{"id":300987,"date":"2026-08-05T07:23:48","date_gmt":"2026-08-05T07:23:48","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/visitorlens-session-replay-visitor-recording\/"},"modified":"2026-10-19T07:09:35","modified_gmt":"2026-10-19T07:09:35","slug":"visitor-lens","status":"publish","type":"plugin","link":"https:\/\/tah.wordpress.org\/plugins\/visitor-lens\/","author":15971633,"comment_status":"closed","ping_status":"closed","template":"","meta":{"version":"1.0.10","stable_tag":"1.0.10","tested":"7.0.7","requires":"6.2","requires_php":"7.4","requires_plugins":null,"header_name":"Visitor Lens","header_author":"Rayhan Kabir","header_description":"Lightweight visitor analytics, session recording & replay for WordPress. Track clicks, scrolls, mouse movements, inputs and more \u2014 then replay sessions visually.","assets_banners_color":"464a5b","last_updated":"2026-10-19 07:09:35","external_support_url":"","external_repository_url":"","donate_link":"","header_plugin_uri":"https:\/\/myrecorp.com","header_author_uri":"https:\/\/upwork.com\/fl\/rayhan1","rating":0,"author_block_rating":0,"active_installs":10,"downloads":355,"num_ratings":0,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":{"1.0.0":{"tag":"1.0.0","author":"recorp","date":"2026-08-05 07:23:34","revision":3634970},"1.0.10":{"tag":"1.0.10","author":"recorp","date":"2026-10-19 07:09:35","revision":3754159},"1.0.7":{"tag":"1.0.7","author":"recorp","date":"2026-10-18 18:57:07","revision":3753491},"1.0.8":{"tag":"1.0.8","author":"recorp","date":"2026-10-18 20:03:32","revision":3753550},"1.0.9":{"tag":"1.0.9","author":"recorp","date":"2026-10-18 20:12:40","revision":3753568}},"upgrade_notice":{"1.0.2":"<p>Security and compliance update. Fixes text domain mismatch and adds full GDPR personal data export\/erasure support. Recommended for all users.<\/p>"},"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3634957,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3634957,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3634957,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3634957,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.0.0","1.0.10","1.0.7","1.0.8","1.0.9"],"block_files":[],"assets_screenshots":{"screenshot-1.png":{"filename":"screenshot-1.png","revision":3634957,"resolution":"1","location":"assets","locale":"","width":1866,"height":842},"screenshot-2.png":{"filename":"screenshot-2.png","revision":3634957,"resolution":"2","location":"assets","locale":"","width":1742,"height":842},"screenshot-3.png":{"filename":"screenshot-3.png","revision":3634957,"resolution":"3","location":"assets","locale":"","width":1746,"height":842},"screenshot-4.png":{"filename":"screenshot-4.png","revision":3634957,"resolution":"4","location":"assets","locale":"","width":1740,"height":842},"screenshot-5.png":{"filename":"screenshot-5.png","revision":3634957,"resolution":"5","location":"assets","locale":"","width":1695,"height":841},"screenshot-6.png":{"filename":"screenshot-6.png","revision":3634957,"resolution":"6","location":"assets","locale":"","width":1527,"height":2192},"screenshot-7.png":{"filename":"screenshot-7.png","revision":3634957,"resolution":"7","location":"assets","locale":"","width":1258,"height":842}},"screenshots":{"1":"<strong>Dashboard<\/strong> \u2014 KPI cards, visitor trend chart, top pages, and live visitor count.","2":"<strong>Session Replay<\/strong> \u2014 Filter and watch recorded visitor sessions in a visual player.","3":"<strong>Statistics \u2013 Overview<\/strong> \u2014 Key metrics with trend sparklines and date range selector.","4":"<strong>Statistics \u2013 Audience<\/strong> \u2014 Browser, OS, device type, and screen resolution charts.","5":"<strong>Statistics \u2013 Traffic Sources<\/strong> \u2014 Referrer breakdown including search engine and keyword data.","6":"<strong>Settings \u2013 General<\/strong> \u2014 Configure tracking, recording, exclusions, and sampling rate.","7":"<strong>Settings \u2013 Privacy<\/strong> \u2014 Consent gate configuration, DNT, IP hashing, and input masking.","8":"<strong>Settings \u2013 Data Management<\/strong> \u2014 Storage usage, retention period, and manual purge controls."}},"plugin_section":[],"plugin_tags":[5375,6207,55692,144307,3397],"plugin_category":[],"plugin_contributors":[154245],"plugin_business_model":[],"class_list":["post-300987","plugin","type-plugin","status-publish","hentry","plugin_tags-click-tracking","plugin_tags-heatmap","plugin_tags-session-replay","plugin_tags-user-recording","plugin_tags-visitor-analytics","plugin_contributors-recorp","plugin_committers-recorp"],"banners":{"banner":"https:\/\/ps.w.org\/visitor-lens\/assets\/banner-772x250.png?rev=3634957","banner_2x":"https:\/\/ps.w.org\/visitor-lens\/assets\/banner-1544x500.png?rev=3634957","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/visitor-lens\/assets\/icon-128x128.png?rev=3634957","icon_2x":"https:\/\/ps.w.org\/visitor-lens\/assets\/icon-256x256.png?rev=3634957","generated":false},"screenshots":[{"src":"https:\/\/ps.w.org\/visitor-lens\/assets\/screenshot-1.png?rev=3634957","caption":"<strong>Dashboard<\/strong> \u2014 KPI cards, visitor trend chart, top pages, and live visitor count."},{"src":"https:\/\/ps.w.org\/visitor-lens\/assets\/screenshot-2.png?rev=3634957","caption":"<strong>Session Replay<\/strong> \u2014 Filter and watch recorded visitor sessions in a visual player."},{"src":"https:\/\/ps.w.org\/visitor-lens\/assets\/screenshot-3.png?rev=3634957","caption":"<strong>Statistics \u2013 Overview<\/strong> \u2014 Key metrics with trend sparklines and date range selector."},{"src":"https:\/\/ps.w.org\/visitor-lens\/assets\/screenshot-4.png?rev=3634957","caption":"<strong>Statistics \u2013 Audience<\/strong> \u2014 Browser, OS, device type, and screen resolution charts."},{"src":"https:\/\/ps.w.org\/visitor-lens\/assets\/screenshot-5.png?rev=3634957","caption":"<strong>Statistics \u2013 Traffic Sources<\/strong> \u2014 Referrer breakdown including search engine and keyword data."},{"src":"https:\/\/ps.w.org\/visitor-lens\/assets\/screenshot-6.png?rev=3634957","caption":"<strong>Settings \u2013 General<\/strong> \u2014 Configure tracking, recording, exclusions, and sampling rate."},{"src":"https:\/\/ps.w.org\/visitor-lens\/assets\/screenshot-7.png?rev=3634957","caption":"<strong>Settings \u2013 Privacy<\/strong> \u2014 Consent gate configuration, DNT, IP hashing, and input masking."}],"raw_content":"<!--section=description-->\n<p><strong>See VisitorLens in action \u2014 watch the overview:<\/strong><\/p>\n\n<p>https:\/\/youtu.be\/P9CD1_ZHJdU<\/p>\n\n<p><strong>VisitorLens<\/strong> is a powerful yet lightweight visitor analytics and session replay plugin built natively for WordPress. Stop guessing why visitors leave and start <em>watching<\/em> their real journeys \u2014 every click, scroll, and mouse movement recorded and replayed directly inside your dashboard.<\/p>\n\n<p>Whether you run a WooCommerce store, a membership site, or a content blog, VisitorLens gives you the UX data you need to increase conversions and fix friction points \u2014 without sending any data to third-party servers.<\/p>\n\n<h3>Why VisitorLens?<\/h3>\n\n<p>Most analytics tools tell you <strong>what<\/strong> happened. VisitorLens shows you <strong>why<\/strong>. Watch session recordings to discover rage clicks, form drop-offs, confusing navigation, and missed conversion opportunities \u2014 then fix them with confidence.<\/p>\n\n\n\n<h3>Core Features (Free)<\/h3>\n\n<p><strong>Session Recording &amp; Replay<\/strong>\n* Record every visitor session: mouse movements, clicks, scrolls, form interactions\n* Replay sessions in a built-in visual player inside your WP admin\n* Filter replays by date, duration, page URL, device type, rage clicks, and error count\n* Input masking enabled by default \u2014 sensitive form fields are never recorded\n* Automatic session pruning (configurable retention: 1\u201390 days)<\/p>\n\n<p><strong>Visitor Analytics Dashboard<\/strong>\n* Real-time visitor count with auto-refresh\n* Daily, weekly, and monthly visitor trends (interactive line chart)\n* Top pages ranked by page views\n* Recent visitor log with location, browser, and device<\/p>\n\n<p><strong>Statistics Page<\/strong>\n* Overview KPIs: total visitors, sessions, page views, bounce rate, avg. session duration\n* Pages report: top landing pages, exit pages, most visited URLs\n* Audience report: browser breakdown, OS\/platform, device type, screen resolution\n* Traffic sources: direct, organic, referral, social \u2014 with search engine and keyword breakdown\n* Real-time active visitors with live page list<\/p>\n\n<p><strong>Geo-Location<\/strong>\n* Country, region, and city detection via ip-api.com (free tier, optional)\n* GeoIP lookup can be disabled in Settings \u2192 General<\/p>\n\n<p><strong>Privacy &amp; Consent<\/strong>\n* Consent gate: show a banner before recording begins (opt-in or opt-out mode)\n* Cookie-based consent persistence with configurable cookie name\n* GDPR-compliant: privacy policy content auto-added to WP Privacy Policy page\n* Personal data export and erasure via WP Tools \u2192 Export\/Erase Personal Data\n* Honour Do Not Track (DNT) browser signal (optional)\n* Exclude logged-in administrators, specific IP ranges, URLs, and user roles<\/p>\n\n<p><strong>Data Management<\/strong>\n* Export sessions as CSV or JSON directly from the Replay page\n* Bulk-delete filtered sessions\n* Storage usage card in Settings showing DB table sizes\n* Configurable automatic cleanup via WP-Cron<\/p>\n\n\n\n<h3>Who Is This For?<\/h3>\n\n<ul>\n<li><strong>eCommerce store owners<\/strong> \u2014 find cart abandonment causes, fix checkout friction<\/li>\n<li><strong>Agency &amp; freelance developers<\/strong> \u2014 include analytics in every client site build<\/li>\n<li><strong>Bloggers &amp; content sites<\/strong> \u2014 understand how readers consume content<\/li>\n<li><strong>SaaS &amp; membership sites<\/strong> \u2014 improve onboarding flows and feature discovery<\/li>\n<li><strong>CRO specialists<\/strong> \u2014 validate A\/B test hypotheses with real session evidence<\/li>\n<\/ul>\n\n\n\n<h3>Privacy &amp; GDPR<\/h3>\n\n<p>VisitorLens is built with privacy at its core:<\/p>\n\n<ul>\n<li><strong>Minimal third-party use<\/strong> \u2014 only ip-api.com for optional GeoIP (can be disabled in Settings)<\/li>\n<li><strong>IP hashing<\/strong> \u2014 visitor IPs are hashed with a secret salt by default<\/li>\n<li><strong>Input masking<\/strong> \u2014 form fields are masked and never sent to the server<\/li>\n<li><strong>Consent tools<\/strong> \u2014 built-in opt-in\/opt-out consent gate<\/li>\n<li><strong>Data export &amp; erasure<\/strong> \u2014 full WordPress personal data tools integration<\/li>\n<li><strong>Configurable retention<\/strong> \u2014 auto-delete old sessions on a schedule<\/li>\n<\/ul>\n\n\n\n<h3>Performance<\/h3>\n\n<ul>\n<li>Tracker script: ~4 KB gzipped<\/li>\n<li>Recorder script: ~9 KB gzipped<\/li>\n<li>All recording data is batched and sent asynchronously \u2014 zero impact on page load scores<\/li>\n<li>Uses WordPress REST API for all communication \u2014 no custom AJAX endpoints<\/li>\n<li>No external JavaScript libraries loaded on the frontend<\/li>\n<\/ul>\n\n\n\n<h3>Command-line &amp; AI access<\/h3>\n\n<p>VisitorLens keeps every record in your own WordPress database, so you do not need a browser to analyse your visitors. The <strong>ReCorp Ops CLI (<code>rc<\/code>)<\/strong>, built by the VisitorLens team, reads VisitorLens data directly and answers in plain text or <code>--json<\/code>. It is made for AI assistants as much as for humans: hand <strong>ChatGPT, Claude, Codex, Gemini, Cursor or any agent that can run shell commands<\/strong> an SSH login to your server plus the <code>rc<\/code> command, and it can analyse your site's visitors in seconds \u2014 \"who is on my site right now\", \"which pages lose visitors\", \"show me today's frustrated sessions\" \u2014 instead of clicking through dashboards.<\/p>\n\n<h4>Connect a site<\/h4>\n\n<p><strong>SSH + WP-CLI<\/strong> \u2014 give the <code>rc<\/code> CLI read access to your site's database over your own SSH login:\n    rc sites add-ssh   &lt;\/path\/to\/wordpress&gt; --host= --port=22 --key=\nthen <code>rc sites check &lt;alias&gt;<\/code> to confirm the connection and detect the VisitorLens tables.<\/p>\n\n<h4>Visitor commands<\/h4>\n\n<ul>\n<li><code>rc visitors online &lt;site&gt;<\/code> \u2014 visitors active in the last 5 minutes<\/li>\n<li><code>rc visitors summary &lt;site&gt; --days=7<\/code> \u2014 visitors and pageviews per day<\/li>\n<li><code>rc visitors recent &lt;site&gt; --limit=50<\/code> \u2014 latest page views<\/li>\n<li><code>rc visitors pages &lt;site&gt; --days=30<\/code> \u2014 top pages with average load time<\/li>\n<li><code>rc visitors sources &lt;site&gt; --days=30<\/code> \u2014 traffic sources and UTM campaigns<\/li>\n<li><code>rc visitors sessions &lt;site&gt; --frustrated<\/code> \u2014 recorded sessions (only rage-click \/ error sessions with <code>--frustrated<\/code>)<\/li>\n<li><code>rc visitors session &lt;site&gt; &lt;id&gt; --all<\/code> \u2014 one recording as an event timeline (clicks, scrolls, inputs, errors)<\/li>\n<li><code>rc visitors visitor &lt;site&gt; &lt;id&gt;<\/code> \u2014 one visitor: device, pages viewed, recordings<\/li>\n<li><code>rc visitors tables &lt;site&gt;<\/code> \u2014 VisitorLens tables with approximate row counts<\/li>\n<li><code>rc visitors sql &lt;site&gt; \"SELECT \u2026\"<\/code> \u2014 ad-hoc read-only query (<code>{p}<\/code> expands to the VisitorLens table prefix; SELECT\/SHOW\/DESCRIBE\/EXPLAIN only)<\/li>\n<li><code>rc insights digest &lt;site&gt; --days=7 --json<\/code> \u2014 AI-ready digest: traffic leaks, best landing pages, frustration hot-spots and where to add conversion hooks<\/li>\n<\/ul>\n\n<p>Every visitor command is read-only. Add <code>--json<\/code> for machine-readable output and <code>--limit=n<\/code> \/ <code>--days=n<\/code> to control the window. IP addresses are masked by default; <code>--ip<\/code> shows them.<\/p>\n\n<h4>A prompt that works<\/h4>\n\n<p>\"You have the <code>rc<\/code> CLI and SSH access to my site <code>&lt;alias&gt;<\/code>. Run <code>rc visitors summary &lt;alias&gt; --days=7<\/code>, <code>rc visitors sessions &lt;alias&gt; --frustrated<\/code> and <code>rc insights digest &lt;alias&gt; --json<\/code>, then tell me where visitors drop off, which sessions I should watch, and the three fixes to make first.\"<\/p>\n\n<h3>External services<\/h3>\n\n<p>This plugin optionally connects to <strong>ip-api.com<\/strong> to perform GeoIP lookups (country, region, city) for each tracked visitor.<\/p>\n\n<p><strong>What is sent:<\/strong> The visitor's IP address.\n<strong>When it is sent:<\/strong> On every page-view tracking request, if the GeoIP setting is enabled (Settings \u2192 General \u2192 GeoIP Lookup). No data is sent if GeoIP is disabled.\n<strong>Why:<\/strong> To display geographic location of visitors in the analytics dashboard and session list.\n<strong>Service provider:<\/strong> ip-api.com (ip-api.com)\n* Terms of Service: https:\/\/ip-api.com\/docs\/legal\n* Privacy Policy: https:\/\/ip-api.com\/docs\/legal<\/p>\n\n<p>You can disable GeoIP under <strong>VisitorLens \u2192 Settings \u2192 General \u2192 GeoIP Lookup<\/strong> at any time.<\/p>\n\n<h3>Privacy Policy<\/h3>\n\n<p>VisitorLens collects the following data about your site visitors when activated:<\/p>\n\n<ul>\n<li>Hashed IP address and approximate geographic location (country, city, region)<\/li>\n<li>Browser, operating system, device type, and screen resolution<\/li>\n<li>Pages visited, referrer URL, UTM campaign parameters<\/li>\n<li>Session recordings: mouse movements, clicks, scroll depth (form inputs are masked by default)<\/li>\n<li>WordPress user ID (only for logged-in users)<\/li>\n<\/ul>\n\n<p>All data is stored in your WordPress database. Nothing is sent to external servers.<\/p>\n\n<p>You are responsible for disclosing your use of session recording technology to your visitors in your site's Privacy Policy. VisitorLens automatically adds a suggested privacy policy text to your WordPress Privacy Policy page (Settings \u2192 Privacy).<\/p>\n\n<!--section=installation-->\n<ol>\n<li>Upload the <code>visitor-lens<\/code> folder to <code>\/wp-content\/plugins\/<\/code>.<\/li>\n<li>Activate the plugin through <strong>Plugins \u2192 Installed Plugins<\/strong>.<\/li>\n<li>Navigate to <strong>VisitorLens \u2192 Dashboard<\/strong> in your admin menu.<\/li>\n<li>Visit your site in an incognito\/private window (or as a non-admin) to record your first session.<\/li>\n<li>Return to <strong>VisitorLens \u2192 Session Replay<\/strong> to watch it back.<\/li>\n<\/ol>\n\n<p><strong>Note:<\/strong> Logged-in administrators are excluded from tracking by default. Test tracking in a private browser window or by temporarily logging out.<\/p>\n\n<!--section=faq-->\n<dl>\n<dt id=\"can%20an%20ai%20assistant%20%28chatgpt%2C%20claude%2C%20codex%29%20analyse%20my%20visitors%3F\"><h3>Can an AI assistant (ChatGPT, Claude, Codex) analyse my visitors?<\/h3><\/dt>\n<dd><p>Yes. Give the assistant SSH access to your server plus the ReCorp Ops CLI (<code>rc<\/code>), and it can query live and historical visitor data directly \u2014 see the <em>Command-line &amp; AI access<\/em> section above for the full command list.<\/p><\/dd>\n<dt id=\"does%20visitorlens%20send%20data%20to%20any%20external%20server%3F\"><h3>Does VisitorLens send data to any external server?<\/h3><\/dt>\n<dd><p>All session recording data is stored exclusively in your own WordPress database. When the optional GeoIP feature is enabled (disabled by default), the visitor's IP address is sent to ip-api.com to look up their country\/city. You can enable GeoIP under Settings \u2192 General; if it is disabled, no data is sent externally.<\/p><\/dd>\n<dt id=\"will%20session%20recording%20slow%20down%20my%20website%3F\"><h3>Will session recording slow down my website?<\/h3><\/dt>\n<dd><p>No. The recording scripts are tiny (&lt; 15 KB combined, gzipped) and all data is sent asynchronously in batches after the page has loaded. Page load speed and Core Web Vitals are unaffected.<\/p><\/dd>\n<dt id=\"is%20visitorlens%20gdpr%20compliant%3F\"><h3>Is VisitorLens GDPR compliant?<\/h3><\/dt>\n<dd><p>Yes. VisitorLens includes a built-in consent gate, IP address hashing, input masking, and full integration with WordPress's personal data export and erasure tools. It also auto-populates your Privacy Policy page with a detailed data usage description. You are responsible for disclosing the use of session recording in your own privacy policy.<\/p><\/dd>\n<dt id=\"does%20it%20work%20with%20woocommerce%3F\"><h3>Does it work with WooCommerce?<\/h3><\/dt>\n<dd><p>Yes. The free version tracks all pages including WooCommerce shop, product, cart, and checkout pages. The Pro version adds dedicated WooCommerce analytics including revenue attribution, cart abandonment tracking, and checkout funnel analysis.<\/p><\/dd>\n<dt id=\"how%20do%20i%20stop%20recording%20certain%20pages%20or%20users%3F\"><h3>How do I stop recording certain pages or users?<\/h3><\/dt>\n<dd><p>Go to <strong>VisitorLens \u2192 Settings \u2192 General<\/strong>. You can exclude specific URLs (with wildcard support), IP addresses, logged-in user roles, and bots. You can also set a sampling rate to record only a percentage of sessions.<\/p><\/dd>\n<dt id=\"can%20i%20export%20or%20delete%20session%20data%3F\"><h3>Can I export or delete session data?<\/h3><\/dt>\n<dd><p>Yes. From the <strong>Session Replay<\/strong> page, use the Export button (CSV or JSON) for any filtered set of sessions. Use the Bulk Delete button to remove sessions. For GDPR erasure requests, use <strong>Tools \u2192 Erase Personal Data<\/strong> \u2014 VisitorLens will automatically erase all sessions linked to that user's WordPress account.<\/p><\/dd>\n<dt id=\"where%20is%20session%20data%20stored%3F\"><h3>Where is session data stored?<\/h3><\/dt>\n<dd><p>All data is stored in your WordPress database in dedicated tables prefixed with <code>{wp_prefix}vs_<\/code>. No files are written to the filesystem.<\/p><\/dd>\n<dt id=\"how%20long%20is%20session%20data%20kept%3F\"><h3>How long is session data kept?<\/h3><\/dt>\n<dd><p>By default, sessions are deleted after 7 days. You can change this to anywhere from 1 to 90 days under <strong>VisitorLens \u2192 Settings \u2192 Data Management<\/strong>.<\/p><\/dd>\n<dt id=\"does%20it%20work%20with%20page%20builders%20like%20elementor%2C%20divi%2C%20or%20beaver%20builder%3F\"><h3>Does it work with page builders like Elementor, Divi, or Beaver Builder?<\/h3><\/dt>\n<dd><p>Yes. VisitorLens records at the DOM level and works with any theme or page builder without any configuration.<\/p><\/dd>\n<dt id=\"can%20i%20see%20who%20is%20currently%20on%20my%20site%3F\"><h3>Can I see who is currently on my site?<\/h3><\/dt>\n<dd><p>Yes. The Dashboard shows a real-time active visitor count that auto-refreshes. The Statistics page has a dedicated Real-Time section showing live visitor count and the pages they are currently viewing.<\/p><\/dd>\n<dt id=\"is%20there%20a%20multisite%20%2F%20network%20version%3F\"><h3>Is there a multisite \/ network version?<\/h3><\/dt>\n<dd><p>Not yet \u2014 multisite support is planned for a future release. Currently, the plugin must be activated per-site.<\/p><\/dd>\n\n<\/dl>\n\n<!--section=changelog-->\n<h4>1.0.10<\/h4>\n\n<ul>\n<li>Improvement: refined the highlighted VisitorLens entry in the admin sidebar menu for a cleaner, more premium look.<\/li>\n<\/ul>\n\n<h4>1.0.9<\/h4>\n\n<ul>\n<li>New: added an overview video to the plugin description.<\/li>\n<\/ul>\n\n<h4>1.0.8<\/h4>\n\n<ul>\n<li>Maintenance: internal code cleanup and reliability improvements.<\/li>\n<\/ul>\n\n<h4>1.0.6<\/h4>\n\n<ul>\n<li>Security: <code>\/track<\/code> and <code>\/record<\/code> public REST endpoints now reject cross-origin forgery attempts (Origin\/Referer must match the site) and are rate-limited per IP, preventing anonymous flooding\/pollution of visitor and session data. Tracker\/recorder scripts retry once instead of dropping data if a request is ever rate-limited.<\/li>\n<li>Fix: Annotated remaining dynamic-WHERE SQL queries in <code>class-rest-replay.php<\/code> with explicit prepared-fragment justification comments, consistent with the rest of the codebase (queries were already built from <code>wpdb-&gt;prepare()<\/code>d fragments \u2014 no functional change).<\/li>\n<li>Update: Bundled Chart.js updated from v4.5.0 to v4.5.1.<\/li>\n<\/ul>\n\n<h4>1.0.2<\/h4>\n\n<ul>\n<li>Fix: Text domain corrected to <code>visitor-lens<\/code> throughout all PHP files.<\/li>\n<li>Fix: Added <code>Domain Path: \/languages<\/code> to plugin header.<\/li>\n<li>Fix: Sanitized <code>$_GET['vs_replay']<\/code> with <code>sanitize_text_field()<\/code> + <code>wp_unslash()<\/code>.<\/li>\n<li>Fix: SVG icon output in admin nav now passes through <code>wp_kses()<\/code> for safe output.<\/li>\n<li>Fix: Active nav link class attribute now properly escaped with <code>esc_attr()<\/code>.<\/li>\n<li>New: Added <code>class-privacy.php<\/code> \u2014 GDPR privacy policy content registration, personal data exporter, and personal data eraser.<\/li>\n<li>Improvement: <code>VSR_VERSION<\/code> constant now matches plugin header version.<\/li>\n<\/ul>\n\n<h4>1.0.1<\/h4>\n\n<ul>\n<li>Fix: Deprecated <code>%f<\/code>\/<code>%d<\/code> with null values in <code>wpdb::prepare()<\/code> \u2014 lat\/lon and screen dimensions now default to <code>0<\/code> instead of <code>null<\/code>.<\/li>\n<li>Fix: <code>daily_summary.visitors<\/code> now only increments for genuinely new unique visitors using <code>$wpdb-&gt;rows_affected<\/code>.<\/li>\n<li>New: Session export (CSV\/JSON) and bulk delete on the Replay page.<\/li>\n<li>New: Storage usage card in Settings \u2192 Data Management.<\/li>\n<\/ul>\n\n<h4>1.0.0<\/h4>\n\n<ul>\n<li>Initial release.<\/li>\n<li>Visitor analytics dashboard with Chart.js line chart.<\/li>\n<li>Session recording and replay.<\/li>\n<li>GeoIP location detection (local database).<\/li>\n<li>Statistics page: overview, pages, audience, traffic sources, real-time.<\/li>\n<li>Settings: general, privacy\/consent, data management.<\/li>\n<li>REST API: <code>\/vsr\/v1\/track<\/code>, <code>\/vsr\/v1\/record<\/code>, <code>\/vsr\/v1\/replay\/*<\/code>, <code>\/vsr\/v1\/stats\/*<\/code>, <code>\/vsr\/v1\/settings<\/code>.<\/li>\n<\/ul>","raw_excerpt":"Record, replay and analyze every visitor session. See exactly what users click, scroll and do on your WordPress site \u2014 no coding required.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/tah.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/300987","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/tah.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/tah.wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/tah.wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=300987"}],"author":[{"embeddable":true,"href":"https:\/\/tah.wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/recorp"}],"wp:attachment":[{"href":"https:\/\/tah.wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=300987"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/tah.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=300987"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/tah.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=300987"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/tah.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=300987"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/tah.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=300987"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/tah.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=300987"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}