* Fix: prevented a fatal error on older PHP versions (below 7.1) where autoloading the bundled MaxMind GeoIP2 library could crash the visitor-tracking request (HTTP 500), causing visits to not be recorded. On such servers the plugin now safely skips the local GeoIP database reader and falls back to the other geolocation methods (Cloudflare headers, permanent cache, external API), so tracking keeps working. The reader initialization was also hardened to catch a broader range of runtime errors and log them when WP_DEBUG is enabled.
* Performance: the CanvasJS charting library (~527 KB) is no longer loaded for regular front-end visitors. It is only enqueued in the admin dashboard and, on the front-end, only for logged-in administrators who can see the admin-bar chart. This improves front-end PageSpeed / Total Blocking Time with no change to the charts.
* Fix: Campaign visits (UTM) now appear in the Traffic Sources report under their own "UTM Traffic" category. Newsletter/email links carry no HTTP referer, so campaign visits were previously counted as "Direct". Campaign visits with no real referer are now tagged and shown as a distinct "UTM Traffic" source (e.g. "newsletter (email)"), separate from Direct and Referral, and are not double-counted. Campaign labels are intentionally kept out of the "Referring Sites" report so that report continues to list only genuine referring domains. Also improved UTM extraction to recover utm_medium from redirect/click-tracking links whose inner url is not URL-encoded.
* Fix: Google Search Console "Sync Now" no longer creates duplicate keyword rows on every run. The duplicate-check queries were reading from prefixed table names that did not exist, so the check never matched and each sync re-inserted the same keywords (plus duplicate source/country lookup rows). The read queries now match the plugin's actual table names.
* New: UTM campaign support. Visits arriving with utm_source/utm_medium (e.g. from newsletter or email links) are now detected and recorded as a traffic source in the "Referring Sites" report, shown as "source (medium)". This fixes email/newsletter traffic previously appearing as Direct because such links carry no HTTP referer. UTM parameters are also detected inside redirect/click-tracking links.
* Security: hardened all report REST routes and admin AJAX endpoints against SQL injection by parameterizing every query and forcing pagination values to integers.
* Security: fixed a stored/second-order SQL injection where the custom timezone setting was saved without validation; timezone values are now validated against known timezone identifiers and UTC offsets before storage.
* Security: added capability checks to the admin-facing statistics AJAX endpoints so site analytics can no longer be requested by unauthenticated or low-privilege users.
* Security: fixed reflected XSS and SQL injection in the IP history endpoint (output escaped, inputs sanitized and parameterized).
1. Data retention settings with manual and automatic cleanup
2. Performance improvements