WP Statistics – Simple, privacy-friendly Google Analytics alternative

14.16.10 – 2026-07-25

Fix: Prevented a fatal error on the tracking request when the referrer parameter was sent as an array instead of a single value.

Enhancement: General security hardening and internal improvements.

14.16.9 – 2026-07-21

Fix: Content Analytics no longer adds the site-wide historical baseline into each post’s Total Views, so per-post totals are accurate again (issue #1097).

Fix: Prevented a fatal error on admin load when license validation fails or the license key is empty.

Enhancement: Hardened input handling and output escaping across the visitor and referral reports.

14.16.8 – 2026-05-19

Enhancement: Hardened input handling across admin AJAX endpoints, the dynamic query builder, the referrer pipeline, and the GeoIP download URL.

Enhancement: Removed the bundled moment.min.js in favor of the copy shipped with WordPress core.

Enhancement: Added direct-file-access guards, switched date() calls to gmdate(), and routed parse_url() through wp_parse_url().

Enhancement: Normalized translator placeholders and text domains; routed translated UI strings through escape/kses functions.

Enhancement: Replaced direct unlink() calls in plugin code with wp_delete_file().

14.16.7 – 2026-05-12

Enhancement: Hardened escaping and sanitization in device reports.

Enhancement: Tracking endpoints now send noindex and no-cache headers to prevent “ghost pages” in Google Search Console.

Fix: Stopped GeoLite2-City background downloads on Cloudflare IP Geolocation sites