually-exclusive choice across all cards; nothing preselected; the "Get" button stays disabled until a duration is picked, then promotes to solid and carries tier+plan to the gateway (Jun 16–18).
Disabled-CTA UX — tooltip ("Please select a plan duration", all 10 langs) + the duration rows glow on a blocked click, so the button explains itself instead of reading as broken (Jun 18).
Indicative pricing only — no exact/geo "this is what you'll pay" claims; "as low as / from / save up to". Real NordVPN checkout values entered; the "price verified" claim was removed and the fetcher paused (can't match the affiliate checkout) (Jun 17).
Feature tooltips from a single-source glossary — same plain-language explanation for every provider, English-gated so translated pages don't leak (Jun 18).
a11y fix — card selection shown via frame/border, not opacity (the dimmed-text version was 13 contrast failures against the gate) (Jun 16).
/out gateway — 3-template model, LIVE ON PROD (Jun 18):
NordVPN / paid → clean confirm screen: rating, the picked plan + indicative price, a small "Change" edit, a personalized "Works on your <device>, <browser> in <country>" line (Cloudflare geo + UA, server-side), "Try risk-free for 30 days", drill-down details.
Free tiers (ProtonVPN / Windscribe) → "X vs NordVPN" comparison nudging the paid upgrade — honest (Proton Free is genuinely private), data-driven from a FREE_COMPARE map (8 free providers ready; only Proton + Windscribe are monetized today).
Paid competitors → unchanged straight redirect (we earn on those).
Tier-aware affiliate links — "Buy Prime" now lands on the Prime checkout, not a generic one (/out redirect selects url_id by tier × duration) (Jun 18).
Curated provider API now exposes plan tiers, OS, and featuredPlans for the gateway (Jun 16–17).
Broker pipeline: go.vpn.com unified into one durable path (the other money funnel)
go.vpn.com domain-broker leads now flow through the central pipeline. They used to POST straight from the lander to a GHL webhook — no D1, no Google Ads offline conversions, no durable backup (a failed POST = a silently lost paid lead). Now the landers (FormV2 + the acquire/v2 inline form) POST to www.vpn.com/api/domain-intake, so the vpn-forms worker owns D1-first (durable) → GHL → server-side domain_inquiry → hourly gclid→Google Ads offline upload — the same proven path www uses. Deployed go-vpn v0.3 (Jun 18).
Why it mattered: go.vpn.com is paid traffic (captures gclid) — those conversions never reached Google Ads (wasted bid signal), and a GHL hiccup meant a lost paid lead. Both fixed.
Safety net: if the central endpoint is ever unreachable, the lander falls back to the direct GHL post — a paid lead can't be lost during the cutover.
lead_origin marker (migration 0005, Jun 19) — the worker stamps each lead's submitting property (go-vpn/web/staging) from the request Origin, campaign-independent, so go.vpn.com leads are countable even when their ad URL sets utm_source=google.
Validated end-to-end: a real go.vpn.com paid lead confirmed flowing D1 → GHL (ghl_status=sent) → ads_status=sent; no JS errors from the cutover.
Measurement & analytics
Restored the affiliate-click conversion signal — it had regressed to .track() (a non-counted custom event) in the itbroke→bowtie swap, zeroing VPN affiliate conversions for ~5 days. Back to .converted() (Jun 17).
Validated bowtie against server ground truth. Broker conversions match D1 exactly (52 leads = 52 conversions in 7d — the broker fires server-side, so it's ad-block-proof). /out is bot/302-heavy, so client-side gateway events only see a fraction — use D1 + the affiliate dashboard for volume, bowtie flows for shape/trend only.
Defined reusable bowtie flows (nord-affiliate, broker-lead, free-rescue) + a standing alert if broker leads drop to zero.
bowtie bug #20 — filed and resolved (Jun 18). A flow read ~20× lower than get_conversions for the same event (14 vs 330 on /vpn/nordvpn). Root cause was not a bug or session loss — it was the affil.click→affiliate_click rename (the flow matched the literal old name; get_conversions is name-agnostic). askbowtie shipped a name-agnostic kind:'conversion' flow step; our nord-affiliate flow now matches at 291/637. Contract to stay green: conversion events carry category='conversion' (.converted()) + meta.provider → counted regardless of name. The 97%-still-affil.click is just the rename's prod cutover landing this week — self-resolving.
Forms ingest fixes — server events were being silently dropped; added the required User-Agent + session_id (Jun 16).
Social-proof toast upgrade
Daily → weekly counts — the "[N] people chose X" toast now uses a 7-day window (was 24h). Same real, cookie-deduped distinct-visitor numbers, just a fatter, still-fresh window (NordVPN ~620/wk, ProtonVPN ~387/wk). Label reads "this week" (Jun 18).
Shows across all /vpn/* pages — was only the exact /vpn/ hub + provider pages. Now every VPN guide/best-X/comparison gets the cross-provider rotation; provider pages stay single-provider (Jun 18).
NordVPN fallback on weak provider pages — a provider page with under 100 visitors/week now shows NordVPN's count ("[N] chose NordVPN" → review page) instead of a thin feed. With weekly numbers only Nord + Proton clear 100, so most competitor pages now carry the Nord nudge (Jun 18).
Fixed the toast icon 404s (purevpn, ivpn) — generated the missing -icon-brand.svg from existing assets + a .png fallback so a missing icon never 404s again (Jun 18).
Next leg (building now): a single "[N] requests this week" toast on the domain-broker pages — counting all D1 leads. Now that go.vpn.com is unified into D1, this is the full realistic picture (www + go.vpn.com).
Deploy safety
Enforced git parity — staging can only deploy from pushed git, closing the hole that put a wrong (un-pushed) version on prod on Jun 17. deploy.sh now push-or-fails; incident + rule recorded in deploy-architecture.md (Jun 17).
Parked plan #89 (full CF branch-deploys) — a single main branch + the push guard is sufficient (Jun 17).
Other fixes
Translated provider pages had lost all plan pricing (deepMerge replaced arrays wholesale) — fixed by merging plans by index; affected 9 langs × 22 providers (Jun 16).
Removed the empty /tools stub (all langs) — thin content shadowed by a redirect (Jun 16).
Popups: vpn-exit-3 back into rotation (even 3-way test) (Jun 16).
Ads: dropped loginAccount from the Data Manager drain (was causing a 403 → offline conversions = 0) (Jun 16).
Open items / decisions
The funnel is only ~hours old on prod (full version live Jun 18). Give it a few days before judging conversion impact — don't read early flow numbers as gospel.
Gateway bypass leak: ~36 of ~51 daily NordVPN affiliate clicks skip the gateway entirely (direct sub-IDs p20/h50/sb7m in content/popups, not routed through /out). Worth tracking down — the whole strategy is to funnel everything through the review page.
Make VPN affiliate conversions ad-block-proof? Optional: fire affiliate_click server-side from /out (the pattern the broker already uses) instead of the client pixel.
Monetization reality: we link to 22 providers but can only monetize ~5. That, not page design, will drive which providers get the "vs Nord" treatment vs left alone.
go.vpn.com health = "blocker" in askbowtie — driven by rage-clicks (51 in 24h, zero JS errors), likely pre-existing aggressive-lander UX, not the cutover. Worth a separate look.
(resolved) bowtie bug #20 — fixed; flows are still shape/canary, volume still from D1 + affiliate dashboard.
Snapshot (honest, early)
D1: 52 real broker leads in 7d, all forwarded to GHL.
/out: ~237 clicks in 24h (Proton 82, Nord 66, …) — server log; bowtie sees the human-JS subset.