=== Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels & A/B Testing ===
Contributors: optiuser
Donate link: https://optiuser.com/
Tags: heatmap, ab testing, click tracking, session recording, funnel

Requires at least: 5.8
Tested up to: 6.9
Requires PHP: 7.4
Stable tag: 1.3.1
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Free self-hosted heatmaps, funnels & A/B WooCommerce testing for WordPress. Privacy-first. Pro adds recordings, forms, journeys & errors.

== Description ==

**Opti-Behavior is a self-hosted behavior analytics and conversion optimization plugin for WordPress.**

See where visitors click, scroll, hesitate, abandon funnels, submit forms, hit errors, and move through your website — directly from your WordPress dashboard.

Unlike external analytics clouds, Opti-Behavior stores visitor behavior data on your own WordPress server. Use it to run heatmaps, funnels, A/B tests, click tracking, visitor journeys, form analytics, error tracking, and session recordings with privacy-first controls.

= Core Features (Free) =

* Click & scroll heatmaps with color-coded intensity (Mobile & Desktop)
* Real-time analytics dashboard — visitors, sessions, pageviews, bounce rate, scroll depth
* Interactive world map with visitor locations, Top Pages, and Traffic Sources
* Conversion funnels with multi-step dropout analysis and device filtering
* A/B testing with page-split experiments, visual variant previews, winner application, and conversion goal tracking
* Session & visitor tracking (duration, pages visited, referrers, outbound links)
* Bot detection & filtering (Google, Bing, Yahoo, etc.)
* Scheduled email reports (Daily, Weekly, Monthly)
* IP anonymization, no cookies required, no third-party data sharing
* Multilingual admin: English, French, German, Spanish, Portuguese, Italian

= Pro Features (Upgrade) =

* **Session Recordings** — full playback with privacy controls
* **Error Tracking** — JS errors, network errors, Core Web Vitals
* **Friction Detection** — rage clicks and dead clicks
* **Form Analytics** — field-level interaction and abandonment tracking
* **User Journey Analytics** — Sankey diagram visitor path visualization
* **Advanced Heatmap Filtering** — country, browser, device, and date
* **Priority Support**

**Try Pro FREE for 6 months** — no credit card required!

[Learn more about Opti-Behavior Pro](https://optiuser.com/opti-behavior/)

== Installation ==

= Automatic Installation =

1. Log in to your WordPress admin panel
2. Navigate to Plugins > Add New
3. Search for "Opti-Behavior"
4. Click "Install Now" and then "Activate"

= Manual Installation =

1. Download the plugin zip file
2. Log in to your WordPress admin panel
3. Navigate to Plugins > Add New > Upload Plugin
4. Choose the downloaded zip file and click "Install Now"
5. After installation, click "Activate Plugin"

= After Activation =

1. Navigate to **Opti-Behavior** in your WordPress admin menu
2. The plugin starts tracking automatically - no configuration required!
3. Visit the **Dashboard** to see real-time visitor activity
4. Go to **Heatmaps** to view click patterns on your pages
5. Check **Funnels** to set up conversion tracking
6. Adjust **Settings** to customize tracking behavior and privacy options

That's it! Opti-Behavior works out of the box with smart defaults.

== Frequently Asked Questions ==

= Does this plugin slow down my website? =

Absolutely not! Opti-Behavior is built for speed from the ground up. Our **Hybrid Storage engine** writes analytics events to optimized files on disk instead of your database, eliminating database bloat and keeping queries fast. The tracking script is only ~15KB minified and loads 100% asynchronously -- it never blocks page rendering. Events are batch-processed in memory and daily statistics are pre-aggregated, so even your admin dashboard loads instantly. This is lighter and faster than Hotjar, Clarity, or any SaaS analytics tool. We've tested it on sites with millions of pageviews with zero performance impact on Core Web Vitals.

= Is this plugin GDPR compliant? =

Yes, by design! Since all data is stored locally on your WordPress server, there are no cross-border data transfers to worry about. The plugin includes IP anonymization, data retention controls, and works without cookies. No DPA (Data Processing Agreement) with a third party is needed because YOU are the only data controller. However, you should still update your privacy policy to disclose your analytics practices.

= Is this plugin CCPA compliant? =

Yes! The California Consumer Privacy Act (CCPA) gives California residents the right to know what personal data is collected about them, the right to request deletion, and the right to opt out of the sale of their personal information. Opti-Behavior supports CCPA compliance in the following ways:

* **No data selling:** Opti-Behavior never sells, shares, or transfers your visitors' data to any third party. You are the sole data controller.
* **IP anonymization:** Enable IP anonymization in Settings to avoid storing full IP addresses.
* **Data deletion:** Use the Danger Zone (Settings page) to delete all collected data at any time, or enable "Delete all data on uninstall" to purge everything when removing the plugin.
* **No cross-context behavioral advertising:** All analytics data stays on your server. No data is used for advertising profiling.
* **Opt-out support:** You can integrate Opti-Behavior with your existing GDPR/CCPA consent banner (Cookiebot, Complianz, CookieYes, etc.) to honor visitor opt-out requests before tracking begins.

You should update your privacy policy to disclose that you collect behavioral analytics data, describe the data types collected, and explain how visitors can request data deletion.

= How is this different from Microsoft Clarity? =

Microsoft Clarity is free but Microsoft acts as an **independent data controller** -- they use your visitors' behavioral data for their own purposes, including advertising. With Opti-Behavior, all data stays on YOUR server. Additionally, Opti-Behavior offers conversion funnels, scheduled reports, and bot detection that Clarity doesn't provide. The Pro version adds session recordings, error tracking, form analytics, and user journeys. AI-powered insights are on the roadmap as an upcoming feature.

= How is this different from Hotjar? =

Hotjar sends all data to their cloud servers (AWS Ireland). You have no control over where your data goes. Hotjar's equivalent features (heatmaps + recordings + funnels + error tracking) cost $213+/month ($2,556/year). Opti-Behavior keeps everything on your server, and the Pro upgrade is a fraction of the cost.

= How is this different from Matomo? =

Matomo offers self-hosted web analytics (similar privacy model), but their behavior analytics features require expensive premium plugins: heatmaps (EUR 199/yr), session recordings (EUR 549/yr), funnels (EUR 99/yr), and form analytics (EUR 79/yr) -- totaling EUR 926+/year. Opti-Behavior includes heatmaps and funnels free, with all other behavior analytics in a single affordable Pro upgrade.

= Are there any session or pageview limits? =

No! Unlike SaaS analytics tools that cap sessions (Hotjar free: 35/day, Mouseflow free: 500/month, Lucky Orange free: 100/month), Opti-Behavior stores all data locally with no artificial limits. The only limit is your server's storage capacity.

= Can I export my data? =

Yes! Export all analytics data in CSV format directly from the admin dashboard.

= Does this work with caching plugins? =

Yes! Opti-Behavior is compatible with WP Super Cache, W3 Total Cache, WP Rocket, and other popular caching plugins.

= Will this work on multisite? =

Yes! Opti-Behavior is multisite compatible and can be activated network-wide or on individual sites.

= Does this plugin call any external services? =

The plugin makes minimal use of external services. See the "External Services" section for full details:

* **ip-api.com** — Primary IP geolocation (only when CloudFlare headers are unavailable)
* **ipwho.is** — Secondary IP geolocation fallback (only when ip-api.com is rate-limited or unavailable)
* **OpenStreetMap** — Map tiles for the admin visitor map
* **api.optiuser.com** — Anonymous install tracking (24-hour heartbeat), Pro trial license management, and download access codes
* **optiuser.com** — Pro plugin download page (user-initiated only)

All visitor analytics data is stored locally on your server. No analytics data is ever sent to any external service. All JavaScript libraries are bundled within the plugin.

= What data does this plugin collect? =

The plugin collects:
* Page views and URLs
* Click positions and elements
* Mouse movements and scroll depth
* Session duration and timestamps
* Referrer information
* Device and browser information (user agent)
* Anonymized IP addresses (optional)
* Approximate location based on browser timezone

No personally identifiable information (PII) is collected by default. All data is stored locally in your WordPress database.

= Can I delete all data when uninstalling? =

Yes! Enable "Delete all data on uninstall" in Settings. All database tables and options will be removed when you uninstall.

= Does it work with WooCommerce? =

Absolutely! Track checkout funnels, view heatmaps on product pages, analyze cart abandonment patterns, and optimize conversion flows -- all without sharing your customers' data with third parties.

= Does it work with page builders? =

Yes! Works with Elementor, Divi, Beaver Builder, WPBakery, Gutenberg, and all major page builders.

= What is the Hybrid Storage Engine? =

The Hybrid Storage engine is our innovative approach to analytics data storage. Instead of writing every click, scroll, and pageview directly to your MySQL database (which causes bloat and slowdowns), analytics events are stored in optimized JSON files on disk. This keeps your database lean and your queries fast. Combined with batch processing and compression, the Hybrid Storage engine handles millions of events without any performance impact. Enable it in Settings > Storage Options.

= How do I get support? =

For support questions, use the [WordPress.org support forums](https://wordpress.org/support/plugin/opti-behavior/). For priority support, upgrade to [Opti-Behavior Pro](https://optiuser.com/).

== External Services ==

This plugin may connect to external services in limited circumstances:

= IP Geolocation (ip-api.com) =

**Purpose:** Provides geographic location data (country, city, timezone) for visitor analytics and map visualization.

**When Used:** Only when a visitor's location cannot be determined from CloudFlare headers. If CloudFlare is active, no external calls are made.

**Data Sent:** Only the visitor's IP address. No personally identifiable information is transmitted.

**Caching:** Results are cached for 1 hour to minimize API requests.

**Privacy:**
* Service: https://ip-api.com/
* Terms & Privacy: https://ip-api.com/docs/legal
* Note: ip-api.com may log IP addresses. Review their privacy policy for details.

= IP Geolocation Fallback (ipwho.is) =

**Purpose:** Secondary geolocation fallback when ip-api.com is rate-limited or unavailable. Provides geographic location data (country, city, region, timezone) for visitor analytics.

**When Used:** Only when both CloudFlare headers and ip-api.com fail to resolve a visitor's location. ip-api.com's free tier has a 45 requests/minute rate limit, so on high-traffic sites ipwho.is ensures visitors are still geolocated accurately.

**Data Sent:** Only the visitor's IP address. No personally identifiable information is transmitted.

**Caching:** Results are cached for 1 hour to minimize API requests.

**Privacy:**
* Service: https://ipwho.is/
* Terms & Privacy: https://ipwho.is/
* Note: ipwho.is may log IP addresses. Review their privacy policy for details.

= OpenStreetMap Tiles =

**Purpose:** Displays the interactive visitor location map in your WordPress admin dashboard.
**When Used:** Only when YOU (the admin) view the real-time visitor map. Not used on the frontend.
**Data Sent:** Your browser makes direct requests to OpenStreetMap tile servers (standard HTTP headers only).

**Privacy:**
* Service: https://www.openstreetmap.org/
* Tile Policy: https://operations.osmfoundation.org/policies/tiles/
* Privacy Policy: https://wiki.osmfoundation.org/wiki/Privacy_Policy

= OptiUser API (api.optiuser.com) =

**Purpose:** Handles anonymous install tracking, plugin deactivation notifications, Pro trial license generation, license validation, update checks, and download access code generation for the Pro plugin.

**When Used:**
* **Install tracker:** Sends an anonymous heartbeat once every 24 hours after activation, containing only: site URL, WordPress version, PHP version, plugin version, and plugin type (free/pro). No visitor data or personal information is sent.
* **Deactivation:** Notifies the API when the plugin is deactivated so installation records stay up to date.
* **Pro upgrade pages:** When an admin views a Pro feature upgrade page (Session Recordings, Error Tracking, User Journeys, Form Analytics), the plugin requests a one-time download access code from the API. This code is used to securely access the Pro download page on optiuser.com.

**Data Sent:** Site URL, WordPress admin username, admin email address (only when requesting a Pro download access code). No visitor analytics data is ever sent to the API.

**Privacy:**
* Service: https://api.optiuser.com/
* Website: https://optiuser.com/
* Privacy Policy: https://optiuser.com/privacy-policy/
* The API stores installation metadata (site URL, plugin version) for license management. No visitor data is collected or stored by the API.

= OptiUser Website (optiuser.com) =

**Purpose:** Hosts the Opti-Behavior Pro download page and sales/feature pages. When an admin clicks "Download Pro — Free for 6 Months" on a Pro upgrade page, they are redirected to optiuser.com to register and download the Pro plugin.

**When Used:** Only when an admin chooses to download Opti-Behavior Pro from a Pro upgrade page within the WordPress admin. This is an optional, user-initiated action.

**Data Sent:** Site URL,  username, and  email address are passed as URL parameters to pre-fill the registration form. No visitor analytics data is sent.

**Privacy:**
* Service: https://optiuser.com/
* Privacy Policy: https://optiuser.com/privacy-policy/

**Important Note:** All analytics data is stored locally on your WordPress server. The external services listed above are used only for optional geographic features (ip-api.com, ipwho.is, OpenStreetMap), anonymous install tracking, and Pro license management (api.optiuser.com). No visitor analytics data ever leaves your server.

== Screenshots ==

1. Real-time analytics dashboard with visitor metrics, interactive world map, and traffic breakdown
2. Visual click heatmap showing user interaction patterns on a page
3. Conversion funnel builder with step-by-step dropout analysis
4. Detailed page analytics with engagement metrics and scroll depth
5. Settings panel with privacy controls, data retention, and storage options
6. Bot detection showing filtered crawler traffic vs real visitors
7. Scheduled email reports configuration
8. Mobile vs Desktop heatmap comparison view
9. AI Insights panel — coming soon feature preview
10. Dark mode interface for comfortable nighttime administration

== Changelog ==

= 1.3.1 - 2026-05-04 =
* Fix: Keep Free click heatmap detail working when Pro is disabled by loading the Free detail page and AJAX handlers correctly.
* Fix: Pro runtime detection no longer treats the Free fallback `opti_behavior_pro_active()` helper as an active Pro runtime.

= 1.3.0 - 2026-05-03 =
* Feature: Added a delayed WordPress.org review reminder banner with Opti-Behavior branding, shown to admins after 7 days of plugin use with review, done, remind, and hide actions.
* Feature: Frontend Stats Bar metrics now link admins to the relevant detail pages for faster page-level analysis.
* Enhancement: Frontend Stats Bar layout now dynamically compacts and wraps metrics so Pro metrics remain visible on narrower screens.
* Enhancement: Refined the onboarding setup wizard styling, copy, and welcome-page flow.
* Fix: Heatmap Detail iframe height no longer enters viewport-height feedback loops on pages with 100vh/min-height wrappers, preventing runaway growth and clipped footers.
* Fix: Hardened heatmap reset SQL and A/B Visual Editor redirect handling.
* Maintenance: Synced the Free plugin title, package metadata, version constant, readme stable tag, and changelog for the 1.3.0 release.

= 1.2.9.3 - 2026-05-03 =
* Fix: Heatmap Detail iframe height no longer enters viewport-height feedback loops on pages with 100vh/min-height wrappers, preventing runaway growth and clipped footers.
* Fix: Added safer cache-busted heatmap asset versioning for this hotfix release.
= 1.2.9 - 2026-05-01 =
* Feature: Added a per-page heatmap reset button on Heatmap Detail pages so admins can delete stale heatmap data after major page redesigns without deleting session recordings, sessions, or analytics history.
* Enhancement: Optimized and polished the Frontend Stats Bar overlay for cleaner frontend admin stats display.
* Enhancement: Added advanced GDPR compact consent banner controls for improved privacy-banner design and behavior.
* Fix: A/B Visual Editor launch and preview flows remain popup-safe with browser privacy extensions and ad blockers.

= 1.2.8.1 - 2026-04-28 =
* Fix: A/B Testing Visual Editor launchers now use native direct links for saved variants, preventing ad blockers and popup blockers from making Open Visual Editor appear broken.
* Fix: Visual Editor Preview now uses a server-side save-and-redirect form flow instead of script-created popups, so preview opens reliably with unsaved changes.
* Enhancement: Added regression coverage for popup-blocker-safe Visual Editor opening and preview behavior.

= 1.2.8 - 2026-04-28 =
* Feature: Added expanded A/B testing tools for page-split experiments, visual variant previews, winner application, and conversion goal tracking.
* Feature: Added improved A/B test results reporting with impressions, conversions, conversion rate, and winner indicators.
* Enhancement: Improved A/B attribution for page-split variant pages and cross-page goals so experiment results stay accurate across visitor journeys.
* Maintenance: Prepared the Free plugin package metadata, version constants, readme stable tag, and changelog for the 1.2.8 release.

= 1.2.7 - 2026-04-09 =
* Feature: Selective data deletion in Danger Zone — 9 category checkboxes (Sessions, Visitors, Events, Heatmaps, Recordings, Traffic, Errors, Funnels, Forms) let users choose which data to delete instead of deleting everything
* Enhancement: Select All / Deselect All toggle for quick category selectio
* Fix: False-positive broken links — same-origin images and internal pages no longer flagged as "Blocked" when server blocks HEAD requests (LiteSpeed Cache, WAF). HEAD failures now fallback to GET verification before saving
* Fix: Error source now shows actual JS file path instead of generic "admin-ajax.php" — uses call stack capture at fetch/XHR call time
* Fix: Session recorder console.log/warn messages now gated behind the Debug & Logging "Enable JavaScript Debug Logging" setting — no more console spam on production sites
* Enhancement: JS Errors page file links now show full URL on mouse hover (tooltip) and are clickable to open the source file directly
* Enhancement: IMG resource error verification uses HEAD + GET fallback with _optiVerify flag to prevent XHR interceptor self-tracking


= 1.2.6 - 2026-04-7 =
* Fix: Attention heatmap showing click stats instead of scroll stats
* Enhancement: Admin tracking settings, admin bar offset, login detection
* Enhancement: Translations updated (FR, DE, ES, IT, PT-BR)
* Feature: Onboarding popup 

= 1.2.5.1 - 2026-04-5 =
* Enhancement: Replace raw console.log/warn/info in session-recorder.js
* Fix: All visitor-facing and admin console output now respects the debug logging settings in wp-admin

= 1.2.5 - 2026-04-5 =
* Fix: Session recording playback shows white empty page on live server — set inlineStylesheet:false to prevent oversized FullSnapshot payloads (3–7 MB) that Hostinger nginx rejects
* Fix: Added oversized-payload guard in session-recorder.js — warns when non-beacon payload exceeds 1 MB
* Fix: PHP empty-events guard — rejects AJAX saves with no events when no DB row exists yet
* Enhancement: Comprehensive debug logging in JS (FullSnapshot detection, save batch type distribution, server response) and PHP (error_log for event types, FullSnapshot presence, file save confirmation)
* Fix: Removed console plugin from rrweb config to eliminate type-6 events and extra payload bulk

= 1.2.4.2 - 2026-04-04 =
* Fix: Heatmap data protection improvements and welcome page refinements
* Enhancement: Minor code quality improvements across core files

= 1.2.4.1 - 2026-04-03 =
* Fix: Resolve PHP 8.2 null deprecations + wpdb prepare mismatch	

= 1.2.4 - 2026-04-03 =
* Fix: Resolved all WordPress Plugin Check errors and warnings (escape output, nonce verification, readme compliance)
* Fix: GDPR consent banner not displaying — admin-notices CSS/JS no longer hides plugin's own ob-* elements
* Enhancement: Default auto-cleanup on fresh install (weekly, 90-day retention, bot/bounce session removal)
* Enhancement: Moved Pro trial offer above feature list on welcome page for better visibility
* Fix: Consent banner logic simplified — removed obsolete checkbox, uses Consent Banner Source radios only

= 1.2.3 - 2026-03-29 =
* Feature: Frontend Stats Bar — admin-only analytics overlay on every frontend page with 6 color themes and per-stat visibility settings
* Feature: Custom SMTP email configuration for scheduled reports with WP Mail fallback, and Cron Monitor for scheduled task health
* Enhancement: Full cache plugin compatibility (Autoptimize, LiteSpeed, WP Rocket, SG Optimizer) — nonce refresh, client-side cookie IDs, script tag protection, and visibilitychange flush
* Enhancement: Optimized live visitors query, esc_sql() hardening, admin submenu reorder, and PHPCS compliance fixes
* Fix: 10 Smart Data Cleanup bugs (recording file deletion, cascade orphans, scheduling), debug log download fatal error, and auto-cleanup via daily cron

= 1.2.2 - 2026-03-22 =
* Feature: Rich banner styles — info, warning, success, promo, custom with configurable colors, images, and CTA buttons
* Enhancement: Dismiss tracking stores timestamps for duration-based re-show logic with automatic migration from old format
* Fix: Self-referral bug — site's own domain no longer appears as referrer in analytics, user journey, and form analytics views

= 1.2.1 - 2026-03-17 =
* Feature: Server-side proxy for heatmap iframe loading — bypasses CDN-level X-Frame-Options restrictions (e.g., Hostinger) that block iframe embedding
* Enhancement: Heatmap iframe now uses `srcdoc` with proxied HTML content, injecting `<base href>` for correct relative URL resolution
* Enhancement: Generic JS scan to detect and cap elements with inflated inline heights from unknown/custom slider frameworks
* Fix: Heatmap iframe blank/error on sites with CDN-level `X-Frame-Options: deny` (e.g., Hostinger-hosted sites)
* Fix: Server-side proxy added to both Free and Pro AJAX classes to prevent action not registered error when Pro overrides Free
* Fix: Removed broken CDN Lucide CSS (`cdn.jsdelivr.net`) from Pro detail page that caused MIME type error
* Security: Proxy endpoint restricted to same-site URLs only, with nonce verification and `manage_options` capability check

= 1.2.0 - 2026-03-11 =
* Feature: "Try Pro FREE for 6 Months" admin banner with trial countdown, dismiss, and expired state variants
* Feature: ipwho.is secondary geolocation API fallback when ip-api.com is rate-limited (free, HTTPS, no rate limit)
* Enhancement: License-aware trial banner visibility using Manifest Manager (hidden for valid Pro license, shown for expired trial)
* Enhancement: Geolocation fallback chain expanded: CloudFlare → Cache → ip-api.com → ipwho.is → Timezone → Browser Language
* Enhancement: Added ipwho.is to External Services disclosure, FAQ, and Privacy Policy sections in readme.txt
* Fix: Trial banner dismiss button now removes element from DOM instead of CSS hide (fixes specificity conflict with admin-notices.css)
* Fix: Trial banner no longer appears when Pro plugin is active with a valid license
* Fix: "Unknown" country in Real-time Visitors resolved for high-traffic sites exceeding ip-api.com 45 req/min rate limit
* Fix: Stable tag mismatch between readme.txt and main plugin file header
* Fix: Short description trimmed to 150-character WordPress.org maximum

= 1.1.1 - 2026-03-10 =
* Fix: PHP version compatibility check was comparing against non-existent PHP 7.6 instead of 7.4, preventing activation on PHP 7.4.x servers
* Enhancement: Added OptiUser API (api.optiuser.com) and OptiUser Website (optiuser.com) to External Services disclosure for WordPress.org compliance
* Enhancement: Expanded FAQ "Does this plugin call any external services?" with detailed list of all 4 external services
* Enhancement: Added "Try Pro FREE for 6 months" call-to-action in Pro Features section with direct download link
* Enhancement: Updated upgrade pages with 6-month free Pro trial messaging and hidden download page URL

= 1.1.0 - 2026-03-09 =
* Feature: Plugin install tracker with 24-hour heartbeat mechanism for anonymous usage statistics
* Feature: Automatic plugin type detection (Free/Pro) in tracker heartbeat data
* Feature: Deactivation notification to API for immediate status updates
* Enhancement: Autoloader class conflict prevention for shared Free/Pro classes (Ajax, Detail Page, Parser, Cache)
* Enhancement: Heatmaps sessions column now uses file-based device counts (Desktop + Mobile) for accurate sorting
* Enhancement: Heatmap table column widths rebalanced to accommodate tooltip icons and translations
* Enhancement: Table headers no longer truncated — always fully readable with nowrap styling
* Enhancement: Title truncation moved from PHP to CSS text-overflow for cleaner hover tooltips
* Fix: Autoloader excluding shared Pro/Free classes to prevent Free overriding Pro AJAX handler
* Fix: Heatmap detail page duplicate rendering caused by auto-instantiation
* Fix: SQL prepared statement parameter mismatch when date filters were active on heatmaps
* Fix: Sessions ORDER BY alias referencing non-existent table alias
* Fix: Plugin re-activation now triggers immediate heartbeat to update API status
* Fix: Removed unexpected ARCHITECTURE.md file from plugin root (Plugin Check compliance)
* Fix: Wrapped all error_log() calls in WP_DEBUG guards for production safety
* Fix: Synced Stable tag and Plugin Name between readme.txt and main plugin header
* Fix: Removed localhost/development URL from tracker API endpoint
* Code Quality: Clean uninstall with tracker options and cron job cleanup

= 1.0.9 - 2026-02-10 =
* Feature: Smart Data Cleanup system with bot/spam removal, quality thresholds, and scheduled auto-cleanup via WordPress cron
* Feature: Comprehensive tooltip system across all pages (Dashboard, Heatmaps, Funnels, Settings, Form Analytics, Error Tracking)
* Feature: Form Analytics upgrade page with menu integration, database table handlers, and scheduled report support
* Feature: Danger Zone redesign with horizontal sub-tabs (Full Reset, Date Range, Smart Cleanup, Auto Schedule)
* Feature: German (de_DE) language support with complete translations
* Feature: Italian (it_IT) language support with complete translations
* Feature: Spanish (es_ES) complete translation files
* Feature: Portuguese (pt_BR) complete translation files
* Enhancement: Replaced all emoji icons with Lucide SVG icons throughout the plugin for professional UI
* Enhancement: Unified page header style across all pages (Dashboard, Heatmaps, Funnels, Settings, Recordings, Errors)
* Enhancement: Country flag icons in language dropdown selector
* Enhancement: Funnel step cards made more compact with improved layout and per-funnel country filter with flag icons
* Enhancement: Heatmaps page search functionality and mobile preview mode for heatmap iframe
* Enhancement: Guest preview mode for accurate non-logged-in heatmap display
* Enhancement: Replaced Data Protection tab with Storage Stats page with improved tooltips
* Enhancement: Standardized button styles with Lucide icons and btn-danger class for destructive actions
* Enhancement: Added User Journeys and Form Analytics data to scheduled email reports
* Enhancement: Improved browser/OS detection with HarmonyOS support and better bot detection
* Enhancement: PRO feature gating with badges on menu items, heatmap tooltips, and blocked PRO heatmap types for free users
* Enhancement: Admin menu icon updated to 35x35 PNG with hover states
* Enhancement: French translations extensively improved with shortened menu labels
* Enhancement: AI Insights panel with Lucide icon styling and default message
* Fix: Move Heatmap trajectory rendering with proper coordinate scaling and adaptive colors based on website background
* Fix: Scroll Heatmap legend positioning and visibility
* Fix: Attention Heatmap legend positioning moved outside iframe with smooth gradients and base color coverage
* Fix: Bounce rate KPI mismatch with daily history chart
* Fix: Heatmaps page Mobile Traffic showing 0% - Device Split now uses sessions data
* Fix: Session count mismatch between total and device split
* Fix: Time period filter icon and dropdown functionality with correct default selection
* Fix: Traffic Overview chart layout with reduced empty space
* Fix: Funnel URL matching filters and string concatenation bug
* Fix: Conditional cleanup settings not persisting after page refresh
* Fix: Date range file deletion now includes uploads/opti-behavior-data/ directory
* Fix: Delete All Data not clearing storage properly
* Fix: Top Engaged Users widget column width for long country names
* Fix: Scheduled reports SQL error and instant stats update
* Fix: Heatmap download now includes page content with overlay
* Fix: Stat history bar charts display
* Fix: Stats inconsistency when Pro is active
* Code Quality: WordPress Plugin Check - 0 errors, 0 warnings (100% compliant)
* Code Quality: Renamed non-prefixed variables in HTML templates with opti_behavior_ prefix
* Code Quality: Complete uninstall cleanup with all database tables, cron jobs, transients, and legacy directories

= 1.0.8 - 2025-12-08 =
* Feature: User Intent Rules - Advanced system for analyzing and categorizing user behavior patterns
* Enhancement: Analytics Dashboard time filter now defaults to 30 Days for better data overview
* Fix: Improved favicon handling for referrer websites with proper fallback support

= 1.0.7 - 2025-12-02 =
* Enhancement: Added French language translations for improved internationalization
* Fix: Resolved sendPageView function issues for accurate page tracking
* Fix: Corrected Returning Visitors calculation and display
* Fix: Fixed Logged In Visitors detection and counting
* Feature: Display username for logged-in visitors in Top Engaged Users widget
* Enhancement: Extended device type support for all device categories (desktop, mobile, tablet, PC)
* Code Quality: WordPress coding standards compliance improvements
* Code Quality: Added debug logging controls via settings page
* Security: Fixed nonce verification warnings
* Security: Enhanced prepared SQL statements with proper phpcs annotations

= 1.0.6 - 2025-11-30 =
* Feature: New vs Returning Visitors analytics dashboard widget
* Feature: Visited Directories analytics with depth tracking and page views
* Feature: Visitor Authentication analytics showing logged-in vs guest users
* Fix: WordPress DB coding standards - SQL wildcards now use placeholders
* Enhancement: Improved prepared SQL statements compliance
* Code Quality: Full WordPress.DB.PreparedSQLPlaceholders compliance

= 1.0.5 - 2025-11-23 =
* Fix: Removed all debug error_log() calls from production code
* Fix: Replaced date() with gmdate() for timezone-safe date handling
* Fix: Added translator comments for i18n compliance
* Fix: Updated API URL from localhost to production endpoint
* Fix: Corrected stable tag version mismatch
* Enhancement: Improved readme with better descriptions and FAQ
* Enhancement: Added Plugin URI and updated Author URI
* Enhancement: Optimized WordPress.org directory submission compliance
* Compatibility: Full WordPress 6.8 compatibility verified
* Enhancement: Added COALESCE for better handling of NULL titles in Top Pages
* Enhancement: Improved country detection with browser language fallback when IP geolocation fails
* Enhancement: Top Pages widget now displays page views instead of clicks for better accuracy

= 1.0.4 - 2025-11-20 =
* Enhancement: Added file-based storage system for high-traffic sites
* Enhancement: Implemented automatic bot detection and filtering
* Enhancement: Added performance optimizer with automatic database indexing
* Enhancement: Separate mobile and desktop heatmap tracking and visualization
* Enhancement: Batch processing for improved performance
* Enhancement: Enhanced debug logging system with WordPress-compliant manager
* Enhancement: Added Lucide icon library (v0.554.0, ISC License) for modern UI
* Security: Replaced direct filesystem operations with WP_Filesystem API
* Security: Replaced unlink() with wp_delete_file() for file deletion
* Code Quality: WordPress coding standards compliance improvements
* Code Quality: Improved data sanitization and validation
* Compatibility: Tested up to WordPress 6.8

= 1.0.3 =
* Security: Fix Unsafe SQL calls
* Security: Fix files and directories locations use
* Security: Moved inline CSS to external stylesheet
* Security: Moved inline JS to external stylesheet
* Follows WordPress coding standards
* Plugin Check validation passed

= 1.0.2 =
Review and fix all the issues listed in the review email.

= 1.0.1 =
* Security: Enhanced sanitization for $_SERVER variables
* Security: Improved json_decode() data sanitization
* Security: Moved inline CSS to external stylesheet for WordPress compliance
* Code Quality: Added proper sanitization for all user inputs
* Code Quality: Enhanced data validation in AJAX handlers
* Compatibility: Verified all security checks are in place

= 1.0.0 =
* Initial release
* Visual heatmap tracking
* Real-time analytics dashboard
* Page performance metrics
* User journey tracking
* GDPR compliance features
* Data export functionality
* Multisite support
* Debug mode for troubleshooting

== Upgrade Notice ==

= 1.3.1 =
Fixes Free click heatmap detail loading when Pro is disabled. Recommended for all Free users and Free+Pro sites that may deactivate Pro.

= 1.2.9 =
Adds per-page heatmap data reset for redesigned pages, a branded confirmation modal, optimized Frontend Stats Bar polish, advanced GDPR banner controls, and filtering/cache fixes. Recommended for all users.

= 1.2.8.1 =
Fixes A/B Visual Editor opening and preview flows when browser popup blockers or privacy extensions are active. Recommended for all A/B testing users.

= 1.2.8 =
Adds expanded A/B testing tools, improved experiment reporting, and more reliable page-split/cross-page goal attribution. Recommended for all A/B testing users.

= 1.2.4 =
Fixes all WordPress Plugin Check issues, GDPR consent banner visibility, and adds smart auto-cleanup defaults on fresh installs.

= 1.2.3 =
Major release with Frontend Stats Bar, SMTP email config, full cache plugin compatibility (LiteSpeed, WP Rocket, Autoptimize, SG Optimizer), 10 Smart Data Cleanup bug fixes, live visitors query optimization, and cron monitor. Recommended for all users.

= 1.2.1 =
Critical fix for heatmap iframe not loading on Hostinger and other CDN-hosted sites. Server-side proxy bypasses X-Frame-Options restrictions. Also fixes slider height issues and fatal error with older Pro versions. Recommended for all users.

= 1.2.0 =
New Pro trial banner with license-aware visibility, ipwho.is geolocation fallback for high-traffic sites, and fixes for "Unknown" country in Real-time Visitors. Recommended for all users.

= 1.1.0 =
Major stability release with anonymous install tracker, autoloader conflict fixes for Free/Pro coexistence, heatmap sessions accuracy improvements, SQL fixes, and full WordPress Plugin Check compliance (0 errors, 0 warnings). Recommended for all users.

= 1.0.9 =
Major release with Smart Data Cleanup, comprehensive tooltips, Form Analytics foundation, 4 new languages (German, Italian, Spanish, Portuguese), Lucide SVG icons throughout, 15+ bug fixes for heatmaps/funnels/stats, and 100% WordPress Plugin Check compliance.

= 1.0.8 =
New User Intent Rules feature for behavior analysis, Analytics Dashboard now defaults to 30-day view, and improved favicon handling for referrer websites.

= 1.0.7 =
Important update with French translations, visitor tracking improvements, and username display in Top Engaged Users. Enhanced coding standards compliance and debug logging controls.

= 1.0.5 =
WordPress.org submission update: Fixes debug code, timezone handling, and i18n compliance. All users should update for WordPress coding standards compliance.

= 1.0.4 =
Major update with file storage system, bot detection, and performance optimizations. Recommended for all users, especially high-traffic sites.

= 1.0.3 =
Important security update with enhanced SQL security. All users should update.

= 1.0.0 =
Initial release. Install to start tracking user behavior with powerful heatmaps and analytics.

== Privacy Policy ==

Opti-Behavior collects user interaction data to provide analytics insights. This data includes:

* Page URLs and titles
* Click coordinates and target elements
* Mouse movement patterns
* Scroll depth
* Session timestamps
* Referrer URLs
* Browser and device information
* IP addresses (can be anonymized)
* Approximate location based on browser timezone (client-side only, no external services)

**Data Storage:** All analytics data is stored locally in your WordPress database or file system. No data is sent to external analytics servers.

**External Services:** This plugin may make API calls to ip-api.com and ipwho.is for IP geolocation when CloudFlare headers are not available. ipwho.is is used as a secondary fallback when ip-api.com is rate-limited or unavailable. Only the visitor's IP address is sent to these services. See the "External Services" section above for complete details.

**Usage Tracking:** With your explicit consent (granted via the first-run welcome screen), this plugin sends anonymous usage statistics to api.optiuser.com once every 24 hours. The data includes: site URL, plugin version, WordPress version, PHP version, and the site administrator email address. This data is used solely to understand plugin adoption and improve the product. Tracking only begins after you click "Accept & Continue" on the welcome page shown at first activation. You may review our full data practices at https://optiuser.com/privacy-policy/

**No Third-Party Data Sharing:** Unlike cloud-based analytics tools, Opti-Behavior does not share, sell, or transfer your visitors' data to any third party. You are the sole data controller.

**User Rights:** You have full control over data retention and deletion. Users can request data deletion at any time.

When using this plugin, ensure your site's privacy policy discloses:
* What data is being collected
* How long it is retained
* Who has access to it
* How users can request deletion
* That data is stored locally and not shared with third parties

== Third-Party Libraries ==

This plugin bundles the following open-source libraries:

= Chart.js =
* Version: 4.4.0
* License: MIT License
* Homepage: https://www.chartjs.org/
* Used for: Rendering analytics charts and graphs

= Leaflet =
* Version: 1.9.4
* License: BSD 2-Clause License
* Homepage: https://leafletjs.com/
* Used for: Real-time visitor map visualization

= heatmap.js =
* Version: 2.0.5
* License: MIT License
* Homepage: https://www.patrick-wied.at/static/heatmapjs/
* Used for: Generating visual heatmaps of user interactions

= Lucide =
* Version: 0.554.0
* License: ISC License
* Homepage: https://lucide.dev/
* Used for: Icon library for the admin interface

All bundled libraries use GPL-compatible licenses (MIT, BSD 2-Clause, and ISC) and are included locally within the plugin. See THIRD-PARTY-LICENSES.txt in the plugin directory for full license texts.

== Credits ==

Developed by [OptiUser](https://optiuser.com/)
