=== Opti-Behavior – Self-Hosted Heatmaps, Funnels, A/B Testing & Smart Insights ===
Contributors: optiuser
Donate link: https://optiuser.com/
Tags: heatmap, click tracking, funnel, woocommerce analytics, user behavior

Requires at least: 5.8
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.10.1
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Self-hosted click heatmaps, click tracking and funnels for WordPress and WooCommerce. Analytics data is stored on your server. Session replay in Pro.

== Description ==

**See why visitors leave. Fix it. Prove it. On your own WordPress server.**

Opti-Behavior adds click heatmaps, click tracking, conversion funnels and A/B testing to WordPress for free, and stores visitor data in your own WordPress database and files. Session recordings, scroll heatmaps and rage-click detection are in Pro.

https://www.youtube.com/watch?v=2wlJ6ok5-Wk

🚀 **[Try the Live Demo](https://demo.optiuser.com/?demo_login=go)** – explore the full analytics dashboard in one click, no installation and no signup required.

Visitors rarely explain why they leave. They click, scroll, hesitate, abandon forms, hit errors or drop out of checkout. Opti-Behavior records those silent signals, and Smart Insights tells you which problem to fix first, why, and whether your fix worked.

Comparing tools? Read [Google Analytics alternatives for WordPress](https://optiuser.com/blog/google-analytics-alternative-wordpress/) and [cookieless visitor tracking in WordPress](https://optiuser.com/blog/cookieless-visitor-tracking-2026-wordpress-first-party-data/).

= 🔄 How it works: one loop, not a pile of dashboards =

1. **Collect** – traffic, heatmaps and funnels in the free plugin; session recordings, errors, forms and user journeys in Pro.
2. **Understand** – Smart Insights reads them together and writes one card per problem: what is wrong, on which page or funnel step, how many visitors it costs, and since when.
3. **Fix** – each card gives one next action and opens the report that shows the problem: the heatmap, the funnel step, the recording.
4. **Prove** – mark the card as fixed: Opti-Behavior compares the period before and after your change and shows the result. Test bigger changes with an A/B test.

The **How it works** page shows this loop with your own numbers, a first-days checklist, the latest release notes and a **Setup check**: are visits received, is a caching or optimization plugin blocking a tracker, are your own visits counted? Each item has a button to fix it.

= ✅ Free features =

* **[Real-time traffic](https://optiuser.com/opti-behavior/ob-feature-dashboard/)** – visitors, sessions, pageviews, bounce rate, scroll depth, top pages, traffic sources, devices and visitor map, with visit duration, visited pages, referrers and outbound links.
* **"AI Assistants" channel** – visits from ChatGPT, Perplexity, Claude and Copilot are counted on their own instead of inside Organic Search.
* **[Click heatmaps](https://optiuser.com/opti-behavior/ob-feature-heatmaps/)** for desktop and mobile. Point at a hot area to see how many clicks it received ("N clicks in this area").
* **[Unlimited conversion funnels](https://optiuser.com/opti-behavior/ob-feature-funnels/)** with multi-step drop-off analysis and device filtering. Opti-Behavior detects your site type (WooCommerce, Easy Digital Downloads, blog, lead-gen, signup, membership, LMS, booking) and proposes ready-made funnels built from your own URLs: create one in a click or edit it first. Nothing is created without you asking.
* **[A/B testing](https://optiuser.com/opti-behavior/ob-feature-ab-testing/)** – page-split experiments, variant previews, conversion goals and winner application.
* **[Smart Insights](https://optiuser.com/opti-behavior/ob-feature-smart-insights/)** – one card per problem, ranked by visitors lost, with a confidence level from the visits measured, the next action, a before / after result and notifications.
* **Page X-Ray preview** – your three most visited pages of the period, each with a health score and its first problem.
* **Shop for WooCommerce** – product views, adds to cart, checkouts and paid orders, and the visits each product loses (viewed, not added to cart), worst product first. The shop counters store no order number, customer name, e-mail address or coupon code.
* **Site report** – print or save as PDF a report of any period from Opti-Behavior > Reports: traffic, the three most costly issues and, when your site has them, shop, clicks, funnels, busiest hours and A/B tests. A "Site report" link in Traffic and Smart Insights opens it for the same period.
* **Scheduled e-mail reports**, daily, weekly or monthly – visits, page views, time per visit and bounce with their change, the three most costly issues, top sources, devices, most viewed pages and, on WooCommerce sites, the product that loses the most visits.
* **Visitor country** from a local database shipped with the plugin (DB-IP Lite): it works right after activation, and the visitor IP address is not sent to a geolocation service.
* **Bot and spam filtering** – visits from headless browsers and automation tools (detected by their user agent) are refused at collection, and browsers driven by an automation tool (navigator.webdriver) are marked as automated traffic. Setting "Enable automated traffic detection" in Traffic & Behavior settings, on by default.
* **[Settings & privacy controls](https://optiuser.com/opti-behavior/ob-feature-settings/)** – consent, storage, reports, cleanup, languages and debugging in one place.
* **Multilingual admin** – English, French, German, Spanish, Portuguese and Italian.

= 💎 Pro features =

* **[Session recordings](https://optiuser.com/opti-behavior/ob-feature-recordings/)** – watch real visits: hesitation, scrolling, navigation, rage and dead clicks. Filter by problem: JavaScript error, click friction or abandoned form.
* **Scroll, move and attention heatmaps** – how far visitors scroll, where the mouse moves and where attention stays. Heatmap filters by country, browser, device, visitor type and date.
* **[Errors & performance](https://optiuser.com/opti-behavior/ob-feature-errors/)** – JavaScript errors, network issues, broken links and Core Web Vitals problems.
* **Friction detection** – rage clicks and dead clicks that signal frustration ([how rage and dead click detection works](https://optiuser.com/blog/rage-click-dead-click-detection-wordpress/)).
* **[Form analytics](https://optiuser.com/opti-behavior/ob-feature-forms/)** – field-level effort, errors, abandonment, refill behavior and completion time.
* **[User journeys](https://optiuser.com/opti-behavior/ob-feature-journeys/)** – Sankey-style view of common paths and exits; turn high-value journeys into funnels.
* **Page X-Ray** – one report per page: health score, a "Where visitors click" table (rage clicks, dead clicks and JS errors per element), where visitors come from and go next, a page audit, "What changed?" against the previous period, "I fixed this" with a 14-day before / after, desktop or mobile view, and an action plan.
* **Full reports** – full site report (a card for every page, up to 10 page reports in annex) and a one-page Page X-Ray report with the click map of the page, printed or saved as PDF, with your client's name and the sections you choose to hide.
* **Shop** – estimated lost sales per product (an indicative range, from your conversion rate and average order), payment errors by error type and payment method, and shop events (add to cart, checkout, payment failure) in session recordings, recorded only in Full Tracking mode after the visitor's consent.
* **Advanced A/B testing** – visual edits, targeting, scheduling, WooCommerce tests and revenue attribution.
* **More Smart Insights signals** – errors, rage and dead clicks, slow pages, broken links and abandoned forms feed Smart Insights and Page X-Ray, with a session recording as proof when one exists.

🎁 **Try Pro free for 6 months**, no credit card required. [See Pro plans and prices](https://optiuser.com/opti-behavior/pricing/) | 🚀 [Live Demo](https://demo.optiuser.com/?demo_login=go)

= 🛡️ Privacy & Performance by Design =

* **Self-hosted data** – visitor behavior data is stored in your WordPress database and files. No third-party analytics cloud: analytics data is not sold or shared with external behavior platforms.
* **Privacy controls** – cookie-free anonymous tracking by default, IP anonymization, retention settings and uninstall cleanup options. Full Tracking mode uses cookies only after the visitor accepts the consent banner, and the `[opti_behavior_cookie_settings]` shortcode lets visitors change or withdraw their choice at any time.
* **Hybrid Storage** – high-volume analytics events are stored in files instead of the database. Database size [measured on one production site](https://optiuser.com/blog/wordpress-analytics-plugin-database-size/).
* **Lightweight tracking** – minified trackers loaded with `defer`. We measured PageSpeed on a test page with the plugin on and off: [see the article](https://optiuser.com/blog/analytics-plugin-slow-down-wordpress/).
* **WooCommerce ready** – analyze product pages, carts, checkout funnels and revenue-focused experiments while keeping customer behavior data under your control.

== Installation ==

= Automatic Installation =

1. Log in to your WordPress admin panel
2. Navigate to Plugins > Add New
3. Search for "Opti-Behavior"
4. Click "Install Now" and then "Activate"

= Manual Installation =

1. Download the plugin zip file
2. Log in to your WordPress admin panel
3. Navigate to Plugins > Add New > Upload Plugin
4. Choose the downloaded zip file and click "Install Now"
5. After installation, click "Activate Plugin"

= After Activation =

1. Navigate to **Opti-Behavior** in your WordPress admin menu. The menu has two groups: **Your data** and **What to fix**.
2. The plugin starts tracking automatically - no configuration required!
3. Open **How it works**: the Setup check confirms that visits are received and offers to exclude your own visits.
4. Visit **Traffic** to see real-time visitor activity and **Heatmaps** to see where visitors click.
5. Open **Funnels**: Opti-Behavior proposes ready-made funnels for your site type, created in one click.
6. Check **Smart Insights**: the first cards usually come after about 100 visits on a page, and the menu light turns red, yellow or green.
7. Adjust **Settings** to customize tracking behavior and privacy options.

That's it! Opti-Behavior works out of the box with smart defaults.

== Frequently Asked Questions ==

= Is there a live demo I can try? =

Yes! You can explore the full Opti-Behavior dashboard instantly at [demo.optiuser.com](https://demo.optiuser.com/?demo_login=go) – no installation, no account, no credit card required. Browse real heatmaps, funnels, A/B tests, and Smart Insights before installing.

= How do I add a heatmap to my WordPress site? =

1. Install and activate Opti-Behavior from **Plugins > Add New** (search "Opti-Behavior").
2. Nothing to paste: tracking starts on its own. Heatmaps are recorded for posts, pages, products, home and shop.
3. When visitors have clicked, open **Opti-Behavior > Heatmaps** and choose the page. On small sites the Heatmaps list is up to date right away.
4. No data yet? Open **How it works**: the Setup check tells you whether visits are received and whether a caching or optimization plugin blocks the tracker.

Click heatmaps are free. Scroll, move and attention heatmaps are in Pro. Step-by-step guide: [How to add a heatmap to WordPress](https://optiuser.com/blog/wordpress-heatmap-plugin-guide/).

= My heatmap stays empty after installing a caching plugin. Why? =

Caching and optimization plugins (WP Rocket, LiteSpeed Cache and others) can delay, combine or block tracking scripts. Open **Opti-Behavior > How it works**: the Setup check tells you whether visits are received and whether a caching or optimization plugin blocks a tracker, with a button to fix each item. Plugin-by-plugin fixes: [Heatmap not working after installing a cache plugin](https://optiuser.com/blog/heatmap-not-working-cache-plugin/).

= Can I share a heatmap with a client or my team? =

Yes. On the heatmap page, the download button saves the heatmap as a PNG image, with the clicks where the screen shows them. Send it or paste it into your report. This is in the free plugin.

= What does click tracking record in the free plugin? =

Each click on your tracked pages: where it happened and which element was clicked, shown on the click heatmap for desktop and mobile. Clicks on links to other sites are recorded too. The data is stored in your own WordPress database and files.

= Does the free plugin record sessions? =

No. The free plugin records clicks, traffic and funnels. Session recordings (session replay), scroll heatmaps and rage-click detection are in Opti-Behavior Pro, a separate plugin.

= How does Smart Insights decide what to fix first? =

By the visitors each problem costs. Every card counts the visits it touches and the visitors it loses, compares the page with your site average, and gets a confidence level from the number of visits measured. A card is "Critical" only with enough visits, high confidence and a loss that matters on your site; cards built on few visits are marked "Provisional". Money is shown only for a checkout funnel with at least 20 orders or a form with your own value of a conversion. When you fix a problem, mark the card as resolved: Opti-Behavior measures the period after your change and shows the result.

Most "insight" tools raise alarms. Smart Insights counts.

* **Ranked by visitors lost**, not by alarming words. "Critical" must be earned: enough visits measured, high confidence, and a loss that matters on your site.
* **Confidence comes from the visits measured.** A card built on few visits says "Provisional · N visits" instead of pretending.
* **Money only when it is real.** An amount "at risk" is shown for a funnel that ends at the checkout (with at least 20 orders over the period) or for a form priced with your own value of a conversion. Every other card shows the visitors it loses.
* **Funnel cards name the step** visitors leave: "between Product and Cart, 60 of 90 visitors leave".
* **One card per problem.** Cards with identical data are merged, and a card the rules no longer confirm is closed, never counted as a win.
* **No lift promises** without a published source.
* **Results you can check.** A resolved card shows before, after and the verdict. The admin menu light shows where you stand at a glance: red = a Critical problem, yellow = High or Medium, green = nothing to fix.

The first cards usually come after about 100 visits on a page. Nothing to set up.

= Why don't I see any insights yet? =

Smart Insights needs data first: the first cards usually come after about 100 visits on a page. Open **How it works**: its Setup check tells you whether visits are received, whether a caching or optimization plugin blocks a tracker, and whether your own visits are counted (exclude them for cleaner data).

= What is Page X-Ray? =

Page X-Ray is the per-page report of Smart Insights, in Opti-Behavior Pro. It answers "why doesn't this page convert?" with a health score, what the page is for and whether visitors reach its main button, a behavior map, a page audit (clarity, buttons, trust, content, sharing), the WordPress changes that came before a problem, a before / after comparison and an action plan. In the free plugin, the tab previews your three most visited pages with a health score and their first problem.

Pick a page and get one report built from every module:

* **Health score** with the share of each module, and a page list ranked from the one to fix first.
* **What the page is** – its type (sales page, product, article, lead page…), its goal and how often visitors reach its main button. Choose the buttons that matter by clicking them on the page.
* **Behavior map** – the page in ten parts: viewing time, visitors still there, clicks, and where to move or repeat the main button.
* **Page audit** – the conversion checklist of its type: clarity, buttons, trust (reviews, guarantee, payment signs, contact), content and sharing. Each check says what was found on the page and what to do.
* **What changed** – plugin, theme and core updates and page edits are marked on every chart; a problem that starts right after a change names it: "started 1 day after Plugin X was updated".
* **Evolution** – 14 days before against 14 days after each change, with a noise test so a random swing is never reported as a result.
* **Action plan** – in order: check the measurement, fix the defects, then test each change with an A/B test only when the page has the traffic to conclude.

In the free plugin, the Page X-Ray tab shows a preview of your three most visited pages; the full report is in Opti-Behavior Pro.

= Does this plugin slow down my website? =

The tracking scripts are minified and loaded with `defer`, events are sent in batches, and the Hybrid Storage engine can store high-volume analytics events in files instead of writing every interaction directly to MySQL. We measured PageSpeed on a test page with the plugin on and off: [see the article](https://optiuser.com/blog/analytics-plugin-slow-down-wordpress/). As with any analytics tool, the result on your site depends on your hosting, traffic volume and settings.

= What privacy controls does it include? =

Self-hosted: recordings and behavior data are stored on your own server. Opti-Behavior includes IP anonymization, data retention controls, cookie-free anonymous tracking by default, a built-in consent banner (or your consent plugin) before Full Tracking sets any cookie, and the `[opti_behavior_cookie_settings]` shortcode so visitors can change or withdraw their choice at any time. These controls do not make a site compliant on their own: update your privacy policy and check your setup with your own legal adviser.

= Does it work without cookies? =

Yes. Anonymous mode, the default, sets no cookie: visits are counted on your own server. Full Tracking mode uses cookies only after the visitor accepts the consent banner. Whether your site still needs a consent banner depends on everything it loads, not only analytics: see [WordPress analytics without a cookie banner](https://optiuser.com/blog/wordpress-visitor-tracking-without-cookies/) and check with your data protection adviser.

= How is this different from Microsoft Clarity? =

Clarity is a cloud service from Microsoft: behavior data is processed on Microsoft's servers under its terms. Opti-Behavior runs inside WordPress: recordings and behavior data are stored on your own server. It also includes funnels, scheduled reports, bot filtering, A/B testing, and Smart Insights that ranks what to fix first and checks whether your fix worked. See [Microsoft Clarity alternatives for WordPress](https://optiuser.com/blog/microsoft-clarity-alternatives/).

= How is this different from Hotjar? =

Hotjar is a cloud service: behavior data is stored on Hotjar's servers. Opti-Behavior keeps behavior analytics inside WordPress, on your own server. Click heatmaps and funnels are in the Free plugin; recordings, scroll / move / attention heatmaps, form analytics, journeys, errors and advanced A/B testing are in Pro. See [Opti-Behavior vs Hotjar](https://optiuser.com/opti-behavior/compare/vs-hotjar/).

= How is this different from Matomo? =

Matomo is a self-hosted web analytics platform. Opti-Behavior focuses on behavior analytics and conversion work inside WordPress: heatmaps, funnels and A/B testing in Free; recordings, forms, journeys and friction insights in Pro.

= Are there any session or pageview limits? =

There are no artificial SaaS-style session caps in the plugin. Your practical limit is your own server storage, database capacity, and retention settings.

= Can I export my data? =

Yes. The Traffic dashboard exports its data to CSV.

= Does this work with caching plugins? =

Yes. Opti-Behavior is designed to work with common WordPress caching plugins such as WP Rocket, LiteSpeed Cache, W3 Total Cache, Autoptimize, SG Optimizer, and WP Super Cache.

= Will this work on multisite? =

Opti-Behavior works on multisite: each site keeps its own tables and data folder. After network activation, open each site's dashboard once. Multisite is not yet in our test suite, so please test on a staging copy first.

= Does this plugin call any external services? =

Yes, only for specific supporting features such as an optional update of the country database (only when you ask for it, no visitor data sent), admin map tiles, an optional daily status message (site URL, versions, one admin email) after you accept it on the welcome screen, optional announcements (licence type only, same condition), and user-initiated OptiUser website links (the Pro trial page included). See the **External Services** section below for details.

= What data does this plugin collect? =

Depending on settings, Opti-Behavior can collect page views, URLs, click positions, scroll depth, session timestamps, referrers, device/browser data, anonymized IP data, approximate location signals, and interaction metadata. It does not collect form field values by default, and analytics data is stored locally in your WordPress database or file system.

= Can I delete all data when uninstalling? =

Yes. Enable **Delete all data on uninstall** in Settings to remove stored plugin data when the plugin is uninstalled.

= My host is busy or shared — how do I keep the plugin light on the server? =

Two settings make the biggest difference. First, run WP-Cron from a real server cron instead of inside visitor page loads: add `define( 'DISABLE_WP_CRON', true );` to `wp-config.php` and have your host call `wp-cron.php` every 5 minutes. Cleanup, reports and database upkeep then never run inside a visitor request. Second, keep the default "Posts & Pages Only" heatmap scope and the default data retention so tables stay small. All heavy maintenance (index changes, table conversion, OPTIMIZE) is size-capped and time-boxed, and every frontend tracking request is rate-limited so concurrent visitors cannot pile up on the database.

= Does it work with WooCommerce? =

Yes. Use Opti-Behavior to analyze product pages, cart behavior, checkout funnels, CTA clicks, and revenue-focused A/B tests while keeping customer behavior data under your control.

= Does it work with page builders? =

Yes. Opti-Behavior works with Gutenberg, Elementor, Divi, Beaver Builder, WPBakery, and other major WordPress builders.

= What is the Hybrid Storage Engine? =

Hybrid Storage is Opti-Behavior's performance-focused storage approach. Instead of pushing every click, scroll, and pageview directly into MySQL, high-volume events can be stored in optimized files and aggregated for faster reporting. This helps reduce database bloat on busy sites.

= Which questions does Opti-Behavior help answer? =

Most site owners already have traffic numbers. The hard part is understanding the human reason behind the numbers.

Opti-Behavior helps answer practical conversion questions:

* Which parts of the page attract attention?
* Where do visitors hesitate or lose confidence?
* Which funnel step causes the biggest drop-off?
* Which form field creates too much effort?
* Which CTA, layout, product page, or message should be tested next?
* Are bots, spam, errors, or slow pages distorting your decisions?

The goal is not more dashboards. The goal is better decisions.

= How do I get support? =

Free users can use the WordPress.org support forum. Pro users get priority support through OptiUser.

Hotjar is a trademark of Hotjar Ltd. Microsoft and Clarity are trademarks of Microsoft Corporation. Opti-Behavior is not affiliated with or endorsed by them.

== External Services ==

This plugin may connect to external services in limited circumstances:

= Country database (DB-IP Lite, db-ip.com) =

**Purpose:** The free DB-IP Lite country database from db-ip.com (https://db-ip.com) is used to find a visitor's country on your own server. The database is included in the plugin (assets/geo/) and renewed with each plugin version: no download is needed. The plugin can also download a newer file from db-ip.com. Only the database file is downloaded; no visitor data is sent to db-ip.com. Terms and licence: https://db-ip.com/db/lite.php (CC BY 4.0). IP geolocation by DB-IP (https://db-ip.com).

**When Used:** Never on its own. db-ip.com is contacted only when an administrator clicks "Update now" in Settings > Traffic & Behavior, or ticks "Check for a newer database every month" there (off by default, can be turned off).

**Data Sent:** No visitor data. The request sends the user agent "Opti-Behavior/<version>", without your site address.

**Privacy:**
* Service: https://db-ip.com/
* Terms and licence: https://db-ip.com/db/lite.php

= OpenStreetMap Tiles =

**Purpose:** Displays the interactive visitor location map in your WordPress admin dashboard.
**When Used:** Only when YOU (the admin) view the real-time visitor map. Not used on the frontend.
**Data Sent:** Your browser makes direct requests to OpenStreetMap tile servers (standard HTTP headers only).

**Privacy:**
* Service: https://www.openstreetmap.org/
* Tile Policy: https://operations.osmfoundation.org/policies/tiles/
* Privacy Policy: https://wiki.osmfoundation.org/wiki/Privacy_Policy

= OptiUser API (api.optiuser.com) =

**Purpose:** Handles the optional daily status message (site URL, versions, one admin email; only after you accept it on the welcome screen), and plugin deactivation notifications. Licence validation and update checks are made by the Pro plugin itself, only after you install and activate it.

**When Used:**
* **Install tracker:** Sends a heartbeat once every 24 hours after activation, containing only: site URL, WordPress version, PHP version, plugin version, plugin type (free/pro), and one best available administrator contact email when a valid contact exists. No visitor data is sent.
* **Deactivation:** Notifies the API when the plugin is deactivated so installation records stay up to date.
* **Announcements:** Optional short news banners on the plugin's own screens. Only after you accept the daily status message on the welcome screen, or while Pro is active, the plugin asks api.optiuser.com for current announcements at most once every 6 hours. Data sent: only the licence type (free, pro, trial or expired); no site URL, domain or email. Closing a banner is stored on your site only, nothing is sent. Terms of Service: https://optiuser.com/terms-of-service/ - Privacy Policy: https://optiuser.com/privacy-policy/

**Data Sent:** Site URL, WordPress admin username when applicable, and one best available administrator contact email for install tracking. The plugin selects a single valid contact email and does not send a list of administrator emails. No visitor analytics data is ever sent to the API.

**Privacy:**
* Service: https://api.optiuser.com/
* Website: https://optiuser.com/
* Terms of Service: https://optiuser.com/terms-of-service/
* Privacy Policy: https://optiuser.com/privacy-policy/
* The API stores installation metadata (site URL, plugin version) for license management. No visitor data is collected or stored by the API.

= OptiUser Website (optiuser.com) =

**Purpose:** Hosts the Opti-Behavior Pro trial page and sales/feature pages. Every "Upgrade to Pro" / "Try Pro" link of the plugin (welcome screen, trial notice, Pro feature pages, heatmap, Smart Insights, A/B tests, Settings) opens the same Pro trial page on optiuser.com in a new tab.

**When Used:** Only when an admin clicks one of these links. The plugin itself sends nothing: the browser opens the page.

**Data Sent:** Only your site address and the place of the link (utm parameters) travel in the link. No username, email or visitor analytics data is sent.

**Privacy:**
* Service: https://optiuser.com/
* Privacy Policy: https://optiuser.com/privacy-policy/

**Important Note:** All analytics data is stored locally on your WordPress server. The external services listed above are used only for optional geographic features (optional update of the DB-IP Lite country database, which is included in the plugin; OpenStreetMap map tiles), the optional daily status message (only after you accept it), optional announcements (only after you accept the daily status message, or with Pro active), and Pro license management (api.optiuser.com). Visitor analytics data (pages, clicks, sessions) stays on your server. The visitor's IP address is not sent to any geolocation service: the country is looked up on your own server.

== Screenshots ==

1. Real-time WordPress analytics dashboard with visitors, sessions, page views, average session time, scroll depth, and bounce rate KPIs.
2. Live visitor activity feed with country flags, anonymized visitor identifiers, page URLs, and an interactive real-time visitor map.
3. Traffic overview chart comparing visitors, sessions, and page views across the selected date range.
4. Top engaged users and top pages report showing session frequency, average session duration, country, page views, and interaction counts.
5. Visitor activity heatmap showing high-traffic days and hours for behavior analytics and content timing decisions.
6. Audience analytics widgets for new vs returning visitors, visited directories, and logged-in visitor authentication activity.
7. Traffic classification dashboard with human traffic, spam traffic, bot detection, crawler breakdown, and user intent segmentation.
8. Acquisition and environment analytics for referrers, countries, and browser usage.
9. Device analytics for desktop, mobile, tablet, operating systems, and screen resolutions.
10. Heatmaps overview with total heatmaps, total clicks, mobile traffic, average time on page, hottest page, click-through rate, and searchable page list.
11. Free click heatmap for WordPress: detail view with date, country, browser, visitor type, desktop/mobile filters, page preview, and click intensity overlay.
12. Pro: Move heatmap detail view showing mouse movement trails and visitor movement patterns on a live page preview.
13. Pro: Attention heatmap detail view showing attention intensity and engagement hotspots on the selected page.
14. Pro: Scroll heatmap detail view showing scroll-depth intensity, loaded scroll points, and page-level engagement depth.
15. Post Analytics panel with entry sources, on-page visitor behavior, exit behavior, total interactions, scroll depth, bounce rate, and update time.
16. Page-level analytics with country, browser, device breakdowns, visitor trends, heatmap access, and session recording access.
17. Pro: Session Recordings list with watched status, duration, visitor activity, visited pages, referrer, country, browser, operating system, and device data.
18. Pro: Session recording page timeline showing multi-page visitor journeys with events, clicks, durations, and replay controls.
19. Pro: Session replay player with visitor metadata, event timeline, playback controls, skip-inactive mode, and page-by-page session navigation.
20. Conversion funnels dashboard showing funnel steps, completion rate, abandonment rate, device and country filters, and funnel performance cards.
21. Funnel builder modal for creating or editing URL-based funnel steps with URL match rules and step ordering.
22. Pro: User Journey Analytics with journey flow visualization, top paths, entry and exit analysis, page groups, device, browser, country, visitor, and referrer filters.
23. Pro: Errors Tracking dashboard for JavaScript errors, network errors, friction events, rage clicks, slow pages, affected sessions, performance, and broken links.
24. Pro: Form Analytics dashboard with form views, submissions, conversion rate, completion time, abandonments, activity trends, and top forms by conversion.
25. Privacy and GDPR settings comparing anonymous mode and full tracking for cookies, IP storage, geolocation, consent, session accuracy, and user journey tracking.
26. Consent banner configuration with third-party consent plugin detection, banner position controls, colors, title, and message settings.
27. A/B Testing dashboard with running tests, drafts, completed tests, impressions, search, filters, conversion rate, and test results actions.
28. A/B Testing decision engine results with weighted goals, recommended winner, composite score by variant, per-goal breakdown, and Pro-only heatmap impact by variant.
29. A/B Testing click-goal results with statistical significance, confidence, goal configuration, variant conversion rates, winner status, Pro-only Bayesian analysis, and conversion trend chart.
30. Smart Insights: one card per problem, ranked by the visitors it costs, with confidence, evidence, the next action and a "How it works" strip showing what each module sent.
31. Smart Insights notification panel with new problems and the admin menu light (red, yellow, green).
32. How it works page: the seven collectors with your own numbers, the four-step loop, the Setup check and the first-days checklist.
33. Pro: Page X-Ray report with health score, behavior map, page audit, WordPress changes and action plan.

== Changelog ==

= 1.10.1 - 2026-10-20 =
* **New:** Shop screen for WooCommerce sites (menu Opti-Behavior > Shop): product views, adds to cart, checkouts and paid orders, and the lost visits of each product (product views that did not lead to an add to cart), worst product first. The shop counters store no order number, customer name, e-mail address or coupon code.
* **New:** "Shop" block in the scheduled e-mail report on WooCommerce sites: product views, adds to cart, paid orders and failed payments of the report period compared with the period before, the three products that lose the most visits and a link to the Shop screen. No block when nothing was counted.
* **New:** Print or save as PDF a site report from Opti-Behavior > Reports. It opens with a Summary (traffic tiles and the three most costly issues), then one section for each part of your site that has data: Traffic, Shop, Clicks and errors, Busiest time, Journeys and funnels, A/B tests. Charts have round graduations. A "Site report" link in the header of Traffic and Smart Insights opens it with the same period.
* **New:** Optional "Made with Opti-Behavior" line at the end of a report, off by default.
* **New:** The country of a visitor now comes from a free local database (DB-IP Lite) included in the plugin, in every privacy mode: the visitor IP address is no longer sent to ip-api.com / ipwho.is. Countries work right after activation, with no download; an optional monthly update is in Settings > Traffic & Behavior > Country database. IP Geolocation by DB-IP.
* **New:** Traffic Channel filter: visits coming from ChatGPT, Perplexity, Claude and Copilot have their own channel, "AI Assistants". They were counted in "Organic Search": that figure goes down by the same number, also for past periods (the visits are reclassified when the report is read, nothing is lost). Gemini has no referrer of its own and stays under Google. A visit whose link carries utm_source=chatgpt.com (or chat.openai.com, perplexity, perplexity.ai, claude.ai, copilot.microsoft.com) is counted there too, even when the browser sends no referrer; a paid click (utm_medium cpc, ppc, paid) stays in "Paid Ads".
* **New:** Smart Insights: without Pro, the "Page X-Ray" tab now shows a real preview: your three most visited pages of the period (20 visits or more), each with a health score and the headline of its first problem, computed from the data the free plugin collects (bounce, scroll depth, clicks, funnels). The full report stays in Opti-Behavior Pro.
* **New:** Traffic and Heatmaps: during the first days, a box at the top of the page says whether visits are received (waiting, warning or error, with the action to take). "Visits are received" is shown once. A site installed for more than 7 days that has visits shows no box.
* **New:** License & Quota tab: "Already have a Pro trial or license?" block with an "Open My account" link to optiuser.com (no address and no parameter in the link).
* **New:** With Opti-Behavior Pro installed, when its licence could not be confirmed, the Recordings, User Journeys, Errors and Forms pages show the reason, a "Re-check licence" button and a link to the License & Quota tab, instead of an empty or upgrade page. The menu shows an amber dot.
* **New:** Scheduled e-mail report, new design: the key figures first (visits, page views, time per visit, bounce, with their change), the three most costly issues, top sources, devices and most viewed pages, the most clicked element with a link to its heatmap, the Shop block and an A/B test block, each with one "What it means / What to do" sentence. A summary subject line and inbox preview, a plain-text version, a layout for phones and dark mode.
* **New:** Top Pages shows the page views of each page. The Traffic export includes the campaigns.
* **New:** The Opti-Behavior brand mark at the top of the Opti-Behavior screens, of the reports and of the report e-mails.
* **Improved:** Deactivation survey: a "Skip & Deactivate" button, a sentence that says what is sent to optiuser.com if you submit, and two new reasons. The Deactivate click never waits when optiuser.com cannot be reached.
* **Improved:** Smart Insights: the severity of a card is its coloured left edge, the page ends with room for the floating Insights button, the Insights button keeps your choice, and the "How it works" strip is open on the first visit only.
* **Improved:** Settings, data retention: on WooCommerce sites, the detailed data line also names the store events.
* **Improved:** Review request: it is shown only after an administrator has seen their own data (a heatmap with clicks opened, or a funnel report with entries), from the next Opti-Behavior screen, never before 48 hours after install and never next to another Opti-Behavior banner. New text with "Leave a review", "Maybe later" and "Don't ask again".
* **Improved:** Settings > Privacy: "Anonymous Mode" is now labelled "Cookieless mode (pseudonymised, 24 h)", with a short note under the choice: this is pseudonymisation, not anonymisation, and GDPR still applies. The behaviour is unchanged.
* **Improved:** Heatmap detail: the "AI Insights" panel is now titled "Top Clicked Elements", with the subtitle "Ranked by number of clicks". The list itself is unchanged.
* **Improved:** How it works: in the Setup check card, a check that needs an action is one full-width band with its button; the checks that pass are small tiles on one row.
* **Improved:** Settings > Danger Zone: one white card per sensitive action with a red outline button, and the size of each Full Reset category at the end of its line. Texts and behaviour are unchanged.
* **Improved:** Settings > Traffic & Behavior: the Country database card shows its status, a switch for the monthly update and an "Update now" button. "IP Geolocation by DB-IP" is credited in this card.
* **Improved:** Traffic, reports and report e-mails: the change of a rate (bounce, scroll depth) is shown in points, the change of a count in percent. When the previous period has too few days of data to compare, the change says "new" instead of a made-up +100%.
* **Improved:** Funnels created by the plugin itself are marked "Suggested" with a "Confirm" button. Until you confirm one, it is not counted in Smart Insights, Page X-Ray or the reports.
* **Improved:** Smart Insights: funnel step names are readable, each card links to its main report, and an open card that an updated rule no longer finds is closed.
* **Improved:** Display: the realtime map fits every visitor, the Traffic chips are never cut, and the Heatmaps list has clearer folder and device labels with one sort arrow.
* **Improved:** Every new screen, report and e-mail text is translated in French, German, Spanish, Italian and Brazilian Portuguese.
* **Fix:** www.example.com and example.com are now one page in Top Pages and in the Page X-Ray preview. Another sub-domain stays its own site.
* **Fix:** An address under the search permalink base (for example /search/term/) is a search page, like ?s=. It leaves the Page X-Ray preview and its heatmap follows the archive rule.
* **Fix:** The country is no longer guessed from the browser language (it was often wrong, e.g. "United States" for any en-US browser). Without Cloudflare and without the country database it shows "Unknown". The language itself is still recorded.
* **Fix:** License & Quota tab: the "could not initialize" card was shown without Opti-Behavior Pro. It is now shown only when Pro is loaded.
* **Fix:** Time per page and per visit: a page view counts 30 minutes at most and a visit 4 hours at most, so a tab left open no longer inflates the averages. Older data is read the same way; nothing is rewritten.
* **Fix:** Funnels count entries from real visits only, following the spam setting of the site.
* **Fix:** Smart Insights: the admin menu, the Smart Insights screen and the site report show the same number of open problems.
* **Fix:** Reports: "the three most costly issues" uses the open Smart Insights cards that overlap the period, so a report no longer says "No costly issue" while problems are listed.
* **Fix:** Report e-mail: scroll depth and referrers are the same as on the Traffic screen, and the addresses of one page (www, trailing slash, tracking parameters) are one row in Top pages.
* **Fix:** Traffic: the Top Page and Top referrer chips show the first row of their widget.
* **Fix:** Shop: an add to cart from a plain link (?add-to-cart=) is counted when the visitor comes from a page of your site. A product with adds to cart but no measured product view shows "Not measured" instead of 0.
* **Fix:** The short site report no longer shows the Pro line when Opti-Behavior Pro is active.
* **Privacy:** Pro: session-linked shop events are recorded only in Full mode, after the visitor's consent. Anonymous mode keeps daily counters only, with no session.
* **Privacy:** Anonymous Mode, and Full Tracking before the visitor accepts: the tracker no longer reads the time zone or the browser language on the visitor's device. The language comes from the Accept-Language header the browser already sends.
* **Privacy:** Anonymous Mode: the daily salt behind the anonymous visitor identifier is now random, kept for one UTC day and deleted the next day, so a past identifier cannot be rebuilt. The geolocation cache key is no longer built from the bare IP address.
* **Privacy:** The log of bot visits stores the full IP address only in Full Tracking mode. In the other modes it keeps the network part only (IPv4 /24, IPv6 /48).
* **Privacy:** An older session-start path could store the real IP address. It now follows the same rule as the live one (real IP only in Full Tracking with consent), and its unused entry point was removed.
* **Privacy:** Full Tracking before the visitor accepts: when another visitor on the same IP address had accepted during the last hour, the cached region, city and time zone could be stored for the visitor who had not. Without consent nothing is taken from that cached answer.
* **Privacy:** WooCommerce order numbers are removed from the page addresses Opti-Behavior stores (order received, view order and order pay pages, also with plain permalinks). The page itself is still counted, so a funnel step on the order received page keeps working.
* **Privacy:** Address parameters with a secret name (password reset key, reset token, API key...) are removed from tracked page addresses, Top Pages and exports.
* **Privacy:** Realtime visitors and the Traffic export never show a whole IP address: in Full Tracking mode the end is hidden (IPv4 x.x.x.0, IPv6 /48), in the other modes the visitor is "Anonymous". A privacy mode that cannot be read is treated as anonymous.
* **Privacy:** Top Engaged Users shows an anonymous visitor as such, with no login name and no profile link.
* **Docs:** The readme, the settings and a new suggested privacy policy text (in the WordPress privacy guide) describe the local country database (DB-IP Lite).

= 1.10.0 - 2026-10-10 =
* **New:** Smart Insights "Things to check": page, funnel, engagement, scroll, mobile bounce and traffic spike cards now list the checks behind the problem, each one measured on your own data and shown as a compact card ("Not measured" when there is not enough traffic yet).
* **New:** Smart Insights cards have a clearer design: severity colour, key figures in tiles, a short story per signal family and a detail panel. Free users see every result Free computes.
* **New:** Spam filter: automated visits (headless browsers, scripts) are refused at collection and filtered from every report, even when they arrive with a referrer.
* **New:** Heatmap detail: hovering a click area shows "N clicks in this area" in the free plugin too, following the Count Bar Display setting. On small sites the Heatmaps list is up to date right away.
* **New:** The Pro feature pages (Recordings, User Journeys, Errors, Forms) explain what each feature does, with the trial button first. The Pro trial notice has a new design and can be closed for good.
* **Changed:** Pro trial: every "Try Pro" / "Upgrade to Pro" link (welcome screen, trial notice, Pro feature pages, heatmap, Smart Insights, A/B tests, Settings) opens the same Pro trial page on optiuser.com in a new tab. The plugin no longer starts a trial in one click and no longer downloads or installs Opti-Behavior Pro. It sends nothing when you click: only your site address travels in the link.
* **Changed:** Welcome screen: the data-sharing question is asked right after activation, only when Free runs alone, you can decline it, and the Pro trial is a separate choice. Settings show one line "Installation status: Shared / Not shared" with a Change link. Announcement banners are fetched only after you accept the daily status message, or with Pro active.
* **Changed:** The per-audience segment breakdown and the Weekly CRO Summary are now part of Opti-Behavior Pro.
* **Changed:** "How it works": the lines from the active modules to Smart Insights are animated. A/B tests: a click goal that is not a CSS selector (an XPath, for example) is refused with a clear message.
* **Security:** Admin screens (Traffic browsers / referrers / top pages, Smart Insights, A/B test builder) now escape quotes in every value they display, so a crafted browser name, referrer or page title sent by a visitor can no longer run script in the admin. A leftover debug branch of the heatmap data endpoint was removed.
* **Privacy:** Personal data (e-mail, user name, tokens, keys) is removed from tracked page addresses. Addresses already stored are cleaned in the background.
* **Performance:** wp-admin no longer waits when api.optiuser.com cannot be reached: the daily status message is sent in the background and the deactivation survey never holds the Deactivate click. Dashboard widget caches are cleared without heavy database queries.
* **Fix:** Same numbers everywhere: Traffic visitors, new / returning and Top Pages use one set of visits; Smart Insights, funnels and Page X-Ray count the same visits; Top Pages shows one row per page; the Heatmaps list and detail show the same click count.
* **Fix:** Smart Insights figures: each card shows the loss of its own gap (exit rate, scroll, segment vs all visitors), related cards never repeat the main card's figure, traffic spikes show no loss figure, and old figures are cleared on recalculation. A story card is never hidden as noise.
* **Fix:** Smart Insights: cards are regenerated once after each plugin update, the briefing stacks on phones, the Severity filter and severity sort work in every admin language, the Reset button appears with "All statuses", success messages stay visible, and the detail window moves keyboard focus.
* **Fix:** Traffic: "% vs last period" shows "—" when there is no previous period, an idle tab no longer inflates the visit duration, the Traffic Channel filter classifies visits exactly like the dashboard, and the review reminder only appears on the plugin's own screens.
* **Fix:** Heatmaps: Refresh now really clears the cached heatmap; deleting heatmap data keeps the device and type you were looking at; Reset puts the header period back to All time; switching views quickly never shows the previous view's numbers. Heatmaps taken over by URL query variants (?utm=…) are repaired and grouped like the list.
* **Fix:** Heatmaps list: a page number past the last page shows the last page; searching keeps your sort; the first click on a column sorts high to low.
* **Fix:** Funnels: editing a paused funnel keeps it paused, a deleted funnel cannot be saved back, a step without a URL is refused, the report of a paused funnel opens, a failed Re-scan no longer locks the button, and changing period quickly never shows the old numbers.
* **Fix:** A/B tests: "Declare Best Performer" no longer crowns a variant on a tie or without data. Numbers and dates follow your admin language. Filter profile labels are translatable. The onboarding popup sends its answer once.
* **Fix:** Heatmap image download — on long pages the downloaded PNG showed the clicks shifted and paler than the heatmap on screen. The image now shows every click exactly where the screen does, and very long pages no longer produce an empty image.
* **Fix:** With Opti-Behavior Pro on a renewed trial (or a licence bought after the trial), the red "Your Pro Trial Has Ended" banner could appear while Pro was working. It is no longer shown when the licence server confirms the licence is active.
* **Fix:** Smart Insights — "Visitor Confusion Pattern" now compares a page's button clicks with a site average in the same unit, and "quick visit" signals respect the minimum session duration of your spam filter.
* **Fix:** The code passes the WordPress.org Plugin Check without errors, and the plugin name is the same in the plugin list and on its WordPress.org page.

= 1.9.2.1 - 2026-09-25 =
* **Security:** Hardening from the WordPress.org security review. Funnel events are tied to the visitor's own session cookie, so a public request can no longer report made-up sessions, and new funnel entries are limited per visitor IP. Forwarding headers (X-Forwarded-For, Client-IP, CF-Connecting-IP) are only trusted from Cloudflare or from a reverse proxy on your own network. Visitor IP addresses are never sent to a geolocation service before the visitor accepts the consent banner, and outbound geolocation lookups are limited per minute.
* **Fix:** Translation files no longer contain pieces of source code in their translator comments (a build tool copied them by mistake; security scanners reported them as suspicious). Translations are unchanged.

= Earlier versions =
Full changelog: changelog.txt (in the plugin folder) / [https://optiuser.com/opti-behavior/changelog/](https://optiuser.com/opti-behavior/changelog/)

== Upgrade Notice ==

= 1.10.1 =
Shop counters for WooCommerce, a site report to print or save as PDF (Opti-Behavior > Reports), a new scheduled e-mail report, a Page X-Ray preview and privacy changes: the country comes from a local database included in the plugin. Pair with Opti-Behavior Pro 1.10.1.

= 1.10.0 =
Smart Insights "Things to check" and clearer cards, Pro trial now starts on optiuser.com (nothing installed from the plugin), personal data removed from tracked URLs, same visit counts on every screen, admin security escaping and many fixes. Pair with Opti-Behavior Pro 1.10.0.

= 1.9.2.1 =
Security hardening from the WordPress.org review: funnel events tied to the visitor session, trusted-proxy IP detection, no geolocation before consent, clean translation files. Includes everything in 1.9.2. Update recommended.

= 1.9.2 =
Security release: fixes an unauthenticated stored cross-site scripting issue (CVE-2026-95686, CVE-2026-95809) and a spam recalculation that could hide every session. Update as soon as possible. Pair with Opti-Behavior Pro 1.9.2.

= 1.9.1 =
Performance and storage release: deferred, minified trackers, heatmaps only on pages that matter, a much smaller events table, database size caps and server-stability fixes for busy sites. Pair with Opti-Behavior Pro 1.9.1.

= 1.9.0 =
Major release: Smart Insights v2 analyst briefing (cost-ranked insights, money impact, evidence), automatic funnel creation from site detection, cleanup safety-limit rework with a 50000 per-run default, and a fix for an HTTP 500 on concurrent first-visit tracking. Pair with Opti-Behavior Pro 1.9.0.

= 1.7.1.2 =
Smart Insights usability release: notification cards, the Smart Insights center, and insight details now show when each signal was detected (relative time with exact date on hover). Pair with Opti-Behavior Pro 1.7.1.2 to keep both plugins on the same version.

== Privacy Policy ==

Opti-Behavior collects user interaction data to provide analytics insights. This data includes:

* Page URLs and titles
* Click coordinates and target elements
* Mouse movement patterns
* Scroll depth
* Session timestamps
* Referrer URLs
* Browser and device information
* IP addresses (can be anonymized)
* Approximate location: the country only. It comes from the Cloudflare header when present, otherwise from the visitor's IP address, looked up on your own server in the local DB-IP Lite country database, in every privacy mode. The IP address is not sent to any third party. Without Cloudflare and without the database, no country is recorded (the screens show "Unknown"). The browser language and the time zone are never used to guess a country.

**Data Storage:** All analytics data is stored locally in your WordPress database or file system. No data is sent to external analytics servers.

**External Services:** The country of a visitor is found on your own server, from the Cloudflare header or the local DB-IP Lite country database. The visitor's IP address is not sent to any geolocation service. The database is included in the plugin; a newer file is downloaded from db-ip.com only after an administrator asks for it. See the "External Services" section above for complete details.

**Usage Tracking:** With your explicit consent (granted via the first-run welcome screen), this plugin sends usage statistics to api.optiuser.com once every 24 hours. The data includes: site URL, plugin version, WordPress version, PHP version, and one best available administrator contact email when a valid contact exists. This data is used solely to understand plugin adoption, support license/trial email flows, and improve the product. Tracking only begins after you click "Accept & Continue" on the welcome page shown at first activation. You may review our full data practices at https://optiuser.com/privacy-policy/

**No analytics cloud:** Opti-Behavior does not sell visitor data or send it to an analytics platform. No visitor data is sent to a geolocation service: the country is looked up on your own server (see External Services). You are the data controller.

**User Rights:** You have full control over data retention and deletion. Users can request data deletion at any time.

When using this plugin, ensure your site's privacy policy discloses:
* What data is being collected
* How long it is retained
* Who has access to it
* How users can request deletion
* That analytics data is stored locally on your server
* That the visitor's IP address is used on your own server to determine the country (DB-IP Lite database), and is not sent to any third party

== Third-Party Libraries ==

This plugin bundles the following open-source libraries:

= Chart.js =
* Version: 4.4.0
* License: MIT License
* Homepage: https://www.chartjs.org/
* Used for: Rendering analytics charts and graphs

= Leaflet =
* Version: 1.9.4
* License: BSD 2-Clause License
* Homepage: https://leafletjs.com/
* Used for: Real-time visitor map visualization

= heatmap.js =
* Version: 2.0.5
* License: MIT License
* Homepage: https://www.patrick-wied.at/static/heatmapjs/
* Used for: Generating visual heatmaps of user interactions

= Lucide =
* Version: 0.554.0
* License: ISC License
* Homepage: https://lucide.dev/
* Used for: Icon library for the admin interface

All bundled libraries use GPL-compatible licenses (MIT, BSD 2-Clause, and ISC) and are included locally within the plugin. See THIRD-PARTY-LICENSES.txt in the plugin directory for full license texts.

== Credits ==

Developed by [OptiUser](https://optiuser.com/)

IP Geolocation by DB-IP (https://db-ip.com), CC BY 4.0. The DB-IP Lite country database is included unmodified in assets/geo/ (see assets/geo/NOTICE.txt).
