=== Vireo Analytics – Privacy-First Website Analytics ===
Contributors: RebelCode, jeangalea
Tags: analytics, statistics, privacy, gdpr, google-analytics-alternative
Requires at least: 6.9
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 0.8.6
License: GPLv3 or later
License URI: https://www.gnu.org/licenses/gpl-3.0.html

Privacy-first WordPress analytics. Clean dashboard, no cookies, no consent banners, no third-party tracking.

== Description ==

Vireo Analytics is a self-hosted, privacy-first analytics plugin for WordPress. It gives you the numbers that actually matter: pageviews, visitors, top content, referrers, countries, devices, without cookies, without a consent banner, and without handing your visitors' data to anyone else. It all stays in your own database.

The numbers you see are the numbers that matter. Most analytics tools count uptime monitors (StatusCake, UptimeRobot, Pingdom), SEO crawlers (Ahrefs, Semrush), AI bots (GPTBot, ClaudeBot, PerplexityBot), and headless browsers as "visitors", inflating your stats by 20 to 40%. Vireo Analytics filters them out at the tracker level against a database of over eight hundred known crawlers, sorted into what each one is doing, plus Cloudflare signals and automation detection. What you see is real humans reading your content.

It's designed to be a drop-in replacement for Jetpack Stats or Google Analytics for site owners who want clarity over dashboards full of noise. Moving from another tool doesn't mean starting again at zero: Vireo Analytics imports your history from Google Analytics 4, Koko Analytics, Jetpack Stats, Statify, WP Statistics, Burst Statistics, Independent Analytics and SlimStat.

**Features**

* Clean, fast dashboard with pageviews, unique visitors, and trend charts.
* The Overview opens with what changed since the previous period, and which pages and sources gained or lost the most.
* Top content, top referrers, countries, and device breakdowns.
* Cookie-free tracking, so no consent banner is needed for basic analytics.
* Daily-rotating salted hashes for visitor identity, GDPR-compatible out of the box.
* Counts pageviews with or without JavaScript. A no-script pixel catches readers whose browser never runs the tracker, and both paths keep working behind a full-page cache.
* Admin-bar sparkline showing today's traffic at a glance.
* Per-post analytics column on the Posts list screen.
* Custom events API for tracking button clicks, form submissions, and other interactions.
* 404 tracking so you can spot broken inbound links.
* Weekly email digest delivered to your inbox.
* CSV export of any dashboard view.
* Imports your history from Google Analytics 4, Koko Analytics, Jetpack Stats, Statify, WP Statistics, Burst Statistics, Independent Analytics and SlimStat, so switching doesn't mean starting at zero.
* See what the AI assistants take against what they send back. ChatGPT, Claude, Gemini, Perplexity, Copilot and others are reported as their own traffic source, alongside how many pages their crawlers fetched and the ratio between the two. Works on history you already collected.
* Bot filtering you can actually see. Crawlers, AI trainers, SEO tools, uptime monitors, link previews and headless browsers are sorted into categories and reported back to you, so you can check what was excluded instead of taking it on trust.
* Catches automated browsers that lie about who they are. A headless browser can send any user agent it likes, so the tracker checks the flags the automation tools set on themselves.
* Skips prefetched and prerendered pages, which the reader may never actually look at.
* Honours Do Not Track and Global Privacy Control: visitors who ask not to be tracked are not tracked, with no setting to turn on.
* Core Web Vitals measured from the people actually visiting your site, where a lab tool measures one run on one machine. Loading, responsiveness and visual stability, reported as the 75th percentile Google grades on, because an average hides the slowest quarter of your readers.
* The searches that brought people in, pulled from Search Console, for the whole site and for each post on its own screen, with the page Google showed for each one. Google strips the query before your site ever sees it, so this is the only place it exists.
* Notes pinned to a date, so a spike six weeks ago still has an explanation attached to it.
* Let an editor or a client read the dashboard without making them an administrator.
* Works across a multisite network, with a single view of every site for whoever runs them.
* Tells you when it stops recording. Analytics fails silently by nature, and a plugin that has stopped counting looks exactly like a quiet week, so this one raises it in Site Health and in the admin rather than leaving you to notice a flat chart weeks later.
* Per-site "exclude logged-in admins" setting.
* Works with WP RSS Aggregator and Spotlight. If you aggregate feeds, see which sources your readers click through to; if you show Instagram feeds, see how often visitors open a post, follow a link from it, or press Follow.
* Available in German, Spanish, French, Italian, Japanese, Dutch, Portuguese, Brazilian Portuguese and Russian.


== Installation ==

1. Upload the plugin files to `/wp-content/plugins/vireo-analytics/`, or install via Plugins → Add New and search for "Vireo Analytics".
2. Activate the plugin through the Plugins menu.
3. Visit **Vireo Analytics → Overview** to see your dashboard. First pageviews will appear within a minute.

If you already have analytics data from Koko Analytics or Jetpack Stats, you'll see a one-click import banner on the Overview page. Imports run in the background and can be paused or resumed at any time.

== Frequently Asked Questions ==

= Is this GDPR-compliant? =

Yes. Vireo Analytics doesn't set cookies, doesn't use localStorage for tracking, and hashes visitor identifiers with a salt that rotates every 24 hours. No consent banner is required for basic analytics. Country-level geolocation is derived from the IP on the server; the raw IP is never written to the analytics tables, and the short-lived buffer file holding it is deleted as soon as the aggregator processes it, usually within a minute. You should still mention the plugin in your privacy policy.

= What exactly does the "Visitors" number mean? =

Within a single day it's a true unique count: one person is counted once no matter how many pages they read. Over a longer range it's the sum of the daily counts, so someone who visited on three days in the month counts three times.

That isn't laziness, it's the privacy model. A visitor is identified by a hash of their IP and browser, salted with a secret that is thrown away and regenerated every night. Tomorrow the same person produces a completely different hash, so there is nothing that can link them back to today. That's what makes cookie-free, consent-free tracking legitimate rather than a technicality. The cost is that "unique people this month" is a question the data genuinely cannot answer, and we'd rather say so than print a number that looks precise and isn't.

Pageviews are exact over any range.

= Does it honour Do Not Track and Global Privacy Control? =

Yes, and it's on by default. If a visitor's browser sends `DNT: 1` or `Sec-GPC: 1`, the tracker refuses to fire for them, and the collection endpoint refuses the pageview even if something sends one anyway. Those visits are not recorded anywhere. This costs you some traffic in the dashboard, which is the point: an opt-out you can switch off isn't an opt-out. If you have a specific reason to override it, the `vireo_honor_opt_out` filter can return false.

= How does it compare to Koko Analytics? =

Vireo Analytics started with deep respect for Koko's approach and covers the same ground: cookie-free, self-hosted, clean dashboard. Where they differ: Vireo Analytics includes per-post analytics columns on the Posts list screen, 404 tracking with referrer attribution, an admin-bar sparkline, and a more aggressive bot filter. Both are excellent; pick whichever fits how you work.

= Why are my numbers lower than [other plugin]? =

You're probably used to inflated numbers. Most other analytics plugins count uptime monitors (StatusCake, UptimeRobot, Pingdom), SEO crawlers (Ahrefs, Semrush, MJ12), AI indexing bots (GPTBot, ClaudeBot, PerplexityBot), and various testing tools as "visitors". Vireo Analytics filters all of those out, so the numbers you see are real humans reading your content. On most sites this strips 20-40% of what other tools report. We think that's the right tradeoff; if you disagree there's a filter (`va_bot_ua_pattern`) to relax the pattern.

= Can I migrate from Jetpack Stats? =

Yes. The built-in importer pulls up to 14 months of historical data from the Jetpack Stats API (requires an active Jetpack connection). The Overview page will show a one-click banner the first time Jetpack Stats is detected on the site.

= Can I migrate from Google Analytics? =

Yes. Settings, then Import data, brings your history across: daily pageviews and visitors, your pages, your referrers, countries and devices. It reads the Analytics Data API directly, so you need a Google service account key and your numeric property ID rather than the G- measurement ID. Sessions, events and conversions do not come across, because there is nowhere to put them.

= Does it work with caching plugins? =

Yes. Tracking runs on every page load via a lightweight POST beacon, including cached pages. When you first activate the plugin, you may need to wait for your cache to regenerate before every page starts tracking. Once that happens, tracking is universal.

= How does it compare to Google Analytics? =

Google Analytics shows you more (segmentation, audiences, attribution modelling) but requires a cookie banner, sends your visitors' data to Google, and has become increasingly complex. Vireo Analytics answers "how many people visited what, from where, on what device", which is what most WordPress site owners actually look at. For site owners who don't need enterprise-grade attribution modelling, the tradeoff is usually worth it.

= Does it track logged-in admins? =

By default, no. There's a setting at **Vireo Analytics → Settings** to enable admin tracking if you want to see your own visits (useful for testing).

= How long is data kept? =

Raw visitor hashes and referrer rows are aggregated into daily rollups after 24 hours. Daily rollups are kept indefinitely unless you set a retention limit in **Settings → Retention**. The default retention is 730 days (two years).

= Will it slow down my site? =

The tracking beacon is fired asynchronously after the page is interactive, using the browser's `navigator.sendBeacon()` API where available. The pageview is recorded by a standalone endpoint that boots WordPress without loading plugins or your theme. Hosts that block direct PHP inside wp-content fall back to admin-ajax automatically. On a well-hosted site you will not notice a difference.

== External services ==

This plugin includes an optional one-click importer for historical Jetpack Stats data. When (and only when) a site owner runs that importer from **Vireo Analytics → Settings → Import data**, the plugin calls the WordPress.com Stats API at `https://stats.wordpress.com/csv.php` to retrieve the site's existing pageview, referrer, and top-post history.

What is sent:

* The site's existing Jetpack `blog_id` (read from the connected Jetpack install).
* The Jetpack API key (read from the connected Jetpack install).
* A requested date range and table name (e.g. `views`, `referrers`, `topposts`).

What is not sent: no visitor data, no user data, no site content, no credentials beyond the Jetpack API key the site already holds.

When it is sent: only while the import is actively running, in response to a site owner clicking "Run Import". No background or recurring calls are made.

The Stats API is provided by Automattic Inc. (WordPress.com).

* Terms of Service: https://wordpress.com/tos/
* Privacy Policy: https://automattic.com/privacy/

The importer is entirely optional.

= Google Analytics (optional, importer) =

When a site owner runs the Google Analytics importer, the plugin signs a request with the service-account key they pasted and calls `https://oauth2.googleapis.com/token` for an access token, then `https://analyticsdata.googleapis.com` to read that property's history.

What is sent: the service account's own credentials and a date range. No visitor data, no site content, nothing about anyone reading the site.

When it is sent: only while an import is running, in response to a site owner starting one. The key can be removed from the same screen afterwards.

= Google Search Console (optional) =

When a site owner connects Search Console, the plugin authenticates the same way and calls `https://searchconsole.googleapis.com` to read the searches that led people to the site.

What is sent: the service account's own credentials, the property address the owner entered, and a date range.

When it is sent: once a day on a schedule, and whenever the owner presses the refresh control. A refresh fetches the last week straight away and then the rest of the requested history in the background, a fortnight at a time over a few minutes, so that one press can produce several calls in a row. This is the one recurring outbound call the plugin makes, and it only happens on sites that have connected Search Console. Disconnecting stops it and removes the schedule.

Both Google APIs are provided by Google LLC.

* Terms of Service: https://policies.google.com/terms
* Privacy Policy: https://policies.google.com/privacy

= DB-IP (optional, geolocation) =

Country-level geolocation needs a local database, and Pro's city-level detail needs a second one. When a site owner presses the download button, the plugin fetches the current monthly file from `https://download.db-ip.com`.

What is sent: nothing but the request for the file. No site data, no visitor data, no identifiers. Lookups afterwards happen entirely on your own server against the downloaded file; no address is ever sent anywhere.

When it is sent: only when the owner presses the button.

DB-IP Lite data is provided by DB-IP under CC BY 4.0.

* Website: https://db-ip.com/
* Privacy Policy: https://db-ip.com/legal/privacy

A site that imports nothing, connects nothing and downloads no geolocation database contacts none of these services.

It does make one recurring request to itself: once an hour the plugin posts to its own tracking endpoint to check the fast path is still reachable, because a host rule or a CDN change can break it silently. That request never leaves your server and carries no data about anyone.

None of these paths send visitor data anywhere. Every one of them pulls data in.

== Screenshots ==

1. The overview: what the bot filter kept out, what the AI assistants took against what they sent back, and the searches that found you.
2. Notes pinned to a date, Core Web Vitals measured from real visitors, and what actually changed since the previous period.
3. Top pages, referrers grouped by how people arrived, and where in the world they were.
4. Settings, including which roles can read the dashboard without being administrators.
5. Importing history out of Google Analytics.

== Changelog ==

= 0.8.6 =
* Changed: Vireo Analytics is now developed and supported by RebelCode, the team behind WP RSS Aggregator and Spotlight.

= 0.8.5 =
* Added: a card for sites running WP RSS Aggregator. It counts the readers who click an aggregated item through to the original article, per feed source, and, for items imported as posts, the views each source's posts get on your site.
* Added: a card for sites running Spotlight. It counts how often visitors open an Instagram post from a feed, follow a link from the post, press Follow or Load more, and on which page.
* Both start counting when Vireo detects the plugin, and can be switched off with the `vireo_track_wpra` and `vireo_track_spotlight` filters.

= 0.8.4 =
* Fixed: a post ID that matches no post could list one page twice. The tracker sends the post ID from the visitor's browser, so a client can send any number; one that resolves to no post is now ignored and the view counts under the page's address.

= 0.8.3 =
* Fixed: one visitor could add unlimited pageviews in a day. A crawler that runs scripts viewed the same archive pages almost ninety times each and put several hundred pageviews into one day's report. Each visitor now counts for at most 5 views of a page and 50 views in total per day; anything past that is reported under filtered traffic as repeated views. Both limits can be changed with the `vireo_visitor_path_cap` and `vireo_visitor_daily_cap` filters.
* Fixed: the front page could appear twice in the page lists and in What changed, once by its title and once as "/", because some views were recorded with its post ID and some without. Pages are now grouped by address.
* Fixed: comparisons for a range that ends today weighed part of a day against a whole one, so every page looked like it was losing traffic in the morning. The previous period is now scaled to the share of today that has passed.

= 0.8.2 =
* Fixed: two long searches that began with the same 190 characters were stored as one, and the second overwrote the first's clicks and impressions. Searches are now told apart by their full text. Updating refetches the last 90 days of Search Console data once so the split applies to recent history.
* Changed: the Search Console button now reads "Fetch the last 90 days". It fetches the last week straight away and the rest in the background, which "now" no longer described.
* Changed: Japanese translations follow the Japanese WordPress style guide for spacing around English words, numbers, colons and brackets.

= 0.8.1 =
* Fixed: the "Connect Search Console" link on a post's stats screen opened Settings at the top of the page instead of at the Search Console section.

= 0.8.0 =
* Added: each post's screen now shows the searches it appeared for in Google, with the clicks and average position for each. Google has passed almost no organic search terms to websites since 2013, so no analytics plugin can read them from the visit itself. Search Console still has them, and this joins them to the post they reached.
* Added: the site-wide search list on the Overview names the page Google showed for each search.
* Fixed: Search Console history was being cut off. A pull stopped at 25,000 rows for the whole date range, and a 90-day pull on one modest site hit that exactly, so roughly nine rows in ten were dropped without any message. The top searches survived, because Google sorts by clicks, but the long tail and anything totalled from it did not. Pulls now read everything Google returns.
* Changed: refreshing Search Console fetches the last week immediately and the rest of the history in the background, a fortnight at a time. Reading the full history in one request took over a minute once nothing was being dropped, which is longer than an admin page is allowed to run on many hosts.
* Fixed: Search Console data was never removed by the data retention setting, so it was kept indefinitely whatever retention you chose.

= 0.7.9 =
* Fixed: the bundled translations never loaded. Nine locales have shipped inside the zip since 0.7.5 and none of them were ever read, so the plugin stayed in English whatever language the site ran in. The Text Domain and Domain Path lines in a plugin header are metadata; they do not make WordPress read a catalogue out of the plugin's own folder, and the call that does was missing. German, Spanish, French, Italian, Japanese, Dutch, Portuguese, Brazilian Portuguese and Russian now work.
* Changed: the Overview now opens with what actually moved. The sentence explaining the change was being generated already, but it sat inside a card roughly two thirds of the way down the page while a shorter version of the same thought ran as one grey line near the top. The fuller one leads, and the card no longer repeats it.
* Changed: the reorderable sections, including What changed and the traffic chart, now sit directly under the headline figures. AI assistants, Search Console, notes and page speed moved below them. Notes in particular read as a footnote to the chart, which now renders above them rather than below.
* Changed: gained and lost rows carry a bar, scaled across both columns rather than within each one, so a month where the losses are twice the gains looks like one.
* Changed: the headline figures use the plugin's own green. It was already on the chart but not on the numbers, which left the brand sitting on the supporting element.
* Fixed: other plugins' admin notices no longer print on Vireo's screens. Several analytics and licensing plugins register banners with no screen check, so an unrelated plugin's marketing could sit above your traffic. WordPress's own notices, including the update prompt, still show, and so do Vireo's own warnings.

= 0.7.8 =
* Fixed: five importers that shipped without a way to reach them. Statify, WP Statistics, Burst Statistics, Independent Analytics and SlimStat have had working importers since 0.7.0 and the readme has listed them since, but no screen was ever registered for any of them, so the only sources you could actually import from were Koko Analytics, Jetpack Stats and Google Analytics. All five now have an import screen, and the list under Settings is built from the importers that exist rather than a separate hand-written list, so the two cannot drift apart again.
* Changed: the first-run banner now looks for every source it can import from instead of only Koko Analytics and Jetpack Stats, and names the ones it found. A site running any of the other five previously got no prompt at all.
* Fixed: the Overview said the geo-location database was missing on sites whose host or CDN already supplies the visitor's country, while Settings correctly said countries were resolving. Both now check the same thing, and the admin notice and the "What changed" hint follow suit. The "Set it up" link now goes straight to the Geo-location section instead of the top of Settings.
* Fixed: clicking a section's move handle on the Overview, without dragging, left that section greyed out and pinned to the screen until the page was reloaded. A click now does nothing, and a drag always lets go of the section when you release it, even if the pointer leaves the window.
* Changed: the test email now says who it went to. When sending fails it shows the reason the mail system gave, and when it succeeds it explains that WordPress only hands the message to the server, so a missing email points at the host's mail delivery, not at the digest.
* Changed: the page speed card names what it measures (load time, response to clicks, layout shift), grades each figure in words as well as colour, and explains the 75th percentile in plain terms. With under 30 measured visits it says the figures will move.
* Changed: "Countries to treat as junk" no longer shows example country codes, which read as a recommendation.
* Changed: section headings on the Settings screen are larger, so the page scans as sections rather than one long form.
* Changed: the Overview and Settings screens carry the Vireo mark and use the brand green for charts, the map, buttons and selected controls, in place of the default admin blue.

= 0.7.7 =
* Added: a way to clear what an excluded country already recorded. Excluding a country has only ever stopped it being counted from that point on, which left the earlier data in your reports with no way to remove it. Settings, then Geo-location, now offers to clear the stored days for the countries you exclude. It clears the countries report and the lookup cache, and leaves your pageview and visitor totals alone, because nothing else records which country a visit came from and guessing after the fact would be worse than leaving it.

= 0.7.6 =
* Fixed: excluded countries were only honoured on the daily rollups. Everything else that asks whether a request should be counted (including the Pro live visitor feed) never checked the list, so traffic you had chosen to discard kept appearing live while the same traffic was correctly absent from your reports. The check now lives in the shared rule, so anything that consults it gets the setting for free. Reported by a user who noticed the two views disagreeing.
* Fixed: importing a history from another plugin wrote straight into the country report without checking your exclusions, putting back the countries you had already discarded. Imports now skip them.
* Note: neither fix removes rows already stored. Excluding a country stops it being counted from that point on; it does not erase what was counted before.

= 0.7.5 =
* Every bundled translation is complete again. The catalogues were last built in July and covered about two thirds of the plugin, so anything added since (the Google Analytics import, Search Console, the bot filter, AI assistant traffic, Site Health, annotations, Web Vitals) appeared in English no matter what language the site was in. German, French, Italian, Japanese, Dutch, Portuguese in both variants, Russian and Spanish now cover all of it.
* Fixed a batch of Spanish strings that stated the opposite of the English. The Jetpack importer told you to copy your API key into Jetpack rather than out of it, the retention note read as though whole tables were deleted, and the 404 table headed its request count with a word meaning successful accesses.

= 0.7.4 =
* Fixed: crawlers were only counted when they ran the tracking script, and almost none of them do. The filter saw the handful of agents that render JavaScript and missed every one that just fetches HTML, which skewed the categories against each other rather than only lowering them: one site reported AI crawlers at 22 times its search crawlers, where the server log for the same days had them at roughly 1.3 times. Crawlers are now counted when they ask WordPress for a page. Expect these numbers to step up sharply after you update, and expect the balance between categories to shift.
* Fixed: the bot panel described its percentage as "everything that asked for a page". It is what Vireo saw. A site with full-page caching answers many crawler requests before WordPress runs, and nothing inside WordPress can count those, so the panel now says that instead.

= 0.7.3 =
* Fixed: an import that failed said it had succeeded. The browser showed "Import complete" in green, the range was filed in the already-imported list, and the message explaining what to correct was never displayed. A failed import now stops with that message on screen and records nothing.
* Fixed: when Google refused a request because the Analytics Data API was not enabled on the project, the error said to check the service account's access on the property instead. Google's own message names the API and links the page that turns it on, and it is now shown as sent.

= 0.7.2 =
* Added: countries you can treat as junk traffic. Settings, then Geo-location, takes a list of two-letter codes, and anything from those countries is discarded instead of counted, the same as an excluded IP. Bots that announce themselves were already filtered; this is for the traffic that does not. Requested by a user who found the bot filter was not catching what he was seeing.

= 0.7.1 =
Hardening and import safety, from an independent review of the 0.7.0 code.

* Fixed: the tracking endpoint believed a forwarded IP header from anyone who sent one, once proxy trust was switched on. A visitor could claim any address, which sidesteps the per-address rate limit and the excluded-IP rules and invents a new visitor on demand. Headers are now read only when the connection itself came from a known proxy, and the list of those can be set with the `vireo_trusted_proxies` filter. Cloudflare's ranges and the private ranges are trusted by default, so a site behind either keeps working unchanged.
* Fixed: around the day boundary two visitors could be issued different daily salts, because rotation read, generated and wrote without claiming anything first. Only one salt survived, so visitors hashed under the others were counted a second time. A day's salt is now claimed once and shared. Salts older than yesterday are still deleted, so old hashes stay unrecoverable.
* Fixed: the buffer's size limit applied to each file rather than to the directory. A burst arriving while no buffer existed could create several, each with its own allowance. There is now a ceiling across the directory, and the aggregator drains every buffer it finds in a tick rather than the first one.
* Added: imports record what they brought in. Asking for dates already imported now says which run covers them and asks you to confirm, rather than adding the numbers on top in silence. Importing still cannot be undone, so the confirmation is the protection.
* Added: setup instructions for the Google Analytics import and for Search Console now name each screen, both Google products involved, and which property ID is the right one.
* Fixed: the import progress bar reports itself to screen readers, and results and errors are announced instead of appearing silently.

= 0.7.0 =
This release fixes a fault that could stop a site recording, and answers several questions the dashboard had been raising without being able to settle.

* Fixed: on a site that had already been running, a new table could be missing while the code that writes to it was live. Because the daily rollups are written together, that one failure rolled back everything written beside it, including pageviews, and the site stopped recording. Schema changes no longer depend on anyone remembering to bump a version, and a missing table now costs its own rows and nothing else.
* Fixed: deleting the plugin left a Google service-account key, a set of access tokens, four tables and every uploaded database behind. On a network it cleaned only the site you happened to be on. Uninstall now removes all of it, on every site.
* Fixed: a saved Google key could not be removed once pasted. There is now a control for it, and removing the key drops its cached tokens too.
* Fixed: Search Console could lose months of history if a sync timed out partway. It now works a day at a time and loses at most the day it was in the middle of.
* Fixed: speed measurements ignored the excluded-IP list and stored page paths in a different form from everything else, so they never lined up with the pages they described.
* Fixed: a crafted link could put arbitrary text into an admin notice on the settings screen.
* Fixed: on a network, activating the plugin set up only one site, and sites created afterwards were never set up at all.
* Fixed: on sites running Redis or Memcached, the per-address limit on the tracking endpoint counted by reading a value and writing it back, so requests arriving together could all read the same number and all pass. It now counts atomically, and treats an IPv6 allocation as one address rather than as the billions it contains.
* Fixed: importing from Google Analytics could only be reached by knowing the address of its screen, because nothing linked to it.
* Added: Core Web Vitals from real visitors, reported as the 75th percentile.
* Added: Search Console, bringing in the searches people ran before they arrived.
* Added: import from Google Analytics 4.
* Added: notes pinned to a date on the chart.
* Added: choose which roles can read the dashboard, without handing out administrator.
* Added: a network-wide view on multisite.
* Added: works with consent plugins that use the WP Consent API, and can be told to wait for consent on sites whose policy asks for it.
* Added: a Site Health check that says whether the site is recording right now.

Older versions are in [changelog.txt](https://plugins.trac.wordpress.org/browser/vireo-analytics/trunk/changelog.txt), which also ships with the plugin.

== Upgrade Notice ==

= 0.2.2 =
Performance fix from the plugin review: the tracker's rate limiter no longer writes to the options table on sites without a persistent object cache.

= 0.2.1 =
Privacy and hardening fixes from the plugin review: no third-party requests, no generated PHP files, nonce-checked admin filters.

= 0.2.0 =
Initial public release.
