=== Universal Reviews – Ratings, Review Forms, Google Reviews, Social-Proof ===
Contributors: universalwp
Tags: reviews, google reviews, woocommerce reviews, ratings, testimonials
Requires at least: 6.2
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.1.3
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Reviews and ratings for any post or product: forms, moderation, star-rating schema, Google reviews, Elementor and blocks.

== Description ==

**Universal Reviews lets visitors rate and review anything on your site, and gives you one clean place to moderate what they say.**

Attach reviews to posts, pages, custom post types, WooCommerce products, taxonomy terms, users or your whole business, and show them with **Elementor widgets**, **Gutenberg blocks** or **shortcodes**. Reviews live in their own indexed database tables, so lists and summaries stay fast.

**Free:** build review forms with a drag-and-drop field builder, define review types with whole or half stars, moderate everything from one dashboard, block spam without a CAPTCHA, and show reviews with star summaries, filters, helpful votes, owner replies and AggregateRating JSON-LD. Start fast with **Use-Case Packs**: one click sets up a restaurant or WooCommerce review workflow (review type, form with smart follow-up questions, moderation and a display preset), with a preview first and an undo. Optionally connect your own Google Business Profile and show up to 50 recent Google reviews next to your own. Universal Reviews is not affiliated with Google.

**Pro** adds ready-made templates, four more Use-Case Packs (clinics, courses, agencies, rentals), social-proof widgets, analytics, migration, webhooks, AI assist, review requests, review sources, and more Google Reviews options: grid and carousel layouts, five design styles and multiple locations.

The **Features** section lists everything in detail, with setup steps and who the plugin is for.

== Features ==

= Free features =

* **Review forms** — Drag-and-drop builder with 12+ field types and photo uploads. Import and export forms as JSON.
* **Smart fields** — Show a follow-up question only when an earlier answer matches (one condition per field). Enforced on the server.
* **Use-Case Packs** — One-click review setups for restaurants and WooCommerce stores, with a preview and undo.
* **Review types** — Product, service, place or your own, with whole or half stars and a schema.org type.
* **Moderation** — Approve, reject, reply, filter and bulk-edit from one queue, plus optional low-rating email alerts.
* **Spam protection** — Honeypot, signed time trap, rate limits and duplicate blocking. No CAPTCHA.
* **Display** — Rating summary, star filters, helpful votes, owner replies and verified badges.
* **Elementor, blocks and shortcodes** — Form, reviews list and Google Reviews widgets with live previews.
* **Review schema** — AggregateRating JSON-LD for star ratings in search results.
* **Google Reviews (optional)** — Show up to 50 recent reviews from your own Business Profile. Tokens are encrypted.
* **WooCommerce** — Product reviews with an optional verified-buyer badge for logged-in customers.
* **Import, export and privacy** — CSV and JSON tools, WordPress privacy export and erase, no reviewer IP stored by default.
* **Fast** — Indexed tables, precomputed totals and server-side pagination.

= Pro features =

Universal Reviews Pro adds these on top of everything above.

* **Templates** — 10 ready-made review forms for shops, restaurants, hotels and events.
* **Social-proof widgets** — A floating rating badge and a reviews carousel.
* **Analytics** — Per-day review and reply charts. No visitor tracking or cookies.
* **Migration** — Move WooCommerce or comment ratings into Universal Reviews. Batched and safe to re-run.
* **Webhooks** — Signed JSON deliveries for review events, with retries and a delivery log.
* **AI Assist** — Summaries, sentiment and reply drafts. Reviewer names are never sent.
* **Review requests** — Email customers a single-use link that prefills the form.
* **Sources** — Import reviews from any HTTPS JSON feed on a schedule.
* **More Use-Case Packs** — Clinics, courses, agencies and rental properties, plus smart fields with several conditions.
* **More Google Reviews** — Grid and carousel layouts, five design styles, star colours and multiple locations.

= Set it up in about three minutes =

1. Install and activate the plugin.
2. Open **Reviews** in the admin menu and look over **Forms**, **Review Types** and **Settings**. The defaults are sensible.
3. Edit a post, page or product and add `[unirev_reviews show_form=1]`, or drop in the **Reviews List** block, or use the **Reviews List** widget in Elementor.
4. Visit the page, leave a test review, then approve it under **Reviews → Reviews**.
5. Optional: open **Reviews → Google Reviews** to connect your Google Business Profile and show your Google reviews too.

You now have a rating summary, a review list and a review form on the page.

= Who is it for? =

* **Online stores** that want customer reviews and star ratings on WooCommerce product pages.
* **Local businesses and service providers** who want reviews of the business itself, including their Google reviews.
* **Agencies, freelancers and course creators** collecting testimonials.
* **Directories and membership sites** where people review listings, users or categories.
* **Elementor and block-editor users** who want review widgets that match their design.

### Collect, protect and moderate

Build forms with drag and drop. Honeypot, a time trap, rate limits and duplicate blocking protect every submission; you approve, reject or reply from one queue.

### Display reviews

Use Elementor widgets, blocks or shortcodes to show a rating summary, star filters, helpful votes, owner replies and verified badges.

### SEO and structured data

Optional AggregateRating JSON-LD helps your pages qualify for star ratings in search results.

### Performance

Indexed tables, precomputed totals and server-side pagination keep large review sets fast. Scripts load only on pages that use them.

### Import, export and privacy

Import and export reviews as CSV or JSON, use the WordPress privacy export and erase tools, and keep reviewer IPs unstored by default.

### Support and community

* [Support Forum](https://wordpress.org/support/plugin/universal-reviews/) – ask questions and report issues.
* [Facebook Community](https://www.facebook.com/profile.php?id=61594808884671) – share feedback and follow updates.

== Installation ==

### Install from your dashboard (easiest)

1. Go to **Plugins → Add New Plugin**.
2. Search for **Universal Reviews**.
3. Click **Install Now**, then **Activate**.

### Upload the ZIP from WordPress admin

1. Download the `universal-reviews` plugin ZIP.
2. In WordPress, go to **Plugins → Add New Plugin**.
3. Select **Upload Plugin**.
4. Choose the `universal-reviews.zip` file.
5. Click **Install Now**.
6. After installation finishes, click **Activate Plugin**.

### Install manually

1. Download the plugin ZIP.
2. Extract the `universal-reviews` folder.
3. Upload the folder to `/wp-content/plugins/`.
4. Open **Plugins → Installed Plugins** in WordPress.
5. Find **Universal Reviews**.
6. Click **Activate**.

### After activation

After activation, open **Reviews** in the WordPress admin menu.

Start with:

1. **Reviews → Forms** — review the default form or create another form.
2. **Reviews → Review Types** — configure Product, Service, Place or another review type.
3. **Reviews → Settings** — check moderation, anti-abuse, display, privacy and notification settings.
4. Add a review form and review list using a shortcode or Gutenberg block.
5. Submit a test review from the front end.
6. Open **Reviews → Reviews** and test the complete moderation workflow.
7. Approve the test review and confirm that the review list and summary appear correctly.

For the quickest setup, add this shortcode to a post, page or product:

`[unirev_reviews show_form=1]`

This displays the review list and enables the form for the current supported target.

Using Elementor? Edit the page, search the widget panel for **Reviews List** or **Review Form**, and drag it where you want it.

Requirements: WordPress 6.2 or newer and PHP 7.4 or newer. WooCommerce and Elementor are optional.

### Deactivation and uninstall

Deactivating Universal Reviews does not remove review data.

By default, database tables and settings remain available after deactivation. If you want WordPress to remove the plugin's stored data during uninstall, enable **Settings → Privacy → Delete all data on uninstall** before deleting the plugin.

Use this option carefully because uninstall data deletion is intended to be permanent.

= Use-Case Packs =

Use-Case Packs set up a whole review workflow in one click. Open **Reviews → Use-Case Packs**, pick a pack, check the preview and press **Apply pack**.

* **What it creates:** a review type, a form with smart follow-up questions, moderation and alert defaults, and a display preset used as `[unirev_reviews preset="restaurant"]`.
* **Free:** Restaurants & cafés, and WooCommerce stores (optional verified-buyer check, off by default). **Pro:** Clinics & healthcare, Courses & training, Agencies & freelancers, Rental properties.
* **Safe by design:** nothing is saved until you apply; existing types, forms and presets are never overwritten (a numbered copy is made); site-wide settings change only if you tick the box; everything can be undone, and a review type that already has reviews is kept.
* **Clinics:** the Pro pack asks no medical questions, has no photo upload and holds every review for approval. Rules for patient reviews differ by country and profession, so check them first. It is a default, not legal advice.
* **Developers:** add packs with the `unirev_use_case_packs` filter, or answer the purchase check with `unirev_customer_bought_product`.

= Google Reviews setup =

Show recent reviews from your Google Business Profile next to your own. It is optional and never needed for the rest of the plugin.

* **You need:** a verified Business Profile you manage, your own Google Cloud project with the Business Profile APIs approved, and an OAuth "Web application" client with the redirect URI shown on the setup screen (`https://your-site.example/wp-admin/admin-post.php?action=unirev_google_oauth`).
* **Setup:** Reviews → Google Reviews → enter Client ID and Secret → Save Credentials → Connect Google → choose a location. The first sync runs at once.
* **Changing account:** use **Change Google account**, **Edit Client ID & Secret** or **Disconnect** on the same screen.
* **Display:** the `[unirev_google_reviews]` shortcode, the Google Reviews block or the Elementor widget. Free includes the Classic list; Pro adds grid, carousel, design styles, star colour, autoplay, the rating filter and multiple locations (`connection="ID"`).

Universal Reviews is not affiliated with, endorsed by or sponsored by Google. Google review data is not added to your schema.org markup.

= Shortcodes =

### Google Reviews

`[unirev_google_reviews]`

Optional attributes: `connection` (location ID, Pro), `per_page` (1–50), `layout` (`list`; `grid` and `carousel` need Pro), `columns` (2–4, grid and carousel), `card_style` (design style, see below), `autoplay` (carousel only, 0–15 seconds, 0 = off), `min_rating`, `show_summary`, `show_name`, `show_date`, `show_text`, `load_more` (each `1` or `0`), `filter` (rating filter, needs Pro).

Design styles for `card_style` (Classic is free, the rest need Pro): `default` (Classic), `aurora` (dark glass), `candy` (playful pastel), `soft` (neumorphic) and `editorial` (serif, numbered, dark featured first review). Classic also accepts the finishes `shadow`, `flat` and `accent`. Every style works in the list, grid and carousel layouts. The carousel has arrow buttons, page dots, drag, arrow keys and optional autoplay that pauses on hover and for visitors who prefer reduced motion.

Examples: `[unirev_google_reviews per_page="6" show_date="0"]` and `[unirev_google_reviews layout="carousel" card_style="aurora" columns="3" autoplay="5"]`


### Review form

`[unirev_form]`

Default attributes:

* `slug` — Form slug. Default: `unirev_form`.
* `type` — Review type. Default: `product`.
* `target_type` — Target type. Default: `post`.
* `target_id` — Target ID. Defaults to the current supported post when available.

Example:

`[unirev_form type="product" target_type="post" target_id="123"]`

### Review list

`[unirev_reviews]`

Available attributes:

* `type`
* `target_type`
* `target_id`
* `per_page`
* `sort`
* `min_rating`
* `allow_rating_filter`
* `show_form`
* `preset` — a saved display preset (for example one created by a Use-Case Pack). It supplies defaults for `per_page`, `sort`, `allow_rating_filter`, `show_form` and the helpful-vote button; any attribute you write still wins.

Example:

`[unirev_reviews type="product" target_type="post" target_id="123" per_page="10" show_form="1"]`

### Rating summary

`[unirev_summary]`

Available attributes:

* `type`
* `target_type`
* `target_id`

Example:

`[unirev_summary type="product" target_type="post" target_id="123"]`

Supported target types include:

* `post` — WordPress posts and supported post types.
* `product` — WooCommerce products.
* `term` — taxonomy terms.
* `user` — users.
* `business` — the business/site target.

= Blocks =

### Reviews List

Block name: `unirev/reviews-list`

Attributes:

* `reviewType`
* `targetType`
* `targetId`
* `perPage`
* `sort`
* `minRating`
* `allowRatingFilter`

### Review Form

Block name: `unirev/review-form`

Attributes:

* `formSlug`
* `reviewType`
* `targetType`
* `targetId`

### Google Reviews

Block name: `unirev/google-reviews`

Attributes: `connection`, `perPage`, `layout`, `columns`, `cardStyle`, `autoplay`, `minRating`, `showSummary`, `showName`, `showDate`, `showText`, `loadMore`, `filter`.

All blocks are server-rendered.

== Frequently Asked Questions ==

= Does Universal Reviews require WooCommerce? =

No. WooCommerce is not required.

Reviews can target WordPress posts and custom post types, taxonomy terms, users, the site/business and other supported targets. WooCommerce products are supported as the `product` post type.

Universal Reviews does not read WooCommerce orders for purchase verification. A moderator can mark a review as verified from the Reviews screen, and developers can add their own verification logic through the `unirev_verification_providers` filter.

= Can I use Universal Reviews for custom post types? =

Yes. The `post` target type can work with WordPress post types, including custom post types, when the target is public and supported by the plugin's target validation.

= Does Universal Reviews work with Elementor? =

Yes. There are Elementor widgets for the Review Form, the Reviews List and (since 1.1.0) Google Reviews. Drag them onto any Elementor page, template or product layout. They share the same forms, review types and moderation queue as the blocks and shortcodes.

= Can I use it without a page builder? =

Yes. Elementor is optional. Universal Reviews also works with the WordPress block editor and with shortcodes, and you don't need a special theme.

= How do I add star ratings and customer reviews to a WordPress page? =

Add `[unirev_reviews show_form=1]` to the page, insert the **Reviews List** block, or drop in the **Reviews List** widget in Elementor. Visitors will see the rating summary, the approved reviews and the review form.

= How do I show reviews on WooCommerce product pages? =

WooCommerce products are supported as a review target. Add the shortcode, block or Elementor widget to your product description, product template or product layout. Universal Reviews doesn't take over the built-in WooCommerce reviews tab.

= Can visitors upload photos with their review? =

Yes. Reviewers can attach JPEG, PNG, WebP or AVIF photos, and you control the size and number of photos. SVG uploads are never accepted. Photos that can't be verified as real images are rejected, and photos are deleted when a review is rejected or marked as spam.

= Can I collect reviews for my business instead of a page? =

Yes. Use the `business` target type to collect reviews about your company as a whole, then show them anywhere with the same widgets, blocks and shortcodes.

= Can I customize the review form? =

Yes. The form builder supports multiple field types, required fields, half-width layouts, placeholders, help text, headings, text blocks and custom CSS classes. Form styling uses `--unirev-*` CSS variables.

= Can I create different review forms? =

Yes. Forms can be created and managed from **Reviews → Forms**. Forms can be associated with supported review types and embedded with the form shortcode or Review Form block.

= Can I use half-star ratings? =

Yes, since version 1.0.1. Choose **Half stars** under **Star steps** when editing a review type in **Reviews → Review Types**. Types default to whole stars (1 to 5).

= Does the plugin store IP addresses? =

Not by default. IP storage is disabled by default and can be enabled from the privacy settings when a site needs it.

= What happens when I deactivate the plugin? =

Deactivation does not delete reviews, settings or database tables.

Data is removed during uninstall only when **Delete all data on uninstall** has been enabled in **Settings → Privacy**.

= Do I need Redis or another object cache? =

No. Universal Reviews does not require Redis or Memcached.

Rating aggregates are precomputed in a summary table. A persistent object cache can further reduce repeated public queries when available.

= Does the plugin add review schema automatically? =

When enabled, Universal Reviews can output AggregateRating JSON-LD for supported targets whose review list or summary is actually displayed and which have approved reviews.

Structured data eligibility does not guarantee a search-engine rich result.

= Does Universal Reviews guarantee Google star snippets? =

No. The plugin outputs supported structured data according to its configuration and visible review content, but search engines independently decide whether structured data qualifies for or appears as a rich result.

= Will it work with Hindi, Arabic, Chinese and emoji text? =

Yes. Titles, names, answers and avatar initials are cut on character boundaries, so non-Latin text and emoji are no longer corrupted.

= Can the business owner reply to reviews? =

Yes. Moderators with the appropriate capability can add owner replies. Replies are displayed beneath the review on the front end.

= What is a Use-Case Pack? =

A pack is a complete, ready-to-use review setup for one kind of business. Instead of building a form and tuning settings yourself, you pick a pack, look at a preview, and press Apply. It creates a review type, a form with smart follow-up questions, moderation and alert defaults, and a saved display preset you use as `preset="…"`.

= Will a pack overwrite my forms or settings? =

No. The preview shows what will be created, changed or left alone before anything is saved. If a review type or form with the same name already exists, the pack creates its own copy with a numbered name and leaves yours alone. Site-wide settings are only touched if you tick "Also use the pack's display defaults for the whole site". Everything a pack creates can be undone; a review type that already has reviews is kept, so no review is ever orphaned.

= Which packs are free? =

Restaurants & cafés and WooCommerce stores are included in Free. Clinics & healthcare, Courses & training, Agencies & freelancers and Rental properties are part of Pro. Free shows the Pro packs as locked cards.

= What are smart fields? =

A smart field appears only when an earlier answer matches, for example a delivery question after someone chooses Delivery. Free allows one condition per field; Pro allows several, with "all" or "any" matching. Rating, name, email, headline, review text and consent are always shown. The check also runs on the server, so a field hidden by its rule is never stored, even if a request tries to send it.

= Does the low-rating alert hide or delay bad reviews? =

Never. The alert only emails you, through the background queue, so you can reply quickly. The review is published or held exactly as the review type says. The email contains the rating, the review type and a link to your dashboard, but no review text and no reviewer details.

= How does the WooCommerce "verified buyer" option work? =

It is off by default. When you switch it on for a review type, Universal Reviews asks WooCommerce a yes-or-no question: has this customer bought this product? A reviewer who is logged in is checked by their own account, not by the email typed into the form. Nothing about the order is stored; the only result is the existing "verified" badge. Publishing verified buyers without approval is a separate, optional choice.

= Do I need to connect Google? =

No. Google Reviews is optional. Nothing contacts Google unless you set it up.

= Why do I need my own Google Cloud project? =

Google's Business Profile API terms require each business to use its own approved project. Universal Reviews therefore never shares one project between sites: you create the OAuth client, and you authorize access to your own Business Profile.

= Google says my API access is not approved, or the API is not enabled. =

Business Profile API access must be requested from Google and approved (the quota for the APIs shows 0 until it is). Then enable the "My Business Account Management API", "My Business Business Information API" and "Google My Business API" in your project. The plugin shows the exact problem and a recommended action, with technical details you can send to support.

= Why does my Google connection say "Needs Reauthorization"? =

Google no longer accepts the saved authorization, usually because access was revoked, the password changed, or the account lost access to the location. Click Reconnect Google.

= Only some of my Google reviews show. =

The Free plan displays up to 50 recent reviews. Your connection keeps working and the rest are not deleted from Google.

= Which Google Reviews design styles are free? =

Classic (a clean list that follows your theme) is free. Aurora, Candy, Soft and Editorial, the grid and carousel layouts, and autoplay need Pro. On a Free site a Pro style or layout falls back to the Classic list, so a page never breaks.

= Are my Google reviews stored permanently? =

No. They are a temporary copy kept for at most 30 days and refreshed daily. Disconnecting deletes them immediately.

= Google says my server could not be reached, or the location list times out. =

Your server must be able to make outgoing HTTPS requests to Google (`*.googleapis.com` and `accounts.google.com`). Ask your host to allow them, then press Try Again. If you connected the wrong account in the meantime, use Change Google account.

= What happens to privacy data when a review is erased? =

Universal Reviews integrates with the WordPress privacy exporter and eraser. Personal information such as reviewer name, email and stored IP data can be anonymised while the review text remains as a business record.

= Where is the source code for the compiled admin app? =

The admin dashboard (`assets/admin/index.js` and `assets/admin/index.css`) is compiled from the human-readable TypeScript/React source in the `admin-src/` folder, which ships inside the plugin. To rebuild it, run `npm install` and then `npm run build` in the plugin folder (esbuild bundles the JavaScript and the Tailwind CLI builds the CSS; see `admin-src/README.md`). The bundle includes React, React DOM, Radix UI, lucide-react, class-variance-authority, clsx and tailwind-merge, all under MIT-compatible licences. The front-end scripts (`assets/admin/frontend.js` and `assets/admin/google-reviews.js`), the front-end stylesheets, the block editor scripts (`blocks/*/edit.js`) and the PHP are not minified.

== External services ==

Universal Reviews works fully offline. It contacts an external service only if you connect **Google Reviews** (Reviews → Google Reviews), using your own Google Cloud project. Otherwise nothing is sent and no Google code is loaded.

* `accounts.google.com` and `oauth2.googleapis.com` — OAuth sign-in, token exchange, refresh and revocation. Sent: your Client ID and Secret, the authorization code and your tokens.
* `mybusinessaccountmanagement.googleapis.com`, `mybusinessbusinessinformation.googleapis.com` and `mybusiness.googleapis.com` — Business Profile APIs, to list your locations and read reviews for the one you select. Sent: your access token and the account and location IDs.

Requests happen during setup, on Sync Now and in the daily sync, never when a visitor loads a page. A reviewer's Google profile photo, if any, is loaded by visitors' browsers from googleusercontent.com.

Google's [terms](https://policies.google.com/terms), [privacy policy](https://policies.google.com/privacy) and [Business Profile API terms](https://developers.google.com/my-business/content/terms).

== Screenshots ==

1. Dashboard — review metrics, trends, rating distribution and recent activity.
2. Reviews moderation — status filters, search, bulk actions, owner replies and review history.
3. Review form builder — configurable fields, ordering and form preview.
4. Review Types — target and schema configuration.
5. Settings — moderation, anti-abuse, display, privacy and notifications.
6. Dashboard in dark mode.

== Changelog ==

= 1.1.3 = 14 Oct 2026
* Fixed: helpful votes and the fresh-token refresh on cached pages failed on any site whose address contains "reviews" (for example universal-reviews.local), so cached forms were rejected and votes did not count.
* Fixed: submitting a review or vote was blocked ("Invalid request origin") when the visitor reached the site through the www / non-www variant of its address.
* Fixed: Elementor widgets (review form, reviews list, Google reviews) lost their styles and scripts, and served stale security tokens, when Elementor's element cache was on. They now declare their assets and are never cached.
* Fixed: the Google reviews carousel works in right-to-left languages (scroll position, arrows, arrow keys); the page-dot labels are now translatable; filtering to zero reviews now shows a "No reviews match this filter." message.
* Fixed: a photo field hidden by a smart-field rule no longer uploads files.
* Fixed: "Load more" keeps keyboard focus on the newly loaded reviews instead of dropping it.
* Fixed: a fatal error on PHP 8 when a stored settings section was not an array.
* Fixed: long Google reviewer names or IDs containing multibyte characters (CJK, emoji) could be cut mid-character and make the whole cache insert fail.
* Fixed: reviews list and avatar initials no longer fatal on servers without the mbstring extension.
* Fixed: deleting a review type that still has reviews is refused instead of orphaning them.
* Fixed: owner replies are limited to 10,000 characters, a failed save is reported, and the reviewer is emailed the sanitised text.
* Fixed: the average rating and structured data update immediately after an admin adds a review, even when WP-Cron is disabled.
* Fixed: deactivating or uninstalling now removes scheduled Google retry events.
* Security: rate limits, helpful-vote de-duplication and the one-review-per-person check treat an IPv6 visitor's whole /64 network as one visitor, so rotating addresses can no longer bypass them.
* Fixed: behind a reverse proxy or CDN (Cloudflare, a load balancer) every visitor shared one rate-limit bucket. The visitor's real address is now read from CF-Connecting-IP / X-Forwarded-For when the request comes from a private-network proxy, or from one listed with the new `unirev_trusted_proxies` filter.
* Fixed: a visitor could post a review with a form that belongs to a different review type; the form now decides the type.
* Fixed: exports of large sites ran into the admin request limit; export chunks are now 2,000 reviews each and skip the extra count query.
* Fixed: reviews of password-protected posts are no longer listed publicly.
* Fixed: when Google rejects the saved client (credentials replaced or removed), the connection now asks you to reconnect instead of showing a permanent error.
* Fixed: sites that existed before network activation get the default review type and form; the first request after an update takes a lock so concurrent visitors don't all run the database upgrade.
* Fixed: deleting a multisite sub-site now removes its Universal Reviews tables.
* Fixed: the public submit response no longer returns the new review's sequential ID, which revealed total volume including pending and spam reviews.
* Improved: the review form now explains each invalid field right next to it ("This field is required." or the email message), linked to the field for screen readers, cleared as soon as the visitor fixes it; an optional email address that is filled in is also checked before sending.
* Fixed: a malformed background job no longer raises PHP notices; photo uploads are limited to 25 megapixels (was 40) to bound image-processing load; Google carousel autoplay stops on first touch; the reply box, required marker and rating counts use logical CSS properties so they mirror correctly in right-to-left languages; the honeypot field is inert for assistive tech and helpful-vote results are announced.
* Improved: translations load only on pages that show a review widget; Google Reviews styles load in the page head and in the block editor, and are registered up front for page builders.
* Improved: the public reviews list is cacheable by CDNs and browsers for visitors who are not logged in (60 seconds).
* Privacy: the personal-data export now includes the reviewer's email and stored IP address; erasing a reviewer also removes the stored verification reference and unlinks their account from the audit history.
* Accessibility: visible focus outlines in high-contrast / forced-colors mode; "Verified" is announced to screen readers; helpful buttons name the review author; rating filters expose the active choice; the carousel list has an accessible name.

= 1.1.2 = 10 Oct 2026
* New: Use-Case Packs. Reviews → Use-Case Packs sets up a complete review workflow in one click: a review type, a form with smart follow-up questions, moderation and alert defaults and a saved display preset. Free includes Restaurants & cafés and WooCommerce stores; Pro adds Clinics & healthcare, Courses & training, Agencies & freelancers and Rental properties.
* New: packs are previewed before anything is saved, never overwrite what you already have, can be applied in parts and can be undone. A review type that already has reviews is kept when a pack is undone.
* New: smart fields. A form field can be shown only when an earlier answer matches (one condition on Free, several with all/any matching on Pro). The server enforces it, so a field hidden by its rule is never stored.
* New: low-rating alerts. A review type can email you when a review is rated at or below a threshold. It only notifies; nothing is hidden or delayed, and the email has no review text or reviewer details.
* New: optional WooCommerce "verified buyer" check per review type (off by default). Logged-in reviewers are checked by their own account. Publishing verified buyers without approval is a separate choice.
* New: per-review-type setting to override the site-wide "auto-approve verified reviewers" choice.
* New: display presets: `[unirev_reviews preset="restaurant"]` supplies saved list defaults; an explicit attribute still wins.
* New: forms can set their own button text and thank-you message.
* New: schema.org types MedicalBusiness, LodgingBusiness and ProfessionalService for review types.
* Improved: the form builder keeps a form's settings and smart-field rules when you edit and save it, and supports them in template import and export.
* Security: the public reviews list no longer returns reviews of draft, private or trashed posts when no target is given.
* Security: guests are no longer marked as verified buyers from a typed email (logged-in buyers still are); the public vote endpoint accepts helpful votes only.
* Performance: admin lists are capped at 100 per page, bulk actions at 500 reviews, review history at 200 entries, and summaries without a stored row are cached.
* Uninstall now also removes the plugin's cached transients.
* Database: adds a `settings` column to the review types table and two indexes on the reviews table. It updates automatically on first load.

= 1.1.1 = 08 Oct 2026
* New: 5 design styles for Google Reviews: Classic (Free), plus Aurora (dark glass), Candy (playful pastel), Soft (neumorphic) and Editorial (serif, numbered, featured first review) for Pro. Each works in list, grid and carousel layouts.
* New: Free plan keeps the Classic list. Choose a style with the shortcode attribute `card_style`, the block "Design style" control, the Elementor widget or Reviews → Google Reviews → Display, which now has a visual style picker.
* New (Pro): carousel with arrow buttons, page dots, mouse drag, arrow-key navigation and optional autoplay (0–15 seconds, pauses on hover and for visitors who prefer reduced motion). Columns (2–4) now apply to the carousel as well as the grid.
* Improved: Google Reviews performance. Reviews are read from the object cache and refreshed whenever a sync changes them; expired reviews are never shown. The admin screen counts reviews with a lightweight query.
* Improved: Sync Now has a short cooldown so repeated clicks cannot use up your Google API quota.
* Fixed: the Google sign-in and API request addresses are now properly URL-encoded.

= 1.1.0 = 07 Oct 2026
* New: Google Reviews (optional). Connect your own Google Business Profile with OAuth (your own Google Cloud project; tokens and the client secret are encrypted) and show recent Google reviews from a temporary local copy. Free: one location, up to 50 reviews, daily sync plus Sync Now.
* New: `[unirev_google_reviews]` shortcode, Google Reviews block and Google Reviews Elementor widget.
* New: Google Reviews display options: layout, reviews per page, rating summary, reviewer name, date, text, Google attribution, rating filter, Load more, star style, size and colour, spacing, text size and button style.
* New (Pro): grid layout with 2–4 columns, carousel, card styles, star colour, rating filter, up to 500 reviews per location, and up to 25 locations with Add location and a location choice per block, shortcode or widget.
* New: Change Google account, Edit Client ID & Secret and Disconnect from the Google Reviews screen, a warning when the last successful sync is old, a Google Reviews card on the Dashboard, and a first-run Getting started checklist.
* Improved: translations. The language template now includes the admin app strings.

= 1.0.3 =
* Fixed : Improved and Bug Fixed
* Removed: the admin notice warning that an Nginx server needs manual config to protect the review-photos upload folder (the folder's own protection still applies; this only removed the heads-up notice).

= 1.0.2 =
* New: Review Form block's "Form" field is a dropdown of your saved forms, and adds full color/size style controls for the button, fields and star rating.
* New: Elementor widgets for Review Form and Reviews List.
* New: "Load more reviews" button on review lists (cursor pagination) and a "Helpful" vote button on each review.
* Added: an admin notice (with the exact config) when the server is Nginx, since the upload folder's `.htaccess` protection doesn't apply there.
* Improved: schema.org output uses the correct worst rating for half-star types, a stable `@id`, merges multiple reviewed items into one `@graph`, an allow-list of valid types (filter `unirev_schema_types`) and a `unirev_schema_output` filter to avoid duplicates with WooCommerce or SEO plugins.
* Improved: the duplicate-review guard also checks the reviewer's IP via a privacy-safe one-way hash — works regardless of the "store IP" setting, so a different email no longer bypasses it.
* Improved: Reviews List and Review Form blocks use block API v3, add editor previews, colour and font-size controls, and a searchable picker (posts, products, terms and users) instead of a raw ID field.
* Improved: admin rating-distribution chart is cached in a transient, same as the status-count badge.
* Improved: the public reviews API is now rate-limited per IP, separate from the submission limit; it also no longer runs a total count or resolves target titles, and returns nothing for posts that are no longer public.
* Improved: front-end CSS/JS load in the page head when a post contains the shortcode or block (no layout shift), and rate-limit counters use the persistent object cache when one is available instead of writing database options on every hit.
* Improved: the time-trap token is bound to the visitor's IP; helpful votes use their own rate-limit bucket instead of the submission quota.
* Improved: the submit error no longer reveals whether an item ID exists.
* Improved: admin menu badge counts are cached in a short-lived transient; identical pending background jobs are no longer queued twice.
* Improved: bulk moderation now uses one lookup and one update per status group instead of several queries per review.
* Fixed: Review Form and Reviews List block previews were unstyled in the editor; they now match the front-end.
* Fixed: titles, names, answers and avatar initials are now cut on character boundaries, so Hindi, Arabic, CJK and emoji text is no longer corrupted.
* Fixed: "Highest rated" pagination skipped half-star (4.5) reviews after the first page.
* Fixed: a new auto-approved review now updates the review count, average rating and schema.org data immediately instead of waiting for WP-Cron.
* Fixed: review forms and vote buttons on full-page-cached pages no longer fail with stale nonce or time-trap tokens; fresh tokens are fetched on interaction.
* Fixed: a rate-limit window of 0 no longer disables the limit; window, reviews-per-page and cron interval settings are now range-limited.
* Privacy: the personal-data eraser also removes log entries containing the reviewer's email, and vote records older than one year are pruned.
* Security: photos that cannot be verified (unreadable image header, including AVIF) are rejected; photos are deleted when a review is rejected or marked spam.

= 1.0.1 =
* New: photo reviews (JPEG, PNG, WebP and AVIF uploads with size and count limits; SVG is never accepted) and optional half-star ratings per review type.
* Improved: spam-check filter, vote nonce, admin REST rate limit and settings/summary caching; fixed empty stars showing as filled in review lists.

= 1.0.0 =
* Initial release.
* Dedicated indexed review tables.
* `[unirev_form]`, `[unirev_reviews]` and `[unirev_summary]` shortcodes.
* Reviews List and Review Form Gutenberg blocks.
* Drag-and-drop review form builder.
* Review types with configurable targets and schema.org types.
* Review moderation with bulk actions.
* Owner replies, helpful votes and verified reviews.
* Review history and form-answer inspection.
* Honeypot, signed time trap, rate limiting and duplicate-review protection.
* Streaming CSV/JSON export.
* Batched CSV import with row-level errors.
* Background jobs, logs and diagnostics.
* Precomputed rating summaries and distributions.
* Conditional CSS and JavaScript loading.
* AggregateRating JSON-LD for eligible visible review content.
* WordPress privacy exporter and eraser integration.
* No telemetry.

== Upgrade Notice ==

= 1.1.3 =
Fixes helpful votes and cached forms on sites whose address contains "reviews", Elementor widget caching, right-to-left carousel, IPv6 rate-limit bypass and a PHP 8 settings fatal; adds per-field form errors and proxy/CDN-aware visitor detection. No database changes.

= 1.1.2 =
Adds Use-Case Packs (Restaurants and WooCommerce free), smart form fields, low-rating email alerts and an optional WooCommerce verified-buyer check. The database updates automatically on first load; existing reviews, forms and settings are unchanged.

= 1.1.1 =
Adds five design styles and a carousel with dots, drag and autoplay to Google Reviews (Classic is free, the rest are Pro), plus performance and reliability fixes. No database changes.

= 1.1.0 =
Adds optional Google Reviews (connect your own Google Business Profile, shown from a temporary local copy). The database updates automatically on first load. Nothing contacts Google unless you set it up.

= 1.0.2 =
Adds Elementor widgets, a "Load more reviews" button, a Helpful vote button, new block controls and many security, performance and schema improvements. Recommended for all sites.

= 1.0.1 =
Adds photo reviews and half-star ratings, plus security and performance improvements. The database updates automatically on first load.

= 1.0.0 =
Initial release of Universal Reviews.
