* Fix: Campaign visits (UTM) now appear in the Traffic Sources report under their own "UTM Traffic" category. Newsletter/email links carry no HTTP referer, so campaign visits were previously counted as "Direct". Campaign visits with no real referer are now tagged and shown as a distinct "UTM Traffic" source (e.g. "newsletter (email)"), separate from Direct and Referral, and are not double-counted. Campaign labels are intentionally kept out of the "Referring Sites" report so that report continues to list only genuine referring domains. Also improved UTM extraction to recover utm_medium from redirect/click-tracking links whose inner url is not URL-encoded.
* Fix: Google Search Console "Sync Now" no longer creates duplicate keyword rows on every run. The duplicate-check queries were reading from prefixed table names that did not exist, so the check never matched and each sync re-inserted the same keywords (plus duplicate source/country lookup rows). The read queries now match the plugin's actual table names.
* New: UTM campaign support. Visits arriving with utm_source/utm_medium (e.g. from newsletter or email links) are now detected and recorded as a traffic source in the "Referring Sites" report, shown as "source (medium)". This fixes email/newsletter traffic previously appearing as Direct because such links carry no HTTP referer. UTM parameters are also detected inside redirect/click-tracking links.
* Security: hardened all report REST routes and admin AJAX endpoints against SQL injection by parameterizing every query and forcing pagination values to integers.
* Security: fixed a stored/second-order SQL injection where the custom timezone setting was saved without validation; timezone values are now validated against known timezone identifiers and UTC offsets before storage.
* Security: added capability checks to the admin-facing statistics AJAX endpoints so site analytics can no longer be requested by unauthenticated or low-privilege users.
* Security: fixed reflected XSS and SQL injection in the IP history endpoint (output escaped, inputs sanitized and parameterized).
1. Data retention settings with manual and automatic cleanup
2. Performance improvements