15 versions
Visitor Traffic Real Time Statistics pro history.
Every release of Visitor Traffic Real Time Statistics pro is archived here with its changelog, file size, and security scan result. Use the archive to roll back to a stable release or audit what changed between updates.
15 of 15 releases scanned clean
v11.26Latest
October 19, 20263.1 MBScanned
Fixed
- search engine and referral visits were counted twice for every new visit, and once more on every reload of an already-recorded page. Each visit is now counted once.
Other
- Stronger bot filtering: crawlers and automated browsers that run JavaScript but do not call themselves "bot" (GoogleOther, Google-InspectionTool, Chrome-Lighthouse, HeadlessChrome, Puppeteer/Playwright/Selenium, uptime monitors, HTTP libraries, AI crawlers...) are no longer counted. Both the real request User-Agent and the one reported by the page are checked, and automated browsers (navigator.webdriver) are ignored. Real visitors on CUBOT phones are counted again.
- Pages prerendered by the browser are only counted when the visitor actually opens them. Chrome prerenders top Google results, which was inflating "search engine visits".
- Accurate time on site: engaged time is measured in the browser (visible tab + recent interaction) and reported per page view. It replaces the Heartbeat-based duration, which kept counting for idle/background tabs and measured the first-to-last request of an IP over the whole day. Single-page visits are part of the average. Visits recorded before 11.26 show "-" instead of an invented value. The "Engaged" journey filter and the duration sort use the new value.
- "Online now" is kept up to date by a lightweight report every 60 seconds while the visitor's tab is visible (background tabs no longer count as online).
- Clearer traffic sources: each visit is counted once, under the source of its first page (Organic Search, Direct, Referral, Social Media, UTM Traffic). Google visits now appear under Organic Search, and Gmail, Google Docs, Translate and similar links are no longer counted as search engine visits.
- Security: the visitor IP is now strictly validated before it is stored (forged X-Real-IP / X-Forwarded-For headers could store arbitrary text). The Heartbeat receiver that trusted an IP sent by the browser was removed.
- More accurate countries: the visitor IP is taken from Cloudflare/CDN headers first, internal proxy addresses are skipped, "IP:port" values are understood, the city is no longer borrowed from a different country, and the location cache now expires after 30 days.
- Visitors whose IP cannot be determined are no longer counted as a new visitor on every page view.
- Performance: database schema checks (including ALTER TABLE statements) no longer run on every request, only once after an update. The front end no longer loads jQuery and WordPress Heartbeat for visitors, and the visitor IP is no longer printed into the page HTML.
September 27, 20262.9 MBScanned
* Security: fixed an unauthenticated stored XSS vulnerability via the "page_title" parameter of the visitor-tracking endpoint (ahcpro_track_visitor). A crafted page title could be stored in the title-traffic table and execute in the admin dashboard when the "Traffic by Title" table was loaded. Page titles, user agents and referers are now stripped of any HTML on storage (both in the AJAX handler and in the hit counter itself), and page titles and links are escaped on output, so payloads stored by older versions can no longer execute either. The Excel export keeps clean, readable titles.
* Security: fixed reflected XSS in the dashboard date-range search fields, which echoed submitted values back into the page without escaping.
* Security: hardened output escaping in the "Latest Search Words" block and in the mobile-app REST API (page titles, keywords and referers are no longer returned with markup).
* Hardening: admin redirects now use wp_safe_redirect(), and the database index upgrade routine validates table/index identifiers before running.
September 9, 20262.9 MBScanned
* Security: fixed a stored XSS vulnerability in the search-keywords path of the visitor-tracking endpoint. An unauthenticated visitor could submit a crafted "referer" (e.g. a search-engine URL whose query string contained a percent-encoded HTML payload) that survived URL sanitization, was decoded back to markup, stored in the keywords table, and executed in the admin dashboard when viewing the Latest Search Words / keywords report. Extracted keywords are now stripped of any HTML on storage and escaped on output (URL via esc_url, text via esc_html), in both the table view and the Excel export. This completes the 11.19 tracking-endpoint hardening by closing the sibling "referer" parameter.
August 27, 20262.9 MBScanned
Fixed
- prevented a fatal error on older PHP versions (below 7.1) where autoloading the bundled MaxMind GeoIP2 library could crash the visitor-tracking request (HTTP 500), causing visits to not be recorded. On such servers the plugin now safely skips the local GeoIP database reader and falls back to the other geolocation methods (Cloudflare headers, permanent cache, external API), so tracking keeps working. The reader initialization was also hardened to catch a broader range of runtime errors and log them when WP_DEBUG is enabled.
v11.20Unavailable
August 21, 20262.9 MBScanned
* Performance: the CanvasJS charting library (~527 KB) is no longer loaded for regular front-end visitors. It is only enqueued in the admin dashboard and, on the front-end, only for logged-in administrators who can see the admin-bar chart. This improves front-end PageSpeed / Total Blocking Time with no change to the charts.
v11.16Unavailable
August 8, 20262.9 MBScanned
Fixed
- Campaign visits (UTM) now appear in the Traffic Sources report under their own "UTM Traffic" category. Newsletter/email links carry no HTTP referer, so campaign visits were previously counted as "Direct". Campaign visits with no real referer are now tagged and shown as a distinct "UTM Traffic" source (e.g. "newsletter (email)"), separate from Direct and Referral, and are not double-counted. Campaign labels are intentionally kept out of the "Referring Sites" report so that report continues to list only genuine referring domains. Also improved UTM extraction to recover utm_medium from redirect/click-tracking links whose inner url is not URL-encoded.
- Google Search Console "Sync Now" no longer creates duplicate keyword rows on every run. The duplicate-check queries were reading from prefixed table names that did not exist, so the check never matched and each sync re-inserted the same keywords (plus duplicate source/country lookup rows). The read queries now match the plugin's actual table names.
v11.15Unavailable
August 1, 20262.9 MBScanned
Added
- UTM campaign support. Visits arriving with utm_source/utm_medium (e.g. from newsletter or email links) are now detected and recorded as a traffic source in the "Referring Sites" report, shown as "source (medium)". This fixes email/newsletter traffic previously appearing as Direct because such links carry no HTTP referer. UTM parameters are also detected inside redirect/click-tracking links.
v11.11Unavailable
July 26, 20262.9 MBScanned
* Security: hardened all report REST routes and admin AJAX endpoints against SQL injection by parameterizing every query and forcing pagination values to integers.
* Security: fixed a stored/second-order SQL injection where the custom timezone setting was saved without validation; timezone values are now validated against known timezone identifiers and UTC offsets before storage.
* Security: added capability checks to the admin-facing statistics AJAX endpoints so site analytics can no longer be requested by unauthenticated or low-privilege users.
* Security: fixed reflected XSS and SQL injection in the IP history endpoint (output escaped, inputs sanitized and parameterized).
11.10
* performance improvements
v11.9.12Unavailable
June 28, 20262.9 MBScanned
* Improve: tidied the Geolocation settings panel layout — clearer header, a proper status box with the database state and update button aligned, and consistent spacing between fields.
Why archive
Sometimes the latest release isn't the one you need. The archive lets you pin Visitor Traffic Real Time Statistics pro to a known-good version, or roll back while a bug is investigated. Every release stays scanned and reachable.