v1.9.2
2026-09-25- Security: Fixed an unauthenticated stored cross-site scripting issue in the post analytics box and the dashboard (CVE-2026-95686, CVE-2026-95809, reported through Wordfence). Link addresses, referrers and location data sent by the public tracker are now validated before they are stored, the country name is always resolved by the server, values already stored are cleaned when they are read back, and every value is escaped before it is displayed. Update recommended.
- Feature: "How it works" page (was Roadmap): an animated view of the seven collectors feeding Smart Insights with your own numbers, the four-step loop, a first-days checklist, the Free and Pro modules, the latest release notes, the roadmap and support. Its "Setup check" card shows whether visits are received, whether a caching or optimization plugin blocks a tracker and whether your own visits are counted, with a button to fix each item.
- Fix: Spam filter — after saving the Traffic & Behavior thresholds, the spam recalculation could flag every session as spam ("few scrolls"), so "Exclude spam" hid all recordings, sessions and stats. The recalculation and the scheduled spam cleanup now read scrolls and clicks from the same sources as the rest of the plugin, and sessions wrongly flagged by 1.9.1 are re-checked automatically in the background after the update. Nothing to do on your side.
- Fix: A click on a cookie / consent banner no longer counts as a visitor click, so a visitor who only answered the banner is no longer counted as engaged when spam is excluded. Single-page visits are no longer counted as having at most one scroll.
- Feature: Admin menu in two groups: "Your data" (Traffic, Heatmaps, Recordings, Funnels, User Journeys, Errors Tracking, Forms), then "What to fix" (Smart Insights, A/B Testing). The Dashboard is now "Traffic", with a chart icon; its page is titled "Traffic Overview". The Smart Insights menu item pulses in the colour of your open problems: red = a Critical problem, yellow = High or Medium, green = nothing to fix. Nothing is computed on page load and nothing is added to the public site.
- Feature: Cookie preferences shortcode — paste [opti_behavior_cookie_settings] into your Privacy or Cookie Policy page: visitors see their current choice and can change or withdraw it at any time (GDPR art. 7). Withdrawing removes the tracking cookies and identifiers immediately and tracking falls back to cookie-free anonymous mode. [opti_behavior_cookie_settings display="link"] (or the CSS class ob-consent-open on any link) reopens the banner instead. Settings → Privacy & GDPR.
- Enhancement: The visitor's consent choice is now remembered for 6 months by default (CNIL recommendation); 12 months remains available in Settings → Privacy & GDPR. When the choice expires or is refused, the identifiers stored under the earlier consent are removed from the browser. A/B tests in Full Tracking mode write the variant cookie only after the visitor accepts the consent banner; until then tests keep running cookie-free, exactly like Anonymous mode, and a visitor who accepts later keeps the variant already seen.
- Feature: Smart Insights "How it works" strip: what each module sent over the period, then what was found, fixed and confirmed.
- Feature: Page X-Ray, the per-page report of Smart Insights, is part of Opti-Behavior Pro. In the free version the "Page X-Ray" tab shows a lock and a PRO badge, what the tab does and an example report; the "Dossier" button of the heatmap list carries the same lock.
- Feature: Two one-time messages, on Opti-Behavior screens only: 2 days after installation, if your own visits are still counted, an offer to exclude them; after an update, a note that the menu changed, with a link to the guide. The welcome popup now ends on the "How it works" page, and the welcome screen and popup say "Smart Insights" (was "AI Insights").
- Enhancement: Smart Insights cards are more reliable. Confidence comes from the number of visits measured (a 65-visit card is Medium at most) and Critical must be earned: enough visits measured, High confidence and a loss that matters on this site. Cards with the same numbers get the same priority, "Worse" / "Better" needs a real change, site-wide cards no longer read "Observation on 0 sessions", cards with identical data are merged into one, and a "Provisional · N visits" badge marks cards built on few visits.
- Enhancement: Funnel drop-off cards name the step visitors leave ("between Product and Cart, 60 of 90 visitors leave"), count visits instead of tracking rows, need two steps and 50 visits, show a "Where visitors leave" step bar and open the funnel on that step. The end-to-end drop rule, true of almost every funnel, is gone, and the Funnels page warns when two funnels track the same steps.
- Enhancement: Smart Insights money figures are real: an amount "at risk" is shown only for a funnel that ends at the checkout (with at least 20 orders over the period) or for a form priced with your own value of a conversion. Content funnels, errors, slow pages and engagement drops show the visitors they lose instead of a dollar figure, and amounts computed by the previous rule are no longer displayed.
- Enhancement: Insight details say each thing once, show "Things to check" when nothing was measured, show no lift range without a published source, and show the "Result" of a resolved card (before, after, verdict or the day the measurement ends). Cards the new rules no longer confirm close as "Closed: rule updated" and never count as resolved.
- Enhancement: Heatmap page: each device button shows its icon above the number and keeps the same width whatever the number (12 k above 9 999, exact number on hover); Views, Clicks and Avg Time sit on the same row as the heatmap types.
- Fix: Smart Insights: a custom date range that ends before it starts shows a clear message; the notification panel no longer lists locked Pro previews one by one and no longer covers the buttons of the A/B test wizard; high bounce and low scroll cards use one rule (30 visits, same limits, same comparison with the site average).
- Fix: Heatmaps: the background tasks no longer schedule the same hourly job twice or queue pages without an ID again and again, and the action buttons of the heatmap list no longer overlap the "Last Updated" column.
- Fix: Danger Zone: "Heatmap Data" now counts and deletes the archived heatmaps too, deleting Smart Insights resets the menu colour at once, and a reset is recorded in Cleanup History. Cleanup History folds repeated runs that deleted nothing into one entry and only says "deleted" when something was deleted.
- Fix: Funnels: a link to a funnel opens the list page that contains it, and the suggestions panel keeps both display choices when they are clicked quickly.
- Fix: Dashboard: the real-time visitors globe shows again for visitors without a country, instead of a raw code snippet, and the User Intent card no longer shows rows of zeros above its empty state.
- Fix: Translations: Smart Insights is fully translated (spam filter button, one label per category), the plugin's own admin language now also applies to Smart Insights and Forms, the deactivation survey and about 100 Portuguese strings carry their accents, and every new string is translated in French, German, Spanish, Italian and Portuguese.
- Compatibility: Pair with Opti-Behavior Pro 1.9.2. Update both plugins together.