Changeset 3742708

Timestamp:

10/13/2026 01:11:55 AM (3 weeks ago)

Author:

someguy9

Message:

Release 1.7.0

Location:

lightweight-google-analytics

Files:

• tags/1.7.0 (copied) (copied from lightweight-google-analytics/trunk )
• tags/1.7.0/lightweight-google-analytics.php (modified) (16 diffs)
• tags/1.7.0/readme.txt (modified) (5 diffs)
• tags/1.7.0/uninstall.php (modified) (1 diff)
• trunk/lightweight-google-analytics.php (modified) (16 diffs)
• trunk/readme.txt (modified) (5 diffs)
• trunk/uninstall.php (modified) (1 diff)

lightweight-google-analytics/tags/1.7.0/lightweight-google-analytics.php

@@ -4 +4 @@
  * Plugin URI: https://wordpress.org/plugins/lightweight-google-analytics/
  * Description: Extremely simple plugin to add Google Analytics 4 to your WordPress site using your Measurement ID.
- * Version: 1.6.0
+ * Version: 1.7.0
  * Requires at least: 5.7
  * Requires PHP: 7.0
@@ -18 +18 @@
 }
 
-define( 'LIGHTWEIGHT_GA_VERSION', '1.6.0' );
+define( 'LIGHTWEIGHT_GA_VERSION', '1.7.0' );
 
 // Saved settings with defaults filled in
@@ -30 +30 @@
                 'tracking_code'            => 'analytics-js',
                 'consent_mode'             => '',
+                'gpc'                      => '',
+                'content_groups'           => '',
                 'debug_mode'               => '',
         ) );
@@ -46 +48 @@
                 $reason = 'preview';
         } elseif ( is_user_logged_in() ) {
+                $roles = explode( '-', $settings['tracking_level'] );
                 if ( 'logged-in' === $settings['tracking_level'] ) {
                         $reason = 'logged-in';
-                } elseif ( 'all' !== $settings['tracking_level'] && array_intersect( explode( '-', $settings['tracking_level'] ), (array) wp_get_current_user()->roles ) ) {
+                } elseif ( 'all' !== $settings['tracking_level'] && ( array_intersect( $roles, (array) wp_get_current_user()->roles ) || ( is_multisite() && is_super_admin() && in_array( 'administrator', $roles, true ) ) ) ) {
+                        // Network super admins don't always have the administrator role on the site itself
                         $reason = 'role';
                 }
@@ -57 +61 @@
 }
 
-// Print the tracking code in the head or footer, whichever the settings say
+// GA4 content group (the post's category, the post type, or the kind of archive) and author name for the current page
+function lightweight_ga_page_dimensions() {
+        $group  = '';
+        $author = '';
+        if ( is_front_page() ) {
+                $group = __( 'Home', 'lightweight-google-analytics' );
+        } elseif ( is_home() ) {
+                $group = __( 'Blog', 'lightweight-google-analytics' );
+        } elseif ( is_singular() && get_queried_object() instanceof WP_Post ) {
+                $post = get_queried_object();
+                if ( 'post' === $post->post_type ) {
+                        $categories = get_the_category( $post->ID );
+                        // Prefer the primary category picked in Yoast SEO or Rank Math
+                        $primary = (int) get_post_meta( $post->ID, '_yoast_wpseo_primary_category', true ) ?: (int) get_post_meta( $post->ID, 'rank_math_primary_category', true );
+                        foreach ( $categories as $category ) {
+                                if ( $category->term_id === $primary ) {
+                                        $group = $category->name;
+                                }
+                        }
+                        if ( ! $group && $categories ) {
+                                $group = $categories[0]->name;
+                        }
+                } else {
+                        $type  = get_post_type_object( $post->post_type );
+                        $group = $type ? $type->labels->singular_name : $post->post_type;
+                }
+                if ( post_type_supports( $post->post_type, 'author' ) ) {
+                        $author = get_the_author_meta( 'display_name', $post->post_author );
+                }
+        } elseif ( is_category() || is_tag() || is_tax() ) {
+                $group = single_term_title( '', false );
+        } elseif ( is_post_type_archive() ) {
+                $group = post_type_archive_title( '', false );
+        } elseif ( is_author() ) {
+                $group  = __( 'Author archive', 'lightweight-google-analytics' );
+                $author = get_the_author_meta( 'display_name', get_queried_object_id() );
+        } elseif ( is_date() ) {
+                $group = __( 'Date archive', 'lightweight-google-analytics' );
+        } elseif ( is_search() ) {
+                $group = __( 'Search', 'lightweight-google-analytics' );
+        } elseif ( is_404() ) {
+                $group = __( 'Page not found', 'lightweight-google-analytics' );
+        }
+        // Change or add page-level parameters, e.g. a custom content group for a section of the site
+        $dimensions = array_filter( (array) apply_filters( 'lightweight_ga_page_dimensions', array( 'content_group' => $group, 'author' => $author ) ), 'strlen' );
+        // GA4 ignores parameter values longer than 100 characters
+        return array_map( function ( $value ) {
+                return function_exists( 'mb_substr' ) ? mb_substr( (string) $value, 0, 100 ) : substr( (string) $value, 0, 100 );
+        }, $dimensions );
+}
+
+// The WP Consent API (wordpress.org/plugins/wp-consent-api) lets consent banners share visitors' choices with other plugins.
+// Its functions only exist after plugins_loaded, so this is checked at output time.
+function lightweight_ga_has_consent_api() {
+        return function_exists( 'wp_has_consent' );
+}
+
+// Tell the WP Consent API (and its Site Health check) that tracking follows visitors' choices, which is true while Consent Mode is on
+add_filter( 'wp_consent_api_registered_' . plugin_basename( __FILE__ ), function () {
+        return (bool) lightweight_ga_settings()['consent_mode'];
+} );
+
+// JS that waits for the WP Consent API to know the visitor's choices, then calls `callback` with wp_has_consent and again whenever they change.
+// The API's script loads in the footer, so the first check runs once the page is parsed. Consent banners that set
+// waitfor_consent_hook decide the consent type late; checking earlier would read "no banner" as consent.
+function lightweight_ga_consent_api_js( $callback ) {
+        return '(function(){var c=' . $callback . ',s=function(){if(typeof wp_has_consent==="function"){c();}},w=function(){window.waitfor_consent_hook?document.addEventListener("wp_consent_type_defined",s):s();};document.readyState==="loading"?document.addEventListener("DOMContentLoaded",w):w();document.addEventListener("wp_listen_for_consent_change",s);})();';
+}
+
+// Print the tracking code in the head or footer, whichever the settings say. Consent Mode defaults always go in the
+// head, so they come before any consent banner's update even when the tracking code itself is in the footer.
 add_action( 'wp_head', 'lightweight_ga_display', 0 );
 add_action( 'wp_footer', 'lightweight_ga_display', 0 );
 function lightweight_ga_display() {
         $settings = lightweight_ga_settings();
-        $hook     = 'footer' === $settings['tracking_position'] ? 'wp_footer' : 'wp_head';
-        if ( current_action() !== $hook || empty( $settings['enable_lightweight_ga'] ) || ! lightweight_ga_has_ga4_id() || lightweight_ga_excluded_reason() ) {
+        if ( empty( $settings['enable_lightweight_ga'] ) || ! lightweight_ga_has_ga4_id() || lightweight_ga_excluded_reason() ) {
                 return;
         }
-        $id = $settings['tracking_id'];
+        $id          = $settings['tracking_id'];
+        $in_head     = 'wp_head' === current_action();
+        $is_position = $in_head ? 'footer' !== $settings['tracking_position'] : 'footer' === $settings['tracking_position'];
 
         if ( 'minimalanalytics-inline' === $settings['tracking_code'] ) {
-                $script = file_get_contents( __DIR__ . '/js/minimal-analytics-4.min.js' );
-                if ( ! $script ) {
-                        return;
-                }
-                // The bundled script is configured by swapping the placeholder ID and the debug flag that sit at its top; check both anchors when updating the file
-                $script = str_replace(
-                        array( 'tid:"G-XXXXXXXXXX"', ']},T=!1,' ),
-                        array( 'tid:"' . esc_js( $id ) . '"', ']},T=' . ( $settings['debug_mode'] ? '!0' : '!1' ) . ',' ),
-                        $script
-                );
-                echo "<!-- Minimal Analytics 4 - Lightweight Google Analytics -->\n";
-                wp_print_inline_script_tag( $script );
+                if ( $is_position ) {
+                        lightweight_ga_print_minimal_analytics( $settings );
+                }
                 return;
         }
 
-        echo "<!-- Google tag (gtag.js) - Lightweight Google Analytics -->\n";
         $gtag_stub = 'window.dataLayer=window.dataLayer||[];function gtag(){dataLayer.push(arguments);}';
-
-        if ( $settings['consent_mode'] ) {
+        // Google's documented opt-out flag stops GA4 sending anything for visitors whose browser sends Global Privacy Control.
+        // It has to be set before any gtag() call, so it leads every inline script.
+        if ( $settings['gpc'] ) {
+                $gtag_stub = 'if(navigator.globalPrivacyControl){window["ga-disable-' . esc_js( $id ) . '"]=true;}' . $gtag_stub;
+        }
+
+        if ( $in_head && $settings['consent_mode'] ) {
                 // Consent Mode v2 defaults have to be set before gtag.js loads; the consent banner then calls gtag("consent","update",...)
                 $consent = apply_filters( 'lightweight_ga_consent_defaults', array(
@@ -94 +164 @@
                         'ad_user_data'       => 'denied',
                         'ad_personalization' => 'denied',
-                        'wait_for_update'    => 500,
+                        // How long Google waits for the consent update before sending anything; it carries on as soon as the update
+                        // arrives. With the WP Consent API the update comes once the page is parsed (its script is in the footer), so
+                        // allow for slow pages. Consent banners that call gtag themselves usually update early in the head.
+                        'wait_for_update'    => lightweight_ga_has_consent_api() ? 2000 : 500,
                 ) );
-                wp_print_inline_script_tag( $gtag_stub . 'gtag("consent","default",' . wp_json_encode( $consent ) . ');' );
-        }
-
+                $update = '';
+                if ( lightweight_ga_has_consent_api() ) {
+                        // Pass the visitor's choices from any consent banner that supports the WP Consent API on to Google
+                        // Banners such as Complianz change categories one at a time, so only send an update when the result changes
+                        $update = lightweight_ga_consent_api_js( '(function(){var l;return function(){var s=wp_has_consent("statistics")?"granted":"denied",m=wp_has_consent("marketing")?"granted":"denied";if(s+m===l){return;}l=s+m;gtag("consent","update",{analytics_storage:s,ad_storage:m,ad_user_data:m,ad_personalization:m});};})()' );
+                }
+                echo "<!-- Google Consent Mode defaults - Lightweight Google Analytics -->\n";
+                wp_print_inline_script_tag( $gtag_stub . 'gtag("consent","default",' . wp_json_encode( $consent ) . ');' . $update, array( 'data-lightweight-ga' => true ) );
+        }
+
+        if ( ! $is_position ) {
+                return;
+        }
+
+        echo "<!-- Google tag (gtag.js) - Lightweight Google Analytics -->\n";
         wp_print_script_tag( array(
-                'src'   => 'https://www.googletagmanager.com/gtag/js?id=' . rawurlencode( $id ),
-                'async' => true,
+                'src'                 => 'https://www.googletagmanager.com/gtag/js?id=' . rawurlencode( $id ),
+                'async'               => true,
+                'data-lightweight-ga' => true, // marks this plugin's own tags for the duplicate tracking check
         ) );
 
@@ -111 +197 @@
                 $config['debug_mode'] = true;
         }
+        if ( $settings['content_groups'] ) {
+                $config = array_merge( $config, lightweight_ga_page_dimensions() );
+        }
         // Add or change gtag config options, e.g. send_page_view, cookie_flags or custom dimensions
         $config = apply_filters( 'lightweight_ga_gtag_config', $config, $id );
-        wp_print_inline_script_tag( $gtag_stub . 'gtag("js",new Date());gtag("config","' . esc_js( $id ) . '"' . ( $config ? ',' . wp_json_encode( $config ) : '' ) . ');' );
+        wp_print_inline_script_tag( $gtag_stub . 'gtag("js",new Date());gtag("config","' . esc_js( $id ) . '"' . ( $config ? ',' . wp_json_encode( $config ) : '' ) . ');', array( 'data-lightweight-ga' => true ) );
+}
+
+// Minimal Analytics 4 is configured by swapping values in the bundled script; check all three anchors whenever the file is updated
+function lightweight_ga_print_minimal_analytics( $settings ) {
+        $script = file_get_contents( __DIR__ . '/js/minimal-analytics-4.min.js' );
+        if ( ! $script ) {
+                return;
+        }
+        // Content group and author ride along with every hit as event parameters
+        $params = '';
+        foreach ( $settings['content_groups'] ? lightweight_ga_page_dimensions() : array() as $key => $value ) {
+                $params .= wp_json_encode( 'ep.' . $key ) . ':' . wp_json_encode( $value ) . ',';
+        }
+        $script = str_replace(
+                array( 'tid:"G-XXXXXXXXXX"', ']},T=!1,', '_dbg:T?1:0[0]' ),
+                array( 'tid:"' . esc_js( $settings['tracking_id'] ) . '"', ']},T=' . ( $settings['debug_mode'] ? '!0' : '!1' ) . ',', $params . '_dbg:T?1:0[0]' ),
+                $script
+        );
+        // Run once the page is parsed: from the head it would otherwise send its page view before <title> exists and read a null document.body
+        $run = 'document.readyState==="loading"?document.addEventListener("DOMContentLoaded",r):r();';
+        if ( $settings['consent_mode'] && lightweight_ga_has_consent_api() ) {
+                // Minimal Analytics has no Consent Mode, so with the WP Consent API it only starts once the visitor allows statistics
+                $run = 'var d=0;' . lightweight_ga_consent_api_js( 'function(){if(!d&&wp_has_consent("statistics")){d=1;r();}}' );
+        }
+        if ( $settings['gpc'] ) {
+                $run = 'if(!navigator.globalPrivacyControl){' . $run . '}';
+        }
+        echo "<!-- Minimal Analytics 4 - Lightweight Google Analytics -->\n";
+        wp_print_inline_script_tag( '(function(){var r=function(){' . $script . "\n};" . $run . '})();', array( 'data-lightweight-ga' => true ) );
 }
 
@@ -121 +239 @@
                 add_action( 'admin_menu', array( $this, 'add_admin_menu' ) );
                 add_action( 'admin_init', array( $this, 'init_settings' ) );
+                add_action( 'admin_init', array( $this, 'maybe_upgrade' ) );
                 add_action( 'admin_notices', array( $this, 'admin_notices' ) );
+                add_action( 'wp_ajax_lightweight_ga_scan', array( $this, 'ajax_scan' ) );
                 add_filter( 'plugin_action_links_' . plugin_basename( __FILE__ ), array( $this, 'add_settings_link' ) );
         }
 
+        // Remembers the plugin version so an update can run one-off checks
+        public function maybe_upgrade() {
+                $state = (array) get_option( 'lightweight_ga_state', array() );
+                if ( isset( $state['version'] ) && LIGHTWEIGHT_GA_VERSION === $state['version'] ) {
+                        return;
+                }
+                if ( empty( $state['version'] ) && false !== get_option( 'lightweight_ga_settings' ) ) {
+                        // 1.5.0 to 1.6.0 ticked every checkbox the first time the settings were saved, so ask the site owner to check them
+                        $settings        = lightweight_ga_settings();
+                        $state['review'] = $settings['consent_mode'] || $settings['debug_mode'] || $settings['disable_display_features'];
+                }
+                $state['version'] = LIGHTWEIGHT_GA_VERSION;
+                update_option( 'lightweight_ga_state', $state );
+        }
+
         public function add_settings_link( $links ) {
-                $links[] = '<a href="' . esc_url( menu_page_url( 'lightweight-google-analytics', false ) ) . '">' . esc_html__( 'Settings', 'lightweight-google-analytics' ) . '</a>';
+                $links[] = '<a href="' . esc_url( admin_url( 'options-general.php?page=lightweight-google-analytics' ) ) . '">' . esc_html__( 'Settings', 'lightweight-google-analytics' ) . '</a>';
                 return $links;
         }
 
         public function admin_notices() {
-                $settings = lightweight_ga_settings();
-                $url      = esc_url( menu_page_url( 'lightweight-google-analytics', false ) );
+                if ( ! current_user_can( 'manage_options' ) ) {
+                        return;
+                }
+                $settings = lightweight_ga_settings();
+                $screen   = function_exists( 'get_current_screen' ) && get_current_screen() ? get_current_screen()->id : '';
+                $url      = esc_url( admin_url( 'options-general.php?page=lightweight-google-analytics' ) );
+                $state    = (array) get_option( 'lightweight_ga_state', array() );
+
+                if ( ! empty( $state['review'] ) ) {
+                        $on = array();
+                        foreach ( array( 'consent_mode' => __( 'Consent Mode', 'lightweight-google-analytics' ), 'debug_mode' => __( 'Debug Mode', 'lightweight-google-analytics' ), 'disable_display_features' => __( 'Disable Display Features', 'lightweight-google-analytics' ) ) as $key => $label ) {
+                                if ( $settings[ $key ] ) {
+                                        $on[] = $label;
+                                }
+                        }
+                        /* translators: 1: list of setting names, 2: link to the plugin settings page */
+                        $message = sprintf( __( '<strong>Lightweight Google Analytics:</strong> a bug in versions 1.5.0 to 1.6.0 could switch settings on by themselves the first time they were saved. These are on for this site: %1$s. Consent Mode without a consent banner and Debug Mode can both reduce the data you see in Google Analytics. Please check them in the %2$s and save.', 'lightweight-google-analytics' ), esc_html( implode( ', ', $on ) ), '<a href="' . $url . '">' . esc_html__( 'plugin settings', 'lightweight-google-analytics' ) . '</a>' );
+                        printf( '<div class="notice notice-warning"><p>%s</p></div>', wp_kses_post( $message ) );
+                }
+
+                // The settings page shows its own status message
+                if ( 'settings_page_lightweight-google-analytics' === $screen ) {
+                        return;
+                }
                 if ( 0 === strpos( $settings['tracking_id'], 'UA-' ) ) {
                         /* translators: %s: link to the plugin settings page */
                         $message = sprintf( __( '<strong>Lightweight Google Analytics:</strong> Google shut down Universal Analytics in 2023 and UA- IDs are no longer supported, so no tracking code is being output. Enter your Google Analytics 4 Measurement ID (G-XXXXXXXX) in the %s.', 'lightweight-google-analytics' ), '<a href="' . $url . '">' . esc_html__( 'plugin settings', 'lightweight-google-analytics' ) . '</a>' );
                         printf( '<div class="notice notice-warning"><p>%s</p></div>', wp_kses_post( $message ) );
-                } elseif ( '' === $settings['tracking_id'] ) {
+                } elseif ( '' === $settings['tracking_id'] && in_array( $screen, array( 'dashboard', 'plugins' ), true ) ) {
                         /* translators: %s: link to the plugin settings page */
                         $message = sprintf( __( 'Thank you for installing <strong>Lightweight Google Analytics</strong> - head to the %s to finish setting up Google Analytics.', 'lightweight-google-analytics' ), '<a href="' . $url . '">' . esc_html__( 'settings', 'lightweight-google-analytics' ) . '</a>' );
@@ -145 +302 @@
 
         public function sanitize_settings( $input ) {
-                $input     = (array) $input;
-                $sanitized = array( 'tracking_id' => '' );
-
-                $tracking_id = isset( $input['tracking_id'] ) ? strtoupper( trim( sanitize_text_field( $input['tracking_id'] ) ) ) : '';
-                if ( preg_match( '/^G-[A-Z0-9]+$/', $tracking_id ) ) {
-                        $sanitized['tracking_id'] = $tracking_id;
-                } elseif ( 0 === strpos( $tracking_id, 'UA-' ) ) {
-                        add_settings_error( 'lightweight_ga_settings', 'ua_tracking_id', __( 'Universal Analytics (UA-) IDs are no longer supported because Google shut Universal Analytics down in 2023. Enter your Google Analytics 4 Measurement ID (G-XXXXXXXX) instead.', 'lightweight-google-analytics' ) );
-                } elseif ( '' !== $tracking_id ) {
-                        add_settings_error( 'lightweight_ga_settings', 'invalid_tracking_id', __( 'Invalid Measurement ID. It should look like G-XXXXXXXX and can be found in Google Analytics under Admin > Data Streams.', 'lightweight-google-analytics' ) );
-                }
-
-                foreach ( array( 'enable_lightweight_ga', 'disable_display_features', 'consent_mode', 'debug_mode' ) as $checkbox ) {
-                        $sanitized[ $checkbox ] = isset( $input[ $checkbox ] ) ? 'checked' : '';
+                $input    = (array) $input;
+                $previous = lightweight_ga_settings()['tracking_id'];
+
+                // Accept the ID itself, or a pasted gtag snippet or URL that contains it. The ID is looked for in the raw text because
+                // sanitize_text_field() strips <script> blocks whole, URL included; only the matched letters and digits are ever kept.
+                $raw = isset( $input['tracking_id'] ) && is_string( $input['tracking_id'] ) ? strtoupper( trim( $input['tracking_id'] ) ) : '';
+                if ( preg_match( '/^G-[A-Z0-9]+$/', $raw ) ) {
+                        $tracking_id = $raw;
+                } elseif ( preg_match( '/(?<![A-Z0-9])G-[A-Z0-9]{4,}(?![A-Z0-9])/', $raw, $found ) ) {
+                        $tracking_id = $found[0];
+                        /* translators: %s: the Measurement ID found in the pasted text */
+                        add_settings_error( 'lightweight_ga_settings', 'extracted_tracking_id', sprintf( __( 'Found the Measurement ID %s in the pasted text and saved it.', 'lightweight-google-analytics' ), $tracking_id ), 'info' );
+                } else {
+                        $tracking_id = sanitize_text_field( $raw );
+                }
+
+                $sanitized = array( 'tracking_id' => $tracking_id );
+                if ( '' !== $tracking_id && ! preg_match( '/^G-[A-Z0-9]+$/', $tracking_id ) ) {
+                        // Keep the working ID instead of switching tracking off because of a typo
+                        $sanitized['tracking_id'] = $previous;
+                        if ( 0 === strpos( $tracking_id, 'UA-' ) ) {
+                                add_settings_error( 'lightweight_ga_settings', 'ua_tracking_id', __( 'Universal Analytics (UA-) IDs are no longer supported because Google shut Universal Analytics down in 2023. Enter your Google Analytics 4 Measurement ID (G-XXXXXXXX) instead.', 'lightweight-google-analytics' ) );
+                        } else {
+                                add_settings_error( 'lightweight_ga_settings', 'invalid_tracking_id', __( 'Invalid Measurement ID. It should look like G-XXXXXXXX and can be found in Google Analytics under Admin > Data Streams.', 'lightweight-google-analytics' ) . ( $previous ? ' ' . __( 'Your previous Measurement ID was kept.', 'lightweight-google-analytics' ) : '' ) );
+                        }
+                }
+
+                // ! empty() rather than isset(): on the very first save WordPress runs this twice, the second time on the already sanitized values
+                foreach ( array( 'enable_lightweight_ga', 'disable_display_features', 'consent_mode', 'gpc', 'content_groups', 'debug_mode' ) as $checkbox ) {
+                        $sanitized[ $checkbox ] = ! empty( $input[ $checkbox ] ) ? 'checked' : '';
                 }
 
@@ -167 +340 @@
 
                 $sanitized['tracking_code'] = isset( $input['tracking_code'] ) && 'minimalanalytics-inline' === $input['tracking_code'] ? 'minimalanalytics-inline' : 'analytics-js';
+
+                // The duplicate tag check runs again with the new settings
+                delete_transient( 'lightweight_ga_duplicate_scan' );
+
+                // Saving the settings answers the post-update request to review them
+                $state = (array) get_option( 'lightweight_ga_state', array() );
+                if ( ! empty( $state['review'] ) ) {
+                        $state['review'] = false;
+                        update_option( 'lightweight_ga_state', $state );
+                }
 
                 return $sanitized;
@@ -201 +384 @@
                         'tracking_code'            => __( 'Tracking Code', 'lightweight-google-analytics' ),
                         'consent_mode'             => __( 'Consent Mode', 'lightweight-google-analytics' ),
+                        'gpc'                      => __( 'Global Privacy Control', 'lightweight-google-analytics' ),
+                        'content_groups'           => __( 'Content Groups', 'lightweight-google-analytics' ),
                         'debug_mode'               => __( 'Debug Mode', 'lightweight-google-analytics' ),
                 );
                 foreach ( $fields as $field => $label ) {
-                        add_settings_field( $field, $label, array( $this, 'render_' . $field . '_field' ), 'lightweight_ga_settings', 'lightweight_ga_settings_section', array( 'class' => str_replace( '_', '-', $field ) ) );
-                }
-        }
-
-        // Tells the admin whether tracking is live, and why they personally will not show up in reports
+                        // label_for ties each row's title to its input for screen readers
+                        add_settings_field( $field, $label, array( $this, 'render_' . $field . '_field' ), 'lightweight_ga_settings', 'lightweight_ga_settings_section', array( 'class' => str_replace( '_', '-', $field ), 'label_for' => $field . '_field' ) );
+                }
+        }
+
+        // Tells the admin whether tracking is live, why they personally will not show up in reports, and what might need attention
         public function status_notice() {
                 $settings = lightweight_ga_settings();
-                if ( empty( $settings['enable_lightweight_ga'] ) ) {
+                if ( false === get_option( 'lightweight_ga_settings' ) ) {
+                        $class   = 'warning';
+                        $message = __( 'Enter your Google Analytics 4 Measurement ID (G-XXXXXXXX) and save to start tracking.', 'lightweight-google-analytics' );
+                } elseif ( empty( $settings['enable_lightweight_ga'] ) ) {
                         $class   = 'warning';
                         $message = __( 'Tracking is turned off. Tick "Enable Google Analytics" and save to start tracking.', 'lightweight-google-analytics' );
@@ -228 +417 @@
                 }
                 printf( '<div class="notice notice-%s inline" style="margin:15px 0 0"><p>%s</p></div>', esc_attr( $class ), esc_html( $message ) );
+
+                foreach ( $this->warnings( $settings ) as $warning ) {
+                        printf( '<div class="notice notice-warning inline" style="margin:10px 0 0"><p>%s</p></div>', wp_kses_post( $warning ) );
+                }
+        }
+
+        // Settings combinations that don't do what the site owner probably expects
+        private function warnings( $settings ) {
+                $warnings = array();
+                if ( 'minimalanalytics-inline' === $settings['tracking_code'] && $settings['consent_mode'] && ! lightweight_ga_has_consent_api() ) {
+                        $warnings[] = __( 'Consent Mode only applies to Google\'s gtag.js. Minimal Analytics runs for every visitor whatever they choose in your consent banner, unless the <a href="https://wordpress.org/plugins/wp-consent-api/" target="_blank" rel="noopener">WP Consent API</a> plugin is active with a consent banner that supports it.', 'lightweight-google-analytics' );
+                }
+                if ( lightweight_ga_has_consent_api() && ! $settings['consent_mode'] ) {
+                        $warnings[] = __( 'The WP Consent API is active, but Consent Mode is off, so Google Analytics ignores your visitors\' choices in your consent banner. Turn on Consent Mode to follow them.', 'lightweight-google-analytics' );
+                }
+                if ( $settings['enable_lightweight_ga'] && lightweight_ga_has_ga4_id() ) {
+                        list( $ga, $gtm ) = $this->other_ga_plugins();
+                        if ( $ga ) {
+                                /* translators: %s: plugin name(s) */
+                                $warnings[] = sprintf( __( '%s is also set up to add Google Analytics to your site, so your page views are probably counted twice. Turn off the tracking code in one of the plugins.', 'lightweight-google-analytics' ), esc_html( implode( ', ', $ga ) ) );
+                        }
+                        if ( $gtm ) {
+                                /* translators: %s: plugin name */
+                                $warnings[] = sprintf( __( '%s adds a Google Tag Manager container to your site. If that container also sends GA4 page views, they are counted twice.', 'lightweight-google-analytics' ), esc_html( implode( ', ', $gtm ) ) );
+                        }
+                }
+                return $warnings;
+        }
+
+        // Active plugins that are set up to print their own Google Analytics tag (and ones that print a Tag Manager container,
+        // which may or may not include GA4). Settings outlive deactivated plugins, so each check also needs the plugin active.
+        private function other_ga_plugins() {
+                if ( ! function_exists( 'is_plugin_active' ) ) {
+                        require_once ABSPATH . 'wp-admin/includes/plugin.php';
+                }
+                $option = function ( $name, $key ) {
+                        $value = get_option( $name );
+                        return is_array( $value ) && isset( $value[ $key ] ) ? $value[ $key ] : '';
+                };
+                $monsterinsights = function () {
+                        return function_exists( 'monsterinsights_get_v4_id' ) && monsterinsights_get_v4_id();
+                };
+                $exactmetrics = function () {
+                        return function_exists( 'exactmetrics_get_v4_id' ) && exactmetrics_get_v4_id();
+                };
+                $checks = array(
+                        'google-site-kit/google-site-kit.php'                  => array( 'Site Kit by Google', function () use ( $option ) {
+                                return in_array( 'analytics-4', (array) get_option( 'googlesitekit_active_modules' ), true ) && $option( 'googlesitekit_analytics-4_settings', 'useSnippet' ) && $option( 'googlesitekit_analytics-4_settings', 'measurementID' );
+                        } ),
+                        'google-analytics-for-wordpress/googleanalytics.php'   => array( 'MonsterInsights', $monsterinsights ),
+                        'google-analytics-premium/googleanalytics-premium.php' => array( 'MonsterInsights Pro', $monsterinsights ),
+                        'google-analytics-dashboard-for-wp/gadwp.php'          => array( 'ExactMetrics', $exactmetrics ),
+                        'exactmetrics-premium/exactmetrics-premium.php'        => array( 'ExactMetrics Pro', $exactmetrics ),
+                        'wp-analytify/wp-analytify.php'                        => array( 'Analytify', function () use ( $option ) {
+                                return 'on' === $option( 'wp-analytify-profile', 'install_ga_code' ) && $option( 'wp-analytify-profile', 'profile_for_posts' );
+                        } ),
+                        'ga-google-analytics/ga-google-analytics.php'          => array( 'GA Google Analytics', function () use ( $option ) {
+                                return $option( 'gap_options', 'gap_id' ) && $option( 'gap_options', 'gap_enable' );
+                        } ),
+                        'woocommerce-google-analytics-integration/woocommerce-google-analytics-integration.php' => array( 'Google Analytics for WooCommerce', function () use ( $option ) {
+                                return (bool) $option( 'woocommerce_google_analytics_settings', 'ga_id' );
+                        } ),
+                        'host-analyticsjs-local/host-analyticsjs-local.php'    => array( 'CAOS', function () use ( $option ) {
+                                return $option( 'caos_settings', 'measurement_id' ) && 'manual' !== $option( 'caos_settings', 'script_position' );
+                        } ),
+                        'seo-by-rank-math/rank-math.php'                       => array( 'Rank Math', function () use ( $option ) {
+                                return in_array( 'analytics', (array) get_option( 'rank_math_modules' ), true ) && $option( 'rank_math_google_analytic_options', 'install_code' ) && $option( 'rank_math_google_analytic_options', 'measurement_id' );
+                        } ),
+                        'wp-seopress/seopress.php'                             => array( 'SEOPress', function () use ( $option ) {
+                                return '1' === $option( 'seopress_toggle', 'toggle-google-analytics' ) && '1' === $option( 'seopress_google_analytics_option_name', 'seopress_google_analytics_enable' ) && $option( 'seopress_google_analytics_option_name', 'seopress_google_analytics_ga4' );
+                        } ),
+                        'complianz-gdpr/complianz-gpdr.php'                    => array( 'Complianz', function () use ( $option ) {
+                                return 'google-analytics' === $option( 'cmplz_options', 'compile_statistics' ) && 'no' !== $option( 'cmplz_options', 'configuration_by_complianz' ) && $option( 'cmplz_options', 'ua_code' );
+                        } ),
+                );
+                $ga = array();
+                foreach ( $checks as $basename => $check ) {
+                        if ( is_plugin_active( $basename ) && call_user_func( $check[1] ) ) {
+                                $ga[] = $check[0];
+                        }
+                }
+                $gtm = array();
+                if ( is_plugin_active( 'duracelltomi-google-tag-manager/duracelltomi-google-tag-manager-for-wordpress.php' ) && $option( 'gtm4wp-options', 'gtm-code' ) ) {
+                        $gtm[] = 'GTM4WP';
+                }
+                return array( array_unique( $ga ), $gtm );
+        }
+
+        // Looks for other Google tags on the home page as a logged-out visitor sees it, which catches tracking code added by the
+        // theme or a snippet plugin. Runs in the background from the settings page; cached for 12 hours and cleared on save.
+        public function ajax_scan() {
+                check_ajax_referer( 'lightweight_ga_scan' );
+                if ( ! current_user_can( 'manage_options' ) ) {
+                        wp_send_json( array() );
+                }
+                $ids = get_transient( 'lightweight_ga_duplicate_scan' );
+                if ( ! is_array( $ids ) ) {
+                        // A cache-busting parameter, never ?tagverify (Site Kit hides its own tag for that)
+                        $url      = add_query_arg( 'lga_check', time(), home_url( '/' ) );
+                        $response = wp_remote_get( $url, array(
+                                'timeout'   => 10,
+                                'headers'   => array( 'Cache-Control' => 'no-cache' ),
+                                'sslverify' => apply_filters( 'https_local_ssl_verify', false, $url ),
+                        ) );
+                        // A blocked or failed request means "don't know", not "no duplicates"
+                        if ( is_wp_error( $response ) || 200 !== wp_remote_retrieve_response_code( $response ) ) {
+                                wp_send_json( array() );
+                        }
+                        // Drop this plugin's own tags, then collect the Google tag IDs that are left. IDs are matched rather than gtag.js
+                        // URLs because some plugins serve gtag.js from the site itself.
+                        $html = preg_replace( '#<script[^>]*data-lightweight-ga[^>]*>.*?</script>#is', '', wp_remote_retrieve_body( $response ) );
+                        preg_match_all( '/(?:id=|["\'])((?:G|GT)-[A-Z0-9]{6,12}|GTM-[A-Z0-9]{4,10})(?![A-Z0-9])/', $html, $matches );
+                        $ids = array_values( array_unique( $matches[1] ) );
+                        set_transient( 'lightweight_ga_duplicate_scan', $ids, 12 * HOUR_IN_SECONDS );
+                }
+                $own      = lightweight_ga_settings()['tracking_id'];
+                $messages = array();
+                // A second copy of the site's own ID is the certain duplicate, so it goes first
+                usort( $ids, function ( $a, $b ) use ( $own ) {
+                        return ( $b === $own ) - ( $a === $own );
+                } );
+                foreach ( $ids as $tag_id ) {
+                        if ( $tag_id === $own ) {
+                                /* translators: %s: Measurement ID */
+                                $messages[] = sprintf( __( 'Your Measurement ID (%s) is also added to your home page by your theme or another plugin, so your page views are counted twice. Remove the other copy of the tracking code.', 'lightweight-google-analytics' ), $tag_id );
+                        } elseif ( 0 === strpos( $tag_id, 'GTM-' ) ) {
+                                /* translators: %s: Google Tag Manager container ID */
+                                $messages[] = sprintf( __( 'A Google Tag Manager container (%s) is on your home page. If it also sends GA4 page views, they are counted twice.', 'lightweight-google-analytics' ), $tag_id );
+                        } else {
+                                /* translators: %s: Google tag ID */
+                                $messages[] = sprintf( __( 'Another Google tag (%s) is on your home page, added by your theme or another plugin. If it also sends page views to Google Analytics, they are counted twice.', 'lightweight-google-analytics' ), $tag_id );
+                        }
+                }
+                wp_send_json( $messages );
         }
 
@@ -239 +562 @@
                 echo '  <h2>' . esc_html__( 'Options', 'lightweight-google-analytics' ) . '</h2>' . "\n";
                 $this->status_notice();
+                $settings = lightweight_ga_settings();
+                if ( $settings['enable_lightweight_ga'] && lightweight_ga_has_ga4_id() ) {
+                        // Checks the home page for other Google tags in the background, so a slow loopback request doesn't hold up this page
+                        echo '<div id="lightweight-ga-scan" aria-live="polite"></div>';
+                        echo '<script>(function(){var b=new URLSearchParams({action:"lightweight_ga_scan",_ajax_nonce:' . wp_json_encode( wp_create_nonce( 'lightweight_ga_scan' ) ) . '});fetch(' . wp_json_encode( admin_url( 'admin-ajax.php' ) ) . ',{method:"POST",credentials:"same-origin",body:b}).then(function(r){return r.json();}).then(function(m){var w=document.getElementById("lightweight-ga-scan");(Array.isArray(m)?m:[]).forEach(function(t){var d=document.createElement("div"),p=document.createElement("p");d.className="notice notice-warning inline";d.style.margin="10px 0 0";p.textContent=t;d.appendChild(p);w.appendChild(d);});}).catch(function(){});})();</script>';
+                }
                 echo '  <form action="options.php" method="post">' . "\n";
 
@@ -271 +600 @@
         public function render_tracking_id_field() {
                 $settings = lightweight_ga_settings();
-                echo '<input type="text" name="lightweight_ga_settings[tracking_id]" class="regular-text tracking_id_field" placeholder="G-XXXXXXXX" value="' . esc_attr( $settings['tracking_id'] ) . '">';
-                echo '<span class="tracking_id_field_validate" style="display:none;color:#27ae60;font-weight:500;margin-left:0.8em;vertical-align:middle;"><svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" fill="currentColor" viewBox="0 0 16 16" style="vertical-align:middle;"><path d="M8 15A7 7 0 1 1 8 1a7 7 0 0 1 0 14zm0 1A8 8 0 1 0 8 0a8 8 0 0 0 0 16z"/><path d="M10.97 4.97a.235.235 0 0 0-.02.022L7.477 9.417 5.384 7.323a.75.75 0 0 0-1.06 1.06L6.97 11.03a.75.75 0 0 0 1.079-.02l3.992-4.99a.75.75 0 0 0-1.071-1.05z"/></svg> ' . esc_html__( 'Google Analytics 4', 'lightweight-google-analytics' ) . '</span>';
-                echo '<p class="description">' . wp_kses_post( __( 'Your Google Analytics 4 Measurement ID, which starts with G-. Find it in <a href="https://analytics.google.com/" target="_blank" rel="noopener">Google Analytics</a> under Admin > Data Streams > your web stream.', 'lightweight-google-analytics' ) ) . '</p>';
+                echo '<input type="text" name="lightweight_ga_settings[tracking_id]" id="tracking_id_field" class="regular-text tracking_id_field" placeholder="G-XXXXXXXX" value="' . esc_attr( $settings['tracking_id'] ) . '">';
+                echo '<span class="tracking_id_field_validate" style="display:none;color:#27ae60;font-weight:500;margin-left:0.8em;vertical-align:middle;"><svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" fill="currentColor" viewBox="0 0 16 16" style="vertical-align:middle;" aria-hidden="true"><path d="M8 15A7 7 0 1 1 8 1a7 7 0 0 1 0 14zm0 1A8 8 0 1 0 8 0a8 8 0 0 0 0 16z"/><path d="M10.97 4.97a.235.235 0 0 0-.02.022L7.477 9.417 5.384 7.323a.75.75 0 0 0-1.06 1.06L6.97 11.03a.75.75 0 0 0 1.079-.02l3.992-4.99a.75.75 0 0 0-1.071-1.05z"/></svg> ' . esc_html__( 'Google Analytics 4', 'lightweight-google-analytics' ) . '</span>';
+                echo '<p class="description">' . wp_kses_post( __( 'Your Google Analytics 4 Measurement ID, which starts with G-. Find it in <a href="https://analytics.google.com/" target="_blank" rel="noopener">Google Analytics</a> under Admin > Data Streams > your web stream. You can also paste Google\'s whole tag snippet and the ID will be picked out of it.', 'lightweight-google-analytics' ) ) . '</p>';
         }
 
         public function render_tracking_position_field() {
                 $settings = lightweight_ga_settings();
-                echo '<select name="lightweight_ga_settings[tracking_position]" class="tracking_position_field">';
+                echo '<select name="lightweight_ga_settings[tracking_position]" id="tracking_position_field" class="tracking_position_field">';
                 echo '<option value="header" ' . selected( $settings['tracking_position'], 'header', false ) . '>' . esc_html__( 'Header (default, recommended)', 'lightweight-google-analytics' ) . '</option>';
                 echo '<option value="footer" ' . selected( $settings['tracking_position'], 'footer', false ) . '>' . esc_html__( 'Footer', 'lightweight-google-analytics' ) . '</option>';
@@ -298 +627 @@
                         'all'                         => __( 'Track all users (including logged in admins)', 'lightweight-google-analytics' ),
                 );
-                echo '<select name="lightweight_ga_settings[tracking_level]" class="tracking_level_field">';
+                echo '<select name="lightweight_ga_settings[tracking_level]" id="tracking_level_field" class="tracking_level_field">';
                 foreach ( $levels as $value => $label ) {
                         echo '<option value="' . esc_attr( $value ) . '" ' . selected( $settings['tracking_level'], $value, false ) . '>' . esc_html( $label ) . '</option>';
@@ -308 +637 @@
         public function render_tracking_code_field() {
                 $settings = lightweight_ga_settings();
-                echo '<select name="lightweight_ga_settings[tracking_code]" class="tracking_code_field">';
+                echo '<select name="lightweight_ga_settings[tracking_code]" id="tracking_code_field" class="tracking_code_field">';
                 echo '<option value="analytics-js" ' . selected( $settings['tracking_code'], 'analytics-js', false ) . '>' . esc_html__( "Google's gtag.js (recommended)", 'lightweight-google-analytics' ) . '</option>';
                 echo '<option value="minimalanalytics-inline" ' . selected( $settings['tracking_code'], 'minimalanalytics-inline', false ) . '>' . esc_html__( 'Minimal Analytics 4 by idarek (inline, no external request, fewer features)', 'lightweight-google-analytics' ) . '</option>';
                 echo '</select>';
-                echo '<p class="description">' . wp_kses_post( __( 'Minimal Analytics 4 is a 3.5 KB inline script that sends page views, 90% scrolls, file downloads, outbound clicks and site searches straight to Google Analytics without loading gtag.js. It stores its client and session IDs in localStorage, so it is not affected by Consent Mode. <a href="https://github.com/idarek/minimal-analytics-4" target="_blank" rel="noopener">Learn more</a>', 'lightweight-google-analytics' ) ) . '</p>';
+                echo '<p class="description">' . wp_kses_post( __( 'Minimal Analytics 4 is a 3.5 KB inline script that sends page views, 90% scrolls, file downloads, outbound clicks and site searches straight to Google Analytics without loading gtag.js. It stores its client and session IDs in localStorage, so Consent Mode does not apply to it; with the WP Consent API it waits for statistics consent instead. <a href="https://github.com/idarek/minimal-analytics-4" target="_blank" rel="noopener">Learn more</a>', 'lightweight-google-analytics' ) ) . '</p>';
         }
 
         public function render_consent_mode_field() {
-                $this->checkbox( 'consent_mode', __( 'Enable Google Consent Mode v2', 'lightweight-google-analytics' ), __( 'Analytics and ad storage are denied by default until a cookie consent plugin grants consent with <code>gtag("consent", "update", ...)</code>. Only applies to gtag.js. <a href="https://developers.google.com/tag-platform/security/guides/consent" target="_blank" rel="noopener">Learn more</a>', 'lightweight-google-analytics' ) );
+                $this->checkbox( 'consent_mode', __( 'Enable Google Consent Mode v2', 'lightweight-google-analytics' ), __( 'Analytics and ad storage are denied by default until your cookie consent plugin grants consent. Works automatically with consent plugins that support the <a href="https://wordpress.org/plugins/wp-consent-api/" target="_blank" rel="noopener">WP Consent API</a> (such as Complianz and CookieYes), which also makes Minimal Analytics wait for consent. Other consent plugins need to call <code>gtag("consent", "update", ...)</code> themselves. <a href="https://developers.google.com/tag-platform/security/guides/consent" target="_blank" rel="noopener">Learn more</a>', 'lightweight-google-analytics' ) );
+        }
+
+        public function render_gpc_field() {
+                $this->checkbox( 'gpc', __( 'Honor Global Privacy Control', 'lightweight-google-analytics' ), __( 'Visitors whose browser sends a <a href="https://globalprivacycontrol.org/" target="_blank" rel="noopener">Global Privacy Control</a> signal (an opt-out built into Brave, DuckDuckGo and Firefox) are not measured. Recommended if your site has to follow California\'s CCPA or a similar law that treats the signal as an opt-out request.', 'lightweight-google-analytics' ) );
+        }
+
+        public function render_content_groups_field() {
+                $this->checkbox( 'content_groups', __( 'Send content groups and authors', 'lightweight-google-analytics' ), __( 'Sends the post\'s category (or the page type, such as Page or Search) as GA4\'s Content group, so you can compare sections of your site in reports. Also sends the author\'s name as an <code>author</code> parameter; to report on it, add an event-scoped custom dimension named <code>author</code> in Google Analytics under Admin > Custom definitions.', 'lightweight-google-analytics' ) );
         }
 

lightweight-google-analytics/tags/1.7.0/readme.txt

@@ -6 +6 @@
 Tested up to: 7.1
 Requires PHP: 7.0
-Stable tag: 1.6.0
+Stable tag: 1.7.0
 License: GPLv3
 License URI: http://www.gnu.org/licenses/gpl.html
@@ -19 +19 @@
 
 * Performance focused with no bloat and never any upsells
-* Only needs your GA4 Measurement ID (G-XXXXXXXX)
+* Only needs your GA4 Measurement ID (G-XXXXXXXX), or paste Google's whole tag snippet and the ID is picked out of it
 * Load the tracking code in the header or footer
 * Exclude logged-in users by role (admins, editors and authors are excluded by default)
 * Post previews and the Customizer are never tracked
 * Option to disable Google's advertising features (Google signals)
-* Google Consent Mode v2 support for GDPR/CCPA compliance with cookie consent plugins
+* Google Consent Mode v2 support for GDPR/CCPA compliance, working automatically with consent plugins that support the WP Consent API (such as Complianz and CookieYes)
+* Option to honor Global Privacy Control, the opt-out signal sent by Brave, DuckDuckGo and Firefox
+* Optional content groups: the post's category (or page type) as GA4's Content group, plus the author's name, so you can compare sections and authors in reports
+* Warns you on the settings page when another plugin, your theme or a pasted snippet also adds Google Analytics, so page views aren't counted twice
 * Debug Mode for testing in GA4 DebugView
 * Optional Minimal Analytics 4 mode: a 3.5 KB inline script that reports page views, scrolls, downloads, outbound clicks and site searches without loading gtag.js at all
 * The settings page tells you whether tracking is live and why your own visits may not show up
-* Works with WP Rocket's local Google Analytics feature
 * Filters for developers to change the gtag config, the consent defaults or when tracking is skipped
 
@@ -50 +52 @@
         $defaults['region'] = array( 'AT', 'BE', 'DE', 'FR', 'IE', 'NL' );
         return $defaults;
+} );`
+
+Change the content group or author sent with each page (when Content Groups is on), or add more page-level parameters:
+
+`add_filter( 'lightweight_ga_page_dimensions', function ( $dimensions ) {
+        if ( is_page( 'pricing' ) ) {
+                $dimensions['content_group'] = 'Sales';
+        }
+        return $dimensions;
 } );`
 
@@ -78 +89 @@
 Google Consent Mode v2 tells Google that analytics and advertising storage are denied until the visitor consents. Enable it if you use a cookie consent plugin that updates the consent state through `gtag("consent", "update", ...)` and you need to comply with GDPR or similar rules. It only applies to Google's gtag.js code.
 
+= Which consent plugins work with Consent Mode? =
+
+Any consent plugin that supports the [WP Consent API](https://wordpress.org/plugins/wp-consent-api/), such as Complianz and CookieYes, works automatically: install and activate the WP Consent API plugin, then turn on Consent Mode. Statistics consent controls Google Analytics storage and marketing consent controls the advertising storage types, and both follow the visitor's choice when it changes. Note that the WP Consent API treats a site with no consent plugin as having consent. Other consent plugins need to call `gtag("consent", "update", ...)` themselves.
+
+= What does the Global Privacy Control option do? =
+
+Global Privacy Control is an opt-out signal built into Brave and DuckDuckGo and available in Firefox. California's CCPA and similar US state laws treat it as a request to opt out of the sale or sharing of personal information. When the option is on, visitors who send the signal are not measured: gtag.js gets Google's documented opt-out flag, and Minimal Analytics doesn't run at all.
+
+= How do I see content groups and authors in Google Analytics? =
+
+Turn on Content Groups in the plugin settings. The content group shows up under the built-in "Content group" dimension in reports such as Pages and screens. To report on authors, add an event-scoped custom dimension named `author` in Google Analytics under Admin > Custom definitions; it fills in from then on, usually within 48 hours.
+
+= Why does the settings page say my page views are counted twice? =
+
+The plugin checks whether another analytics plugin is set up to add Google Analytics too (such as Site Kit, MonsterInsights or Rank Math), and looks at your home page for other Google tags added by your theme or a code snippet plugin. Remove the extra copy so each visit is only counted once. Tags that only appear on some pages, or only after cookie consent, can't be detected.
+
 = What is the Minimal Analytics 4 option? =
 
-It replaces Google's gtag.js with [Minimal Analytics 4](https://github.com/idarek/minimal-analytics-4) by Dariusz Wieckiewicz (MIT), a small inline script that talks to Google Analytics directly. It sends page views, session start and engagement events, 90% scrolls, file downloads, outbound link clicks and site searches, plus UTM campaign attribution. It does not support Consent Mode or Google's enhanced measurement, and it stores its client and session IDs in localStorage, so check your privacy requirements before using it.
+It replaces Google's gtag.js with [Minimal Analytics 4](https://github.com/idarek/minimal-analytics-4) by Dariusz Wieckiewicz (MIT), a small inline script that talks to Google Analytics directly. It sends page views, session start and engagement events, 90% scrolls, file downloads, outbound link clicks and site searches, plus UTM campaign attribution. It does not support Consent Mode or Google's enhanced measurement, and it stores its client and session IDs in localStorage, so check your privacy requirements before using it. With the WP Consent API and Consent Mode turned on, it waits until the visitor allows statistics before it runs.
 
 = How do I test if tracking is working? =
@@ -95 +122 @@
 
 == Changelog ==
+
+= 1.7.0 =
+* Fixed: saving the settings for the first time on a new install switched on Consent Mode, Debug Mode and Disable Display Features by themselves (since 1.5.0). Sites updating from an affected version that have any of them on get a one-time notice asking to check them.
+* Fixed: with Minimal Analytics in the header (the default), page views were sent before the page title existed, so GA4 showed "(not set)" titles, and scrolling at the top of the page caused a JavaScript error.
+* Fixed: saving a mistyped or pasted Measurement ID cleared the working one and stopped tracking. The previous ID is now kept, and the ID is picked out of a pasted gtag snippet or URL.
+* Fixed: with the tracking code in the footer, the Consent Mode defaults were printed in the footer too, after consent banners could already update them. They now always go in the head.
+* Fixed: setup notices were shown to all logged-in users on every admin screen. They now only show to admins, and the setup reminder only on the Dashboard and Plugins screens.
+* Fixed: the settings page told new installs to tick "Enable Google Analytics" although it was already ticked.
+* New: works with consent plugins that support the WP Consent API when Consent Mode is on, for gtag.js and Minimal Analytics.
+* New: option to honor Global Privacy Control.
+* New: optional content groups (post category or page type) and author names for GA4 reports, with a `lightweight_ga_page_dimensions` filter.
+* New: duplicate tracking warning when another plugin, the theme or a snippet also adds Google Analytics.
+* New: a warning when Consent Mode is on but Minimal Analytics would ignore it, and a hint when the WP Consent API is active but Consent Mode is off.
+* Network super admins are excluded along with administrators, and deleting the plugin on a multisite network removes its settings from every site.
+* Settings fields are now properly labeled for screen readers.
 
 = 1.6.0 =

lightweight-google-analytics/tags/1.7.0/uninstall.php

@@ -1 +1 @@
 <?php
-// Remove the plugin's only stored data
+// Remove everything the plugin stores, on every site of a multisite network
 if ( ! defined( 'WP_UNINSTALL_PLUGIN' ) ) {
         exit;
 }
-delete_option( 'lightweight_ga_settings' );
+
+function lightweight_ga_uninstall_site() {
+        delete_option( 'lightweight_ga_settings' );
+        delete_option( 'lightweight_ga_state' );
+        delete_transient( 'lightweight_ga_duplicate_scan' );
+}
+
+if ( is_multisite() ) {
+        foreach ( get_sites( array( 'fields' => 'ids', 'number' => 0 ) ) as $site_id ) {
+                switch_to_blog( $site_id );
+                lightweight_ga_uninstall_site();
+                restore_current_blog();
+        }
+} else {
+        lightweight_ga_uninstall_site();
+}

lightweight-google-analytics/trunk/lightweight-google-analytics.php

@@ -4 +4 @@
  * Plugin URI: https://wordpress.org/plugins/lightweight-google-analytics/
  * Description: Extremely simple plugin to add Google Analytics 4 to your WordPress site using your Measurement ID.
- * Version: 1.6.0
+ * Version: 1.7.0
  * Requires at least: 5.7
  * Requires PHP: 7.0
@@ -18 +18 @@
 }
 
-define( 'LIGHTWEIGHT_GA_VERSION', '1.6.0' );
+define( 'LIGHTWEIGHT_GA_VERSION', '1.7.0' );
 
 // Saved settings with defaults filled in
@@ -30 +30 @@
                 'tracking_code'            => 'analytics-js',
                 'consent_mode'             => '',
+                'gpc'                      => '',
+                'content_groups'           => '',
                 'debug_mode'               => '',
         ) );
@@ -46 +48 @@
                 $reason = 'preview';
         } elseif ( is_user_logged_in() ) {
+                $roles = explode( '-', $settings['tracking_level'] );
                 if ( 'logged-in' === $settings['tracking_level'] ) {
                         $reason = 'logged-in';
-                } elseif ( 'all' !== $settings['tracking_level'] && array_intersect( explode( '-', $settings['tracking_level'] ), (array) wp_get_current_user()->roles ) ) {
+                } elseif ( 'all' !== $settings['tracking_level'] && ( array_intersect( $roles, (array) wp_get_current_user()->roles ) || ( is_multisite() && is_super_admin() && in_array( 'administrator', $roles, true ) ) ) ) {
+                        // Network super admins don't always have the administrator role on the site itself
                         $reason = 'role';
                 }
@@ -57 +61 @@
 }
 
-// Print the tracking code in the head or footer, whichever the settings say
+// GA4 content group (the post's category, the post type, or the kind of archive) and author name for the current page
+function lightweight_ga_page_dimensions() {
+        $group  = '';
+        $author = '';
+        if ( is_front_page() ) {
+                $group = __( 'Home', 'lightweight-google-analytics' );
+        } elseif ( is_home() ) {
+                $group = __( 'Blog', 'lightweight-google-analytics' );
+        } elseif ( is_singular() && get_queried_object() instanceof WP_Post ) {
+                $post = get_queried_object();
+                if ( 'post' === $post->post_type ) {
+                        $categories = get_the_category( $post->ID );
+                        // Prefer the primary category picked in Yoast SEO or Rank Math
+                        $primary = (int) get_post_meta( $post->ID, '_yoast_wpseo_primary_category', true ) ?: (int) get_post_meta( $post->ID, 'rank_math_primary_category', true );
+                        foreach ( $categories as $category ) {
+                                if ( $category->term_id === $primary ) {
+                                        $group = $category->name;
+                                }
+                        }
+                        if ( ! $group && $categories ) {
+                                $group = $categories[0]->name;
+                        }
+                } else {
+                        $type  = get_post_type_object( $post->post_type );
+                        $group = $type ? $type->labels->singular_name : $post->post_type;
+                }
+                if ( post_type_supports( $post->post_type, 'author' ) ) {
+                        $author = get_the_author_meta( 'display_name', $post->post_author );
+                }
+        } elseif ( is_category() || is_tag() || is_tax() ) {
+                $group = single_term_title( '', false );
+        } elseif ( is_post_type_archive() ) {
+                $group = post_type_archive_title( '', false );
+        } elseif ( is_author() ) {
+                $group  = __( 'Author archive', 'lightweight-google-analytics' );
+                $author = get_the_author_meta( 'display_name', get_queried_object_id() );
+        } elseif ( is_date() ) {
+                $group = __( 'Date archive', 'lightweight-google-analytics' );
+        } elseif ( is_search() ) {
+                $group = __( 'Search', 'lightweight-google-analytics' );
+        } elseif ( is_404() ) {
+                $group = __( 'Page not found', 'lightweight-google-analytics' );
+        }
+        // Change or add page-level parameters, e.g. a custom content group for a section of the site
+        $dimensions = array_filter( (array) apply_filters( 'lightweight_ga_page_dimensions', array( 'content_group' => $group, 'author' => $author ) ), 'strlen' );
+        // GA4 ignores parameter values longer than 100 characters
+        return array_map( function ( $value ) {
+                return function_exists( 'mb_substr' ) ? mb_substr( (string) $value, 0, 100 ) : substr( (string) $value, 0, 100 );
+        }, $dimensions );
+}
+
+// The WP Consent API (wordpress.org/plugins/wp-consent-api) lets consent banners share visitors' choices with other plugins.
+// Its functions only exist after plugins_loaded, so this is checked at output time.
+function lightweight_ga_has_consent_api() {
+        return function_exists( 'wp_has_consent' );
+}
+
+// Tell the WP Consent API (and its Site Health check) that tracking follows visitors' choices, which is true while Consent Mode is on
+add_filter( 'wp_consent_api_registered_' . plugin_basename( __FILE__ ), function () {
+        return (bool) lightweight_ga_settings()['consent_mode'];
+} );
+
+// JS that waits for the WP Consent API to know the visitor's choices, then calls `callback` with wp_has_consent and again whenever they change.
+// The API's script loads in the footer, so the first check runs once the page is parsed. Consent banners that set
+// waitfor_consent_hook decide the consent type late; checking earlier would read "no banner" as consent.
+function lightweight_ga_consent_api_js( $callback ) {
+        return '(function(){var c=' . $callback . ',s=function(){if(typeof wp_has_consent==="function"){c();}},w=function(){window.waitfor_consent_hook?document.addEventListener("wp_consent_type_defined",s):s();};document.readyState==="loading"?document.addEventListener("DOMContentLoaded",w):w();document.addEventListener("wp_listen_for_consent_change",s);})();';
+}
+
+// Print the tracking code in the head or footer, whichever the settings say. Consent Mode defaults always go in the
+// head, so they come before any consent banner's update even when the tracking code itself is in the footer.
 add_action( 'wp_head', 'lightweight_ga_display', 0 );
 add_action( 'wp_footer', 'lightweight_ga_display', 0 );
 function lightweight_ga_display() {
         $settings = lightweight_ga_settings();
-        $hook     = 'footer' === $settings['tracking_position'] ? 'wp_footer' : 'wp_head';
-        if ( current_action() !== $hook || empty( $settings['enable_lightweight_ga'] ) || ! lightweight_ga_has_ga4_id() || lightweight_ga_excluded_reason() ) {
+        if ( empty( $settings['enable_lightweight_ga'] ) || ! lightweight_ga_has_ga4_id() || lightweight_ga_excluded_reason() ) {
                 return;
         }
-        $id = $settings['tracking_id'];
+        $id          = $settings['tracking_id'];
+        $in_head     = 'wp_head' === current_action();
+        $is_position = $in_head ? 'footer' !== $settings['tracking_position'] : 'footer' === $settings['tracking_position'];
 
         if ( 'minimalanalytics-inline' === $settings['tracking_code'] ) {
-                $script = file_get_contents( __DIR__ . '/js/minimal-analytics-4.min.js' );
-                if ( ! $script ) {
-                        return;
-                }
-                // The bundled script is configured by swapping the placeholder ID and the debug flag that sit at its top; check both anchors when updating the file
-                $script = str_replace(
-                        array( 'tid:"G-XXXXXXXXXX"', ']},T=!1,' ),
-                        array( 'tid:"' . esc_js( $id ) . '"', ']},T=' . ( $settings['debug_mode'] ? '!0' : '!1' ) . ',' ),
-                        $script
-                );
-                echo "<!-- Minimal Analytics 4 - Lightweight Google Analytics -->\n";
-                wp_print_inline_script_tag( $script );
+                if ( $is_position ) {
+                        lightweight_ga_print_minimal_analytics( $settings );
+                }
                 return;
         }
 
-        echo "<!-- Google tag (gtag.js) - Lightweight Google Analytics -->\n";
         $gtag_stub = 'window.dataLayer=window.dataLayer||[];function gtag(){dataLayer.push(arguments);}';
-
-        if ( $settings['consent_mode'] ) {
+        // Google's documented opt-out flag stops GA4 sending anything for visitors whose browser sends Global Privacy Control.
+        // It has to be set before any gtag() call, so it leads every inline script.
+        if ( $settings['gpc'] ) {
+                $gtag_stub = 'if(navigator.globalPrivacyControl){window["ga-disable-' . esc_js( $id ) . '"]=true;}' . $gtag_stub;
+        }
+
+        if ( $in_head && $settings['consent_mode'] ) {
                 // Consent Mode v2 defaults have to be set before gtag.js loads; the consent banner then calls gtag("consent","update",...)
                 $consent = apply_filters( 'lightweight_ga_consent_defaults', array(
@@ -94 +164 @@
                         'ad_user_data'       => 'denied',
                         'ad_personalization' => 'denied',
-                        'wait_for_update'    => 500,
+                        // How long Google waits for the consent update before sending anything; it carries on as soon as the update
+                        // arrives. With the WP Consent API the update comes once the page is parsed (its script is in the footer), so
+                        // allow for slow pages. Consent banners that call gtag themselves usually update early in the head.
+                        'wait_for_update'    => lightweight_ga_has_consent_api() ? 2000 : 500,
                 ) );
-                wp_print_inline_script_tag( $gtag_stub . 'gtag("consent","default",' . wp_json_encode( $consent ) . ');' );
-        }
-
+                $update = '';
+                if ( lightweight_ga_has_consent_api() ) {
+                        // Pass the visitor's choices from any consent banner that supports the WP Consent API on to Google
+                        // Banners such as Complianz change categories one at a time, so only send an update when the result changes
+                        $update = lightweight_ga_consent_api_js( '(function(){var l;return function(){var s=wp_has_consent("statistics")?"granted":"denied",m=wp_has_consent("marketing")?"granted":"denied";if(s+m===l){return;}l=s+m;gtag("consent","update",{analytics_storage:s,ad_storage:m,ad_user_data:m,ad_personalization:m});};})()' );
+                }
+                echo "<!-- Google Consent Mode defaults - Lightweight Google Analytics -->\n";
+                wp_print_inline_script_tag( $gtag_stub . 'gtag("consent","default",' . wp_json_encode( $consent ) . ');' . $update, array( 'data-lightweight-ga' => true ) );
+        }
+
+        if ( ! $is_position ) {
+                return;
+        }
+
+        echo "<!-- Google tag (gtag.js) - Lightweight Google Analytics -->\n";
         wp_print_script_tag( array(
-                'src'   => 'https://www.googletagmanager.com/gtag/js?id=' . rawurlencode( $id ),
-                'async' => true,
+                'src'                 => 'https://www.googletagmanager.com/gtag/js?id=' . rawurlencode( $id ),
+                'async'               => true,
+                'data-lightweight-ga' => true, // marks this plugin's own tags for the duplicate tracking check
         ) );
 
@@ -111 +197 @@
                 $config['debug_mode'] = true;
         }
+        if ( $settings['content_groups'] ) {
+                $config = array_merge( $config, lightweight_ga_page_dimensions() );
+        }
         // Add or change gtag config options, e.g. send_page_view, cookie_flags or custom dimensions
         $config = apply_filters( 'lightweight_ga_gtag_config', $config, $id );
-        wp_print_inline_script_tag( $gtag_stub . 'gtag("js",new Date());gtag("config","' . esc_js( $id ) . '"' . ( $config ? ',' . wp_json_encode( $config ) : '' ) . ');' );
+        wp_print_inline_script_tag( $gtag_stub . 'gtag("js",new Date());gtag("config","' . esc_js( $id ) . '"' . ( $config ? ',' . wp_json_encode( $config ) : '' ) . ');', array( 'data-lightweight-ga' => true ) );
+}
+
+// Minimal Analytics 4 is configured by swapping values in the bundled script; check all three anchors whenever the file is updated
+function lightweight_ga_print_minimal_analytics( $settings ) {
+        $script = file_get_contents( __DIR__ . '/js/minimal-analytics-4.min.js' );
+        if ( ! $script ) {
+                return;
+        }
+        // Content group and author ride along with every hit as event parameters
+        $params = '';
+        foreach ( $settings['content_groups'] ? lightweight_ga_page_dimensions() : array() as $key => $value ) {
+                $params .= wp_json_encode( 'ep.' . $key ) . ':' . wp_json_encode( $value ) . ',';
+        }
+        $script = str_replace(
+                array( 'tid:"G-XXXXXXXXXX"', ']},T=!1,', '_dbg:T?1:0[0]' ),
+                array( 'tid:"' . esc_js( $settings['tracking_id'] ) . '"', ']},T=' . ( $settings['debug_mode'] ? '!0' : '!1' ) . ',', $params . '_dbg:T?1:0[0]' ),
+                $script
+        );
+        // Run once the page is parsed: from the head it would otherwise send its page view before <title> exists and read a null document.body
+        $run = 'document.readyState==="loading"?document.addEventListener("DOMContentLoaded",r):r();';
+        if ( $settings['consent_mode'] && lightweight_ga_has_consent_api() ) {
+                // Minimal Analytics has no Consent Mode, so with the WP Consent API it only starts once the visitor allows statistics
+                $run = 'var d=0;' . lightweight_ga_consent_api_js( 'function(){if(!d&&wp_has_consent("statistics")){d=1;r();}}' );
+        }
+        if ( $settings['gpc'] ) {
+                $run = 'if(!navigator.globalPrivacyControl){' . $run . '}';
+        }
+        echo "<!-- Minimal Analytics 4 - Lightweight Google Analytics -->\n";
+        wp_print_inline_script_tag( '(function(){var r=function(){' . $script . "\n};" . $run . '})();', array( 'data-lightweight-ga' => true ) );
 }
 
@@ -121 +239 @@
                 add_action( 'admin_menu', array( $this, 'add_admin_menu' ) );
                 add_action( 'admin_init', array( $this, 'init_settings' ) );
+                add_action( 'admin_init', array( $this, 'maybe_upgrade' ) );
                 add_action( 'admin_notices', array( $this, 'admin_notices' ) );
+                add_action( 'wp_ajax_lightweight_ga_scan', array( $this, 'ajax_scan' ) );
                 add_filter( 'plugin_action_links_' . plugin_basename( __FILE__ ), array( $this, 'add_settings_link' ) );
         }
 
+        // Remembers the plugin version so an update can run one-off checks
+        public function maybe_upgrade() {
+                $state = (array) get_option( 'lightweight_ga_state', array() );
+                if ( isset( $state['version'] ) && LIGHTWEIGHT_GA_VERSION === $state['version'] ) {
+                        return;
+                }
+                if ( empty( $state['version'] ) && false !== get_option( 'lightweight_ga_settings' ) ) {
+                        // 1.5.0 to 1.6.0 ticked every checkbox the first time the settings were saved, so ask the site owner to check them
+                        $settings        = lightweight_ga_settings();
+                        $state['review'] = $settings['consent_mode'] || $settings['debug_mode'] || $settings['disable_display_features'];
+                }
+                $state['version'] = LIGHTWEIGHT_GA_VERSION;
+                update_option( 'lightweight_ga_state', $state );
+        }
+
         public function add_settings_link( $links ) {
-                $links[] = '<a href="' . esc_url( menu_page_url( 'lightweight-google-analytics', false ) ) . '">' . esc_html__( 'Settings', 'lightweight-google-analytics' ) . '</a>';
+                $links[] = '<a href="' . esc_url( admin_url( 'options-general.php?page=lightweight-google-analytics' ) ) . '">' . esc_html__( 'Settings', 'lightweight-google-analytics' ) . '</a>';
                 return $links;
         }
 
         public function admin_notices() {
-                $settings = lightweight_ga_settings();
-                $url      = esc_url( menu_page_url( 'lightweight-google-analytics', false ) );
+                if ( ! current_user_can( 'manage_options' ) ) {
+                        return;
+                }
+                $settings = lightweight_ga_settings();
+                $screen   = function_exists( 'get_current_screen' ) && get_current_screen() ? get_current_screen()->id : '';
+                $url      = esc_url( admin_url( 'options-general.php?page=lightweight-google-analytics' ) );
+                $state    = (array) get_option( 'lightweight_ga_state', array() );
+
+                if ( ! empty( $state['review'] ) ) {
+                        $on = array();
+                        foreach ( array( 'consent_mode' => __( 'Consent Mode', 'lightweight-google-analytics' ), 'debug_mode' => __( 'Debug Mode', 'lightweight-google-analytics' ), 'disable_display_features' => __( 'Disable Display Features', 'lightweight-google-analytics' ) ) as $key => $label ) {
+                                if ( $settings[ $key ] ) {
+                                        $on[] = $label;
+                                }
+                        }
+                        /* translators: 1: list of setting names, 2: link to the plugin settings page */
+                        $message = sprintf( __( '<strong>Lightweight Google Analytics:</strong> a bug in versions 1.5.0 to 1.6.0 could switch settings on by themselves the first time they were saved. These are on for this site: %1$s. Consent Mode without a consent banner and Debug Mode can both reduce the data you see in Google Analytics. Please check them in the %2$s and save.', 'lightweight-google-analytics' ), esc_html( implode( ', ', $on ) ), '<a href="' . $url . '">' . esc_html__( 'plugin settings', 'lightweight-google-analytics' ) . '</a>' );
+                        printf( '<div class="notice notice-warning"><p>%s</p></div>', wp_kses_post( $message ) );
+                }
+
+                // The settings page shows its own status message
+                if ( 'settings_page_lightweight-google-analytics' === $screen ) {
+                        return;
+                }
                 if ( 0 === strpos( $settings['tracking_id'], 'UA-' ) ) {
                         /* translators: %s: link to the plugin settings page */
                         $message = sprintf( __( '<strong>Lightweight Google Analytics:</strong> Google shut down Universal Analytics in 2023 and UA- IDs are no longer supported, so no tracking code is being output. Enter your Google Analytics 4 Measurement ID (G-XXXXXXXX) in the %s.', 'lightweight-google-analytics' ), '<a href="' . $url . '">' . esc_html__( 'plugin settings', 'lightweight-google-analytics' ) . '</a>' );
                         printf( '<div class="notice notice-warning"><p>%s</p></div>', wp_kses_post( $message ) );
-                } elseif ( '' === $settings['tracking_id'] ) {
+                } elseif ( '' === $settings['tracking_id'] && in_array( $screen, array( 'dashboard', 'plugins' ), true ) ) {
                         /* translators: %s: link to the plugin settings page */
                         $message = sprintf( __( 'Thank you for installing <strong>Lightweight Google Analytics</strong> - head to the %s to finish setting up Google Analytics.', 'lightweight-google-analytics' ), '<a href="' . $url . '">' . esc_html__( 'settings', 'lightweight-google-analytics' ) . '</a>' );
@@ -145 +302 @@
 
         public function sanitize_settings( $input ) {
-                $input     = (array) $input;
-                $sanitized = array( 'tracking_id' => '' );
-
-                $tracking_id = isset( $input['tracking_id'] ) ? strtoupper( trim( sanitize_text_field( $input['tracking_id'] ) ) ) : '';
-                if ( preg_match( '/^G-[A-Z0-9]+$/', $tracking_id ) ) {
-                        $sanitized['tracking_id'] = $tracking_id;
-                } elseif ( 0 === strpos( $tracking_id, 'UA-' ) ) {
-                        add_settings_error( 'lightweight_ga_settings', 'ua_tracking_id', __( 'Universal Analytics (UA-) IDs are no longer supported because Google shut Universal Analytics down in 2023. Enter your Google Analytics 4 Measurement ID (G-XXXXXXXX) instead.', 'lightweight-google-analytics' ) );
-                } elseif ( '' !== $tracking_id ) {
-                        add_settings_error( 'lightweight_ga_settings', 'invalid_tracking_id', __( 'Invalid Measurement ID. It should look like G-XXXXXXXX and can be found in Google Analytics under Admin > Data Streams.', 'lightweight-google-analytics' ) );
-                }
-
-                foreach ( array( 'enable_lightweight_ga', 'disable_display_features', 'consent_mode', 'debug_mode' ) as $checkbox ) {
-                        $sanitized[ $checkbox ] = isset( $input[ $checkbox ] ) ? 'checked' : '';
+                $input    = (array) $input;
+                $previous = lightweight_ga_settings()['tracking_id'];
+
+                // Accept the ID itself, or a pasted gtag snippet or URL that contains it. The ID is looked for in the raw text because
+                // sanitize_text_field() strips <script> blocks whole, URL included; only the matched letters and digits are ever kept.
+                $raw = isset( $input['tracking_id'] ) && is_string( $input['tracking_id'] ) ? strtoupper( trim( $input['tracking_id'] ) ) : '';
+                if ( preg_match( '/^G-[A-Z0-9]+$/', $raw ) ) {
+                        $tracking_id = $raw;
+                } elseif ( preg_match( '/(?<![A-Z0-9])G-[A-Z0-9]{4,}(?![A-Z0-9])/', $raw, $found ) ) {
+                        $tracking_id = $found[0];
+                        /* translators: %s: the Measurement ID found in the pasted text */
+                        add_settings_error( 'lightweight_ga_settings', 'extracted_tracking_id', sprintf( __( 'Found the Measurement ID %s in the pasted text and saved it.', 'lightweight-google-analytics' ), $tracking_id ), 'info' );
+                } else {
+                        $tracking_id = sanitize_text_field( $raw );
+                }
+
+                $sanitized = array( 'tracking_id' => $tracking_id );
+                if ( '' !== $tracking_id && ! preg_match( '/^G-[A-Z0-9]+$/', $tracking_id ) ) {
+                        // Keep the working ID instead of switching tracking off because of a typo
+                        $sanitized['tracking_id'] = $previous;
+                        if ( 0 === strpos( $tracking_id, 'UA-' ) ) {
+                                add_settings_error( 'lightweight_ga_settings', 'ua_tracking_id', __( 'Universal Analytics (UA-) IDs are no longer supported because Google shut Universal Analytics down in 2023. Enter your Google Analytics 4 Measurement ID (G-XXXXXXXX) instead.', 'lightweight-google-analytics' ) );
+                        } else {
+                                add_settings_error( 'lightweight_ga_settings', 'invalid_tracking_id', __( 'Invalid Measurement ID. It should look like G-XXXXXXXX and can be found in Google Analytics under Admin > Data Streams.', 'lightweight-google-analytics' ) . ( $previous ? ' ' . __( 'Your previous Measurement ID was kept.', 'lightweight-google-analytics' ) : '' ) );
+                        }
+                }
+
+                // ! empty() rather than isset(): on the very first save WordPress runs this twice, the second time on the already sanitized values
+                foreach ( array( 'enable_lightweight_ga', 'disable_display_features', 'consent_mode', 'gpc', 'content_groups', 'debug_mode' ) as $checkbox ) {
+                        $sanitized[ $checkbox ] = ! empty( $input[ $checkbox ] ) ? 'checked' : '';
                 }
 
@@ -167 +340 @@
 
                 $sanitized['tracking_code'] = isset( $input['tracking_code'] ) && 'minimalanalytics-inline' === $input['tracking_code'] ? 'minimalanalytics-inline' : 'analytics-js';
+
+                // The duplicate tag check runs again with the new settings
+                delete_transient( 'lightweight_ga_duplicate_scan' );
+
+                // Saving the settings answers the post-update request to review them
+                $state = (array) get_option( 'lightweight_ga_state', array() );
+                if ( ! empty( $state['review'] ) ) {
+                        $state['review'] = false;
+                        update_option( 'lightweight_ga_state', $state );
+                }
 
                 return $sanitized;
@@ -201 +384 @@
                         'tracking_code'            => __( 'Tracking Code', 'lightweight-google-analytics' ),
                         'consent_mode'             => __( 'Consent Mode', 'lightweight-google-analytics' ),
+                        'gpc'                      => __( 'Global Privacy Control', 'lightweight-google-analytics' ),
+                        'content_groups'           => __( 'Content Groups', 'lightweight-google-analytics' ),
                         'debug_mode'               => __( 'Debug Mode', 'lightweight-google-analytics' ),
                 );
                 foreach ( $fields as $field => $label ) {
-                        add_settings_field( $field, $label, array( $this, 'render_' . $field . '_field' ), 'lightweight_ga_settings', 'lightweight_ga_settings_section', array( 'class' => str_replace( '_', '-', $field ) ) );
-                }
-        }
-
-        // Tells the admin whether tracking is live, and why they personally will not show up in reports
+                        // label_for ties each row's title to its input for screen readers
+                        add_settings_field( $field, $label, array( $this, 'render_' . $field . '_field' ), 'lightweight_ga_settings', 'lightweight_ga_settings_section', array( 'class' => str_replace( '_', '-', $field ), 'label_for' => $field . '_field' ) );
+                }
+        }
+
+        // Tells the admin whether tracking is live, why they personally will not show up in reports, and what might need attention
         public function status_notice() {
                 $settings = lightweight_ga_settings();
-                if ( empty( $settings['enable_lightweight_ga'] ) ) {
+                if ( false === get_option( 'lightweight_ga_settings' ) ) {
+                        $class   = 'warning';
+                        $message = __( 'Enter your Google Analytics 4 Measurement ID (G-XXXXXXXX) and save to start tracking.', 'lightweight-google-analytics' );
+                } elseif ( empty( $settings['enable_lightweight_ga'] ) ) {
                         $class   = 'warning';
                         $message = __( 'Tracking is turned off. Tick "Enable Google Analytics" and save to start tracking.', 'lightweight-google-analytics' );
@@ -228 +417 @@
                 }
                 printf( '<div class="notice notice-%s inline" style="margin:15px 0 0"><p>%s</p></div>', esc_attr( $class ), esc_html( $message ) );
+
+                foreach ( $this->warnings( $settings ) as $warning ) {
+                        printf( '<div class="notice notice-warning inline" style="margin:10px 0 0"><p>%s</p></div>', wp_kses_post( $warning ) );
+                }
+        }
+
+        // Settings combinations that don't do what the site owner probably expects
+        private function warnings( $settings ) {
+                $warnings = array();
+                if ( 'minimalanalytics-inline' === $settings['tracking_code'] && $settings['consent_mode'] && ! lightweight_ga_has_consent_api() ) {
+                        $warnings[] = __( 'Consent Mode only applies to Google\'s gtag.js. Minimal Analytics runs for every visitor whatever they choose in your consent banner, unless the <a href="https://wordpress.org/plugins/wp-consent-api/" target="_blank" rel="noopener">WP Consent API</a> plugin is active with a consent banner that supports it.', 'lightweight-google-analytics' );
+                }
+                if ( lightweight_ga_has_consent_api() && ! $settings['consent_mode'] ) {
+                        $warnings[] = __( 'The WP Consent API is active, but Consent Mode is off, so Google Analytics ignores your visitors\' choices in your consent banner. Turn on Consent Mode to follow them.', 'lightweight-google-analytics' );
+                }
+                if ( $settings['enable_lightweight_ga'] && lightweight_ga_has_ga4_id() ) {
+                        list( $ga, $gtm ) = $this->other_ga_plugins();
+                        if ( $ga ) {
+                                /* translators: %s: plugin name(s) */
+                                $warnings[] = sprintf( __( '%s is also set up to add Google Analytics to your site, so your page views are probably counted twice. Turn off the tracking code in one of the plugins.', 'lightweight-google-analytics' ), esc_html( implode( ', ', $ga ) ) );
+                        }
+                        if ( $gtm ) {
+                                /* translators: %s: plugin name */
+                                $warnings[] = sprintf( __( '%s adds a Google Tag Manager container to your site. If that container also sends GA4 page views, they are counted twice.', 'lightweight-google-analytics' ), esc_html( implode( ', ', $gtm ) ) );
+                        }
+                }
+                return $warnings;
+        }
+
+        // Active plugins that are set up to print their own Google Analytics tag (and ones that print a Tag Manager container,
+        // which may or may not include GA4). Settings outlive deactivated plugins, so each check also needs the plugin active.
+        private function other_ga_plugins() {
+                if ( ! function_exists( 'is_plugin_active' ) ) {
+                        require_once ABSPATH . 'wp-admin/includes/plugin.php';
+                }
+                $option = function ( $name, $key ) {
+                        $value = get_option( $name );
+                        return is_array( $value ) && isset( $value[ $key ] ) ? $value[ $key ] : '';
+                };
+                $monsterinsights = function () {
+                        return function_exists( 'monsterinsights_get_v4_id' ) && monsterinsights_get_v4_id();
+                };
+                $exactmetrics = function () {
+                        return function_exists( 'exactmetrics_get_v4_id' ) && exactmetrics_get_v4_id();
+                };
+                $checks = array(
+                        'google-site-kit/google-site-kit.php'                  => array( 'Site Kit by Google', function () use ( $option ) {
+                                return in_array( 'analytics-4', (array) get_option( 'googlesitekit_active_modules' ), true ) && $option( 'googlesitekit_analytics-4_settings', 'useSnippet' ) && $option( 'googlesitekit_analytics-4_settings', 'measurementID' );
+                        } ),
+                        'google-analytics-for-wordpress/googleanalytics.php'   => array( 'MonsterInsights', $monsterinsights ),
+                        'google-analytics-premium/googleanalytics-premium.php' => array( 'MonsterInsights Pro', $monsterinsights ),
+                        'google-analytics-dashboard-for-wp/gadwp.php'          => array( 'ExactMetrics', $exactmetrics ),
+                        'exactmetrics-premium/exactmetrics-premium.php'        => array( 'ExactMetrics Pro', $exactmetrics ),
+                        'wp-analytify/wp-analytify.php'                        => array( 'Analytify', function () use ( $option ) {
+                                return 'on' === $option( 'wp-analytify-profile', 'install_ga_code' ) && $option( 'wp-analytify-profile', 'profile_for_posts' );
+                        } ),
+                        'ga-google-analytics/ga-google-analytics.php'          => array( 'GA Google Analytics', function () use ( $option ) {
+                                return $option( 'gap_options', 'gap_id' ) && $option( 'gap_options', 'gap_enable' );
+                        } ),
+                        'woocommerce-google-analytics-integration/woocommerce-google-analytics-integration.php' => array( 'Google Analytics for WooCommerce', function () use ( $option ) {
+                                return (bool) $option( 'woocommerce_google_analytics_settings', 'ga_id' );
+                        } ),
+                        'host-analyticsjs-local/host-analyticsjs-local.php'    => array( 'CAOS', function () use ( $option ) {
+                                return $option( 'caos_settings', 'measurement_id' ) && 'manual' !== $option( 'caos_settings', 'script_position' );
+                        } ),
+                        'seo-by-rank-math/rank-math.php'                       => array( 'Rank Math', function () use ( $option ) {
+                                return in_array( 'analytics', (array) get_option( 'rank_math_modules' ), true ) && $option( 'rank_math_google_analytic_options', 'install_code' ) && $option( 'rank_math_google_analytic_options', 'measurement_id' );
+                        } ),
+                        'wp-seopress/seopress.php'                             => array( 'SEOPress', function () use ( $option ) {
+                                return '1' === $option( 'seopress_toggle', 'toggle-google-analytics' ) && '1' === $option( 'seopress_google_analytics_option_name', 'seopress_google_analytics_enable' ) && $option( 'seopress_google_analytics_option_name', 'seopress_google_analytics_ga4' );
+                        } ),
+                        'complianz-gdpr/complianz-gpdr.php'                    => array( 'Complianz', function () use ( $option ) {
+                                return 'google-analytics' === $option( 'cmplz_options', 'compile_statistics' ) && 'no' !== $option( 'cmplz_options', 'configuration_by_complianz' ) && $option( 'cmplz_options', 'ua_code' );
+                        } ),
+                );
+                $ga = array();
+                foreach ( $checks as $basename => $check ) {
+                        if ( is_plugin_active( $basename ) && call_user_func( $check[1] ) ) {
+                                $ga[] = $check[0];
+                        }
+                }
+                $gtm = array();
+                if ( is_plugin_active( 'duracelltomi-google-tag-manager/duracelltomi-google-tag-manager-for-wordpress.php' ) && $option( 'gtm4wp-options', 'gtm-code' ) ) {
+                        $gtm[] = 'GTM4WP';
+                }
+                return array( array_unique( $ga ), $gtm );
+        }
+
+        // Looks for other Google tags on the home page as a logged-out visitor sees it, which catches tracking code added by the
+        // theme or a snippet plugin. Runs in the background from the settings page; cached for 12 hours and cleared on save.
+        public function ajax_scan() {
+                check_ajax_referer( 'lightweight_ga_scan' );
+                if ( ! current_user_can( 'manage_options' ) ) {
+                        wp_send_json( array() );
+                }
+                $ids = get_transient( 'lightweight_ga_duplicate_scan' );
+                if ( ! is_array( $ids ) ) {
+                        // A cache-busting parameter, never ?tagverify (Site Kit hides its own tag for that)
+                        $url      = add_query_arg( 'lga_check', time(), home_url( '/' ) );
+                        $response = wp_remote_get( $url, array(
+                                'timeout'   => 10,
+                                'headers'   => array( 'Cache-Control' => 'no-cache' ),
+                                'sslverify' => apply_filters( 'https_local_ssl_verify', false, $url ),
+                        ) );
+                        // A blocked or failed request means "don't know", not "no duplicates"
+                        if ( is_wp_error( $response ) || 200 !== wp_remote_retrieve_response_code( $response ) ) {
+                                wp_send_json( array() );
+                        }
+                        // Drop this plugin's own tags, then collect the Google tag IDs that are left. IDs are matched rather than gtag.js
+                        // URLs because some plugins serve gtag.js from the site itself.
+                        $html = preg_replace( '#<script[^>]*data-lightweight-ga[^>]*>.*?</script>#is', '', wp_remote_retrieve_body( $response ) );
+                        preg_match_all( '/(?:id=|["\'])((?:G|GT)-[A-Z0-9]{6,12}|GTM-[A-Z0-9]{4,10})(?![A-Z0-9])/', $html, $matches );
+                        $ids = array_values( array_unique( $matches[1] ) );
+                        set_transient( 'lightweight_ga_duplicate_scan', $ids, 12 * HOUR_IN_SECONDS );
+                }
+                $own      = lightweight_ga_settings()['tracking_id'];
+                $messages = array();
+                // A second copy of the site's own ID is the certain duplicate, so it goes first
+                usort( $ids, function ( $a, $b ) use ( $own ) {
+                        return ( $b === $own ) - ( $a === $own );
+                } );
+                foreach ( $ids as $tag_id ) {
+                        if ( $tag_id === $own ) {
+                                /* translators: %s: Measurement ID */
+                                $messages[] = sprintf( __( 'Your Measurement ID (%s) is also added to your home page by your theme or another plugin, so your page views are counted twice. Remove the other copy of the tracking code.', 'lightweight-google-analytics' ), $tag_id );
+                        } elseif ( 0 === strpos( $tag_id, 'GTM-' ) ) {
+                                /* translators: %s: Google Tag Manager container ID */
+                                $messages[] = sprintf( __( 'A Google Tag Manager container (%s) is on your home page. If it also sends GA4 page views, they are counted twice.', 'lightweight-google-analytics' ), $tag_id );
+                        } else {
+                                /* translators: %s: Google tag ID */
+                                $messages[] = sprintf( __( 'Another Google tag (%s) is on your home page, added by your theme or another plugin. If it also sends page views to Google Analytics, they are counted twice.', 'lightweight-google-analytics' ), $tag_id );
+                        }
+                }
+                wp_send_json( $messages );
         }
 
@@ -239 +562 @@
                 echo '  <h2>' . esc_html__( 'Options', 'lightweight-google-analytics' ) . '</h2>' . "\n";
                 $this->status_notice();
+                $settings = lightweight_ga_settings();
+                if ( $settings['enable_lightweight_ga'] && lightweight_ga_has_ga4_id() ) {
+                        // Checks the home page for other Google tags in the background, so a slow loopback request doesn't hold up this page
+                        echo '<div id="lightweight-ga-scan" aria-live="polite"></div>';
+                        echo '<script>(function(){var b=new URLSearchParams({action:"lightweight_ga_scan",_ajax_nonce:' . wp_json_encode( wp_create_nonce( 'lightweight_ga_scan' ) ) . '});fetch(' . wp_json_encode( admin_url( 'admin-ajax.php' ) ) . ',{method:"POST",credentials:"same-origin",body:b}).then(function(r){return r.json();}).then(function(m){var w=document.getElementById("lightweight-ga-scan");(Array.isArray(m)?m:[]).forEach(function(t){var d=document.createElement("div"),p=document.createElement("p");d.className="notice notice-warning inline";d.style.margin="10px 0 0";p.textContent=t;d.appendChild(p);w.appendChild(d);});}).catch(function(){});})();</script>';
+                }
                 echo '  <form action="options.php" method="post">' . "\n";
 
@@ -271 +600 @@
         public function render_tracking_id_field() {
                 $settings = lightweight_ga_settings();
-                echo '<input type="text" name="lightweight_ga_settings[tracking_id]" class="regular-text tracking_id_field" placeholder="G-XXXXXXXX" value="' . esc_attr( $settings['tracking_id'] ) . '">';
-                echo '<span class="tracking_id_field_validate" style="display:none;color:#27ae60;font-weight:500;margin-left:0.8em;vertical-align:middle;"><svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" fill="currentColor" viewBox="0 0 16 16" style="vertical-align:middle;"><path d="M8 15A7 7 0 1 1 8 1a7 7 0 0 1 0 14zm0 1A8 8 0 1 0 8 0a8 8 0 0 0 0 16z"/><path d="M10.97 4.97a.235.235 0 0 0-.02.022L7.477 9.417 5.384 7.323a.75.75 0 0 0-1.06 1.06L6.97 11.03a.75.75 0 0 0 1.079-.02l3.992-4.99a.75.75 0 0 0-1.071-1.05z"/></svg> ' . esc_html__( 'Google Analytics 4', 'lightweight-google-analytics' ) . '</span>';
-                echo '<p class="description">' . wp_kses_post( __( 'Your Google Analytics 4 Measurement ID, which starts with G-. Find it in <a href="https://analytics.google.com/" target="_blank" rel="noopener">Google Analytics</a> under Admin > Data Streams > your web stream.', 'lightweight-google-analytics' ) ) . '</p>';
+                echo '<input type="text" name="lightweight_ga_settings[tracking_id]" id="tracking_id_field" class="regular-text tracking_id_field" placeholder="G-XXXXXXXX" value="' . esc_attr( $settings['tracking_id'] ) . '">';
+                echo '<span class="tracking_id_field_validate" style="display:none;color:#27ae60;font-weight:500;margin-left:0.8em;vertical-align:middle;"><svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" fill="currentColor" viewBox="0 0 16 16" style="vertical-align:middle;" aria-hidden="true"><path d="M8 15A7 7 0 1 1 8 1a7 7 0 0 1 0 14zm0 1A8 8 0 1 0 8 0a8 8 0 0 0 0 16z"/><path d="M10.97 4.97a.235.235 0 0 0-.02.022L7.477 9.417 5.384 7.323a.75.75 0 0 0-1.06 1.06L6.97 11.03a.75.75 0 0 0 1.079-.02l3.992-4.99a.75.75 0 0 0-1.071-1.05z"/></svg> ' . esc_html__( 'Google Analytics 4', 'lightweight-google-analytics' ) . '</span>';
+                echo '<p class="description">' . wp_kses_post( __( 'Your Google Analytics 4 Measurement ID, which starts with G-. Find it in <a href="https://analytics.google.com/" target="_blank" rel="noopener">Google Analytics</a> under Admin > Data Streams > your web stream. You can also paste Google\'s whole tag snippet and the ID will be picked out of it.', 'lightweight-google-analytics' ) ) . '</p>';
         }
 
         public function render_tracking_position_field() {
                 $settings = lightweight_ga_settings();
-                echo '<select name="lightweight_ga_settings[tracking_position]" class="tracking_position_field">';
+                echo '<select name="lightweight_ga_settings[tracking_position]" id="tracking_position_field" class="tracking_position_field">';
                 echo '<option value="header" ' . selected( $settings['tracking_position'], 'header', false ) . '>' . esc_html__( 'Header (default, recommended)', 'lightweight-google-analytics' ) . '</option>';
                 echo '<option value="footer" ' . selected( $settings['tracking_position'], 'footer', false ) . '>' . esc_html__( 'Footer', 'lightweight-google-analytics' ) . '</option>';
@@ -298 +627 @@
                         'all'                         => __( 'Track all users (including logged in admins)', 'lightweight-google-analytics' ),
                 );
-                echo '<select name="lightweight_ga_settings[tracking_level]" class="tracking_level_field">';
+                echo '<select name="lightweight_ga_settings[tracking_level]" id="tracking_level_field" class="tracking_level_field">';
                 foreach ( $levels as $value => $label ) {
                         echo '<option value="' . esc_attr( $value ) . '" ' . selected( $settings['tracking_level'], $value, false ) . '>' . esc_html( $label ) . '</option>';
@@ -308 +637 @@
         public function render_tracking_code_field() {
                 $settings = lightweight_ga_settings();
-                echo '<select name="lightweight_ga_settings[tracking_code]" class="tracking_code_field">';
+                echo '<select name="lightweight_ga_settings[tracking_code]" id="tracking_code_field" class="tracking_code_field">';
                 echo '<option value="analytics-js" ' . selected( $settings['tracking_code'], 'analytics-js', false ) . '>' . esc_html__( "Google's gtag.js (recommended)", 'lightweight-google-analytics' ) . '</option>';
                 echo '<option value="minimalanalytics-inline" ' . selected( $settings['tracking_code'], 'minimalanalytics-inline', false ) . '>' . esc_html__( 'Minimal Analytics 4 by idarek (inline, no external request, fewer features)', 'lightweight-google-analytics' ) . '</option>';
                 echo '</select>';
-                echo '<p class="description">' . wp_kses_post( __( 'Minimal Analytics 4 is a 3.5 KB inline script that sends page views, 90% scrolls, file downloads, outbound clicks and site searches straight to Google Analytics without loading gtag.js. It stores its client and session IDs in localStorage, so it is not affected by Consent Mode. <a href="https://github.com/idarek/minimal-analytics-4" target="_blank" rel="noopener">Learn more</a>', 'lightweight-google-analytics' ) ) . '</p>';
+                echo '<p class="description">' . wp_kses_post( __( 'Minimal Analytics 4 is a 3.5 KB inline script that sends page views, 90% scrolls, file downloads, outbound clicks and site searches straight to Google Analytics without loading gtag.js. It stores its client and session IDs in localStorage, so Consent Mode does not apply to it; with the WP Consent API it waits for statistics consent instead. <a href="https://github.com/idarek/minimal-analytics-4" target="_blank" rel="noopener">Learn more</a>', 'lightweight-google-analytics' ) ) . '</p>';
         }
 
         public function render_consent_mode_field() {
-                $this->checkbox( 'consent_mode', __( 'Enable Google Consent Mode v2', 'lightweight-google-analytics' ), __( 'Analytics and ad storage are denied by default until a cookie consent plugin grants consent with <code>gtag("consent", "update", ...)</code>. Only applies to gtag.js. <a href="https://developers.google.com/tag-platform/security/guides/consent" target="_blank" rel="noopener">Learn more</a>', 'lightweight-google-analytics' ) );
+                $this->checkbox( 'consent_mode', __( 'Enable Google Consent Mode v2', 'lightweight-google-analytics' ), __( 'Analytics and ad storage are denied by default until your cookie consent plugin grants consent. Works automatically with consent plugins that support the <a href="https://wordpress.org/plugins/wp-consent-api/" target="_blank" rel="noopener">WP Consent API</a> (such as Complianz and CookieYes), which also makes Minimal Analytics wait for consent. Other consent plugins need to call <code>gtag("consent", "update", ...)</code> themselves. <a href="https://developers.google.com/tag-platform/security/guides/consent" target="_blank" rel="noopener">Learn more</a>', 'lightweight-google-analytics' ) );
+        }
+
+        public function render_gpc_field() {
+                $this->checkbox( 'gpc', __( 'Honor Global Privacy Control', 'lightweight-google-analytics' ), __( 'Visitors whose browser sends a <a href="https://globalprivacycontrol.org/" target="_blank" rel="noopener">Global Privacy Control</a> signal (an opt-out built into Brave, DuckDuckGo and Firefox) are not measured. Recommended if your site has to follow California\'s CCPA or a similar law that treats the signal as an opt-out request.', 'lightweight-google-analytics' ) );
+        }
+
+        public function render_content_groups_field() {
+                $this->checkbox( 'content_groups', __( 'Send content groups and authors', 'lightweight-google-analytics' ), __( 'Sends the post\'s category (or the page type, such as Page or Search) as GA4\'s Content group, so you can compare sections of your site in reports. Also sends the author\'s name as an <code>author</code> parameter; to report on it, add an event-scoped custom dimension named <code>author</code> in Google Analytics under Admin > Custom definitions.', 'lightweight-google-analytics' ) );
         }
 

lightweight-google-analytics/trunk/readme.txt

@@ -6 +6 @@
 Tested up to: 7.1
 Requires PHP: 7.0
-Stable tag: 1.6.0
+Stable tag: 1.7.0
 License: GPLv3
 License URI: http://www.gnu.org/licenses/gpl.html
@@ -19 +19 @@
 
 * Performance focused with no bloat and never any upsells
-* Only needs your GA4 Measurement ID (G-XXXXXXXX)
+* Only needs your GA4 Measurement ID (G-XXXXXXXX), or paste Google's whole tag snippet and the ID is picked out of it
 * Load the tracking code in the header or footer
 * Exclude logged-in users by role (admins, editors and authors are excluded by default)
 * Post previews and the Customizer are never tracked
 * Option to disable Google's advertising features (Google signals)
-* Google Consent Mode v2 support for GDPR/CCPA compliance with cookie consent plugins
+* Google Consent Mode v2 support for GDPR/CCPA compliance, working automatically with consent plugins that support the WP Consent API (such as Complianz and CookieYes)
+* Option to honor Global Privacy Control, the opt-out signal sent by Brave, DuckDuckGo and Firefox
+* Optional content groups: the post's category (or page type) as GA4's Content group, plus the author's name, so you can compare sections and authors in reports
+* Warns you on the settings page when another plugin, your theme or a pasted snippet also adds Google Analytics, so page views aren't counted twice
 * Debug Mode for testing in GA4 DebugView
 * Optional Minimal Analytics 4 mode: a 3.5 KB inline script that reports page views, scrolls, downloads, outbound clicks and site searches without loading gtag.js at all
 * The settings page tells you whether tracking is live and why your own visits may not show up
-* Works with WP Rocket's local Google Analytics feature
 * Filters for developers to change the gtag config, the consent defaults or when tracking is skipped
 
@@ -50 +52 @@
         $defaults['region'] = array( 'AT', 'BE', 'DE', 'FR', 'IE', 'NL' );
         return $defaults;
+} );`
+
+Change the content group or author sent with each page (when Content Groups is on), or add more page-level parameters:
+
+`add_filter( 'lightweight_ga_page_dimensions', function ( $dimensions ) {
+        if ( is_page( 'pricing' ) ) {
+                $dimensions['content_group'] = 'Sales';
+        }
+        return $dimensions;
 } );`
 
@@ -78 +89 @@
 Google Consent Mode v2 tells Google that analytics and advertising storage are denied until the visitor consents. Enable it if you use a cookie consent plugin that updates the consent state through `gtag("consent", "update", ...)` and you need to comply with GDPR or similar rules. It only applies to Google's gtag.js code.
 
+= Which consent plugins work with Consent Mode? =
+
+Any consent plugin that supports the [WP Consent API](https://wordpress.org/plugins/wp-consent-api/), such as Complianz and CookieYes, works automatically: install and activate the WP Consent API plugin, then turn on Consent Mode. Statistics consent controls Google Analytics storage and marketing consent controls the advertising storage types, and both follow the visitor's choice when it changes. Note that the WP Consent API treats a site with no consent plugin as having consent. Other consent plugins need to call `gtag("consent", "update", ...)` themselves.
+
+= What does the Global Privacy Control option do? =
+
+Global Privacy Control is an opt-out signal built into Brave and DuckDuckGo and available in Firefox. California's CCPA and similar US state laws treat it as a request to opt out of the sale or sharing of personal information. When the option is on, visitors who send the signal are not measured: gtag.js gets Google's documented opt-out flag, and Minimal Analytics doesn't run at all.
+
+= How do I see content groups and authors in Google Analytics? =
+
+Turn on Content Groups in the plugin settings. The content group shows up under the built-in "Content group" dimension in reports such as Pages and screens. To report on authors, add an event-scoped custom dimension named `author` in Google Analytics under Admin > Custom definitions; it fills in from then on, usually within 48 hours.
+
+= Why does the settings page say my page views are counted twice? =
+
+The plugin checks whether another analytics plugin is set up to add Google Analytics too (such as Site Kit, MonsterInsights or Rank Math), and looks at your home page for other Google tags added by your theme or a code snippet plugin. Remove the extra copy so each visit is only counted once. Tags that only appear on some pages, or only after cookie consent, can't be detected.
+
 = What is the Minimal Analytics 4 option? =
 
-It replaces Google's gtag.js with [Minimal Analytics 4](https://github.com/idarek/minimal-analytics-4) by Dariusz Wieckiewicz (MIT), a small inline script that talks to Google Analytics directly. It sends page views, session start and engagement events, 90% scrolls, file downloads, outbound link clicks and site searches, plus UTM campaign attribution. It does not support Consent Mode or Google's enhanced measurement, and it stores its client and session IDs in localStorage, so check your privacy requirements before using it.
+It replaces Google's gtag.js with [Minimal Analytics 4](https://github.com/idarek/minimal-analytics-4) by Dariusz Wieckiewicz (MIT), a small inline script that talks to Google Analytics directly. It sends page views, session start and engagement events, 90% scrolls, file downloads, outbound link clicks and site searches, plus UTM campaign attribution. It does not support Consent Mode or Google's enhanced measurement, and it stores its client and session IDs in localStorage, so check your privacy requirements before using it. With the WP Consent API and Consent Mode turned on, it waits until the visitor allows statistics before it runs.
 
 = How do I test if tracking is working? =
@@ -95 +122 @@
 
 == Changelog ==
+
+= 1.7.0 =
+* Fixed: saving the settings for the first time on a new install switched on Consent Mode, Debug Mode and Disable Display Features by themselves (since 1.5.0). Sites updating from an affected version that have any of them on get a one-time notice asking to check them.
+* Fixed: with Minimal Analytics in the header (the default), page views were sent before the page title existed, so GA4 showed "(not set)" titles, and scrolling at the top of the page caused a JavaScript error.
+* Fixed: saving a mistyped or pasted Measurement ID cleared the working one and stopped tracking. The previous ID is now kept, and the ID is picked out of a pasted gtag snippet or URL.
+* Fixed: with the tracking code in the footer, the Consent Mode defaults were printed in the footer too, after consent banners could already update them. They now always go in the head.
+* Fixed: setup notices were shown to all logged-in users on every admin screen. They now only show to admins, and the setup reminder only on the Dashboard and Plugins screens.
+* Fixed: the settings page told new installs to tick "Enable Google Analytics" although it was already ticked.
+* New: works with consent plugins that support the WP Consent API when Consent Mode is on, for gtag.js and Minimal Analytics.
+* New: option to honor Global Privacy Control.
+* New: optional content groups (post category or page type) and author names for GA4 reports, with a `lightweight_ga_page_dimensions` filter.
+* New: duplicate tracking warning when another plugin, the theme or a snippet also adds Google Analytics.
+* New: a warning when Consent Mode is on but Minimal Analytics would ignore it, and a hint when the WP Consent API is active but Consent Mode is off.
+* Network super admins are excluded along with administrators, and deleting the plugin on a multisite network removes its settings from every site.
+* Settings fields are now properly labeled for screen readers.
 
 = 1.6.0 =

lightweight-google-analytics/trunk/uninstall.php

@@ -1 +1 @@
 <?php
-// Remove the plugin's only stored data
+// Remove everything the plugin stores, on every site of a multisite network
 if ( ! defined( 'WP_UNINSTALL_PLUGIN' ) ) {
         exit;
 }
-delete_option( 'lightweight_ga_settings' );
+
+function lightweight_ga_uninstall_site() {
+        delete_option( 'lightweight_ga_settings' );
+        delete_option( 'lightweight_ga_state' );
+        delete_transient( 'lightweight_ga_duplicate_scan' );
+}
+
+if ( is_multisite() ) {
+        foreach ( get_sites( array( 'fields' => 'ids', 'number' => 0 ) ) as $site_id ) {
+                switch_to_blog( $site_id );
+                lightweight_ga_uninstall_site();
+                restore_current_blog();
+        }
+} else {
+        lightweight_ga_uninstall_site();
+}