The License page now has a persistent consent panel. If you installed before 5.1.0 you'll see an unticked consent checkbox \u2014 tick it to record explicit consent and re-enable the Re-provision button. Tracking is not interrupted.<\/p>","5.1.0":"
WordPress.org compliance release: explicit opt-in for provisioning, logs moved to uploads directory, stricter sanitization and unique prefixes. No tracking behavior change.<\/p>","5.0.4":"
Fixes a tracker init TypeError introduced by 5.0.3's orphaned method calls. Upgrading is required for tracking to function. Cache-buster bump.<\/p>","5.0.3":"
Privacy & security: removes third-party geo-IP fallbacks, adds CSRF protection on the encryption-key endpoint, prefixes the legacy Removes client-side event-limit enforcement; quota is now exclusively server-side. License page fix.<\/p>","5.0.0":" Major refactor:<\/strong> the plugin no longer requires a customer-hosted Cloudflare Worker. Events post directly to the managed ingestion endpoint. Old event queue tables are dropped on upgrade. Test thoroughly after upgrading.<\/p>"},"ratings":[],"assets_icons":{"icon-256x256.png":{"filename":"icon-256x256.png","revision":3592261,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3592261,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3592261,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["5.2.1","5.2.2","5.2.3","5.2.4","5.2.5","5.2.6","5.3.0","5.3.1","5.3.2","5.4.0","5.4.1","5.4.2","5.4.3"],"block_files":[],"assets_screenshots":[],"screenshots":[]},"plugin_section":[],"plugin_tags":[232,986,5926,550,286],"plugin_category":[36,45],"plugin_contributors":[269386],"plugin_business_model":[],"class_list":["post-305232","plugin","type-plugin","status-publish","hentry","plugin_tags-analytics","plugin_tags-conversion-tracking","plugin_tags-server-side","plugin_tags-tracking","plugin_tags-woocommerce","plugin_category-analytics","plugin_category-ecommerce","plugin_contributors-jachtdigital2026","plugin_committers-jachtdigital2026"],"banners":{"banner":"https:\/\/ps.w.org\/jacht-easy-server-side-tracking\/assets\/banner-772x250.png?rev=3592261","banner_2x":"https:\/\/ps.w.org\/jacht-easy-server-side-tracking\/assets\/banner-1544x500.png?rev=3592261","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/jacht-easy-server-side-tracking\/assets\/icon-256x256.png?rev=3592261","icon_2x":"https:\/\/ps.w.org\/jacht-easy-server-side-tracking\/assets\/icon-256x256.png?rev=3592261","generated":false},"screenshots":[],"raw_content":"\n Ad blockers and browser privacy settings block Google Analytics on a large share of your visits \u2014 commonly 30-50%.<\/strong> Those visitors still browse, still add to cart, and still buy. You just never see them. Your reports under-count traffic, your best-converting channels look worse than they are, and every decision you make from that data is made from an incomplete picture.<\/p>\n\n Easy Server Side Tracking closes that gap. Instead of the browser talking straight to What you get back<\/strong><\/p>\n\n We are a proxy, not a data broker.<\/strong> Your analytics data is forwarded to your own Google Analytics property and kept so you can look at it. It is not sold, not shared with third parties, not used to build profiles, and not combined across customers.<\/p>\n\n Stored per event: event name, page URL, referrer, user agent, country, consent state, anonymous client and session IDs, and a bot score.<\/p>\n\n Raw IP addresses are never stored.<\/strong> The IP is hashed with a salt that rotates every day and truncated, which is enough to rate-limit abuse and nothing more \u2014 the hash cannot be reversed, and the same visitor produces a different hash tomorrow.<\/p>\n\n Events are deleted automatically according to your plan's retention period.<\/p>\n\n A guided setup walks you through it: agree to what is shared and create your free account, enter your two Google Analytics credentials, tell us which cookie banner you use, and answer two questions so the right tracking settings are applied. Most sites are done in a few minutes.<\/p>\n\n The free tier is not a trial and does not expire. Paid plans raise the monthly event allowance and extend dashboard retention; they are bought on the dashboard and applied to your site automatically. No licence key is ever entered in WordPress, and no plugin feature is locked, disabled or degraded on the free tier.<\/strong><\/p>\n\n This plugin connects to the following external services. Each is necessary for the functionality described and is only contacted as documented below.<\/p>\n\n This plugin does not collect or store personal data on the WordPress site itself. All event data is sent to the external services listed above and stored there subject to those services' privacy policies.<\/p>\n\n The plugin stores the following non-personal data in WordPress options for its own operation:<\/p>\n\n No cookies are set by the plugin itself; the in-browser tracker uses a first-party cookie named To check data is arriving, open Realtime<\/strong> in Google Analytics and load a page on your site.<\/p>\n\n\n Plans are managed entirely on the dashboard \u2014 you never enter a license key in WordPress. Buy or change a plan at https:\/\/dashboard.easyserversidetracking.com\/, then on Account \u2192 Websites<\/strong> use the Plan<\/strong> dropdown next to a site to assign it the plan (or switch it back to the Default<\/strong> free plan). The new monthly limit is applied to the tracking service automatically; no change is needed in WordPress.<\/p><\/dd>\n You do not need to sign up anywhere first. During setup you press Create free account<\/strong> and the plugin provisions your site for you \u2014 that click is the only moment anything is sent. The free tier is fully functional and does not expire. A paid plan at https:\/\/dashboard.easyserversidetracking.com\/ raises your monthly event allowance and dashboard retention.<\/p><\/dd>\n It can run alongside Each event includes: event name, page URL, page title, referrer, anonymized client ID and session ID, consent state, and event-specific parameters (e.g. WooCommerce order IDs, scroll percentages, click targets). The visitor's IP address is processed by the worker for geo-resolution and rate limiting but is not stored long-term. No personally identifiable information (name, email, address) is sent unless you explicitly configure user-data fields.<\/p><\/dd>\n After activation the License page shows your Yes. Deactivating the plugin stops event collection. The plugin's options can be deleted via the standard WordPress plugin uninstall flow.<\/p><\/dd>\n\n<\/dl>\n\n\nevent_count<\/code> option, and documents external services. No tracking behavior change. Migration runs automatically on next admin pageload.<\/p>","5.0.2":"google-analytics.com<\/code> \u2014 the request blockers are built to recognise \u2014 events go to a tracking endpoint that isn't on any blocklist, and are forwarded to Google Analytics 4 from there.<\/p>\n\n\n
How it works<\/h4>\n\n
\n
collect.easyserversidetracking.com<\/code> over HTTPS, signed with a short-lived token so only your site can send as your site.<\/li>\nWhat we do and do not store<\/h4>\n\n
Privacy and consent<\/h4>\n\n
\n
What you need<\/h4>\n\n
\n
Setup<\/h4>\n\n
Features<\/h4>\n\n
\n
view_item<\/code>, add_to_cart<\/code>, begin_checkout<\/code>, shipping and payment steps, and purchase<\/code><\/li>\nPricing<\/h4>\n\n
External services<\/h3>\n\n
collect.easyserversidetracking.com (managed ingestion worker)<\/h4>\n\n
\n
dashboard.easyserversidetracking.com (management & provisioning server)<\/h4>\n\n
\n
Google Analytics 4 (Measurement Protocol)<\/h4>\n\n
\n
https:\/\/www.google-analytics.com\/g\/collect<\/code> or https:\/\/www.google-analytics.com\/mp\/collect<\/code>.<\/li>\ngoogletagmanager.com (gtag.js)<\/h4>\n\n
\n
gtag.js<\/code> library to the visitor's browser for client-side GA4 measurement.<\/li>\ngtag.js<\/code> telemetry while the script is loaded (page views, automatic events). Its measurement requests are routed through your own site rather than straight to Google.<\/li>\ngtag.js<\/code> provides the GA4 session and engagement signals the plugin cannot reproduce on its own.<\/li>\nPrivacy<\/h3>\n\n
\n
esst_site_id<\/code> \u2014 the site identifier returned by the management server.<\/li>\nesst_signing_secret<\/code> \u2014 the HMAC signing secret for the managed ingestion endpoint (encrypted at rest).<\/li>\nesst_collect_url<\/code>, esst_plan_summary<\/code> \u2014 operational state from the management server (collect endpoint URL and the plan name shown in the admin).<\/li>\njachtsst_user_opt_in_at<\/code>, jachtsst_user_opt_in_by<\/code>, jachtsst_user_opt_in_text<\/code> \u2014 the record of who agreed to the data sharing, when, and the exact wording they agreed to. This is kept so the consent can be evidenced later, and includes the WordPress user ID of the administrator who ticked the box. It is never sent anywhere.<\/li>\njachtsst_setup_completed_at<\/code>, jachtsst_cmp_choice<\/code> \u2014 setup progress, so the guided setup does not reappear.<\/li>\n<\/ul>\n\n_ga<\/code> (the standard GA4 client identifier) when present.<\/p>\n\n\n\n
\/wp-content\/plugins\/<\/code>.<\/li>\n\n
How do I set up and connect my site?<\/h3><\/dt>\n
\n
How do I upgrade, or change a site's plan?<\/h3><\/dt>\n
Do I need an account?<\/h3><\/dt>\n
Does this replace gtag.js?<\/h3><\/dt>\n
gtag.js<\/code> (hybrid mode), or you can rely entirely on the server-side path. The script is loaded from googletagmanager.com<\/code> only when hybrid mode is enabled in the Settings screen.<\/p><\/dd>\nWhat data is sent to the managed worker?<\/h3><\/dt>\n
Where can I see my events?<\/h3><\/dt>\n
site_id<\/code> and a link to the management dashboard, where you can view your live event log, monthly usage, and configure plan options.<\/p><\/dd>\nCan I uninstall cleanly?<\/h3><\/dt>\n
5.4.3<\/h4>\n\n
\n
5.4.2<\/h4>\n\n
\n
5.4.1<\/h4>\n\n
\n
5.4.0<\/h4>\n\n
\n
5.3.2<\/h4>\n\n
\n
5.3.1<\/h4>\n\n
\n
5.3.0<\/h4>\n\n
\n
5.2.6<\/h4>\n\n
\n
function fetch(){\u2026}<\/code> (e.g. the common admin-ajax \"data_fetch\" live-search snippet), which overwrites the browser's native window.fetch. The tracker now detects a shadowed fetch and recovers a pristine native fetch (via a hidden same-origin iframe) so events send normally. Init marker advanced to \"v5\".<\/li>\n<\/ul>\n\n5.2.5<\/h4>\n\n
\n
5.2.4<\/h4>\n\n
\n
5.2.3<\/h4>\n\n
\n
5.2.2<\/h4>\n\n
\n
5.2.1<\/h4>\n\n
\n
5.2.0<\/h4>\n\n
\n
5.1.7<\/h4>\n\n
\n
wp_head<\/code> outputs (the googletagmanager preconnect hint and the early gtag consent script) were still gated on the provisioning id alone, so they could fire on grandfathered or consent-withdrawn sites. Both now require explicit consent AND provisioning, matching the tracker.<\/li>\n5.1.6<\/h4>\n\n
\n
5.1.5<\/h4>\n\n
\n
WPINC<\/code>, which silently aborted the suite) and added coverage for the consent mapping.<\/li>\n<\/ul>\n\n5.1.4<\/h4>\n\n
\n
\/g\/collect<\/code> proxy. The mere presence of a provisioning id (esst_site_id<\/code>, which can survive an upgrade) no longer enables anything. Legacy installs with a provisioning id but no consent record now stay OFF and show a notice prompting the admin to review and enable. Withdrawing consent fully stops tracking.<\/li>\ngcs<\/code> signal, defaulting to denied) instead of a hardcoded \"granted\" value.<\/li>\n$_GET<\/code> WooCommerce variation attributes are now unslashed, sanitized (sanitize_key<\/code> \/ sanitize_text_field<\/code>) and validated before being passed to WooCommerce's variation matcher.<\/li>\n<\/ul>\n\n