GT Link Manager

• New Help links. A circled ? next to screens and settings opens the matching documentation page in a new tab.
• New Novashare short links. Turn it on under GT Links > Integrations > Social sharing, choose Custom as the link shortener in Novashare, and shared posts use your branded links with no code. Each shared URL gets one link in a Novashare category.
• New gtlm_novashare_should_shorten filter to decide which shared URLs become branded links.
• New Analytics integrations under GT Links > Integrations. Send short link clicks to Google Analytics 4, Plausible (beta), Matomo, Umami, Simple Analytics, PostHog, Mixpanel, Amplitude, Rybbit, and Clicky from your server, or to Independent Analytics, Koko Analytics, WP Statistics, Burst Statistics, SlimStat, Statify, and Matomo for WordPress on your own site, with no code. Everything is off by default.
• New Browser tag support for Google Tag Manager, Fathom Analytics, and Microsoft Clarity, which have no server-side API. GA4 can use this route too if you'd rather not create an API secret.
• New Settings detection for MonsterInsights, ExactMetrics, Analytify, Site Kit, GA Google Analytics, Plausible Analytics, Connect Matomo, Clicky, and GTM4WP. Leave a field blank to use what they already hold.
• New A setting for sharing visitor IP addresses and countries with analytics services, off by default. The suggested privacy policy text updates to name the tools you've turned on and what they receive.
• New Six developer hooks for integrations, including gtlm_integrations_should_send for visitor consent.
• Improved On LiteSpeed servers the redirect now reaches the visitor before click counting starts, as it already did on PHP-FPM.
• Fixed REST link lists returned an empty link_mode for every link, and PHP logged an undefined variable warning. This started in 1.11.0.
• Changed Only administrators can now create, change, trash, restore, toggle or copy direct and regex links, or permanently delete any link. This covers the dashboard, REST API, CSV import and AI agents. Contributors, Authors and Editors keep standard links and can still move them to the Trash. The new gtlm_restricted_capability filter hands this to another role.
• Fixed Links with non-Latin slugs and direct paths with encoded characters now resolve.
• Fixed A direct path entered with slashes, such as /old-page/, now matches. Links with a custom port, an underscore or an international domain in the destination no longer return a 404.
• Fixed Bulk copy and CSV auto-suffix no longer rewrite direct paths as slugs. A regex rule can't take a suffix, so it's now counted as failed or skipped instead of being corrupted.
• Fixed Regex patterns and replacements keep <, > and %xx when saved, and $10 in a replacement no longer reads as $1 followed by 0.
• Fixed Editing a direct or regex link on a site with an object cache now clears its cached copy.
• Fixed Turning off geolocation on a link now pauses its rules instead of deleting them.
• Fixed A partial REST update to a category no longer clears the fields it left out, and a REST update can no longer blank a link's slug.
• Fixed Restoring or toggling a link through REST returns the same shape as every other link response, and a 404 for a missing link.
• Fixed The privacy text on the link editor and Settings screens now says so when this site shares visitor data with an analytics service.
• Fixed The editor's link inserter only offers active links with a usable address, and inserts the link name when no text is selected.
• Fixed Bulk Set category with nothing chosen no longer clears categories. A new No category option does that on purpose.
• Fixed Category counts no longer include trashed links. Stored counts are corrected on upgrade.
• Fixed Trash retention uses site time, so links aren't purged hours early on sites west of UTC.
• Fixed The rewrite rule is removed on deactivation, staged CSV files are deleted on uninstall, and a visitor can no longer cancel the geo self-test.
• Fixed Smaller issues with copy buttons on plain HTTP admin screens, referrers containing quotes, the rel filter on older rows, the Diagnostics sample link, the geo preview, and validation errors while editing a link.
• Fixed The analytics Campaigns tab and CSV export show a campaign's UTM values instead of a bare number, including campaigns you've since removed. In the CSV, the value column of campaign rows changes to match.
• Fixed The analytics REST enable and resume routes accept consent=true, as documented. Other values, such as yes, are still refused.
• Updated translation template.

• New Prefix-free links. Turn it on under Settings > Advanced redirects and data cleanup to serve every standard link from the site root, as yoursite.com/your-slug. Links already shared with the prefix keep redirecting, so nothing published breaks. The settings screen lists links that share a URL with a published page or post, and saving a link that takes over a post or page URL shows a warning.
• New a Random slug button next to the Slug field. It fills in a six-character slug without look-alike characters such as 0 and o. Slugs still follow the Link Name until you type or generate one, and clearing the field hands it back to the name.
• Improved the Site Agent note in Settings links to the Site Agent page.
• Updated translation template.

• New AI agent support through Site Agent, a free plugin that connects agents such as Claude, ChatGPT and Cursor to your site. With Site Agent 0.4 or later, a connected agent gets the GT Link Manager skill automatically: it can find, create and update links, set country rules, organize categories and read analytics, using the same checks as the REST API.
• New gtlm_agent() for integrations. It returns every link with the branded short link as url and the destination as target_url, the same shape as link lists. Permanent deletion and analytics changes stay in the dashboard.
• New an AI agents page in the GT Links menu shows what a connected agent can do and how to connect one.
• Improved settings are grouped into cards.

• Fixed after an automatic update from 1.7 or earlier, every short link could return 404 until someone opened the dashboard. Database updates now run on the first request after an update.
• Fixed Quick Edit could rewrite a regex pattern or direct path as if it were a slug. Changing only the destination of ^old/(.*)$ saved the pattern as old, which then matched every URL containing "old". Renaming a link also changed its slug, and saving with Advanced redirects off turned direct and regex links into standard ones. Existing links now keep their slug, path or pattern.
• Fixed with a persistent object cache, one failed database lookup could keep a short link returning 404 until it was edited.
• Privacy: analytics keeps minute-level detail only as long as individual click records (seven days by default), then reduces each day to daily totals, existing data included. Country-rule outcomes are recorded only when countries are on, and empty or scripted user agents are no longer counted.
• Fixed analytics stopped collecting at 100 MB and blamed stale reports. Collection no longer stops for size; past a storage warning level you set, Delete old data removes old days and frees the space. CSV export now works on long ranges and exports daily totals; its time column is now date.
• New Top links shows each link's destination URL.
• Improved the links list works on phones, rows are shorter, and the admin has clearer icons, status notices and an Edit Link title.

• Add opt-in Advanced Analytics with WordPress-time trends, referring-page and link reports, instant breakdown tabs, and CSV exports.
• Keep analytics lightweight with no visitor scripts, cookies or beacons, bounded background processing, and configurable retention including Forever reports.
• Simplify settings, improve accessibility and diagnostics, and add a copyable AI setup prompt.
• Fix direct/regex REST paths, CSV roundtrips, redirect matching, and click-counter metadata.
• Harden protected WordPress routes, CSV upload storage, and spreadsheet exports.

= 1.8.0 = = 1.8.1 = Adds a hover-and-click copy button to the Branded URL column and the plugin's own icon in the admin menu, plus an expanded readme and FAQ. No database changes.

• What's Changed
• New a copy button on the Branded URL column. It appears when you hover the row or focus it with the keyboard, copies the full branded link, and confirms with an inline Copied badge that clears itself.
• New the plugin's own icon now appears in the admin menu, replacing the generic WordPress link dashicon. It is painted as a mask filled with the menu's own text colour, so it matches the icons beside it in every state and every admin colour scheme, staying light on dark sidebars and dark on light ones.
• Updated refreshed the WordPress.org plugin icon.
• Commits
• Release 1.8.1: copy button, brand menu icon, expanded readme (ead0ff0)

= 1.7.1 = = 1.8.0 = Tested with WordPress 7.1. Fixes a soft 404 that made every dead, trashed, or deactivated short link return the site's front page at HTTP 200, and fixes space-separated rel values being silently dropped. Adds optional click counting (off by default), Undo for trash and status changes, optional automatic Trash cleanup (off for existing sites, so nothing in your Trash is deleted by updating), and an accessibility and native-UI pass on the admin screens. Adds one column to the links table on upgrade; existing links are untouched.

• What's Changed
• Fixed the links table collapsed narrow columns when many were shown at once. With every column visible, Mode and Clicks were squeezed to a few pixels and their values wrapped one character per line. Every column now has a minimum width, the wide ones wrap instead of being clipped, and the table scrolls sideways on its own rather than stretching the admin page.
• New Optional click counting, off by default. Turn it on under Settings and each link gets a running total of how many times it has been followed, shown as a sortable Clicks column and included in CSV export. It stores one number per link and nothing else -- no IP address, user agent, referrer, or timestamp -- and the count is written after the redirect has already been sent, so the redirect itself is not slowed down. The plugin's suggested privacy-policy text updates itself to match whichever setting you choose. Use gtlm_count_click to skip clicks you do not want counted.
• Fixed a deleted, trashed, or deactivated short link returned HTTP 200 with the site's front page instead of a 404. The prefix rewrite rule matches the whole namespace, so an unresolved slug fell through to the home page, and search engines could index every dead link as duplicate front-page content. Unresolved prefixed links now return a real 404 rendered by the theme's own template. Direct and regex mode still fall through untouched, and the gtlm_404_on_missing_link filter restores the old behaviour.
• Fixed rel values separated by spaces were silently discarded. The plugin writes space-separated rel into Link headers and core Button blocks, but only accepted commas on input, so round-tripping a value emptied it. Commas, spaces, and arrays are all accepted now, and the allowed-token validation is unchanged.
• Fixed the Active, Inactive, and Trash views were implemented but never rendered, leaving them reachable only by typing the URL by hand. They now appear above the links table.
• Fixed bulk actions ran while the page rendered, which gave no confirmation message and re-ran the action on a browser refresh. They now run before output and redirect to a clean URL with a result message.
• New Undo. Trashing, restoring, activating, and deactivating a link now offer a one-click Undo in the success notice, for single links and bulk selections alike.
• New Trash retention. Links left in the Trash can be permanently deleted after a configurable number of days, set under Settings. New installs start at 30 days. Existing sites are left at 0 (keep forever) on upgrade, so nothing already sitting in your Trash is deleted because you updated; switch it on yourself when you want it.
• New Empty Trash button on the Trash view.
• Improved the admin screens now inherit the WordPress admin surface instead of painting over it. Custom admin colour schemes, high-contrast mode, and reduced-motion preferences are all respected.
• Improved accessibility. Row checkboxes and every filter dropdown have proper labels, keyboard focus is visible, and the notice area sits where WordPress expects it.
• Improved long URLs no longer break across three lines in the links table. The Branded URL column shows the readable path, with the full URL on hover and in the Copy URL action.
• Improved a fresh install now records its schema version during activation instead of re-running the migration on the first admin page load.
• Compatibility Tested against WordPress 7.1. Verified on a WordPress 7.1 and PHP 8.4 install: redirects, geolocation targeting, the REST API, CSV import and export, the links list table, and both block editor inserters all behave as before, with no deprecation notices raised.
• Compatibility Confirmed the GT Link format and the core Button control still work inside the iframed block editor canvas, including search, insertion, and rel handling.
• Commits
• Release 1.8.0: WordPress 7.1 support, redirect fixes, trash undo, click counting (b120a8c)

= 1.7.0 = = 1.7.1 = Fixes the GT Link inserter for the core Button block while preserving the Button block's native link settings.

• What's Changed
• Fixed The GT Link toolbar now works with the core Button block by updating the Button's native URL and rel attributes.
• Improved Rich text and Button controls now share the same GT Link search popover, normalize rel attributes, and preserve noopener for buttons that open in a new tab.
• Commits
• Fix Core Button link inserter (f9bbe5a)

= 1.6.1 = = 1.7.0 = Adds geolocation targeting: route each link by visitor country using the header your CDN already sends — no GeoIP database, no external API, no added latency. Two columns are added to the links table automatically on upgrade; existing links are untouched and keep redirecting exactly as before. Enable it under GT Links → Settings → Geolocation Targeting.

• What's Changed
• New Geolocation targeting. Any link can route visitors to a different destination based on their country, with rules evaluated in order and the first country match winning.
• New Country detection with zero dependencies. The country is read from request variables your CDN or web server already provides — Cloudflare (CF-IPCountry), CloudFront, Vercel, Google App Engine, nginx GeoIP2, Apache mod_geoip, mod_maxminddb, or a custom header you name. No GeoIP database file, no third-party API, no outbound request.
• New EU country group expands to all 27 member states in a single rule; extendable via gtlm_geo_country_groups.
• New Per-rule status codes, and a "show a 404" fallback for visitors matching no rule.
• New Geolocation settings section with a live "Detected Now" readout showing which country and source resolved for the current request — the fastest way to confirm your CDN is forwarding a country header.
• New "Check Detection" button. Lists every country header present on the request with its raw value, and runs a loopback self-test — it sends the site a request carrying a country header and reports what the plugin detected at the other end. That proves detection works even on a local or staging install with no CDN in front, where "no country on this request" is correct rather than a fault. Also validates a country code you type before you use it in a rule.
• New The detection readout distinguishes "nothing is proxying this site, so no country is expected" from "your CDN is in front but sent no country header" — only the second is a misconfiguration, and it now says how to fix it.
• New Rule builder in the link editor. Numbered rows show match precedence, rules can be reordered, one-click picks cover common markets (US + CA, EU, UK, India, AU + NZ), the long country list is filterable, selections show as removable chips, and the "Everyone else" fallback reads as the final row. It warns when a country is listed twice (only the highest rule can ever match) or when a rule has countries but no URL.
• New Rule preview. Pick a country and see exactly which rule wins and where it sends — evaluated in the browser against your unsaved edits, with no request made.
• New Privacy disclosure. The plugin registers a suggested privacy-policy section under Settings → Privacy → Policy Guide, and states inline that country detection reads only a CDN-provided header — never the visitor's IP address, never an external service, and the country is never stored or logged.
• Fixed a partial REST update (PATCH) of one field silently reset every field that was not included, because each write argument declared a schema default that WP_REST_Request materialises into the request. Sending only geo_rules would reset redirect_type to 301 — which quietly breaks geo targeting — and blank tags, notes, and rel. Omitted fields now keep their stored values. Create defaults are unchanged.
• New Optional X-GTLM-Country debug response header showing the detected country, its source, and whether a rule matched.
• New Geo rules are exposed in the REST API on /links (create, read, update) with a self-describing schema, so links can be geo-targeted programmatically. Posting geo_rules without geo_mode opts the link in automatically.
• New Geo rules round-trip through CSV import and export; a malformed rules cell is dropped without failing the row.
• New Geo column in the links list table, and geolocation status in Diagnostics.
• Performance geolocation costs nothing on links that do not use it — the check is a single array read, and country detection is never invoked unless a matched link opts in. Detection and settings are resolved once per request.
• Note: geo-targeted links should use 302, not 301. A 301 is cached by the browser permanently, which pins a visitor to whichever country they were in on their first click. The link editor warns when a geo link is set to 301.
• Note: a country header can be forged on requests that reach your site without passing through your CDN, so the 404 fallback is not a security control. Behind Cloudflare, CF-IPCountry is rewritten at the edge and cannot be spoofed; the "Cloudflare only" detection method is the strictest setting.
• Commits
• Deploy the bare version to WordPress.org, not the tag name (03e7b9f)
• Add geolocation targeting, bump to 1.7.0 (d45326c)
• Add Playground blueprint for wp.org Live Preview (6ea77f0)

= 1.6.0 = = 1.6.1 = Fixes nonce mismatch bug affecting trash/restore/delete actions, hardens regex pattern validation, adds REST API descriptions and category caching.

• What's Changed
• Fixed nonce mismatch bug — trash, restore, and permanent delete actions were failing due to inconsistent nonce prefixes.
• Fixed potential ReDoS vulnerability — removed error suppression on regex pattern matching, added pattern length validation.
• Standardized all nonce prefixes to gtlm_ across admin actions and list table.
• Added REST API route descriptions to all endpoints for better discoverability.
• Added object caching for admin category dropdown with proper invalidation on create, update, and delete.
• Updated readme with free training course, developer reference, REST API guide, and new FAQ entries.
• Commits
• Add 1.6.1 changelog and upgrade notice to readme (fc0c2af)
• 1.6.1 (c6e0f85)

= 1.5.3 = = 1.6.0 = Adds direct (prefix-free) and regex (pattern-based) redirect modes. Enable in Settings > Advanced Redirects. Fully backwards compatible.

• What's Changed
• Added advanced redirects: Direct (prefix-free) and Regex (pattern-based) link modes.
• Direct links redirect without the prefix — e.g., yoursite.com/my-page instead of yoursite.com/go/my-page.
• Regex links match request paths against patterns with capture group substitution in destination URLs.
• New "Enable Advanced Redirects" toggle in Settings (off by default) to opt in.
• Link edit form shows mode selector (Standard / Direct / Regex) with contextual fields.
• Conflict detection warns when direct link paths match existing WordPress posts or pages.
• Regex patterns are validated on save; invalid patterns are rejected.
• List table shows link mode with filter support.
• REST API accepts and returns link_mode, regex_replacement, and priority fields.
• New database columns: link_mode, regex_replacement, priority — fully backwards compatible.
• Commits
• Add advanced redirects: direct (prefix-free) and regex link modes, bump to 1.6.0 (fc691d9)

• What's Changed
• Fixed plugin zip size bloat — excluded .wordpress-org assets directory from distribution package.
• Commits
• Exclude .wordpress-org from dist zip, bump to 1.5.3 (9d8135b)

= 1.5.1 = = 1.5.2 = Data is now preserved on uninstall by default. Enable "Delete Data on Uninstall" in Settings to remove all data.

• What's Changed
• Added "Delete Data on Uninstall" setting — data is now preserved by default when the plugin is deleted.
• Uninstall only removes tables and options if the user explicitly opts in via Settings.
• Commits
• Add opt-in data deletion on uninstall, bump to 1.5.2 (87f9b60)
• added screenshots (6df05b4)

• Initial Release: First release of GT Link Manager v1.5.1.

• Renamed internal code prefix from gt_ to gtlm_ (4+ characters) per WordPress.org guidelines.
• Fixed nonce verification order in CSV import handler — nonce is now checked before reading POST data.
• Fixed SQL injection vector — $orderby now uses %i identifier placeholder in prepared queries.
• Added Source Code section to readme for compiled block editor assets.
• Added card-based UI styling to all admin pages (edit link, categories, settings, import/export).
• Settings page reorganized into General, Tools, and Diagnostics cards.
• Clean uninstall now removes both old (gt_) and new (gtlm_) prefix options and tables.

• Block editor: aligned GT Link popover anchoring with core rich text behavior using selection-based anchor.

• Refactored admin into separate actions and rendering classes for maintainability.
• Added Pretty Links CSV import preset alongside Generic and LinkCentral.
• Improved input sanitization on redirect URI parsing.
• Added PHPCS configuration and Composer dev tooling.
• Added uninstall.php for clean plugin removal (drops tables and options).
• Improved build.sh with .distignore support and critical file verification.
• Improved release workflow with version verification, checksums, and distribution validation.
• Block editor popover anchor now uses bounding rect snapshot for reliable positioning.
• Button primary color now follows WordPress admin theme color.
• Lowered PHP requirement from 8.2 to 8.0.
• Tested up to WordPress 6.9.

• Fixed release packaging bug that accidentally removed blocks/link-inserter/build/* from zip assets.
• GitHub release workflow now compiles block editor assets before zipping and verifies build files exist.

• Fixed block editor link inserter not appearing on WordPress 6.8+.
• Removed deprecated useAnchor hook that crashed the toolbar button on render.
• Eliminated react-jsx-runtime dependency that prevented the script from loading on some WordPress versions.
• Popover now anchors to the toolbar button for reliable positioning.

• Fixed critical bug: links disappeared after 1.1.9 update because new DB columns were not added on plugin update (only on fresh activation).
• Added automatic DB migration that runs on update to add missing columns and backfill existing rows.
• Fixed WordPress admin sidebar menu getting unintended card styles on the Settings page.
• Improved Settings page: Flush Permalinks and Run Diagnostics buttons are now inline, diagnostics output uses a clean table layout with status badges.

• Added link activate/deactivate toggle. Inactive links stop redirecting but remain in the database.
• Delete now moves links to trash instead of permanent deletion. Links can be restored from trash.
• Trash view with restore and permanent delete actions.
• New bulk actions: Activate, Deactivate, Move to Trash, Restore, Delete Permanently.
• REST API: DELETE defaults to trash (use ?force=true for permanent). New /restore and /toggle-active endpoints.
• Status column and views (All / Active / Inactive / Trash) in the links list table.
• New is_active and trashed_at columns added to the links table on upgrade.

• Maintenance release.

• Block editor: Fixed editor scroll jump when opening GT Link popover from the toolbar.
• Block editor: Improved search input focus behavior so opening popover does not move viewport.

• REST API: Added full pagination (page, per_page, category_id, orderby, order) to GET /links endpoint.
• REST API: Added args schema validation to all write endpoints (links, categories, bulk-category).
• Security Replaced innerHTML with DOM methods in admin quick edit to prevent XSS.
• DB: Added rel whitelist validation on filter queries.
• Build: build.sh now compiles block editor assets before packaging.

• Maintenance release.

• Anchor popover to selected text using useAnchor from @wordpress/rich-text.

• Fixed format registration conflict with core/underline on WP 6.9+ (both used bare span tag).
• Added unique className to avoid tagName collision.

• Switch to RichTextToolbarButton for standard format toolbar integration.

• Force-inject format into RichText allowedFormats for reliable toolbar display.

• Rebuilt block editor link inserter with @wordpress/scripts build pipeline.
• Fixed toolbar button not appearing in block editor.
• Proper dependency resolution via index.asset.php.

• Fixed toolbar button registration in block editor for GT Link inserter.
• Added selected-text autofill in GT Link inserter search field.
• Improved redirect detection for WordPress installs in subdirectories.

• Enhance block editor integration with additional dependencies and improved format registration

• Minor internal hardening and cleanup.

• Fixed uninstall to preserve links and settings data across reinstalls.

• Initial release.