=== Bluvia - A/B Testing & CRO Tool ===
Contributors: bluvia
Donate link: https://bluvia.io/
Tags: ab testing, split testing, conversion optimization, cro, multivariate testing
Requires at least: 6.0
Tested up to: 7.1
Stable tag: 1.1.2
Requires PHP: 8.1
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Run A/B tests on your WordPress site and track conversions, with all experiment data stored in your own WordPress database.

== Description ==

**Bluvia - A/B Testing & CRO Tool** lets you run split tests and conversion rate optimization (CRO) experiments directly on your WordPress site. Unlike cloud-based competitors, all experiment data — variants, views, conversions, and results — is stored in your own WordPress database and never leaves your site. The plugin makes one external request unrelated to that data: deactivation feedback, sent to Bluvia only when you submit it. See "External Services" below for the full list of what is sent and when.

= Why Bluvia? =

* **No visitor-based limits** — track as much traffic as your site receives, with no limit on the number of experiments you can create or archive
* **Local data storage** — experiment data, results, and variant content stay in your own WordPress database
* **Privacy-friendly** — designed with privacy in mind, with configurable cookie consent integration

= Experiment Types =

* **Headline** — test different headline text or page titles
* **Page** — test entire versions of a page with different content, layouts, or offers
* **Post** — compare versions of a blog post or article
* **URL Redirect** — split visitor traffic between your current page and one alternative URL
* **Custom Post Type** — test variations of any custom post type on your site
* **Button / CTA** — test changes to a button's text, color, or placement
* **Menu** — test different menu layouts or item labels to improve navigation

= Key Features =

**Experiment Management**

* A/B and multivariate testing with unlimited variants
* Visual experiment editor (WYSIWYG-style interface)
* Preview any variant before launching
* Apply winner: promote the winning variant to live content
* Duplicate experiments for iteration

**Conversion Tracking**

* Goal types: page view, button/link click, form submission, scroll depth
* Cookie-based deduplication to prevent double-counting
* Daily conversion history for trend charts

**Audience Targeting & Segmentation**

* Device type: desktop, mobile, or tablet
* Geographic location — country targeting and geographic exclusions, provided by the Bluvia Premium add-on (free with a registered Bluvia account; see "External Services")
* Traffic source: organic, paid, social, direct, referral
* Visitor type: new vs. returning
* IP exclusion rules to filter out internal traffic

**Results & Analytics**

* Statistical confidence level calculation
* Visual performance charts with historical trends
* Automated insights engine — flags low traffic, trending variants, experiments ending soon
* Export results to PDF

**Privacy**

* Designed with privacy in mind
* All experiment data stored locally on your own server
* Configurable consent integration: tracking, cookies, and the premium add-on's country lookup only activate when your specified consent cookie is present
* No names or email addresses are collected — only behavioral and technical signals. The free plugin sends no visitor data off your server (see "External Services")

== Installation ==

1. Upload the `bluvia-ab-testing-cro-tool` folder to the `/wp-content/plugins/` directory, or install it directly through the WordPress **Plugins > Add New** screen.
2. Activate the plugin through the **Plugins** menu in WordPress.
3. Navigate to **Bluvia - A/B Testing & CRO Tool** in the admin sidebar to create your first experiment.

= Minimum Requirements =

* WordPress 6.0 or higher
* PHP 8.1 or higher

== Frequently Asked Questions ==

= Does this plugin send my data to an external server? =

Your experiment data always stays in your own WordPress database — variants, views, conversions, and results are never transmitted to Bluvia or any third-party service. The plugin makes one external request unrelated to that data:

* **Deactivation feedback.** If you submit the "Quick Feedback" form shown when deactivating the plugin, that feedback is sent to Bluvia.

Country targeting is provided by the Bluvia Premium add-on, which sends the visitor's IP address to Bluvia to resolve their country. See "External Services" below for the exact endpoints and the full list of what is sent and when.

= Is there a limit on how many experiments I can run? =

You can create, run, and archive as many experiments as you need, including running any number of tests simultaneously. There is also no limit on visitor traffic or page views.

= Does it work with page builders like Elementor? =

Yes. When editing Page, Post, or Custom Post Type variants, the visual variant editor supports content built with Elementor and the native WordPress block editor (Gutenberg). More broadly, the plugin works with standard WordPress themes and popular page builders.

= Does the plugin help with privacy and cookie consent? =

Yes. The plugin is designed with privacy in mind: all experiment data stays on your server, and you can configure it to only activate after a visitor accepts your cookie consent banner, by specifying the name of the consent cookie in the plugin settings. Until that cookie is present, the plugin sets no cookies, records no views or conversions, and does not let the premium add-on look up the visitor's country.

= What cookies does the plugin set? =

* `bluvia_experiment_{id}` — experiment assignment
* `bluvia_experiment_variant_{id}` — variant assignment
* `bluvia_view_registered_{id}` — guard against double-counting a view
* `bluvia_last_page` — last visited page (1-hour session cookie)
* `bluvia_goal_completed_{experiment_id}` — goal completion flag
* `bluvia_user_converted` — overall conversion flag
* `bluvia_traffic_source` — traffic source classification
* `bluvia_visitor` — new vs. returning visitor flag

= Can I export my results? =

Yes. Results can be exported to PDF from the experiment results page.

== Screenshots ==

1. Dashboard — Monitor active experiments and key performance metrics.
2. Create Experiment — Select an experiment type and configure your test.
3. Variant Editor — Create and manage experiment variants.
4. Results & Insights — Analyze conversion rates, confidence levels, and recommendations.

== Changelog ==

= 1.1.2 =
* Editor save, launch and variant requests, and conversion tracking requests, now verify their security nonce wherever they read submitted data.
* Test Library links to stop, delete, duplicate, archive or restore a test now check their security nonce before anything else.
* Headline preview overrides are only read from the URL after preview access has been confirmed.
* Admin screens, including the new-test screen and the Results page scheduling notice, are now identified from WordPress's own values instead of re-reading the URL, and unused code that hid the admin bar and menu on screens opened with `iframe=1` has been removed.
* Country targeting and geographic exclusions are now part of Bluvia Premium (add-on 0.8.2 or later), free with a registered Bluvia account. The plugin no longer sends visitor IP addresses to the Bluvia geolocation service.
* The Geo-Targeting and Geographic Regions controls now come from the add-on. Without it, the test editor says a saved geo rule is inactive and keeps it, and tests skip those rules instead of excluding every visitor.

= 1.1.1 =
* CSS and JavaScript variant code is now sanitized on every save path, including when a variant is duplicated.
* Button variant links are sanitized on every save path, and button colours and corner radius accept only valid CSS values.
* Test actions now follow per-post permissions: managing another user's test requires permission to edit others' posts, a test can only target content you can edit, and menu tests require permission to edit theme menus.
* A launched test can no longer be saved with a different test type.
* Excluded IPs: wildcard rules such as 192.168.* now work, IPv6 or malformed ranges no longer exclude every IPv6 visitor, and invalid entries are removed when settings are saved.
* URL tests now match percent-encoded (non-English) permalinks.
* The editor's page search only lists public post types.
* Conversion goals, traffic allocation and exclusion rules are checked against their allowed values when a test is saved, and test notes keep their line breaks.
* Visitor cookies, insight dismissals, share links, inline variant autosave and deactivation feedback now validate their input more strictly.
* Tooltips are shown as plain text.
* Fixed restoring or permanently deleting a test showing a blank page when the browser sent no referrer.
* Fixed CSV and PDF exports ending with an extra line of JSON.
* Fixed error messages showing encoded characters instead of apostrophes.

= 1.1.0 =
* Editor save and launch requests now sanitize array keys as well as values, and add-on hooks receive sanitized data instead of the raw request.
* Removed two unused admin AJAX endpoints, including the one behind the opt-in "Critical Error Reporting" service. The "Logging" setting now only writes a local log file; no error reports are sent to Bluvia.
* Conversions are now queued and counted with views, so simultaneous conversions no longer overwrite each other and conversion rates stay in step with views.
* Menu tests only swap and count the menu being tested, and record a view only on pages where that menu actually renders.
* Headline tests now apply and count on search results, and Preview Test and share links show unsaved headline edits.
* URL redirect tests can now be previewed per variant; Preview stays disabled until a variant has a URL or a menu variant has been created.
* Previews keep working when the site front end is served from another host.
* A bare ?preview=1 link no longer excludes anonymous visitors from running tests.
* Real browsers such as DuckDuckGo and in-app webviews are no longer mistaken for bots, and more crawlers and site-speed tools are excluded.
* Session, bounce, exit, engagement and scroll events are now recorded only for visitors who are counted in the test.
* Visitors whose variant cookie could not be set now see the original content and are not counted, instead of switching variants on the next page.
* All visitor cookies are now HttpOnly, SameSite=Lax, and Secure on HTTPS.
* Share links and share previews now require permission to edit the experiment and the content they preview.

= 1.0.9 =
* PDF exports load their stylesheet through DomPDF instead of an embedded <style> block.
* Dashboard metrics are aggregated in one query scoped to experiments and refreshed hourly instead of every two minutes.
* The optional debug log now uses an unguessable file name; the old debug.log is removed.
* Hardened input sanitization for add-on launch validation and decoded JSON, and add-on settings output is now filtered through wp_kses().
* Deleting A/B Testing no longer removes other Bluvia plugins' license data. Uninstall now deletes only this plugin's own temporary data, so your other Bluvia plugins stay licensed.
* Deleting A/B Testing keeps your site serial while the premium add-on is still installed, so premium stays linked to your Bluvia account if you reinstall.

= 1.0.8 =
* Requires the premium add-on 0.7.0 or later. Older premium versions stay inactive and show an update notice until updated.
* Uninstall now deletes only the premium add-on data folders it registers, and ignores any folder name that could point outside the uploads directory.

= 1.0.6 =
* Admin styles and scripts now load only on Bluvia screens and no longer restyle the WordPress dashboard.

= 1.0.5 =
* "Powered by Bluvia" no longer appears in outgoing emails unless explicitly enabled under Settings > Email Branding.

= 1.0.4 =
* Added a per-install site serial so a premium licence can be linked without pasting a key.
* Test actions on the Test Library now stay available when the premium add-on is deactivated, and a newly created test keeps its Edit, Duplicate and Archive actions before a type is chosen.
* Fixed headline tests not applying the variant excerpt on themes and blocks that read the stored excerpt directly.
* Notification email addresses are validated more strictly when saved.
* Fixed the Go Premium link doubling its origin.
* Fixed refreshing an Elementor variant deleting the featured image.
* Fixed loss of multi-value custom fields when copying a winning variant onto the original.
* Fixed pageview conversion tracking.
* Standardised button spacing and simplified the upgrade badge.

= 1.0.3 =
* Stopped adding a composite index to the WordPress postmeta table. Experiment filters use the dedicated experiment post type, which stays small per site. Sites that received the index on an earlier activation have it removed automatically.
* Removed the remaining references to premium-only experiment types from the free plugin.
* Experiment types are now offered based on what is installed, rather than on licence state.
* Moved the last inline styles and scripts into the WordPress asset queues.
* Fixed PDF export being offered for experiment types that have no variants to report on.
* Hardened the analytics tracking endpoints against inflated counters.
* Element selection no longer attempts to preview pages from other sites.

= 1.0.2 =
* Renamed the plugin to Bluvia - A/B Testing & CRO Tool and updated the text domain to bluvia-ab-testing-cro-tool.
* Removed the limit on simultaneously running experiments on the free plan.
* Moved custom CSS and JavaScript experiments to the premium add-on.
* Removed the scheduling engine from the free plugin.
* Reduced upgrade prompts to the menu item and the Go Premium page.
* External preview URLs now open in a new tab instead of an admin iframe.
* The release package now ships readable JavaScript and Sass source alongside the compiled build.
* Fixed corrupted Spanish translations.
* Fixed exclusion rule inputs showing before their checkbox is checked, the Test Library URL Redirect icon, and several variant reset and winner-selection issues.

= 1.0.1 =
* Fixed menu experiments not showing the assigned variant on sites with full-page caching.
* Fixed geolocation exclusion rules not being applied.
* Fixed headline experiment rendering, conversion goal view, and tracking.
* Fixed variant preview and rendering for button CTA experiments.
* Fixed a stray old text domain in the button CTA preview strings.
* Addressed Plugin Check findings for output escaping and uninstall query arguments.

= 1.0.0 =
* Initial public release of Bluvia - A/B Testing & CRO Tool.
* Added A/B testing for pages, posts, custom post types, and headlines.
* Added conversion tracking and experiment management features.
* Added support for creating and managing experiments from the WordPress dashboard.

= 0.6.9 =
* Fix: a PHP 8.1+ deprecation notice on the Edit Test screen (hidden admin page with no menu parent, so WordPress couldn't resolve its title).
* Fix: Custom CSS/JavaScript experiment previews now open the experiment's configured target page (when one is set) instead of always the site homepage.
* Fix: translated strings containing `/`, `&`, or other special characters (e.g. dates) no longer render as escaped HTML entities.
* Added the `bluvia_after_dashboard_insights` hook so add-ons can render additional Dashboard sections after Insights.

= 0.6.3 =
* Improvement: dev-mode premium feature override is now opt-in only — add `define('BLUVIA_DEV_MODE', true)` to wp-config.php to enable. Previously, sites with `WP_ENVIRONMENT_TYPE=local` had premium features activated automatically; this auto-detection has been removed to prevent unintended activation on staging environments that mirror production.

= 0.6.1 =
* Fix: resolve script enqueue conflict on certain admin pages
* Fix: correct license type detection

= 0.6.0 =
* Feature: automated insights engine with 5 rule-based insight types
* Improvement: GDPR consent cookie integration
* Improvement: PDF export for experiment results

= 0.5.0 =
* Initial public release
* Core experiment types: Headline, Page, Post, URL Redirect, Menu
* Audience segmentation: device, geo, traffic source, new vs. returning
* Statistical confidence level calculation

== External Services ==

= i18next and i18next-http-backend =
Purpose: Load translated UI strings for the admin interface.
Source: admin/assets/scripts/vendor/i18next.min.js, admin/assets/scripts/vendor/i18nextHttpBackend.min.js
License: MIT — https://github.com/i18next/i18next/blob/master/LICENSE

= Deactivation Feedback (free plugin) =
Purpose: The Plugins screen shows a "Quick Feedback" form when you deactivate the plugin. If you select a reason and/or type details and submit that form, the feedback — along with your site URL, WordPress version, PHP version, and plugin version — is sent to Bluvia so we can improve the plugin. Clicking "Skip" or closing the form deactivates the plugin without sending anything.
Endpoint: https://bluvia.io/wp-json/api/v1/critical-error
Server: https://bluvia.io
Privacy policy: https://bluvia.io/privacy-policy/
Terms of Service: https://bluvia.io/terms/

= Geolocation Lookup (premium add-on only) =
The free plugin does not contact this service. Country targeting and geographic exclusions are provided by the Bluvia - A/B Testing & CRO Tool premium add-on, which uses it to determine a visitor's country so experiments that use country targeting can decide whether that visitor should see the test. This runs on the front end.
Data sent: The visitor's IP address, as a query parameter, and nothing else. No cookies, page URLs, or experiment data are transmitted, and Bluvia does not receive your site URL with this request.
When it runs: Only when a running experiment targets a specific country (or uses a geographic exclusion rule) AND the visitor has passed your consent gate. If you have set a consent cookie name under **Settings > GDPR Cookie**, no request is made until that cookie is present. Experiments left at the default "Worldwide" targeting never trigger this request. The resolved country is cached in a cookie for 24 hours so repeat page views do not re-query.
Endpoint: https://bluvia.io/wp-json/api/v1/geoip
Server: https://bluvia.io
Privacy policy: https://bluvia.io/privacy-policy/
Terms of Service: https://bluvia.io/terms/

= Bluvia License Server (premium add-on only) =
The free plugin never performs license validation and sends no license key anywhere. If the Bluvia - A/B Testing & CRO Tool premium add-on is separately installed and activated, it communicates with the Bluvia license server to verify your subscription status. That request transmits your site URL, your license key, and your WordPress version.
Server: https://bluvia.io
Purpose: License key validation and premium feature access control.
Privacy policy: https://bluvia.io/privacy-policy/
Terms of Service: https://bluvia.io/terms/

== Third-Party Libraries & Build Process ==

This plugin's own JavaScript is authored as plain, readable source under `admin/assets/scripts/` and `public/js/`, and its own styles are authored as Sass under `admin/assets/css/`. The release package ships each source file alongside its compiled build, side by side — `tour-manager.js` next to `tour-manager.min.js`, and `tour.scss` next to `tour.min.css` — so human-readable source for every compiled first-party asset is included directly in the package. Only the compiled copy is loaded at runtime.

`gulpfile.mjs` and `package.json` are included in the package as well, so the whole build can be reproduced from the ZIP alone.

The plugin also bundles the following third-party JavaScript/CSS libraries, unmodified from their official releases:

* Select2 4.1.0 — https://github.com/select2/select2 — MIT
* Chart.js 4.5.1 — https://www.chartjs.org — MIT
* chartjs-plugin-datalabels 2.2.0 — https://github.com/chartjs/chartjs-plugin-datalabels — MIT
* chartjs-chart-funnel 4.2.0 — https://github.com/sgratzl/chartjs-chart-funnel — MIT
* driver.js 1.8.0 — https://github.com/kamranahmedse/driver.js — MIT
* Tippy.js 6.3.7 — https://github.com/atomiks/tippyjs — MIT
* Popper.js 2.11.8 — https://github.com/floating-ui/floating-ui — MIT
* jQuery UI 1.14.1 (base theme) — https://jqueryui.com — MIT
* i18next and i18next-http-backend — https://github.com/i18next/i18next — MIT

= Build Process =

To build the plugin from source:

* Requires Node.js 18+ (developed and tested on Node 22) and npm
* `npm install` — install build dependencies
* `npm run dev` — watch and compile Sass to CSS for local development (JS is served unminified directly; no build step needed while developing)
* `npm run build` — compiles CSS and packages a ZIP containing both the readable JS source and its minified build
* `npm run build:release` — full release build used for the WordPress.org submission package: installs production-only Composer dependencies, compiles CSS, and packages the final ZIP

Build tooling: Gulp, Sass (via gulp-dart-sass), Terser (JS minification), and gulp-zip. See `gulpfile.mjs` in the plugin source for the exact build tasks.

== Upgrade Notice ==

= 1.0.3 =
Initial release on WordPress.org. No database changes.

= 0.6.1 =
Maintenance release. No database changes. Safe to upgrade immediately.
