1.2.0

1.2.0

Fixed

• endpoint.php – Architectural cleanup (critical): Removed a leftover SHORTINIT / wp-load.php bootstrap block that was a remnant of the old direct-file architecture. Since tracking now runs exclusively through the WordPress REST API, WordPress is already fully loaded when the handler is invoked — manually re-loading it caused potential $wpdb conflicts and unpredictable behaviour on some server configurations.
• endpoint.php – CORS origin check now supports subdomains: The previous check compared the full HTTP_ORIGIN host against $_SERVER['HTTP_HOST'] directly, which caused legitimate tracking requests from subdomains (e.g. ai.vtubes.tokyo) to be rejected with a 403 Forbidden response. The check now compares the two trailing domain segments (base domain) of both origin and host, so all subdomains of the same root domain are correctly allowed.
• endpoint.php – Input now read via WP REST API: User input is now retrieved cleanly through $request->get_param() instead of accessing $_POST directly, which is the correct and secure pattern for WordPress REST API handlers.
• endpoint.php – DNT / opt-out check added at handler level: Do Not Track and the bunseki_dnt cookie are now respected directly inside the REST handler as an additional server-side safeguard, independent of the JavaScript check.
• b-core.js – Endpoint scope bug fixed: The endpoint variable was referenced inside the bunseki.track() closure before it was assigned a value. Although JavaScript var hoisting prevented a hard error, the value was undefined at definition time and relied on implicit closure behaviour. Replaced with a dedicated getEndpoint() helper that reads window.bunsekiAjax.rest_url at call time, making the behaviour explicit and reliable.
• b-core.js – Heartbeat interval increased from 10 s to 30 s: The session duration heartbeat was firing every 10 seconds, generating a continuous stream of UPDATE queries against the database. On sites with many concurrent visitors this produced significant unnecessary write load. Increased to 30 seconds — duration accuracy is unaffected for practical purposes.
• b-core.js – DoNotTrack check centralised: The DNT and opt-out cookie check was previously duplicated in multiple places throughout the script. Consolidated into a single early-exit check at the top of the load handler and a shared guard inside bunseki.track().
• bunseki-analytic.php – Bot detection called only once per request: Bunseki_Helper::detect_bot() was previously invoked twice per request — once in bunseki_firewall_check() at plugins_loaded and again in bunseki_live_bot_tracker() at shutdown. Refactored into a shared bunseki_insert_bot_hit() function that both hooks call, ensuring the User-Agent string is parsed only once.
• bunseki-analytic.php – Blocked bots now appear in bot statistics: Bots that were blocked by the firewall (die()) never reached the shutdown hook and were therefore never recorded in the bunseki_bots table, making them invisible in the dashboard. bunseki_insert_bot_hit() is now called before the die() so blocked bots are correctly tracked.
• common.php – Retention period comment corrected: The inline comment on the garbage collection function still read "30 days" while the actual value had been updated to 3650 days (10 years). Comment updated to match the real behaviour.
• install.php – Deactivation hook now removes all three cron jobs: The deactivation hook previously only unscheduled bunseki_daily_cleanup_event. The weekly email report event (bunseki_weekly_email_event) and the auto-import event (bunseki_auto_import_event) were left behind as orphaned cron entries. All three are now cleared on deactivation.
• cli.php – AVIF and JPEG XL extensions added to static asset ignore list: The log parser's static file filter did not include .avif and .jxl extensions. These are now excluded alongside existing image formats, consistent with the output formats produced by the Henkan image conversion plugin.

Changed

• Plugin version bumped to 1.2.0.
• Plugin header updated: Tested up to: 7.0, Requires PHP: 8.3.

1.1.2

🚀 Release v1.1.2: Privacy, Security & Standards Update

This update addresses strict privacy requirements and refines core security standards based on the latest automated WordPress Plugin Check (PCP) reports.

🔒 Privacy & GDPR Compliance (Local Assets)

• Removed External CDN Dependencies: Removed the external request to jsdelivr.net to prevent third-party tracking and comply with strict data privacy guidelines (fixing EnqueuedResourceOffloading).
• Bundled Chart.js: The Chart.js library is now securely bundled and loaded locally from the plugin directory (js/chart.min.js).

🛡️ Security Enhancements

• Strict URL Escaping: Refactored dynamic admin links (e.g., CSV export, page refreshes) to use proper esc_url( admin_url(...) ) wrappers, ensuring robust protection against injection vulnerabilities.
• Hardened File Access: Adjusted the execution order of if ( ! defined( 'ABSPATH' ) ) exit; to guarantee it is the absolute first executable line in all PHP files, completely eliminating any edge cases for direct file access.

🛠 Asset Management

• Clean Script Registration: Converted legacy hardcoded <script> tags for Chart.js into native wp_enqueue_script() calls hooked to admin_enqueue_scripts.

1.1.1

🚀 Release v1.1.0: Security, Architecture & Standards Update

This update introduces a major architectural refactoring of the tracking endpoint and ensures strict compliance with WordPress core coding standards and security guidelines.

🛡️ Security & Core Architecture

• REST API Migration: Completely rebuilt the tracking infrastructure. The standalone endpoint.php has been removed and replaced with a secure, native WordPress REST API controller (/wp-json/bunseki/v1/track).
• Direct File Access Prevention: Added strict if ( ! defined( 'ABSPATH' ) ) exit; guards to all executable PHP files.
• Dynamic Beacon Routing: Refactored b-core.js to dynamically route navigator.sendBeacon requests to the new REST API endpoint using wp_localize_script().

🛠 Asset Management & Code Quality

• Clean Enqueuing: Completely removed legacy hardcoded <link> and <style> tags from the admin UI.
• Standardized Hooks: All admin CSS (admin.css) and tracker JS are now strictly loaded via the native wp_enqueue_style and wp_enqueue_script hooks for maximum compatibility with performance plugins.

🎨 UI & Workspace Adjustments

• Polite Menu Placement: Adjusted the admin dashboard menu position from priority 2 to 80 (below the Settings tab) to respect the WordPress workspace and prevent UI clutter.

v.1.0.2

🛠️ Stability & Performance

• PHP 8.1+ Precision: Enforced strict type casting (float to int) in the dashboard calculation logic to resolve modulo deprecation warnings.
• Bulletproof Routing: Switched from URL-based wrappers to strict internal server paths (plugin_dir_path) for all PHP includes, preventing fatal errors on heavily secured servers (allow_url_fopen=0).
• Constant Integrity: Fixed case-sensitivity typos (BUNSEKI_PATH) to ensure strict PHP runtime compliance.

1.0.1

🌍 Internationalization & Localization (i18n)

Full Translation Support: The entire plugin has been refactored to support multilingual setups.

English as Source Language: All hardcoded German strings in the source code have been replaced with English equivalents using official WordPress translation functions (__(), _e(), esc_html_e()).

German Language Pack: Added a comprehensive languages directory containing the de_DE translation files.

Automated Textdomain Loading: The plugin now correctly loads its textdomain on the plugins_loaded hook for maximum compatibility with translation plugins like Loco Translate.

🛠️ Stability & Bug Fixes

Admin UI Syntax Fix: Resolved a critical PHP syntax error in the dashboard where translation tags were incorrectly nested within echo statements.

Log Importer Restoration: Re-activated the "Log Importer" submenu and ensured it is fully accessible alongside the new Live Bot Tracker.

HTML Layout Integrity: Removed misplaced PHP comments that were causing visual breakage in the admin tables.

AJAX Error Handling: Standardized error responses in the log importer for better debugging and international user feedback.

✨ New Admin Options

Live Tracker Toggle: Added a dedicated checkbox in the Importer settings to manually disable the Live Bot Tracker, giving users full control over their data sources.

🧹 Code Quality & Compliance

Final WPCS Polish: Achieved absolute zero errors and warnings in the WordPress Coding Standards (WPCS) scan across all files.

Security Headers: Implemented a non-breaking ABSPATH check in endpoint.php to satisfy security scanners while maintaining standalone performance.

1.0.0

• [Major Architecture Update] Introduced the Real-Time Bot Tracker for strict server environments.
• [Optimization] Completely decoupled the tracking endpoint from heavy WordPress loading cycles.
• [Security] Full code refactoring to achieve 100% compliance with WordPress Coding Standards.
• [Fix] Resolved complex caching issues for immediate dashboard data synchronization.
• Stable 1.0 Master Release.