Description
Opti-Behavior is the most complete self-hosted WordPress analytics plugin — delivering heatmaps, session recordings, click tracking, visitor tracking, and conversion funnels with complete data privacy and zero performance impact, all from your own server. The perfect Hotjar alternative and Google Analytics alternative for privacy-conscious WordPress sites.
Powered by a revolutionary Hybrid Storage engine, Opti-Behavior writes analytics events to optimized files on disk instead of hammering your database. Combined with batch processing, pre-aggregated daily statistics, and a ~15KB async tracking script, your website stays blazing fast — even with millions of pageviews. All your data stays on YOUR WordPress server. No cloud. No third-party access. No data sharing. No GDPR grey zones.
Core Features (Free)
- Click & scroll heatmaps with color-coded intensity (Mobile & Desktop)
- Real-time analytics dashboard — visitors, sessions, pageviews, bounce rate, scroll depth
- Interactive world map with visitor locations, Top Pages, and Traffic Sources
- Conversion funnels with multi-step dropout analysis and device filtering
- Session & visitor tracking (duration, pages visited, referrers, outbound links)
- Bot detection & filtering (Google, Bing, Yahoo, etc.)
- Scheduled email reports (Daily, Weekly, Monthly)
- IP anonymization, no cookies required, no third-party data sharing
- Multilingual admin: English, French, German, Spanish, Portuguese, Italian
Pro Features (Upgrade)
- Session Recordings — full playback with privacy controls
- Error Tracking — JS errors, network errors, Core Web Vitals
- Friction Detection — rage clicks and dead clicks
- Form Analytics — field-level interaction and abandonment tracking
- User Journey Analytics — Sankey diagram visitor path visualization
- Advanced Heatmap Filtering — country, browser, device, and date
- Priority Support
Try Pro FREE for 6 months — no credit card required!
Learn more about Opti-Behavior Pro
External Services
This plugin may connect to external services in limited circumstances:
IP Geolocation (ip-api.com)
Purpose: Provides geographic location data (country, city, timezone) for visitor analytics and map visualization.
When Used: Only when a visitor’s location cannot be determined from CloudFlare headers. If CloudFlare is active, no external calls are made.
Data Sent: Only the visitor’s IP address. No personally identifiable information is transmitted.
Caching: Results are cached for 1 hour to minimize API requests.
Privacy:
* Service: https://ip-api.com/
* Terms & Privacy: https://ip-api.com/docs/legal
* Note: ip-api.com may log IP addresses. Review their privacy policy for details.
IP Geolocation Fallback (ipwho.is)
Purpose: Secondary geolocation fallback when ip-api.com is rate-limited or unavailable. Provides geographic location data (country, city, region, timezone) for visitor analytics.
When Used: Only when both CloudFlare headers and ip-api.com fail to resolve a visitor’s location. ip-api.com’s free tier has a 45 requests/minute rate limit, so on high-traffic sites ipwho.is ensures visitors are still geolocated accurately.
Data Sent: Only the visitor’s IP address. No personally identifiable information is transmitted.
Caching: Results are cached for 1 hour to minimize API requests.
Privacy:
* Service: https://ipwho.is/
* Terms & Privacy: https://ipwho.is/
* Note: ipwho.is may log IP addresses. Review their privacy policy for details.
OpenStreetMap Tiles
Purpose: Displays the interactive visitor location map in your WordPress admin dashboard.
When Used: Only when YOU (the admin) view the real-time visitor map. Not used on the frontend.
Data Sent: Your browser makes direct requests to OpenStreetMap tile servers (standard HTTP headers only).
Privacy:
* Service: https://www.openstreetmap.org/
* Tile Policy: https://operations.osmfoundation.org/policies/tiles/
* Privacy Policy: https://wiki.osmfoundation.org/wiki/Privacy_Policy
OptiUser API (api.optiuser.com)
Purpose: Handles anonymous install tracking, plugin deactivation notifications, Pro trial license generation, license validation, update checks, and download access code generation for the Pro plugin.
When Used:
* Install tracker: Sends an anonymous heartbeat once every 24 hours after activation, containing only: site URL, WordPress version, PHP version, plugin version, and plugin type (free/pro). No visitor data or personal information is sent.
* Deactivation: Notifies the API when the plugin is deactivated so installation records stay up to date.
* Pro upgrade pages: When an admin views a Pro feature upgrade page (Session Recordings, Error Tracking, User Journeys, Form Analytics), the plugin requests a one-time download access code from the API. This code is used to securely access the Pro download page on optiuser.com.
Data Sent: Site URL, WordPress admin username, admin email address (only when requesting a Pro download access code). No visitor analytics data is ever sent to the API.
Privacy:
* Service: https://api.optiuser.com/
* Website: https://optiuser.com/
* Privacy Policy: https://optiuser.com/privacy-policy/
* The API stores installation metadata (site URL, plugin version) for license management. No visitor data is collected or stored by the API.
OptiUser Website (optiuser.com)
Purpose: Hosts the Opti-Behavior Pro download page and sales/feature pages. When an admin clicks „Download Pro — Free for 6 Months” on a Pro upgrade page, they are redirected to optiuser.com to register and download the Pro plugin.
When Used: Only when an admin chooses to download Opti-Behavior Pro from a Pro upgrade page within the WordPress admin. This is an optional, user-initiated action.
Data Sent: Site URL, username, and email address are passed as URL parameters to pre-fill the registration form. No visitor analytics data is sent.
Privacy:
* Service: https://optiuser.com/
* Privacy Policy: https://optiuser.com/privacy-policy/
Important Note: All analytics data is stored locally on your WordPress server. The external services listed above are used only for optional geographic features (ip-api.com, ipwho.is, OpenStreetMap), anonymous install tracking, and Pro license management (api.optiuser.com). No visitor analytics data ever leaves your server.
Privacy Policy
Opti-Behavior collects user interaction data to provide analytics insights. This data includes:
- Page URLs and titles
- Click coordinates and target elements
- Mouse movement patterns
- Scroll depth
- Session timestamps
- Referrer URLs
- Browser and device information
- IP addresses (can be anonymized)
- Approximate location based on browser timezone (client-side only, no external services)
Data Storage: All analytics data is stored locally in your WordPress database or file system. No data is sent to external analytics servers.
External Services: This plugin may make API calls to ip-api.com and ipwho.is for IP geolocation when CloudFlare headers are not available. ipwho.is is used as a secondary fallback when ip-api.com is rate-limited or unavailable. Only the visitor’s IP address is sent to these services. See the „External Services” section above for complete details.
Usage Tracking: With your explicit consent (granted via the first-run welcome screen), this plugin sends anonymous usage statistics to api.optiuser.com once every 24 hours. The data includes: site URL, plugin version, WordPress version, PHP version, and the site administrator email address. This data is used solely to understand plugin adoption and improve the product. Tracking only begins after you click „Accept & Continue” on the welcome page shown at first activation. You may review our full data practices at https://optiuser.com/privacy-policy/
No Third-Party Data Sharing: Unlike cloud-based analytics tools, Opti-Behavior does not share, sell, or transfer your visitors’ data to any third party. You are the sole data controller.
User Rights: You have full control over data retention and deletion. Users can request data deletion at any time.
When using this plugin, ensure your site’s privacy policy discloses:
* What data is being collected
* How long it is retained
* Who has access to it
* How users can request deletion
* That data is stored locally and not shared with third parties
Third-Party Libraries
This plugin bundles the following open-source libraries:
Chart.js
- Version: 4.4.0
- License: MIT License
- Homepage: https://www.chartjs.org/
- Used for: Rendering analytics charts and graphs
Leaflet
- Version: 1.9.4
- License: BSD 2-Clause License
- Homepage: https://leafletjs.com/
- Used for: Real-time visitor map visualization
heatmap.js
- Version: 2.0.5
- License: MIT License
- Homepage: https://www.patrick-wied.at/static/heatmapjs/
- Used for: Generating visual heatmaps of user interactions
Lucide
- Version: 0.554.0
- License: ISC License
- Homepage: https://lucide.dev/
- Used for: Icon library for the admin interface
All bundled libraries use GPL-compatible licenses (MIT, BSD 2-Clause, and ISC) and are included locally within the plugin. See THIRD-PARTY-LICENSES.txt in the plugin directory for full license texts.
Credits
Developed by OptiUser
Screenshots

Real-time analytics dashboard with visitor metrics, interactive world map, and traffic breakdown 
Visual click heatmap showing user interaction patterns on a page 
Conversion funnel builder with step-by-step dropout analysis 
Detailed page analytics with engagement metrics and scroll depth 
Settings panel with privacy controls, data retention, and storage options 
Bot detection showing filtered crawler traffic vs real visitors 
Scheduled email reports configuration 
Mobile vs Desktop heatmap comparison view 
AI-powered insights and optimization suggestions 
Dark mode interface for comfortable nighttime administration 















Installation
Automatic Installation
- Log in to your WordPress admin panel
- Navigate to Plugins > Add New
- Search for „Opti-Behavior”
- Click „Install Now” and then „Activate”
Manual Installation
- Download the plugin zip file
- Log in to your WordPress admin panel
- Navigate to Plugins > Add New > Upload Plugin
- Choose the downloaded zip file and click „Install Now”
- After installation, click „Activate Plugin”
After Activation
- Navigate to Opti-Behavior in your WordPress admin menu
- The plugin starts tracking automatically – no configuration required!
- Visit the Dashboard to see real-time visitor activity
- Go to Heatmaps to view click patterns on your pages
- Check Funnels to set up conversion tracking
- Adjust Settings to customize tracking behavior and privacy options
That’s it! Opti-Behavior works out of the box with smart defaults.
FAQ
-
Does this plugin slow down my website?
-
Absolutely not! Opti-Behavior is built for speed from the ground up. Our Hybrid Storage engine writes analytics events to optimized files on disk instead of your database, eliminating database bloat and keeping queries fast. The tracking script is only ~15KB minified and loads 100% asynchronously — it never blocks page rendering. Events are batch-processed in memory and daily statistics are pre-aggregated, so even your admin dashboard loads instantly. This is lighter and faster than Hotjar, Clarity, or any SaaS analytics tool. We’ve tested it on sites with millions of pageviews with zero performance impact on Core Web Vitals.
-
Is this plugin GDPR compliant?
-
Yes, by design! Since all data is stored locally on your WordPress server, there are no cross-border data transfers to worry about. The plugin includes IP anonymization, data retention controls, and works without cookies. No DPA (Data Processing Agreement) with a third party is needed because YOU are the only data controller. However, you should still update your privacy policy to disclose your analytics practices.
-
How is this different from Microsoft Clarity?
-
Microsoft Clarity is free but Microsoft acts as an independent data controller — they use your visitors’ behavioral data for their own purposes, including advertising. With Opti-Behavior, all data stays on YOUR server. Additionally, Opti-Behavior offers conversion funnels, scheduled reports, bot detection, and AI insights that Clarity doesn’t provide. The Pro version adds session recordings, error tracking, form analytics, and user journeys.
-
How is this different from Hotjar?
-
Hotjar sends all data to their cloud servers (AWS Ireland). You have no control over where your data goes. Hotjar’s equivalent features (heatmaps + recordings + funnels + error tracking) cost $213+/month ($2,556/year). Opti-Behavior keeps everything on your server, and the Pro upgrade is a fraction of the cost.
-
How is this different from Matomo?
-
Matomo offers self-hosted web analytics (similar privacy model), but their behavior analytics features require expensive premium plugins: heatmaps (EUR 199/yr), session recordings (EUR 549/yr), funnels (EUR 99/yr), and form analytics (EUR 79/yr) — totaling EUR 926+/year. Opti-Behavior includes heatmaps and funnels free, with all other behavior analytics in a single affordable Pro upgrade.
-
Are there any session or pageview limits?
-
No! Unlike SaaS analytics tools that cap sessions (Hotjar free: 35/day, Mouseflow free: 500/month, Lucky Orange free: 100/month), Opti-Behavior stores all data locally with no artificial limits. The only limit is your server’s storage capacity.
-
Can I export my data?
-
Yes! Export all analytics data in CSV format directly from the admin dashboard.
-
Does this work with caching plugins?
-
Yes! Opti-Behavior is compatible with WP Super Cache, W3 Total Cache, WP Rocket, and other popular caching plugins.
-
Will this work on multisite?
-
Yes! Opti-Behavior is multisite compatible and can be activated network-wide or on individual sites.
-
Does this plugin call any external services?
-
The plugin makes minimal use of external services. See the „External Services” section for full details:
- ip-api.com — Primary IP geolocation (only when CloudFlare headers are unavailable)
- ipwho.is — Secondary IP geolocation fallback (only when ip-api.com is rate-limited or unavailable)
- OpenStreetMap — Map tiles for the admin visitor map
- api.optiuser.com — Anonymous install tracking (24-hour heartbeat), Pro trial license management, and download access codes
- optiuser.com — Pro plugin download page (user-initiated only)
All visitor analytics data is stored locally on your server. No analytics data is ever sent to any external service. All JavaScript libraries are bundled within the plugin.
-
What data does this plugin collect?
-
The plugin collects:
* Page views and URLs
* Click positions and elements
* Mouse movements and scroll depth
* Session duration and timestamps
* Referrer information
* Device and browser information (user agent)
* Anonymized IP addresses (optional)
* Approximate location based on browser timezoneNo personally identifiable information (PII) is collected by default. All data is stored locally in your WordPress database.
-
Can I delete all data when uninstalling?
-
Yes! Enable „Delete all data on uninstall” in Settings. All database tables and options will be removed when you uninstall.
-
Does it work with WooCommerce?
-
Absolutely! Track checkout funnels, view heatmaps on product pages, analyze cart abandonment patterns, and optimize conversion flows — all without sharing your customers’ data with third parties.
-
Does it work with page builders?
-
Yes! Works with Elementor, Divi, Beaver Builder, WPBakery, Gutenberg, and all major page builders.
-
What is the Hybrid Storage Engine?
-
The Hybrid Storage engine is our innovative approach to analytics data storage. Instead of writing every click, scroll, and pageview directly to your MySQL database (which causes bloat and slowdowns), analytics events are stored in optimized JSON files on disk. This keeps your database lean and your queries fast. Combined with batch processing and compression, the Hybrid Storage engine handles millions of events without any performance impact. Enable it in Settings > Storage Options.
-
How do I get support?
-
For support questions, use the WordPress.org support forums. For priority support, upgrade to Opti-Behavior Pro.
Reviews
Contributors & Developers
“Opti-Behavior – Self-Hosted Heatmaps, Session Recording & Analytics (Hotjar Alternative)” is open source software. The following people have contributed to this plugin.
ContributorsInterested in development?
Browse the code, check out the SVN repository, or subscribe to the development log by RSS.
Changelog
1.2.4.1 – 2026-04-03
- Fix: Resolve PHP 8.2 null deprecations + wpdb prepare mismatch
1.2.4 – 2026-04-03
- Fix: Resolved all WordPress Plugin Check errors and warnings (escape output, nonce verification, readme compliance)
- Fix: GDPR consent banner not displaying — admin-notices CSS/JS no longer hides plugin’s own ob-* elements
- Enhancement: Default auto-cleanup on fresh install (weekly, 90-day retention, bot/bounce session removal)
- Enhancement: Moved Pro trial offer above feature list on welcome page for better visibility
- Fix: Consent banner logic simplified — removed obsolete checkbox, uses Consent Banner Source radios only
1.2.3 – 2026-03-29
- Feature: Frontend Stats Bar — admin-only analytics overlay on every frontend page with 6 color themes and per-stat visibility settings
- Feature: Custom SMTP email configuration for scheduled reports with WP Mail fallback, and Cron Monitor for scheduled task health
- Enhancement: Full cache plugin compatibility (Autoptimize, LiteSpeed, WP Rocket, SG Optimizer) — nonce refresh, client-side cookie IDs, script tag protection, and visibilitychange flush
- Enhancement: Optimized live visitors query, esc_sql() hardening, admin submenu reorder, and PHPCS compliance fixes
- Fix: 10 Smart Data Cleanup bugs (recording file deletion, cascade orphans, scheduling), debug log download fatal error, and auto-cleanup via daily cron
1.2.2 – 2026-03-22
- Feature: Rich banner styles — info, warning, success, promo, custom with configurable colors, images, and CTA buttons
- Enhancement: Dismiss tracking stores timestamps for duration-based re-show logic with automatic migration from old format
- Fix: Self-referral bug — site’s own domain no longer appears as referrer in analytics, user journey, and form analytics views
1.2.1 – 2026-03-17
- Feature: Server-side proxy for heatmap iframe loading — bypasses CDN-level X-Frame-Options restrictions (e.g., Hostinger) that block iframe embedding
- Enhancement: Heatmap iframe now uses
srcdocwith proxied HTML content, injecting<base href>for correct relative URL resolution - Enhancement: Generic JS scan to detect and cap elements with inflated inline heights from unknown/custom slider frameworks
- Fix: Heatmap iframe blank/error on sites with CDN-level
X-Frame-Options: deny(e.g., Hostinger-hosted sites) - Fix: Server-side proxy added to both Free and Pro AJAX classes to prevent action not registered error when Pro overrides Free
- Fix: Removed broken CDN Lucide CSS (
cdn.jsdelivr.net) from Pro detail page that caused MIME type error - Security: Proxy endpoint restricted to same-site URLs only, with nonce verification and
manage_optionscapability check
1.2.0 – 2026-03-11
- Feature: „Try Pro FREE for 6 Months” admin banner with trial countdown, dismiss, and expired state variants
- Feature: ipwho.is secondary geolocation API fallback when ip-api.com is rate-limited (free, HTTPS, no rate limit)
- Enhancement: License-aware trial banner visibility using Manifest Manager (hidden for valid Pro license, shown for expired trial)
- Enhancement: Geolocation fallback chain expanded: CloudFlare Cache ip-api.com ipwho.is Timezone Browser Language
- Enhancement: Added ipwho.is to External Services disclosure, FAQ, and Privacy Policy sections in readme.txt
- Fix: Trial banner dismiss button now removes element from DOM instead of CSS hide (fixes specificity conflict with admin-notices.css)
- Fix: Trial banner no longer appears when Pro plugin is active with a valid license
- Fix: „Unknown” country in Real-time Visitors resolved for high-traffic sites exceeding ip-api.com 45 req/min rate limit
- Fix: Stable tag mismatch between readme.txt and main plugin file header
- Fix: Short description trimmed to 150-character WordPress.org maximum
1.1.1 – 2026-03-10
- Fix: PHP version compatibility check was comparing against non-existent PHP 7.6 instead of 7.4, preventing activation on PHP 7.4.x servers
- Enhancement: Added OptiUser API (api.optiuser.com) and OptiUser Website (optiuser.com) to External Services disclosure for WordPress.org compliance
- Enhancement: Expanded FAQ „Does this plugin call any external services?” with detailed list of all 4 external services
- Enhancement: Added „Try Pro FREE for 6 months” call-to-action in Pro Features section with direct download link
- Enhancement: Updated upgrade pages with 6-month free Pro trial messaging and hidden download page URL
1.1.0 – 2026-03-09
- Feature: Plugin install tracker with 24-hour heartbeat mechanism for anonymous usage statistics
- Feature: Automatic plugin type detection (Free/Pro) in tracker heartbeat data
- Feature: Deactivation notification to API for immediate status updates
- Enhancement: Autoloader class conflict prevention for shared Free/Pro classes (Ajax, Detail Page, Parser, Cache)
- Enhancement: Heatmaps sessions column now uses file-based device counts (Desktop + Mobile) for accurate sorting
- Enhancement: Heatmap table column widths rebalanced to accommodate tooltip icons and translations
- Enhancement: Table headers no longer truncated — always fully readable with nowrap styling
- Enhancement: Title truncation moved from PHP to CSS text-overflow for cleaner hover tooltips
- Fix: Autoloader excluding shared Pro/Free classes to prevent Free overriding Pro AJAX handler
- Fix: Heatmap detail page duplicate rendering caused by auto-instantiation
- Fix: SQL prepared statement parameter mismatch when date filters were active on heatmaps
- Fix: Sessions ORDER BY alias referencing non-existent table alias
- Fix: Plugin re-activation now triggers immediate heartbeat to update API status
- Fix: Removed unexpected ARCHITECTURE.md file from plugin root (Plugin Check compliance)
- Fix: Wrapped all error_log() calls in WP_DEBUG guards for production safety
- Fix: Synced Stable tag and Plugin Name between readme.txt and main plugin header
- Fix: Removed localhost/development URL from tracker API endpoint
- Code Quality: Clean uninstall with tracker options and cron job cleanup
1.0.9 – 2026-02-10
- Feature: Smart Data Cleanup system with bot/spam removal, quality thresholds, and scheduled auto-cleanup via WordPress cron
- Feature: Comprehensive tooltip system across all pages (Dashboard, Heatmaps, Funnels, Settings, Form Analytics, Error Tracking)
- Feature: Form Analytics upgrade page with menu integration, database table handlers, and scheduled report support
- Feature: Danger Zone redesign with horizontal sub-tabs (Full Reset, Date Range, Smart Cleanup, Auto Schedule)
- Feature: German (de_DE) language support with complete translations
- Feature: Italian (it_IT) language support with complete translations
- Feature: Spanish (es_ES) complete translation files
- Feature: Portuguese (pt_BR) complete translation files
- Enhancement: Replaced all emoji icons with Lucide SVG icons throughout the plugin for professional UI
- Enhancement: Unified page header style across all pages (Dashboard, Heatmaps, Funnels, Settings, Recordings, Errors)
- Enhancement: Country flag icons in language dropdown selector
- Enhancement: Funnel step cards made more compact with improved layout and per-funnel country filter with flag icons
- Enhancement: Heatmaps page search functionality and mobile preview mode for heatmap iframe
- Enhancement: Guest preview mode for accurate non-logged-in heatmap display
- Enhancement: Replaced Data Protection tab with Storage Stats page with improved tooltips
- Enhancement: Standardized button styles with Lucide icons and btn-danger class for destructive actions
- Enhancement: Added User Journeys and Form Analytics data to scheduled email reports
- Enhancement: Improved browser/OS detection with HarmonyOS support and better bot detection
- Enhancement: PRO feature gating with badges on menu items, heatmap tooltips, and blocked PRO heatmap types for free users
- Enhancement: Admin menu icon updated to 35×35 PNG with hover states
- Enhancement: French translations extensively improved with shortened menu labels
- Enhancement: AI Insights panel with Lucide icon styling and default message
- Fix: Move Heatmap trajectory rendering with proper coordinate scaling and adaptive colors based on website background
- Fix: Scroll Heatmap legend positioning and visibility
- Fix: Attention Heatmap legend positioning moved outside iframe with smooth gradients and base color coverage
- Fix: Bounce rate KPI mismatch with daily history chart
- Fix: Heatmaps page Mobile Traffic showing 0% – Device Split now uses sessions data
- Fix: Session count mismatch between total and device split
- Fix: Time period filter icon and dropdown functionality with correct default selection
- Fix: Traffic Overview chart layout with reduced empty space
- Fix: Funnel URL matching filters and string concatenation bug
- Fix: Conditional cleanup settings not persisting after page refresh
- Fix: Date range file deletion now includes uploads/opti-behavior-data/ directory
- Fix: Delete All Data not clearing storage properly
- Fix: Top Engaged Users widget column width for long country names
- Fix: Scheduled reports SQL error and instant stats update
- Fix: Heatmap download now includes page content with overlay
- Fix: Stat history bar charts display
- Fix: Stats inconsistency when Pro is active
- Code Quality: WordPress Plugin Check – 0 errors, 0 warnings (100% compliant)
- Code Quality: Renamed non-prefixed variables in HTML templates with opti_behavior_ prefix
- Code Quality: Complete uninstall cleanup with all database tables, cron jobs, transients, and legacy directories
1.0.8 – 2025-12-08
- Feature: User Intent Rules – Advanced system for analyzing and categorizing user behavior patterns
- Enhancement: Analytics Dashboard time filter now defaults to 30 Days for better data overview
- Fix: Improved favicon handling for referrer websites with proper fallback support
1.0.7 – 2025-12-02
- Enhancement: Added French language translations for improved internationalization
- Fix: Resolved sendPageView function issues for accurate page tracking
- Fix: Corrected Returning Visitors calculation and display
- Fix: Fixed Logged In Visitors detection and counting
- Feature: Display username for logged-in visitors in Top Engaged Users widget
- Enhancement: Extended device type support for all device categories (desktop, mobile, tablet, PC)
- Code Quality: WordPress coding standards compliance improvements
- Code Quality: Added debug logging controls via settings page
- Security: Fixed nonce verification warnings
- Security: Enhanced prepared SQL statements with proper phpcs annotations
1.0.6 – 2025-11-30
- Feature: New vs Returning Visitors analytics dashboard widget
- Feature: Visited Directories analytics with depth tracking and page views
- Feature: Visitor Authentication analytics showing logged-in vs guest users
- Fix: WordPress DB coding standards – SQL wildcards now use placeholders
- Enhancement: Improved prepared SQL statements compliance
- Code Quality: Full WordPress.DB.PreparedSQLPlaceholders compliance
1.0.5 – 2025-11-23
- Fix: Removed all debug error_log() calls from production code
- Fix: Replaced date() with gmdate() for timezone-safe date handling
- Fix: Added translator comments for i18n compliance
- Fix: Updated API URL from localhost to production endpoint
- Fix: Corrected stable tag version mismatch
- Enhancement: Improved readme with better descriptions and FAQ
- Enhancement: Added Plugin URI and updated Author URI
- Enhancement: Optimized WordPress.org directory submission compliance
- Compatibility: Full WordPress 6.8 compatibility verified
- Enhancement: Added COALESCE for better handling of NULL titles in Top Pages
- Enhancement: Improved country detection with browser language fallback when IP geolocation fails
- Enhancement: Top Pages widget now displays page views instead of clicks for better accuracy
1.0.4 – 2025-11-20
- Enhancement: Added file-based storage system for high-traffic sites
- Enhancement: Implemented automatic bot detection and filtering
- Enhancement: Added performance optimizer with automatic database indexing
- Enhancement: Separate mobile and desktop heatmap tracking and visualization
- Enhancement: Batch processing for improved performance
- Enhancement: Enhanced debug logging system with WordPress-compliant manager
- Enhancement: Added Lucide icon library (v0.554.0, ISC License) for modern UI
- Security: Replaced direct filesystem operations with WP_Filesystem API
- Security: Replaced unlink() with wp_delete_file() for file deletion
- Code Quality: WordPress coding standards compliance improvements
- Code Quality: Improved data sanitization and validation
- Compatibility: Tested up to WordPress 6.8
1.0.3
- Security: Fix Unsafe SQL calls
- Security: Fix files and directories locations use
- Security: Moved inline CSS to external stylesheet
- Security: Moved inline JS to external stylesheet
- Follows WordPress coding standards
- Plugin Check validation passed
1.0.2
Review and fix all the issues listed in the review email.
1.0.1
- Security: Enhanced sanitization for $_SERVER variables
- Security: Improved json_decode() data sanitization
- Security: Moved inline CSS to external stylesheet for WordPress compliance
- Code Quality: Added proper sanitization for all user inputs
- Code Quality: Enhanced data validation in AJAX handlers
- Compatibility: Verified all security checks are in place
1.0.0
- Initial release
- Visual heatmap tracking
- Real-time analytics dashboard
- Page performance metrics
- User journey tracking
- GDPR compliance features
- Data export functionality
- Multisite support
- Debug mode for troubleshooting
