1.6.1 — telemetry pings sign.redolive.com

Fleet telemetry check-ins now go to Red Olive's public intake at sign.redolive.com. Same payload, same once-a-day cadence, same opt-outs (ROCOO_DISABLE_TELEMETRY / rocoo_telemetry_enabled).

1.6.0 — fleet telemetry (install inventory)

Adds a daily, non-blocking check-in to Red Olive's install inventory so fleet-wide issues (like the 1.5.9 WP Rocket fix) can be scoped and communicated immediately.

What's sent, once per day (plus once right after an update): site URL, plugin/WP/PHP versions, multisite flag, which page-optimizer plugins are active (WP Rocket, LiteSpeed, W3TC, Autoptimize, SG Optimizer, WP-Optimize, Breeze, FlyingPress), and this plugin's settings flags. No visitor data is ever sent.

Opt out: define( 'ROCOO_DISABLE_TELEMETRY', true ); or the rocoo_telemetry_enabled filter.

The ping fires on shutdown as a non-blocking request with a 2-second timeout — it can never delay page output, and a down endpoint fails silently.

1.5.9 — WP Rocket consent fix (GTM/GA4 outage)

Critical fix for sites running WP Rocket (or LiteSpeed / Cloudflare Rocket Loader).

On WP Rocket-cached pages, "Delay JavaScript execution" rewrote the scripts inside the plugin's gated templates and deferred the Consent Mode head block, with two consequences: gated GTM/Meta/GA4 scripts never executed after the visitor accepted (Tag Assistant: "No Google tags found"), and returning visitors' Google hits were sent with consent denied (gcs=G100), so GA4 reported almost no data.

Fixes

• Script activation now undoes optimizer rewrites (promotes data-rocket-src/data-src to src, resets non-JS type) before injecting gated scripts.
• The Consent Mode update is always pushed as a real arguments object — Google ignores plain-array dataLayer pushes.
• The Consent Mode head block, banner.js, and the WhatConverts loader are marked nowprocket data-no-optimize data-cfasync so page optimizers never defer them.

After updating: purge the site's page cache (WP Rocket + any server cache such as Varnish) so cached HTML regenerates, then verify in a private window on the bare URL: accept cookies and confirm /g/collect requests carry gcs=G111.

QA-trap reminder: WP Rocket serves no cache to logged-in users and query-string URLs bypass it — always test logged-out on the bare URL.

1.5.8

Removed the redundant 'Gate WhatConverts under:' dropdown — WhatConverts is now always gated under Marketing (the correct category for lead/PII attribution). Also made the Geo-aware mode copy honest: it requires a host/CDN country header (e.g. Cloudflare) and does nothing without one (every visitor is opt-in), so the misleading '(recommended)' is gone. Via the auto-update pipeline.

1.5.7

Setup polish: the Setup status panel is now a collapsible accordion (badge stays visible; click to expand) so it isn't always occupying the right column. In the WhatConverts box, the gated-load label is bolded and its follow-up note is small italics. Delivered via the GitHub auto-update pipeline.

1.5.6

Admin polish: the WhatConverts settings are now grouped in a branded, bordered box with the WhatConverts logo on the Setup tab — Profile ID, gating, and the "Load before consent (essential)" option read as one distinct section. Delivered via the GitHub auto-update pipeline.

1.5.5

WhatConverts "Load before consent (essential)" option.

For sites with a CRM/HubSpot routine that depends on WhatConverts' first-party wc_* cookies: a new setting loads WhatConverts ungated (before consent) for every visitor, so wc_visitor/wc_client/etc. are set immediately. Everything else — Meta Pixel, Google Ads, GA4, GTM, custom scripts — stays fully gated. The Setup status panel flags the pre-consent firing as a reminder to disclose it in your privacy policy.

Delivered via the GitHub auto-update pipeline.

1.5.4

First-run disclaimer gate + deployment readiness checks.

• First-run gate: the use & liability disclaimer now renders as a content-area modal that blocks the settings UI until accepted. Enforced server-side (the tabs/form aren't rendered until it's accepted), so it can't be skipped. Reuses the existing acceptance record, so sites that already accepted are not asked again.
• Deployment readiness checks in Setup status, detected from the site's active plugins: warns when another plugin injects tags outside this plugin's gate (Site Kit, GTM4WP, MonsterInsights/ExactMetrics, PixelYourSite, Header Footer Code Manager, WPCode); flags full-page caching that can freeze the US-vs-EU/GPC decision on Basic/Balanced (Maximum is cache-safe); and reminds you to exclude banner.js from JS-delay optimizers (WP Rocket, LiteSpeed, Perfmatters).

Delivered via the GitHub auto-update pipeline.

1.5.3

Adds a use & liability disclaimer at the top of Setup, with a one-time recorded acceptance (who/when/version) surfaced in the status panel. Replaces the narrower per-tier risk checkbox.

1.5.2

Setup tab: protection levels stay side-by-side (3-column grid); removed the redundant intro; corrected the tracking-data note to accurately describe each level (Basic/Balanced track US visitors who ignore the banner).