=== Universal Reviews – Ratings, Forms Reviews, Google Reviews, Social-Proof ===
Contributors: universalwp
Tags: reviews, google reviews, product reviews, ratings, customer reviews
Requires at least: 6.2
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.1.1
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Collect, moderate and show ratings and photo reviews on any post or product, plus optional Google reviews. Elementor, blocks and review schema.

== Description ==

**Universal Reviews lets visitors rate and review anything on your site, and gives you one clean place to moderate what they say.**

Attach reviews to posts, pages, custom post types, WooCommerce products, taxonomy terms, users or your whole business, and show them with **Elementor widgets**, **Gutenberg blocks** or **shortcodes**. Reviews live in their own indexed database tables, so lists and summaries stay fast.

= Free features =

* **Form builder** — 12+ field types, photo uploads and per-review-type rules.
* **Review types** — Product, Service, Place or your own, with whole or half stars.
* **Moderation** — Approve, reject, reply and bulk-action from one dashboard.
* **Anti-abuse** — Honeypot, time trap and rate limiting, no CAPTCHA needed.
* **Display** — Star summaries, filters, helpful votes, owner replies and AggregateRating JSON-LD.
* **Google Reviews (optional)** — Connect your own Google Business Profile and show up to 50 recent reviews. Not affiliated with Google.

= Pro features =

Templates, social-proof widgets, analytics, migration, webhooks, AI assist, review requests, sources, and more Google Reviews options (grid, carousel, design styles, more locations).

See the **Features** section for the full list, setup steps and who it is for.

== Features ==

= Free features =

* **Review Forms & Field Builder** — Drag-and-drop form builder with 12+ field types, photo uploads, and per-review-type rules. Import and export templates as JSON, and preview before publishing.
* **Review Types** — Define Product, Service, Place or any custom type, each with its own moderation policy and schema.org type. Choose whole or half-star rating scales per type.
* **Moderation Dashboard** — A focused React-powered queue to approve, reject, reply to and manage incoming reviews. Filter, search, sort and bulk-action across large review collections.
* **Anti-Abuse Protection** — Honeypot, signed time trap, per-IP rate limiting and duplicate-submission blocking — no CAPTCHA required. Sensible defaults out of the box, fully configurable.
* **Elementor & Gutenberg** — Native Review Form and Reviews List widgets/blocks with live previews and style controls. Shortcodes also available for any theme or page builder.
* **Display & Schema.org** — Star-rating summaries, filtering, helpful votes, owner replies and verified badges on the front end. AggregateRating JSON-LD output for real search-result rich snippets.
* **Google Reviews (optional)** — Connect your own Google Business Profile with OAuth (your own Google Cloud project; tokens are encrypted) and show up to 50 recent Google reviews from one location, refreshed daily, with a rating summary, Load more, display options and a Google attribution line. Use the `[unirev_google_reviews]` shortcode, the Google Reviews block or the Google Reviews Elementor widget. Shown from a temporary local copy (kept for at most 30 days), so visitors never trigger a Google request. Disconnect any time to delete it.
* **Built for performance** — Dedicated indexed database tables and precomputed rating totals, with server-side filtering and pagination. Stays fast even with large review collections.

= Pro Features =

adds 9 premium modules on top of everything above.

* **Templates** — 10 ready-made review forms for shops, restaurants, hotels, events and more. Import any template into a working form in one click.
* **Social-Proof Widgets** — A floating rating badge for every page, plus a reviews carousel block/shortcode. Server-rendered from a cached summary, so it appears instantly with no layout shift.
* **Analytics** — Server-side event tracking (created, approved, rejected, replies) with per-day charts. No visitor tracking or cookies involved.
* **Migration** — Move existing WooCommerce product reviews or rating-carrying comments into Universal Reviews. Batched, resumable, and safe to re-run.
* **Webhooks** — Signed JSON deliveries for every review event, retried automatically on failure. Full delivery history, with per-endpoint auto-disable after repeated failures.
* **AI Assist** — AI-generated summaries, sentiment scoring and reply drafts for your reviews. Reviewer names are never sent, and API keys are encrypted at rest.
* **Review Requests** — Invite customers by email with single-use links that prefill the review form. Track sent, opened and completed requests from one screen.
* **Sources** — Import reviews from any HTTPS JSON feed, with field mapping and deduplication. Scheduled syncs run safely in the background.
* **More Google Reviews** — Grid layout with 2–4 columns, carousel, card styles, star colour and rating filter, up to 500 reviews per location, and up to 25 Google locations with a location choice per block, shortcode or widget.

= Set it up in about three minutes =

1. Install and activate the plugin.
2. Open **Reviews** in the admin menu and look over **Forms**, **Review Types** and **Settings**. The defaults are sensible.
3. Edit a post, page or product and add `[unirev_reviews show_form=1]`, or drop in the **Reviews List** block, or use the **Reviews List** widget in Elementor.
4. Visit the page, leave a test review, then approve it under **Reviews → Reviews**.
5. Optional: open **Reviews → Google Reviews** to connect your Google Business Profile and show your Google reviews too.

You now have a rating summary, a review list and a review form on the page.

= Who is it for? =

* **Online stores** that want customer reviews and star ratings on WooCommerce product pages.
* **Local businesses and service providers** who want reviews of the business itself, including their Google reviews.
* **Agencies, freelancers and course creators** collecting testimonials.
* **Directories and membership sites** where people review listings, users or categories.
* **Elementor and block-editor users** who want review widgets that match their design.

### Collect, protect and moderate

Build review forms with a drag-and-drop field builder — rating, heading, text, textarea, select, radio, checkbox, number, email, URL, phone, date and hidden fields — mark fields required, add placeholders, help text and custom CSS classes, and let reviewers attach JPEG, PNG, WebP or AVIF photos with size and count limits (SVG is never accepted). Create review types such as Product, Service or Place, each with its own moderation policy, allowed targets and schema.org type, and whole or half-star scales. Import and export form templates as JSON and preview before publishing.

Every submission passes layered anti-abuse protection — honeypot, signed time trap, per-IP rate limiting, one-review-per-person-per-item, consent and same-site origin checks — with no CAPTCHA. The React-powered moderation dashboard lets you filter, search, sort and bulk-action reviews; approve, reject, spam, trash, feature or delete them; reply as the owner; mark as verified; view original answers; and keep a change history. It uses server-side filtering, sorting and cursor pagination, so the browser never loads the whole database. An optional daily digest emails you when reviews are waiting.

### Display reviews

Add reviews with Elementor widgets, Gutenberg blocks or the `[unirev_form]`, `[unirev_reviews]` and `[unirev_summary]` shortcodes. The Reviews List and Review Form blocks and widgets are server-rendered and share the same forms, review types and moderation queue, with a live editor preview, a dropdown of saved forms, a searchable picker for posts, products, terms and users, and colour and size controls. Elementor is optional — the plugin works the same without it.

Front-end features include a rating summary with average and total, a 5-to-1 star distribution, star-rating filtering (such as 4+ stars), a "Helpful" vote button, a "Load more reviews" button, photo thumbnails, owner replies, verified badges, keyboard-friendly star selection, inline validation and theme-friendly `--unirev-*` CSS variables. CSS and JavaScript load only on pages that show a widget, so your layout doesn't jump.

### SEO and structured data

Universal Reviews can output AggregateRating JSON-LD — the review schema behind star ratings in search results — but only when the page actually displays a target's review list or summary and the target has approved reviews, never for private content. It uses the correct worst rating for half-star types, a stable `@id`, merges reviewed items into one `@graph`, limits output to valid schema.org types (filter `unirev_schema_types`) and offers a `unirev_schema_output` filter to avoid duplicates with WooCommerce or your SEO plugin. Structured data never guarantees a rich result; search engines decide whether and how it appears.

### Performance

Reviews use dedicated, indexed database tables with precomputed rating totals and distributions, so public lists and summaries never run `COUNT(*)` per page view. Background jobs support retry, cancellation and recovery from stuck jobs, and jobs and logs older than 30 days are purged automatically. An optional persistent object cache such as Redis or Memcached makes repeated public queries cheaper but is not required, so the plugin stays practical from hundreds of reviews to much larger collections.

### Import, export and privacy

The Tools area includes streaming CSV and JSON export (with spreadsheet formula-injection protection), batched CSV import of up to 5,000 rows per file with row-level errors, background jobs with retry and cancellation, logs and table-size diagnostics.

Privacy is built in: reviewer IP addresses are not stored by default, and the plugin integrates with the WordPress privacy exporter and eraser (custom answers included). Erasing personal data anonymises reviewer name, email and IP while keeping the review text as a business record. Review data remains after deactivation and is deleted on uninstall only when you enable "Delete all data on uninstall" (each multisite site manages its own setting). No telemetry is sent. Always configure retention, consent and privacy settings according to your site's legal and business requirements.

### Support and community

* [Support Forum](https://wordpress.org/support/plugin/universal-reviews/) – ask questions and report issues.
* [Facebook Community](https://www.facebook.com/profile.php?id=61594808884671) – share feedback and follow updates.

== Installation ==

### Install from your dashboard (easiest)

1. Go to **Plugins → Add New Plugin**.
2. Search for **Universal Reviews**.
3. Click **Install Now**, then **Activate**.

### Upload the ZIP from WordPress admin

1. Download the `universal-reviews` plugin ZIP.
2. In WordPress, go to **Plugins → Add New Plugin**.
3. Select **Upload Plugin**.
4. Choose the `universal-reviews.zip` file.
5. Click **Install Now**.
6. After installation finishes, click **Activate Plugin**.

### Install manually

1. Download the plugin ZIP.
2. Extract the `universal-reviews` folder.
3. Upload the folder to `/wp-content/plugins/`.
4. Open **Plugins → Installed Plugins** in WordPress.
5. Find **Universal Reviews**.
6. Click **Activate**.

### After activation

After activation, open **Reviews** in the WordPress admin menu.

Start with:

1. **Reviews → Forms** — review the default form or create another form.
2. **Reviews → Review Types** — configure Product, Service, Place or another review type.
3. **Reviews → Settings** — check moderation, anti-abuse, display, privacy and notification settings.
4. Add a review form and review list using a shortcode or Gutenberg block.
5. Submit a test review from the front end.
6. Open **Reviews → Reviews** and test the complete moderation workflow.
7. Approve the test review and confirm that the review list and summary appear correctly.

For the quickest setup, add this shortcode to a post, page or product:

`[unirev_reviews show_form=1]`

This displays the review list and enables the form for the current supported target.

Using Elementor? Edit the page, search the widget panel for **Reviews List** or **Review Form**, and drag it where you want it.

Requirements: WordPress 6.2 or newer and PHP 7.4 or newer. WooCommerce and Elementor are optional.

### Deactivation and uninstall

Deactivating Universal Reviews does not remove review data.

By default, database tables and settings remain available after deactivation. If you want WordPress to remove the plugin's stored data during uninstall, enable **Settings → Privacy → Delete all data on uninstall** before deleting the plugin.

Use this option carefully because uninstall data deletion is intended to be permanent.

== Frequently Asked Questions ==

= Does Universal Reviews require WooCommerce? =

No. WooCommerce is not required.

Reviews can target WordPress posts and custom post types, taxonomy terms, users, the site/business and other supported targets. WooCommerce products are supported as the `product` post type.

Universal Reviews does not read WooCommerce orders for purchase verification. A moderator can mark a review as verified from the Reviews screen, and developers can add their own verification logic through the `unirev_verification_providers` filter.

= Can I use Universal Reviews for custom post types? =

Yes. The `post` target type can work with WordPress post types, including custom post types, when the target is public and supported by the plugin's target validation.

= Does Universal Reviews work with Elementor? =

Yes. Version 1.0.2 adds Elementor widgets for the Review Form and the Reviews List. Drag them onto any Elementor page, template or product layout. They share the same forms, review types and moderation queue as the blocks and shortcodes.

= Can I use it without a page builder? =

Yes. Elementor is optional. Universal Reviews also works with the WordPress block editor and with shortcodes, and you don't need a special theme.

= How do I add star ratings and customer reviews to a WordPress page? =

Add `[unirev_reviews show_form=1]` to the page, insert the **Reviews List** block, or drop in the **Reviews List** widget in Elementor. Visitors will see the rating summary, the approved reviews and the review form.

= How do I show reviews on WooCommerce product pages? =

WooCommerce products are supported as a review target. Add the shortcode, block or Elementor widget to your product description, product template or product layout. Universal Reviews doesn't take over the built-in WooCommerce reviews tab.

= Can visitors upload photos with their review? =

Yes. Reviewers can attach JPEG, PNG, WebP or AVIF photos, and you control the size and number of photos. SVG uploads are never accepted. Photos that can't be verified as real images are rejected, and photos are deleted when a review is rejected or marked as spam.

= Can I collect reviews for my business instead of a page? =

Yes. Use the `business` target type to collect reviews about your company as a whole, then show them anywhere with the same widgets, blocks and shortcodes.

= Can I customize the review form? =

Yes. The form builder supports multiple field types, required fields, half-width layouts, placeholders, help text, headings, text blocks and custom CSS classes. Form styling uses `--unirev-*` CSS variables.

= Can I create different review forms? =

Yes. Forms can be created and managed from **Reviews → Forms**. Forms can be associated with supported review types and embedded with the form shortcode or Review Form block.

= Can I use half-star ratings? =

Yes, since version 1.0.1. Choose **Half stars** under **Star steps** when editing a review type in **Reviews → Review Types**. Types default to whole stars (1 to 5).

= Does the plugin store IP addresses? =

Not by default. IP storage is disabled by default and can be enabled from the privacy settings when a site needs it.

= What happens when I deactivate the plugin? =

Deactivation does not delete reviews, settings or database tables.

Data is removed during uninstall only when **Delete all data on uninstall** has been enabled in **Settings → Privacy**.

= Do I need Redis or another object cache? =

No. Universal Reviews does not require Redis or Memcached.

Rating aggregates are precomputed in a summary table. A persistent object cache can further reduce repeated public queries when available.

= Does the plugin add review schema automatically? =

When enabled, Universal Reviews can output AggregateRating JSON-LD for supported targets whose review list or summary is actually displayed and which have approved reviews.

Structured data eligibility does not guarantee a search-engine rich result.

= Does Universal Reviews guarantee Google star snippets? =

No. The plugin outputs supported structured data according to its configuration and visible review content, but search engines independently decide whether structured data qualifies for or appears as a rich result.

= Will it work with Hindi, Arabic, Chinese and emoji text? =

Yes. Titles, names, answers and avatar initials are cut on character boundaries, so non-Latin text and emoji are no longer corrupted.

= Can the business owner reply to reviews? =

Yes. Moderators with the appropriate capability can add owner replies. Replies are displayed beneath the review on the front end.

= Are my Google reviews stored permanently? =

No. They are a temporary copy kept for at most 30 days and refreshed daily. Disconnecting deletes them immediately.

= Google says my server could not be reached, or the location list times out. =

Your server must be able to make outgoing HTTPS requests to Google (`*.googleapis.com` and `accounts.google.com`). Ask your host to allow them, then press Try Again. If you connected the wrong account in the meantime, use Change Google account.

= What happens to privacy data when a review is erased? =

Universal Reviews integrates with the WordPress privacy exporter and eraser. Personal information such as reviewer name, email and stored IP data can be anonymised while the review text remains as a business record.

= Where is the source code for the compiled admin app? =

The admin dashboard (`assets/admin/index.js` and `assets/admin/index.css`) is compiled from the human-readable TypeScript/React source in the `admin-src/` folder, which ships inside the plugin. To rebuild it, run `npm install` and then `npm run build` in the plugin folder (esbuild bundles the JavaScript and the Tailwind CLI builds the CSS; see `admin-src/README.md`). The bundle includes React, React DOM, Radix UI, lucide-react, class-variance-authority, clsx and tailwind-merge, all under MIT-compatible licences. The front-end script (`assets/admin/frontend.js`), the block editor scripts (`blocks/*/edit.js`) and the PHP are not minified.

== External services ==

Universal Reviews works fully offline. The only external service it can contact is **Google**, and only if you choose to connect Google Reviews (Reviews → Google Reviews). Nothing is sent to Google, and no Google code is loaded, otherwise.

When you connect Google Reviews, your server contacts these Google endpoints using your own Google Cloud project and the Google account you authorize:

* `accounts.google.com` and `oauth2.googleapis.com` — OAuth 2.0 sign-in, token exchange, token refresh and token revocation. Data sent: your OAuth Client ID/Secret, the authorization code and your tokens.
* `mybusinessaccountmanagement.googleapis.com`, `mybusinessbusinessinformation.googleapis.com` and `mybusiness.googleapis.com` — the Google Business Profile APIs, used to list the accounts and locations you manage and to read reviews for the location you select. Data sent: your access token and the account/location IDs.

Requests happen when you press Sync Now, during the daily scheduled sync, and while you set up the connection — never when a visitor loads a page. If a reviewer has a Google profile photo, visitors' browsers load that image from Google's image servers (googleusercontent.com).

Google's terms: https://policies.google.com/terms — privacy policy: https://policies.google.com/privacy — Business Profile API terms: https://developers.google.com/my-business/content/terms

== Google Reviews ==

Show recent reviews from your Google Business Profile next to your own reviews. Google Reviews is optional and never required for the rest of the plugin.

**What you need**

* A Google Business Profile you own or manage (verified and active).
* Your own Google Cloud project with the Business Profile APIs enabled and API access approved by Google. Google requires each business to use its own approved project, so Universal Reviews does not ship a shared one.
* An OAuth client ID of type "Web application" with this authorized redirect URI: `https://your-site.example/wp-admin/admin-post.php?action=unirev_google_oauth` (the exact URL is shown on the setup screen).

**Setup**

1. Open Reviews → Google Reviews.
2. Enter your Google Client ID and Client Secret and click Save Credentials.
3. Click Connect Google, sign in with the Google account that manages the business, and approve access.
4. Choose a location. The first sync runs immediately.

**Changing the Google account or credentials:** open Reviews → Google Reviews and use **Change Google account**, **Edit Client ID & Secret** or **Disconnect**. These are also available on the location screen, so a failing Google request never leaves you stuck. Signing in with a different Google account clears the previous location and its cached reviews.

**Display:** use the `[unirev_google_reviews]` shortcode, the **Google Reviews** block or the **Google Reviews** Elementor widget. Google review URLs are only linked when Google supplies one.

**Display options (Reviews → Google Reviews → Display):** layout, reviews per page, rating summary, reviewer name, date, review text, Google attribution, rating filter, Load more, star style and size, spacing, text size and button style.

**Pro, multiple locations:** with Pro you can add more locations (**Add location**), switch between them on the Google Reviews screen, and choose which one a shortcode (`connection="ID"`), block or Elementor widget shows.

Universal Reviews is not affiliated with, endorsed by or sponsored by Google. Google review data is not added to your schema.org review markup.

== Shortcodes ==

### Google Reviews

`[unirev_google_reviews]`

Optional attributes: `connection` (location ID, Pro), `per_page` (1–50), `layout` (`list`; `grid` and `carousel` need Pro), `columns` (2–4, grid and carousel), `card_style` (design style, see below), `autoplay` (carousel only, 0–15 seconds, 0 = off), `min_rating`, `show_summary`, `show_name`, `show_date`, `show_text`, `load_more` (each `1` or `0`), `filter` (rating filter, needs Pro).

Design styles for `card_style` (Classic is free, the rest need Pro): `default` (Classic), `aurora` (dark glass), `candy` (playful pastel), `soft` (neumorphic) and `editorial` (serif, numbered, dark featured first review). Classic also accepts the finishes `shadow`, `flat` and `accent`. Every style works in the list, grid and carousel layouts. The carousel has arrow buttons, page dots, drag, arrow keys and optional autoplay that pauses on hover and for visitors who prefer reduced motion.

Examples: `[unirev_google_reviews per_page="6" show_date="0"]` and `[unirev_google_reviews layout="carousel" card_style="aurora" columns="3" autoplay="5"]`


### Review form

`[unirev_form]`

Default attributes:

* `slug` — Form slug. Default: `unirev_form`.
* `type` — Review type. Default: `product`.
* `target_type` — Target type. Default: `post`.
* `target_id` — Target ID. Defaults to the current supported post when available.

Example:

`[unirev_form type="product" target_type="post" target_id="123"]`

### Review list

`[unirev_reviews]`

Available attributes:

* `type`
* `target_type`
* `target_id`
* `per_page`
* `sort`
* `min_rating`
* `allow_rating_filter`
* `show_form`

Example:

`[unirev_reviews type="product" target_type="post" target_id="123" per_page="10" show_form="1"]`

### Rating summary

`[unirev_summary]`

Available attributes:

* `type`
* `target_type`
* `target_id`

Example:

`[unirev_summary type="product" target_type="post" target_id="123"]`

Supported target types include:

* `post` — WordPress posts and supported post types.
* `product` — WooCommerce products.
* `term` — taxonomy terms.
* `user` — users.
* `business` — the business/site target.

== Blocks ==

### Reviews List

Block name: `unirev/reviews-list`

Attributes:

* `reviewType`
* `targetType`
* `targetId`
* `perPage`
* `sort`
* `minRating`
* `allowRatingFilter`

### Review Form

Block name: `unirev/review-form`

Attributes:

* `formSlug`
* `reviewType`
* `targetType`
* `targetId`

### Google Reviews

Block name: `unirev/google-reviews`

Attributes: `connection`, `perPage`, `layout`, `columns`, `cardStyle`, `autoplay`, `minRating`, `showSummary`, `showName`, `showDate`, `showText`, `loadMore`, `filter`.

All blocks are server-rendered.
== Screenshots ==

1. Dashboard — review metrics, trends, rating distribution and recent activity.
2. Reviews moderation — status filters, search, bulk actions, owner replies and review history.
3. Review form builder — configurable fields, ordering and form preview.
4. Review Types — target and schema configuration.
5. Settings — moderation, anti-abuse, display, privacy and notifications.
6. Dashboard in dark mode.

== Changelog ==

= 1.1.1 = 08 Oct 2026
* New: 5 design styles for Google Reviews: Classic (Free), plus Aurora (dark glass), Candy (playful pastel), Soft (neumorphic) and Editorial (serif, numbered, featured first review) for Pro. Each works in list, grid and carousel layouts.
* New: Free plan keeps the Classic list. Choose a style with the shortcode attribute `card_style`, the block "Design style" control, the Elementor widget or Reviews → Google Reviews → Display, which now has a visual style picker.
* New (Pro): carousel with arrow buttons, page dots, mouse drag, arrow-key navigation and optional autoplay (0–15 seconds, pauses on hover and for visitors who prefer reduced motion). Columns (2–4) now apply to the carousel as well as the grid.
* Improved: Google Reviews performance. Reviews are read from the object cache and refreshed whenever a sync changes them; expired reviews are never shown. The admin screen counts reviews with a lightweight query.
* Improved: Sync Now has a short cooldown so repeated clicks cannot use up your Google API quota.
* Fixed: the Google sign-in and API request addresses are now properly URL-encoded.

= 1.1.0 = 07 Oct 2026
* New: Google Reviews (optional). Connect your own Google Business Profile with OAuth (your own Google Cloud project; tokens and the client secret are encrypted) and show recent Google reviews from a temporary local copy. Free: one location, up to 50 reviews, daily sync plus Sync Now.
* New: `[unirev_google_reviews]` shortcode, Google Reviews block and Google Reviews Elementor widget.
* New: Google Reviews display options: layout, reviews per page, rating summary, reviewer name, date, text, Google attribution, rating filter, Load more, star style, size and colour, spacing, text size and button style.
* New (Pro): grid layout with 2–4 columns, carousel, card styles, star colour, rating filter, up to 500 reviews per location, and up to 25 locations with Add location and a location choice per block, shortcode or widget.
* New: Change Google account, Edit Client ID & Secret and Disconnect from the Google Reviews screen, a warning when the last successful sync is old, a Google Reviews card on the Dashboard, and a first-run Getting started checklist.
* Improved: translations. The language template now includes the admin app strings.

= 1.0.3 =
* Fixed : Improved and Bug Fixed
* Removed: the admin notice warning that an Nginx server needs manual config to protect the review-photos upload folder (the folder's own protection still applies; this only removed the heads-up notice).

= 1.0.2 =
* New: Review Form block's "Form" field is a dropdown of your saved forms, and adds full color/size style controls for the button, fields and star rating.
* New: Elementor widgets for Review Form and Reviews List.
* New: "Load more reviews" button on review lists (cursor pagination) and a "Helpful" vote button on each review.
* Added: an admin notice (with the exact config) when the server is Nginx, since the upload folder's `.htaccess` protection doesn't apply there.
* Improved: schema.org output uses the correct worst rating for half-star types, a stable `@id`, merges multiple reviewed items into one `@graph`, an allow-list of valid types (filter `unirev_schema_types`) and a `unirev_schema_output` filter to avoid duplicates with WooCommerce or SEO plugins.
* Improved: the duplicate-review guard also checks the reviewer's IP via a privacy-safe one-way hash — works regardless of the "store IP" setting, so a different email no longer bypasses it.
* Improved: Reviews List and Review Form blocks use block API v3, add editor previews, colour and font-size controls, and a searchable picker (posts, products, terms and users) instead of a raw ID field.
* Improved: admin rating-distribution chart is cached in a transient, same as the status-count badge.
* Improved: the public reviews API is now rate-limited per IP, separate from the submission limit; it also no longer runs a total count or resolves target titles, and returns nothing for posts that are no longer public.
* Improved: front-end CSS/JS load in the page head when a post contains the shortcode or block (no layout shift), and rate-limit counters use the persistent object cache when one is available instead of writing database options on every hit.
* Improved: the time-trap token is bound to the visitor's IP; helpful votes use their own rate-limit bucket instead of the submission quota.
* Improved: the submit error no longer reveals whether an item ID exists.
* Improved: admin menu badge counts are cached in a short-lived transient; identical pending background jobs are no longer queued twice.
* Improved: bulk moderation now uses one lookup and one update per status group instead of several queries per review.
* Fixed: Review Form and Reviews List block previews were unstyled in the editor; they now match the front-end.
* Fixed: titles, names, answers and avatar initials are now cut on character boundaries, so Hindi, Arabic, CJK and emoji text is no longer corrupted.
* Fixed: "Highest rated" pagination skipped half-star (4.5) reviews after the first page.
* Fixed: a new auto-approved review now updates the review count, average rating and schema.org data immediately instead of waiting for WP-Cron.
* Fixed: review forms and vote buttons on full-page-cached pages no longer fail with stale nonce or time-trap tokens; fresh tokens are fetched on interaction.
* Fixed: a rate-limit window of 0 no longer disables the limit; window, reviews-per-page and cron interval settings are now range-limited.
* Privacy: the personal-data eraser also removes log entries containing the reviewer's email, and vote records older than one year are pruned.
* Security: photos that cannot be verified (unreadable image header, including AVIF) are rejected; photos are deleted when a review is rejected or marked spam.

= 1.0.1 =
* New: photo reviews (JPEG, PNG, WebP and AVIF uploads with size and count limits; SVG is never accepted) and optional half-star ratings per review type.
* Improved: spam-check filter, vote nonce, admin REST rate limit and settings/summary caching; fixed empty stars showing as filled in review lists.

= 1.0.0 =
* Initial release.
* Dedicated indexed review tables.
* `[unirev_form]`, `[unirev_reviews]` and `[unirev_summary]` shortcodes.
* Reviews List and Review Form Gutenberg blocks.
* Drag-and-drop review form builder.
* Review types with configurable targets and schema.org types.
* Review moderation with bulk actions.
* Owner replies, helpful votes and verified reviews.
* Review history and form-answer inspection.
* Honeypot, signed time trap, rate limiting and duplicate-review protection.
* Streaming CSV/JSON export.
* Batched CSV import with row-level errors.
* Background jobs, logs and diagnostics.
* Precomputed rating summaries and distributions.
* Conditional CSS and JavaScript loading.
* AggregateRating JSON-LD for eligible visible review content.
* WordPress privacy exporter and eraser integration.
* No telemetry.

== Upgrade Notice ==

= 1.1.1 =
Adds five design styles and a carousel with dots, drag and autoplay to Google Reviews (Classic is free, the rest are Pro), plus performance and reliability fixes. No database changes.

= 1.1.0 =
Adds optional Google Reviews (connect your own Google Business Profile, shown from a temporary local copy). The database updates automatically on first load. Nothing contacts Google unless you set it up.

= 1.0.2 =
Adds Elementor widgets, a "Load more reviews" button, a Helpful vote button, new block controls and many security, performance and schema improvements. Recommended for all sites.

= 1.0.1 =
Adds photo reviews and half-star ratings, plus security and performance improvements. The database updates automatically on first load.

= 1.0.0 =
Initial release of Universal Reviews.