wp-cron.php<\/code> every few minutes): purchases are delivered by the WooCommerce Action Scheduler in the background.<\/li>\n<\/ol>\n\nUpdating from 0.5.0 or earlier: the plugin renames its options, transients, hooks and REST namespace from td_<\/code> to trackdolphin_<\/code> on first load. Credentials, settings and counters are carried over automatically; delivery jobs that were already scheduled are still processed; the old REST route td\/v1<\/code> keeps answering for cached pages.<\/p>\n\n\n\nDoes the plugin respect visitor consent?<\/h3><\/dt>\nYes. Browser events and server-side orders require an explicit analytics or marketing grant before leaving the shop, including the visitor\u2019s IP address and user agent. No event is sent before a decision or after full rejection, regardless of the service mode. The script reads the WP Consent API (opt-in), Google Consent Mode, Cookiebot, Usercentrics, IAB TCF 2 and Trackdolphin's banner. Defaults never count as decisions. Purchases use the consent snapshot saved at checkout; missing or ineligible snapshots are not transmitted. The same local check applies to queued purchases after an update. Marketing identifiers require marketing consent.<\/p>\n\n
After updating, purge any external full-page\/CDN cache so visitors receive the new script. The plugin invalidates supported WordPress page caches once; cached HTML outside WordPress must be purged by the site operator.<\/p><\/dd>\n
Does it work with HPOS (High-Performance Order Storage)?<\/h3><\/dt>\nYes. The plugin declares compatibility with custom_order_tables<\/code> and only reads and writes order data through the WC_Order<\/code> object.<\/p><\/dd>\nDoes it work with the block checkout?<\/h3><\/dt>\nYes. Consent and identifiers are captured through woocommerce_store_api_checkout_update_order_meta<\/code> for the block checkout and through woocommerce_checkout_create_order<\/code> for the classic checkout. The plugin declares compatibility with cart_checkout_blocks<\/code>.<\/p><\/dd>\nWhat happens without a Trackdolphin account?<\/h3><\/dt>\nNothing. Until the shop is linked with an activation code, no script is added to your pages, no cookie is set and no data is sent anywhere. Paid orders that arrive while the plugin is unlinked are counted in the status line (\"Nicht gemeldete K\u00e4ufe\") so you can see what was missed.<\/p><\/dd>\n
Which cookies does the plugin set?<\/h3><\/dt>\n_td_vid (first-party visitor id, 365 days, only with marketing consent) and _td_consent<\/code> (the consent decision the script saw, 180 days, only after a decision). Click ids (gclid<\/code>, gbraid<\/code>, wbraid<\/code>, _fbc<\/code>) are stored as cookies only with marketing consent. LinkedIn's click ID (li_fat_id<\/code>) is stored in _td_li_fat_id<\/code> for 30 days, also only with marketing consent.<\/p><\/dd>\nWhere is the data stored?<\/h3><\/dt>\nTrackdolphin stores the events of your project on its own infrastructure. Nothing about the visitor is stored in the WooCommerce database except the consent snapshot and identifiers on the order (_td_*<\/code> order meta) and a small encrypted delivery queue in the options table while a purchase is waiting to be sent.<\/p>\n\nPurchases, cancellations and refunds are always delivered to the project the shop is currently linked to, also after the project or collector address has changed. For orders anonymized by WooCommerce's privacy tools, pending and later events are still sent, but without personal data (no identifiers, hashes, address, IP address or user agent; only amount, currency, items and the country code).<\/p><\/dd>\n
What is deleted when I uninstall the plugin?<\/h3><\/dt>\nUninstalling revokes the installation key at Trackdolphin, removes the credentials, settings, counters and the delivery queue. Orders keep their _td_*<\/code> meta so that a later reinstall does not report the same purchase twice.<\/p><\/dd>\n\n<\/dl>\n\n\n0.7.5 (2026-09-26)<\/h4>\n\n\n- Links to trackdolphin.com now carry the language prefix (
\/en\/docs\/\u2026<\/code>); the old addresses keep working as permanent redirects.<\/li>\n- Purchases, cancellations, refunds and queued deliveries are sent to the currently linked project, also after a project or collector address change.<\/li>\n
- Orders anonymized by WooCommerce's privacy tools: pending and later events are still sent, without personal data.<\/li>\n
- The delivery queue marks an event as delivered only after the collector confirms it.<\/li>\n
- Per-service consent: with service switches in the Trackdolphin banner, a \"no\" to a single service (e.g. Google Ads while Meta is allowed) now reaches the consent record, the browser events and the purchase. The consent relay also keeps
origin: migrated<\/code> and source: placeholder<\/code>; invalid entries in the service map are dropped one by one instead of rejecting the record. A retry carries a service the visitor has meanwhile switched off. _td_consent<\/code> stays purpose-based; the purchase reads only the denials from the banner cookie. No new cookie; nothing leaves the shop before the visitor decides.<\/li>\n- Consent banner runtime rebuilt from the current banner package. With service switches, a \"no\" to Google Ads or Google Analytics now also sets the matching Google Consent Mode signals to
denied<\/code>, even when another service of the same purpose is allowed; the dataLayer event td_consent_update<\/code> carries the service map as td_services<\/code>; if the cookie gets too large, the denials are kept and only the \"yes\" entries are dropped. Embeds marked with data-td-cm-src<\/code> stay unloaded behind a placeholder until the visitor loads them. The runtime still makes no network request of its own; nothing leaves the shop before the visitor decides.<\/li>\n<\/ul>\n\n0.7.4<\/h4>\n\n\n- Block browser events and queued orders locally until explicit visitor consent, regardless of service mode; show the override in settings.<\/li>\n
- Validate and sanitize browser payloads before forwarding, preserving consent, identifiers and commerce values.<\/li>\n
- Defer cron scheduling and migrations until init to prevent early translation notices.<\/li>\n
- Gate advertising identifiers on marketing consent and remove plugin cookies on withdrawal.<\/li>\n<\/ul>\n\n
0.7.3<\/h4>\n\n\n- Added: captures LinkedIn's click ID (li_fat_id) with marketing consent and passes it to the server-side conversion.<\/li>\n
- Fixed: pages cached before 0.7.2 keep loading the consent banner via a redirect from the old script address to the bundled file.<\/li>\n
- Security: invalid consent requests no longer use up the shop's consent limit; limits apply per visitor plus a shop-wide cap.<\/li>\n<\/ul>\n\n
0.7.2 (2026-09-19)<\/h4>\n\n\n- Changed: the readable, unminified consent banner runtime is bundled in the plugin under GPL-2.0-or-later and loaded locally with the plugin version. Removed the remote runtime download, its cache and the
\/consent.js<\/code> REST route. Clear page caches after updating so cached pages load the local script.<\/li>\n- Fixed: unlinked or disabled shops emit no consent scripts and make no banner requests.<\/li>\n
- Security: consent relaying has a separate limit of 60 requests per shop per minute, a 64 KiB body limit and strict validation of the decision, four boolean purposes and metadata. Public consent and collect routes document why anonymous access is needed and how it is protected.<\/li>\n
- Security: reject unexpected input types in forms, activation codes, request bodies, server values and identifier parameters; validate identifier cookies.<\/li>\n
- Clarified: Trackdolphin is serviceware. The linking code is not a license key; the plugin contains no trials, paid feature locks or quotas.<\/li>\n<\/ul>\n\n
0.7.1 (2026-09-17)<\/h4>\n\n\n- Changed: the admin notice asking for the link code can now be dismissed, and the choice is remembered. A real error (failed connection test, damaged code) still shows and is never hidden behind the dismissal.<\/li>\n
- Changed: plugin tags no longer name third-party brands.<\/li>\n<\/ul>\n\n
0.7.0 (2026-09-11)<\/h4>\n\n\n- Added: three tracking modes (after consent, collect, always). The mode says what happens BEFORE the visitor has decided: \"after consent\" stays silent (no event, no cookie, no reading); \"collect\" sends everything that is known without touching the device (page including its parameters, referrer, products, value) and leaves the device alone, so there is no visitor id and no session; \"always\" measures right away with identifiers and a cookie. Which mode applies is decided in the Trackdolphin dashboard, per country; the collector tells the plugin. A decision by the visitor always wins over the mode.<\/li>\n
- Added: the consent mode default is now announced in the head of every page, before the shop's own Google tag: all four signals denied with wait_for_update, or granted in \"always\" mode. Without an announcement a Google tag behaves as if consented and sets cookies; in the EEA Google reads missing signals as no consent and does not use the data at all. Switchable, and off by default when another consent tool is detected, because two contradicting defaults are worse than none.<\/li>\n
- Changed: the settings page now has a section \"Trackingverhalten und Zustimmungssignal (Profi-Einstellungen)\" with one sentence per mode and a link into the dashboard. The old, technical note about the visitor cookie is gone (Christopher Motz, 11.9.: \"too technical and it makes no sense, because we want to leave the choice to the user\"). The country list stays in the dashboard on purpose: maintained twice it would contradict itself.<\/li>\n<\/ul>\n\n
0.6.1 (2026-09-11)<\/h4>\n\n\n- Added: a red admin notice on every admin page as soon as the collector declines events for lack of consent and no consent tool hands over a decision. It offers both ways out: \"set up consent banner\" (opens the Trackdolphin dashboard for this project) and \"change tracking settings\" (the plugin settings), plus the note that switching to \"always collect\" runs counter to local regulations in Europe. Dismissible per state; a changed state shows it again. Without declined events the previous, quieter warning stays.<\/li>\n
- Added: consent tools are now detected without the plugin list as well, through constants, classes, functions and options. A tool no longer goes unnoticed just because its folder was renamed, it runs as a must-use plugin, or it is not distributed through the WordPress directory at all. Every marker is backed by the tool's source or its vendor documentation; where no evidence was found, nothing is claimed.<\/li>\n
- Added: three more plugin folders recognised: gdpr-cookie-consent (WebToffee, NOT the same product as CookieYes although both set the same cookies), uk-cookie-consent (Termly) and cookie-notice (hu-manity.co).<\/li>\n
- Added: the finding now distinguishes three cases: none found, found but it hands us nothing, and found and reporting. The wording follows them: a merchant who HAS a consent tool is no longer told he has none, but is told which tool it is and how to wire it up. The self-report to the dashboard carries the case as consent_status.<\/li>\n<\/ul>\n\n
0.6.0 (2026-09-11)<\/h4>\n\n\n- Fixed: after a click on \"accept all\" the page view of the CURRENT page is now sent again. The WP Consent API reports every category on its own and synchronously (
wp_set_consent()<\/code> fires wp_listen_for_consent_change<\/code> per call), so the first event still said \"marketing denied\" and the catch-up was rejected by the collector with 403 consent_required<\/code>. The script now reads the consent state once, after all categories have been set.<\/li>\n- Changed: everything the plugin stores or registers in WordPress now carries the prefix
trackdolphin_<\/code> instead of td_<\/code>: options, transients, the delivery hook (trackdolphin_deliver_event<\/code>), the daily heartbeat, admin actions, nonces, the settings group and the REST namespace (trackdolphin\/v1<\/code>). A one-time migration copies existing options and transients to the new names and removes the old ones; delivery jobs scheduled under the old hook are still processed; the old REST namespace td\/v1<\/code> stays registered as an alias for pages served from a cache. Cookies (_td_vid<\/code>, _td_consent<\/code>), order meta (_td_*<\/code>) and signature headers (X-Td-*<\/code>) are unchanged: they are the contract with the collector, not WordPress namespace. Constants TRACKDOLPHIN_VERSION<\/code> and TRACKDOLPHIN_PATH<\/code> replace TD_VERSION<\/code> and TD_PATH<\/code> (kept as aliases).<\/li>\n- Removed: the update channel introduced in 0.4.1 (
Trackdolphin_Updates<\/code>, pre_set_site_transient_update_plugins<\/code>). Plugins in the WordPress.org directory receive their updates from the directory; a custom updater is not permitted there.<\/li>\n- Changed: licensed under the GPLv2 or later.<\/li>\n
- Changed: the relay rate limit uses a transient instead of direct database writes; the inline configuration and script tags are printed through
wp_print_inline_script_tag()<\/code> and wp_print_script_tag()<\/code>; every file guards against direct access; inputs are unslashed and sanitized; parse_url()<\/code> replaced by wp_parse_url()<\/code>; no error_log()<\/code> in production code (the reason now lands in the status line). Plugin Check reports no errors and no warnings for the shipped files.<\/li>\n- Changed: outdated admin texts that still mentioned the \"personal plugin package\" now point to the activation code.<\/li>\n<\/ul>\n\n
0.5.0 (2026-09-11)<\/h4>\n\n\n- Changed: the personal plugin package is gone. The plugin is the same ZIP for everyone; linking happens with a single activation code from the dashboard (Setup), pasted under WordPress \u2192 Trackdolphin. The code carries collector address, project id, installation id and the one-time secret; it is valid 24 hours and redeemable once. Existing linked shops keep working.<\/li>\n
- Changed: the consent banner runtime is no longer shipped inside the plugin. The shop serves it from its own route (
\/wp-json\/trackdolphin\/v1\/consent.js<\/code>, fetched from the Trackdolphin service and cached for an hour), so the browser still sees only the shop domain and a new banner release needs no plugin update.<\/li>\n- Added: Trackdolphin Consent, the project's own cookie banner. Once a version is published in the dashboard, the plugin fetches it from the collector (cached five minutes) and writes it as an inline configuration into the page head: first-party, no third-party request before the decision.<\/li>\n
- Added: the banner's decisions reach everything that reads consent; every decision is relayed as a consent record to the collector through the shop.<\/li>\n<\/ul>\n\n
0.4.2 (2026-09-11)<\/h4>\n\n\n- Added: when the collector declines browser events for lack of consent (
403 consent_required<\/code>), the status line says so, with the last time it happened and what helps.<\/li>\n- Fixed: timestamps in the status line are shown in the shop's timezone instead of raw UTC.<\/li>\n<\/ul>\n\n
0.4.1 (2026-09-11)<\/h4>\n\n\n- Added: the buyer's identifiers are captured at checkout and travel with the purchase: visitor id,
gclid<\/code>\/gbraid<\/code>\/wbraid<\/code> (also from Google's _gcl_aw<\/code> cookie), _fbc<\/code>\/_fbp<\/code>, GA client id; fallback is the entry URL of WooCommerce's order attribution.<\/li>\n- Added: compatibility declared for HPOS (
custom_order_tables<\/code>) and the block checkout (cart_checkout_blocks<\/code>).<\/li>\n- Added: the plugin reports its version, PHP\/WP\/WC versions, HPOS state, consent finding and delivery counters to the collector with every connection check, on activation and once a day.<\/li>\n
- Added: status line warns when five or more delivery jobs are waiting, with the WP-Cron hint.<\/li>\n
- Fixed: the server-side visitor cookie decision now reads the full consent snapshot, not only the WP Consent API.<\/li>\n<\/ul>\n\n
0.4.0 (2026-09-11)<\/h4>\n\n\n- Changed: the plugin no longer decides about consent; the server does. Every paid order is sent with the consent snapshot and its origin (
source: cmp<\/code> or source: default<\/code>); the collector answers 202 or 403 consent_required<\/code>.<\/li>\n- Added:
country_code<\/code> in the purchase payload so the server can apply the per-country rule.<\/li>\n- Added: a 403
consent_required<\/code> from the server is counted once per order, shown in the status line and never retried.<\/li>\n- Fixed: orders without a consent snapshot (admin, import, subscription renewals) are sent with
source: default<\/code>.<\/li>\n- Fixed: the snippet ignored the WP Consent API unless the banner set
window.wp_consent_type<\/code>; it now also reads window.wp_fallback_consent_type<\/code>.<\/li>\n- Added: the snippet writes the banner decision it sees to the first-party cookie
_td_consent<\/code>; the server-side snapshot reads it as a second source.<\/li>\n- Changed: without a decision the snippet sends an anonymous page view and lets the server decide.<\/li>\n
- Fixed: browser events relayed through the first-party proxy lost the visitor's IP and user agent; the relay is now signed with the installation credentials.<\/li>\n<\/ul>\n\n
0.3.3 (2026-09-10)<\/h4>\n\n\n- Fixed: a Consent Mode
default<\/code> was treated like an update<\/code>. A preset never unlocks events or cookies, only a decision does.<\/li>\n- Every browser event and the purchase snapshot now carry
consent.source<\/code> and consent.cmp<\/code>.<\/li>\n- WP Consent API: the visitor has decided only once the API has written its cookie.<\/li>\n<\/ul>\n\n
0.3.2 (2026-09-10)<\/h4>\n\n\n- Consent management detection and WP Consent API check on the settings page, with a dismissable admin notice when a banner is not bridged to the API.<\/li>\n
- Fixed: the server-side consent snapshot queried a filter that does not exist; every purchase was recorded as \"no consent\" even with a correctly bridged banner.<\/li>\n
- Removed the \"visitor cookie only after consent\" settings row and the \"delete settings on uninstall\" checkbox; uninstall always removes the settings, orders are never touched.<\/li>\n<\/ul>\n\n
0.3.1 (2026-09-09)<\/h4>\n\n\n- Activation errors show their cause; activation redirect and top-level admin menu.<\/li>\n<\/ul>","raw_excerpt":"Server-side tracking for WooCommerce: sends shop events and paid orders to your Trackdolphin project, first-party and consent-aware.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/371064","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=371064"}],"author":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/trackdolphinhq"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=371064"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=371064"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=371064"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=371064"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=371064"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=371064"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}