WWB Restaurant Menu Pro

Description

Developed by Aleksander Auset Bækkelund – WildWebBuilder.com
WordPress.org contributor: aleksa64.

Manage your restaurant menu through a native WordPress administration workspace:
Overview, Menu Items, Categories / Sections, Specials, Menu Order, Analytics,
Import / Export / Demo, and Settings.

Settings are organized into General, Appearance, Display, Food information,
Print / PDF, QR codes, Analytics, and Advanced. Saving one tab preserves the
other tabs. Version 3.4.2 migrates legacy pre-review identifiers to the new wwbrmp_ prefix while preserving menu posts, section relationships, settings, metadata, shortcode usage in WordPress content, and analytics history.

Shortcodes:
* [wwbrmp_restaurant_menu]
* [wwbrmp_today_special]
* [wwbrmp_featured_dishes limit=”6″]
* [wwbrmp_menu_section category=”Drinks”]

The PDF view is a printable HTML page for the browser’s Print / Save as PDF
feature. It does not generate a binary PDF on the server.

Upgrade notes

The 3.3.0 release introduced an additive admin refactor, not a destructive migration.
No uninstall data removal is performed. Deactivation clears scheduled reports and retention cleanup.
The analytics schema is checked once per database version, including upgrades
that do not run the activation hook.

Previous admin URLs for food information, PDF settings, QR codes and shortcodes
remain available. Food/PDF/QR settings now appear inside Settings.

Role behavior follows existing WordPress post capabilities: users with
edit_posts can manage the items they are allowed to edit; categories and global
order require manage_categories; settings, analytics and data tools require
manage_options. Sort requests also check edit_post for each submitted item.

Order changes do not move items between categories. Edit section membership in
the native item editor. Items belonging to multiple sections use one shared
menu_order value; conflicting submitted positions are rejected.

Import and export

JSON format version 1 is supported, up to 5 MB and 1,000 menu items or sections.
Exports include item metadata, status, section hierarchy, media URLs and settings.
This is not a full site or database backup. Analytics history and image binaries
are not exported. Analytics CSV contains at most 5,000 events for the period.

Imports are validated before the preview is saved for 15 minutes. Applying an
import creates drafts and reuses sections by slug without changing existing
sections. Repeated imports from the same source skip previously imported items.
Images are linked only if their URL matches media already present locally;
no remote media is downloaded. Settings are optional; analytics configuration,
recipients and external-service consent are never enabled by an import.

Demo creates three drafts in a Demo Menu section and does not duplicate them
when run again. Review food information and pricing before publishing samples.

External services

QR Server / goQR.me is an optional external QR image generator operated by
Foundata GmbH. Endpoint: https://api.qrserver.com/v1/create-qr-code/

It is disabled until an administrator explicitly enables it in Settings >
QR codes, including after an upgrade. When enabled, QR previews/downloads and
optionally PDF covers request images from QR Server. Requests include the encoded
menu destination/tracking URL, image size, foreground/background colors and
output format. The requesting browser also contacts the service directly, so
the service receives normal connection information such as the browser IP.

Service documentation: https://goqr.me/api/
Terms of service: https://goqr.me/legal/tos-api.html
Privacy policy: https://goqr.me/de/rechtliches/datenschutz-api.html
Legal information: https://goqr.me/legal/

No external analytics service is used. Report emails are sent through WordPress
wp_mail to administrator-configured recipients and may use your site’s mail
provider. Delivery depends on that provider and WP-Cron traffic. Scheduled times
use the WordPress site timezone.

Privacy and retention

Analytics is optional and off by default. Existing installations must explicitly
activate it again under Settings > Analytics after upgrading to 3.4.0. Existing
history is preserved. Enabling analytics shows visitors a choice on menu pages;
events are accepted only after visitor consent. A first-party preference cookie,
wwbrmp_consent, remembers yes/no for 180 days. The menu remains fully usable
without analytics. The menu privacy control lets visitors withdraw consent.

New analytics events contain menu item/category, interaction type, source,
timestamp and viewing duration. Visitor hashes, persistent session identifiers,
page URLs, referrers and user agents are no longer stored in event records.
A keyed, one-minute IP-derived counter limits event requests; raw IPs are never
written to that counter. New versions do not create the old localStorage visitor
ID; making a privacy choice removes any old wwbrmp_sid identifier.

Historical records may still contain fields collected by older versions.
Settings > Analytics provides confirmed administrator actions to remove legacy
visitor information while preserving metrics, or delete history in batches of
5,000 events. A configurable retention period of 30, 90 or 365 days can remove
older events daily, in batches of up to 5,000. The default keeps existing history
until the administrator chooses otherwise. Cleanup depends on WP-Cron traffic.

The plugin does not associate analytics records with emails or WordPress users,
so it cannot reliably locate a visitor’s historical events using WordPress’s
email-based personal data tools. The administrator can instead remove legacy
visitor fields or event history using the documented privacy actions. Suggested
privacy policy text is added to WordPress’s Privacy Policy Guide. This does not
replace the site owner’s assessment of its privacy obligations.

The unused legacy analytics_include_csv setting remains for compatibility;
scheduled email attachments were not implemented in the original version.

License and attribution

Copyright (C) 2026 Aleksander Auset Bækkelund – WildWebBuilder.
Licensed under the GNU General Public License, version 2 or any later version.
See LICENSE.txt for the license and COPYRIGHT.txt for attribution and dependencies.
Author attribution appears in the plugin information and admin overview. No promotional footer is inserted into visitors’ menus.

Screenshots

Installation

  1. Back up your WordPress files and database before upgrading.
  2. Upload the ZIP in Plugins > Add Plugin > Upload Plugin. Replace the existing version when prompted. The plugin folder remains wwb-restaurant-menu-pro.
  3. Activate the plugin if needed and open Restaurant Menu > Overview.
  4. Review Settings > QR codes before enabling the external QR service.

Reviews

There are no reviews for this plugin.

Contributors & Developers

“WWB Restaurant Menu Pro” is open source software. The following people have contributed to this plugin.

Contributors

Changelog

3.4.5

  • Validate, unslash, and sanitize the request method before checking legacy admin redirects.

3.4.4

  • Document narrowly scoped nonce-check exceptions for public read-only PDF views and HMAC-validated permanent QR links.
  • Prefix the uninstall analytics-table variable with wwbrmp.
  • Preserve the 3.4.3 admin access fixes and existing QR validation.

3.4.3

  • Restore hidden admin pages by retaining parent/submenu registration through WordPress access checks.
  • Redirect known pre-prefix admin URLs to registered wwbrmp pages with the original capability checks.
  • Preserve the wwbrmp/WWBRMP prefix migration and existing menu data.

3.4.2

  • WordPress.org review cleanup: unique wwbrmp_ / WWBRMP_ prefixes throughout plugin declarations and stored data.
  • Added one-time migration for existing menu content, settings, metadata, analytics table and shortcode content.
  • Removed Author URI from the plugin header to avoid review-time availability failures.
  • Reviewed request handling, asset enqueueing, contributor metadata and privacy disclosures.

3.4.1

  • Address WordPress.org review feedback for script and style loading.
  • Move printable PDF CSS and JavaScript to WordPress enqueue APIs.
  • Harden long-lived QR redirects with signed URLs and configured-target validation.
  • Add the correct WordPress.org contributor username.
  • Preserve the 3.4.0 privacy, retention, translation and admin architecture changes.

3.4.0

  • Add GPLv2-or-later license and complete author/contributor attribution.
  • Require administrator activation and visitor opt-in for optional analytics.
  • Minimize new event records and remove the persistent visitor identifier.
  • Add optional retention, legacy-data removal and privacy policy guidance.
  • Bound abuse counters and validate privacy actions with capability and nonce checks.
  • Add cached analytics query helpers and document targeted static-check exceptions.
  • Make settings schemas and additional admin/frontend messages translatable;
    include a POT translation template.
  • Restore return values for the admin parent/submenu compatibility callbacks.
  • Preserve existing menu posts, taxonomy IDs, metadata and shortcodes.

3.3.0

  • Consolidate administration into Restaurant Menu with a useful overview,
    native content screens, specials, analytics, data tools and eight settings tabs.
  • Split the single-file implementation into administration/data-tool classes
    and compatibility-preserving settings, content, admin, analytics and frontend modules.
  • Preserve unrelated settings server-side; remove duplicated forms, hidden
    option copies and the obsolete single-list sorting script.
  • Add validated JSON preview/import/export and repeat-safe demo draft creation.
  • Enforce per-item sort permissions, taxonomy membership and request validation;
    add keyboard reorder controls, live status and serialized AJAX saves.
  • Add analytics export nonces, CSV formula protection, bounded event fields,
    safer SQL identifiers and versioned database setup.
  • Correct report scheduling timezone, preserve report cursor and report mail failure.
  • Add optional local-analytics collection control and explicit external QR consent.
  • Load admin assets only on plugin screens; load sortable only on Menu Order.
  • Preserve shortcodes, print layouts, database identifiers and old admin URLs;
    repair visibility for imported items lacking the legacy hide metadata.
  • Restore frontend filter script loading and move analytics JavaScript to an asset.
  • Invalidate menu caches on save/trash/delete and prevent same-second collisions.

3.2.0

  • Supplied baseline: business-day analytics and scheduled reports.