ElementTest Pro 2.5.15

Full Changelog: v2.5.14...v2.5.15

ElementTest Pro 2.5.14

Full Changelog: v2.5.13...v2.5.14

ElementTest Pro 2.5.13

Full Changelog: v2.5.12...v2.5.13

ElementTest Pro 2.5.12

Full Changelog: v2.5.10...v2.5.12

ElementTest Pro 2.5.10

ElementTest Pro 2.5.10

WordPress.org Plugin Check (PCP) warning cleanup — resolves all 259 warnings from the 2026-07-09 scan, so the plugin now passes Plugin Check with zero errors and zero warnings.

Code fixes

• Removed the discouraged load_plugin_textdomain() call; WordPress 4.6+ loads translations automatically for wp.org-hosted plugins.
• Reordered $_POST['page_url'] sanitization in the conversion-tracking and variant-assignment AJAX handlers so esc_url_raw() directly wraps the unslashed input.
• Prefixed the file-scope globals in uninstall.php ($elementtest_site_ids / $elementtest_site_id).

Documented false positives (justified phpcs annotations)

• Cross-function nonce verification in the AJAX handler (~110 warnings) — every handler verifies via verify_admin_request() / verify_public_request() as its first statement.
• Per-field unslash/sanitize loops for $_POST['variants'] / $_POST['goals'].
• WP_DEBUG-gated error_log() calls.
• Function-scoped variables in the includes/views/ templates (~127 warnings).

Internal

• JS VERSION constant in assets/js/frontend.js synced to 2.5.10.

Verification

• php -l passes on all edited files.
• PHPCS (WPCS 3.x) with the exact sniff set from the Plugin Check report shows zero issues.

ElementTest Pro 2.5.9

ElementTest Pro 2.5.9

WordPress.org Plugin Check compliance release — the plugin now passes Plugin Check with zero errors (verified with Plugin Check 1.6.0 against the distribution tree).

Compliance

• Chart.js bundled locally. Exported HTML reports no longer load Chart.js from the jsdelivr CDN; the library (v4.5.1) ships at assets/vendor/chart.umd.min.js and is inlined into exported reports so they remain self-contained and work offline.
• Dev-only artifacts removed from distribution. Standalone CLI test scripts and shell scripts are no longer shipped in the distributed plugin.
• Table names inlined for the Plugin Check SQL sniff. SQL now interpolates {$wpdb->prefix}elementtest_* directly (values were already parameterized via $wpdb->prepare(); no behavior change). Remaining direct-query warnings carry documented phpcs justifications — the plugin's custom tables have no WP API equivalent.
• i18n and packaging fixes. Added a missing translators comment, created the languages/ folder declared by the Domain Path header, and corrected the readme Stable tag.

Compatibility

• Tested up to WordPress 7.0.

Install by uploading elementtest-pro-2.5.9.zip via Plugins → Add New → Upload Plugin, or sync from this repository.

ElementTest Pro 2.5.8

ElementTest Pro 2.5.8

Security

• proxy_page() now uses preg_replace_callback instead of preg_replace when injecting the <base> tag, preventing a same-origin URL containing $1 from being misinterpreted as a regex backreference and corrupting proxied HTML output.
• Database error logging on insert failures (test, goal, conversion) is now gated behind WP_DEBUG so production sites do not write full SQL error text to the PHP error log by default.

Also included since 2.5.6 (if upgrading from an older public release)

• 2.5.7: Assignment proof cookie lifetime matches sticky assignment window; stable public variant assignment before first impression; User-Agent rotation can no longer resample variant assignments.
• 2.5.6: Public tracking writes require server-minted signed assignment proof cookies.

Install by uploading elementtest-pro-2.5.8.zip via Plugins → Add New → Upload Plugin, or sync from this repository.

v2.5.6

Security fix for unauthenticated public tracking forgery (PRs #56 and #57, closes #54).

• Fix: Public tracking writes require signed assignment proof. The public tracking endpoints accept guest traffic, and the public nonce plus test/variant metadata are visible on any page with running tests. An unauthenticated client could harvest those IDs and POST directly to elementtest_track_impression or elementtest_track_conversion, forging analytics and (for custom-event goals) supplying arbitrary dynamic revenue within the clamp. Fix: elementtest_get_variant_assignment is now the server-authoritative assignment gate — it validates page scope, chooses the variant server-side, and sets a signed HttpOnly elementtest_assignment_<test_id> cookie bound to test_id, variant_id, server-derived visitor hash, and expiry. Impression and conversion writes must present that proof cookie for the same visitor/test/variant tuple before inserting events. Public custom-event conversions default to the DB-stored goal revenue; sites that knowingly accept dynamic client revenue must opt in with elementtest_allow_public_custom_event_revenue. Frontend test processing requests assignment before applying variants, recording impressions, or registering conversion listeners. Conversion-only pageview goals depend on the proof cookie created when the visitor saw the source test page; old sessions without proof may need one fresh source-page visit before cross-page conversions count.

v2.5.3

Admin tests-list readability pass.

• Improvement: The Confidence column on the tests list now shows each test's real statistical confidence instead of always reading 0.0%. It's computed with the same significance test the test detail view and exports use, so the list matches what you see when you open the test (a test the detail view calls a 95% winner now reads 95% in the list too). Tests without enough data yet — any non-control variant needs at least 30 impressions — still show 0.0%.
• Change: Removed the Conversion Rate column from the tests list. A conversion rate shown without its control baseline isn't actionable at a glance; the Confidence column is the signal that tells you whether a test has a result worth opening. Per-variant conversion rates are still shown on the test detail view and in the HTML/CSV exports.

Internal: JS VERSION constant synced to 2.5.3.

v2.5.2

v2.5.2 — conversion page-scope correctness (2026-06-01)

Two silent data-integrity fixes for conversion page-scope matching (PRs #49 and #50), merged to main after 2.5.1. One bug dropped real conversions; the other invented false ones. Neither surfaced a user-facing error. No schema changes, no migrations. Plugin constant ELEMENTTEST_VERSION is now 2.5.2 (JS VERSION synced to match).

Fixes

• Conversion tracking on bare vs www. host variants (PR #49). Non-pageview conversions (click, form submit, custom event, add-to-cart) were silently dropped when a test's configured page URL used one host form (e.g. example.com) but the visitor was served the same page on the other (www.example.com), or vice versa. The frontend activates tests by path only, so those visitors saw variants and recorded impressions, but the conversion AJAX failed the server-side page-scope check and lost the conversion with no error. Fix: canonicalize a leading www. in normalize_conversion_url() before the host/port/path comparison so the conversion-write check matches the host-agnostic, path-based frontend delivery. Different paths and unrelated domains still fail the check.

• Cached cross-page pageview conversion over-counting (PR #50). A full-page cache keyed only by path could serve HTML generated for a query-string-specific cross-page pageview goal (e.g. /checkout/order-received/?key=wc_order_*) to a later visitor on the same path with a different query string. The browser trusted the server-baked goal payload and recorded the conversion directly, producing a false conversion (and, when GA4 forwarding was enabled, a false elementtest_converted event) and corrupting A/B data on cached checkout/thank-you flows. Fix: cross-page conversion-only pageview goals now re-validate the live browser URL with the same matcher normal pageview goals use before recording. Triggers containing ? or # still require an exact URL match.

• Client-side pageview path matching now mirrors the server (PR #50). A new path-normalization step lowercases and trims trailing slashes from both the current path and the trigger before comparison, so the cached-safe client re-check never rejects a conversion the server already approved over a trailing-slash or letter-case difference.

• Internal: JS VERSION constant in assets/js/frontend.js synced to 2.5.2 (per the 2.3.9 sync convention).

See CHANGELOG.md for the full technical changelog.

Install

Download elementtest-pro-2.5.2.zip from Assets below. Unzip so WordPress has a top-level elementtest-pro/ folder under wp-content/plugins/, then activate ElementTest Pro.