Release history
SlimStat ships from the WordPress plugin directory, where the current version is 6.0.0, released October 26, 2026. Browse the highlights below, newest first, including report improvements and security fixes.
Free 6.0.0 and Pro 3.0.0: what changed
Free 6.0.0 is in the WordPress directory and Pro 3.0.0 in your account downloads. Update Free first: Pro 3 does not load on Free older than 6.0.0, and the Pro updater holds the update back until Free is current.
New in Free 6
- Heatmaps page: every page visitors click on, with clicks, pageviews, device split and last click. Free reveals each page's five most-clicked links and buttons; Pro opens the visual viewer. Every click keeps the screen size it was recorded at.
- Channels and UTM Campaigns: AI assistants, AI crawlers and AI fetches told apart from search, social, email and paid traffic; the top two groups in each report, with up to five more named; a campaign-link builder in the report header. Historical pageviews stay unattributed.
- Opt-in WooCommerce dashboard: net sales, orders, comparisons, top products, acquisition and a consented purchase journey, synced in small background jobs. If setup cannot finish, the page says why and offers a retry.
- Shortcode Playground: browse, preview, filter, copy and test reports, with new live visitor, page and country counters. Personal fields and visitor reports require analytics access; public aggregate counters remain available.
- A real weekly email sample built from your last seven days, with a one-time send-to-yourself action.
- A cleaner admin: native controls, consistent wording, empty states that say what to do next, a rewritten Help panel, a Get started panel, the SlimStat menu above Appearance, "New" badges for 15 days and honest Pro previews with no blurred mock reports. After updating, a SlimStat 6 card on the Dashboard and Plugins screens says what is new.
What Pro 3 adds
- Visual click and scroll heatmaps in wp-admin on phone, tablet and desktop previews, with the most-clicked elements, dead-click, rage-click and scroll drop-off insights, goal/campaign/saved-filter segments and per-element CSV.
- A front-end overlay from the admin bar's Heatmap menu that places each click on the element it hit, filters by browser, operating system, country, language, channel or source, and loads only for people who can view reports. Pages the theme cannot preview fall back to it.
- Additional heatmap capture stays off on upgraded sites until an administrator starts it; a new site set up with Pro active starts with full capture. Choose its level, sampled share and pages. It follows consent, Do Not Track, retention and erasure and never stores typed input.
- Every channel and UTM campaign, with paging and links from each row to its Ecommerce sales; deeper Ecommerce reports for campaigns, landing pages, devices, guest and account buyers, coupons and refunds, with permission-protected CSV.
- Email reports rebuilt: pick reports by name, send Ecommerce summaries as HTML or CSV, a new Heatmap insights email, and Frequency: Off that really stops sending. Per-author mail shows each author's own numbers and never store revenue.
- Pro shortcodes for Funnels, Heatmap insights, User Overview and Pages by User. Without Pro, the Shortcode Playground previews them with sample data.
- Multisite Network View reads the right subsites and merges totals column by column; external databases use one connection per request with timeouts and no hostname leaks. Licenses and updates use the Nexus API with signed downloads.
Performance, corrected totals and security
Admin charts read half as many database rows: 152,227 instead of 304,454 on the weekly chart over a 150,000-row corpus. Tracking writes 62% fewer option updates per pageview and 96% fewer per blocked bot. These are measured operation counts, not page-speed guarantees.
Some totals change on purpose, to their true value: consent given through the WP Consent API updates the original pageview, anonymous same-page refreshes count once, overlapping funnel steps stop inflating, "Today" and "Yesterday" no longer read 0, and the weekly chart's previous-period total matches its bars. Sites that had "Enable CDN" on record again; the setting is removed because it loaded a tracker file that did not exist. Nothing in your database changes until you click on the new Migration screen, and required steps only add columns and indexes.
Free fixes a SQL injection any logged-in user could reach on sites with the optional Posts and Pages report column on; found in-house, with no report of it in the wild. Pro fixes a Multisite visitor-data disclosure affecting Pro 2.0.1 and earlier: network-wide reports now require the network-management capability plus an explicit, token-bound request.
Read the upgrade and migration guide, or the complete release notes in the Free and Pro readme files.
-
6.0.0
Heatmaps, WooCommerce revenue, campaign channels, and admin charts that read half as many rows.
- Heatmaps: a page list of every page visitors click on, with each page’s five most-clicked links and buttons. Pro adds visual click and scroll maps, dead- and rage-click insights and a front-end overlay from the admin bar.
- Channels and UTM Campaigns: AI assistants, AI crawlers and AI fetches are told apart from search, social, email and paid traffic, with a campaign-link builder in the report header. Free shows the top two groups per report; Pro lists every row.
- WooCommerce revenue dashboard, opt-in: net sales, orders, period comparisons, top products, acquisition and a consented purchase journey, synced in small background jobs and stored on your own server.
- Shortcode Playground: browse reports, preview them with your data, tune filters, then copy or test the shortcode. New live visitor, page and country counters.
- Faster: admin charts read half as many database rows (304,454 → 152,227 on the weekly chart over a 150,000-row corpus), and tracking writes 62% fewer option updates per pageview.
- Totals corrected on purpose: consent upgrades, anonymous refreshes and overlapping funnel steps no longer double count; "Today", "Yesterday" and "Currently Online" read correctly. The "Enable CDN" setting is gone, because it loaded a tracker file that did not exist; sites that had it on record again.
- A Migration screen lists the database steps and runs nothing until you click; required steps only add columns and indexes. Deleting the plugin keeps your analytics unless "Delete Data on Uninstall" is on.
- Security: fixed a SQL injection reachable by any logged-in user on sites with the optional "Posts and Pages" report column on. Found in-house; no report of it in the wild.
-
5.5.0
Goals and funnels, and a stored-XSS fix for Cloudflare geolocation.
- Goals: track a signup, a checkout or a key pageview, with unique visitors, total conversions and conversion rate, calculated back over the full visit history.
- Funnels: chain two to five steps and see where visitors drop out, with ready-made templates for WooCommerce checkout and signups. Funnels are a Pro feature; one goal is free.
- Security: a crafted CF-IPCountry header could be stored as a visitor country and run script when an administrator opened a report. Country codes are now validated to two letters before storage and escaped everywhere they render. Reported via WPScan.
- Google Discover and other android-app:// referrers are recorded again, instead of being dropped as "direct" since 5.4.0.
- The "is empty" and "is not empty" report filters work again, and survive pagination and date changes.
-
5.4.0
Real-time moved into the admin bar, and consent was rebuilt around external CMPs.
- Live site stats in the WordPress admin bar: online visitors, pageviews and top pages, with a per-minute chart for the last 30 minutes.
- Consent architecture rebuilt: SlimStat now integrates with Consent Management Platforms through the WP Consent API rather than running its own competing banner logic, with a GDPR Compliance Mode toggle.
- Salted-hash IP addresses with daily salt rotation, and conditional fingerprint storage that only collects when PII is allowed.
- Geolocation refactored across all three providers — DB-IP as the default, MaxMind with a free licence key, and Cloudflare headers.
- Default data retention set to 420 days, which is 14 months.
- Breaking for add-on developers: legacy internal REST and tracker APIs changed.
-
5.3.0
Redesigned charts, and a tracking method that survives ad blockers.
- Tracking Request Method setting: REST API, Admin-AJAX, or an Ad-Blocker Bypass transport for visits that would otherwise never reach the server.
- Line charts redesigned, with hourly, daily, weekly, monthly and yearly granularities and totals printed above the graph.
- Three more date ranges: last two weeks, previous month, this month.
- Compatibility with the WordPress Interactivity API.
-
5.2.11
A dashboard readable at a glance, and WordPress 6.8 support.
- Country flags and language tags in the access log, so a row identifies its visitor without being decoded.
- Every deprecated hook replaced for WordPress 6.8, multilingual sites included.
- Hardened input checks, leaner SQL on heavy reports, and flatter memory use during traffic spikes.
- Fixes: notes filters, email reports with unusual metadata, and the date picker freezing on same-day ranges.
-
5.2
MaxMind geolocation without a licence key.
- GeoIP data can be loaded from jsDelivr, so geolocation works without registering for a MaxMind licence.
- Fixed the reset-to-factory-settings bug.
- Fixed a deprecation warning by setting the referrer before parsing the URL.
- Vendor libraries autoloaded and cleaned up.
-
5.1
The first release after the VeronaLabs acquisition: a rebuilt interface, and the add-ons back as Pro.
- Interface redesigned, with a softer palette and a clearer report layout.
- The legacy add-ons returned, collected into a single product called SlimStat Pro. Anyone who had bought an individual add-on received Pro free for a year.
- PHP 8.2 compatibility, and IP anonymisation moved onto WordPress core’s own wp_privacy_anonymize_ip().
Reporting a security issue
Security reports go to the maintainers through the plugin's GitHub security page , and confirmed issues are named in the release that fixes them, as 6.0.0 does above.