=== Hostious.io - Pixel your Site Pro ===
Contributors: hostious
Tags: meta pixel, conversion api, google analytics 4, cookie consent, product feed
Requires at least: 6.5
Tested up to: 7.1
Requires PHP: 8.1
Stable tag: 1.4.9
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Tracking, consent, feeds and sales tools for WordPress and WooCommerce – in one plugin, with one menu.

== Description ==

Fourteen modules in four groups. Switch on what the site needs; modules that are off are not loaded.

**Tracking**
* Tracking & pixels – Meta Pixel + Conversion API, Google Analytics 4, Google Ads, Google Tag Manager, TikTok, OpenAI; automatic and custom events; WooCommerce and EDD; reports.
* Pinterest tag, Microsoft Ads (UET), Super Pack (multiple pixels, dynamic parameters …).
* Offline conversions – export orders and leads to Google Ads.

**Consent**
* Cookie consent – banner, script blocking, Google Consent Mode v2, IAB TCF, geolocation, proof of consent.

**Feeds & sharing**
* Product feeds (WooCommerce), EDD product feeds, content feed for Meta dynamic ads, OpenGraph.

**Sales & growth**
* Cost of goods & profit, smart prices, social proof notifications, social login.

= Built on top =

* Get started – one page for pixel IDs, access tokens, consent and the product feed.
* Tracking check – finds what is missing or doubled (Conversions API, Consent Mode, GTM + GA4, other tracking plugins, untracked orders, stale feeds) and sends test events to Meta and GA4.
* Weekly e-mail report and feed monitoring.
* Export and import of all module settings.
* Search and filter events from live search and product filters.
* FlyingPress integration.
* WP-CLI: `wp hostious-pixel modules|check|export|import|report|feeds`.

= Replaces the separate plugins =

On activation the plugin deactivates the separate plugins it contains and takes over their settings, tables and feeds unchanged. The old plugins can then be deleted.

= Updates =

Updates are delivered from hostious.io through the normal WordPress update screens.

== Changelog ==

= 1.4.9 – 2026-10-22 =
* Fixed: search events (Search and SearchNoResults) are also sent with Hostious AJAX Search 3.2.0, which uses new class names in the search field and suggestions. Earlier versions of the search plugin are still supported.

= 1.4.8 – 2026-10-22 =
* Changed: the plugin no longer starts a PHP session on page views. The session sent a PHPSESSID cookie and "Cache-Control: no-store" to every visitor, which kept page caches from storing pages. Landing page, traffic source and UTM data now come from the plugin's own cookies, which were already used as a fallback.
* Security: the Social Connect module's admin actions (sales graph, settings, design preview, provider check, logs, reset to defaults) are no longer open to visitors who are not logged in and now require an administrator.
* Security: capability checks added to the admin actions of the product feeds, content feed, EDD feed, social proof, cookie consent and offline conversion modules.
* Security: variation data for tracking is only returned for published products.
* Updated libraries: Select2 4.0.13, Bootstrap 4.6.2 and jQuery 3.7.1 on the plugin's admin pages; jQuery UI 1.13.3 and DataTables 1.10.25 in the cookie consent module. The older versions had known security fixes.
* PHP 8.5: removed deprecated curl_close() calls, a "case …;" statement, the $http_response_header variable and implicitly nullable parameters in bundled libraries; replaced utf8_decode().
* Removed: leftover license activation code, an upgrade prompt, and an eval() and a create_function() call in the content feed module.
* Requires PHP 8.1 or newer.

= 1.4.7 – 2026-10-19 =
* Fixed: if the report tables were missing (an older install could record the database version without creating them), the plugin tried to add indexes to a table that did not exist on every page view and filled the PHP error log. The tables are now created when missing.
* Fixed: product feeds created before the Google category and price filter settings existed logged thousands of "undefined array key" warnings per run.
* Fixed: the cookie scanner ran an invalid SQL query when no scan had been made yet.
* Fixed: restoring the default banner texts no longer logs "duplicate entry" database errors.
* Fixed: two simultaneous requests upgrading the events queue table could log a "duplicate column" error.
* New: catalog feeds only send valid GTINs, never use the product ID as MPN, and swap AVIF images for WebP/JPEG/PNG (Meta and Google do not accept AVIF). This was previously a separate file on each site.

= 1.4.6 – 2026-10-13 =
* Changed: the OpenAI (ChatGPT ads) "no JavaScript" image tag is no longer printed. OpenAI rejects it when it is fetched without a Referer, so SEO crawlers such as Ahrefs reported it as a broken image on every page. The OpenAI JavaScript pixel and Conversions API work as before. Developers can bring the tag back with the hpys_openai_noscript filter.

= 1.4.5 – 2026-10-11 =
* Fixed: with a delayed tracking script, the consent banner's first pass could ask an add-on pixel (e.g. Pinterest) to load before the main script was ready, which logged a "consentGiven" error. Pixels are now only switched on once the main script is ready.

= 1.4.4 – 2026-10-11 =
* Improved: the consent banner again switches pixels that are already on the page off straight away, as before 1.4.3, and runs once more when a delayed tracking script becomes ready. No more error when the tracking script loads late.

= 1.4.3 – 2026-10-11 =
* Fixed: when the tracking script is set to load only after the visitor's first interaction (e.g. FlyingPress "delay selected scripts"), the consent banner tried to switch the pixels on before the script was there, stopped with an error, and no pixels fired even after consent. It now waits for the tracking script.
* Fixed: on sites with a Content Security Policy, the small inline line that tells the tracking script where the Vimeo helper lives could be turned into a blocked "data:" script by FlyingPress' "delay selected scripts" setting. The line is now left inline, where the policy allows it.

= 1.4.2 – 2026-10-11 =
* Fixed: product feeds could stop updating for good when WordPress failed to save its list of scheduled jobs, or when a replaced stand-alone feed plugin was deactivated (both remove the feeds' shared update job). The plugin now checks the job and the feed timetable and puts them back automatically.

= 1.4.1 – 2026-10-11 =
* Fixed: returning visitors with an old consent cookie from an earlier setup (set for the whole domain, e.g. ".example.com") were asked for consent again on every page. The old cookie is now removed the first time they choose, and the choice is kept.
* Fixed: on phones, a chat button or other fixed button could sit on top of "Accept all" in the cookie banner. The banner is now on top while a choice is needed.

= 1.4.0 – 2026-10-09 =
* New: modern cookie banner layout (Settings › Cookie consent › Banner layout). Compact card without empty space, "Reject all" and "Accept all" side by side in the same size, "Customise" as a quiet button, bottom sheet on phones, and a tidier "Customise" dialog. Colours and texts are kept from the banner design; "Classic" keeps the old look.
* Fixed: Microsoft Ads (Bing), Pinterest and Reddit no longer show "paid add-on" notices – they link to switching the module on instead.
* Fixed: the remaining English texts in the Danish admin (Conversions API notice, event descriptions, cost of goods, consent lists) and video links to the original vendor.
* Fixed: module activation on a fresh install could run twice at the same time and leave a missing log table or duplicate consent texts.

= 1.3.0 – 2026-10-08 =
* Speed: the compact build of the tracking script is used (157 KB instead of 450 KB). Sites that update are switched over once.
* Speed: Vimeo's player API is only loaded on pages with a Vimeo video, instead of on every page.
* Speed: the consent banner loads a script without the IAB TCF libraries (113 KB instead of 190 KB) unless an IAB rule is switched on.
* Speed: the tracking data in each page is packed – the same page details are no longer repeated for every event and pixel.
* Speed: smaller helper script for hashing (21 KB → 9 KB).
* Smaller plugin: fonts trimmed to the characters Danish and other Latin languages use, unused font copies removed, and the consent banner's Arial/Times/Verdana stylesheets no longer embed 850 KB of fonts that every computer already has.

= 1.2.2 – 2026-10-08 =
* Changed: Tracking and Consent now have one simple navigation row with the everyday screens and a "More" menu for the rest. It replaces the module switcher, the page row, the modules' own tab rows and the side menu.

= 1.2.1 – 2026-10-08 =
* New: "View details" on the Plugins screen shows the description and the full changelog, also when no update is waiting.

= 1.2.0 – 2026-10-08 =
* New: every module screen has the Hostious design – the same cards, buttons, switches, tabs, tables and save bar as the plugin's own pages, without welcome banners, logos, video and upsell boxes.
* New: full Danish translation of all modules, and a DA | EN switch in the top bar (saved per user).
* New: the Inter typeface is bundled, so the screens look the same on every computer.
* Removed: AMP support (Super Pack).
* Fixed: an imported consent setup kept pointing to the design template and cookie categories of the old site.
* Fixed: WP-CLI commands no longer build the visitor consent banner (warnings in the command output).

= 1.1.2 – 2026-10-08 =
* New: consent can run in three modes – ask for consent, accept all and show the banner as information (optionally closing when the visitor scrolls), or accept all without a banner. The two accept-all modes are marked as not GDPR compliant.
* Changed: settings changes, module switches and saves on the tracking screens now clear the page cache once per request instead of once per change.
* Fixed: switching on Offline conversions could log database errors until its tables were created.

= 1.1.1 – 2026-10-08 =
* New: "Accept all cookies without asking" under Settings and Get started. The consent banner is not shown, nothing is blocked and tracking runs as if every visitor had accepted. Clearly marked as not GDPR compliant, with a warning on the tracking and consent screens and in the tracking check.

= 1.1.0 – 2026-10-08 =
* New: Get started – pixel IDs, access tokens, consent link, Google Consent Mode and product feed on one page, with format checks.
* New: Tracking check with a score on the overview – Conversions API, Measurement Protocol, consent, Consent Mode, double tracking, other tracking plugins, share of orders tracked and feed status, each with a direct link to fix it.
* New: live tests – send a test event to Meta Events Manager and validate GA4 purchases against Google.
* New: weekly e-mail report – orders and tracked share, consent answers, feeds and open issues.
* New: feed monitoring – one e-mail when a product feed fails or stops updating.
* New: export and import of the settings of every module, incl. consent banners and rules; addresses are moved to the new site, and access tokens only travel when asked for.
* New: search and filter events – picked live-search suggestions (Search), searches without results (SearchNoResults) and product filter use (FilterProducts) to Meta, GA4, TikTok, Pinterest, Microsoft Ads and GTM.
* New: FlyingPress integration – tracking and the consent banner are excluded from "Delay JavaScript", and the page cache is cleared when their settings change.
* New: WP-CLI commands `wp hostious-pixel modules list|on|off`, `check`, `export`, `import`, `report` and `feeds`. Activating a contained plugin with `wp plugin activate` is blocked with an explanation.
* Speed: the offline conversions settings are read with one query instead of three per request; the consent banner no longer loads Google Fonts; social login no longer loads Google Fonts; the multi-pixel add-on only loads its admin scripts where they are used; the tracking screens load jQuery and icons from the plugin instead of external CDNs.
* Changed: GeoIP database, consent exports, IAB vendor list and logs are stored in uploads/hostious-pixel instead of inside the plugin folder, so they survive updates. Existing GeoIP databases are moved automatically.
* Fixed: consent statistics were not saved on databases in strict mode.
* Danish translation of all new screens.

= 1.0.0 – 2026-10-08 =
* First release: fourteen modules in one plugin with one admin menu, an overview with module switches and a shared navigation bar.
* No license keys, license checks or license reminders.
* Quiet takeover of the separate plugins with all data kept; activating them again is blocked with an explanation.
* Updates from hostious.io.
* Danish translation of the plugin's own screens.
* Fixed: social login caused a fatal error on every page on sites without HTTPS.
* Fixed: the product feed database migration could stop the site with a fatal error when it ran outside activation.
* Fixed: content feed script error on post edit screens.
* Security: smart prices settings could be changed by any logged-in user; OpenGraph settings were saved without a security check; two modules let any visitor switch debug output on through the URL.
* Speed: cookie consent no longer runs its install checks on every page view (18 fewer database queries per page); offline conversions no longer checks its table on every request; cost of goods no longer contacts a license server on every request; several modules only load their admin scripts on their own screens; the unused part of the bundled Facebook SDK is removed.
