The daily heartbeat sends its commerce plugin list only on sites actually running WooCommerce. It used to send it everywhere, including sites with no shop at all, where the warning it feeds could never apply. The External services section now describes exactly what the heartbeat carries.
The tracking path now forwards only its own attribution cookie to the collector. It used to forward the whole cookie header, which on a signed in session included the WordPress login cookie, and nothing on the receiving side ever used it. Attribution is unchanged: the one value it depends on still crosses exactly as before.
Cookies coming back from the collector are checked by name before they are set, because they are written under your own domain rather than ours.
Proxied responses always carry a nosniff header, so a mislabelled body cannot be treated as script running with your site’s authority.
1.5.3
The Form leads switch names Keap’s Opt-in Forms among what it controls. It always did control them, and the description listed the other seven, so turning it off did more than it said.
1.5.2
The Keap Opt-in Forms listener now verifies the request’s nonce before it reads anything, using the same check and the same action string that plugin’s own handler runs as its first statement. This plugin accepts exactly the set of requests Keap accepts and never one Keap would reject.
That listener is only registered when the Keap Opt-in Forms plugin is actually installed. On every other site the endpoint does not exist at all.
Leads from Keap opt-in forms carry the person’s name again. The payload sends the Keap application’s name ahead of the contact’s, and the older code took the first one it saw.
Formidable Forms submissions are read through Formidable’s own entry API instead of the raw request. No superglobal is touched, and the values arrive keyed by the field’s real name, so the name and phone number recorded alongside a Formidable capture are the submitted ones rather than blank.
1.5.1
A failed order send now retries once, two minutes later. The collector stores orders under one key per order, so a retry can never duplicate a sale.
Deactivating the plugin clears any pending retry.
1.5.0
Review round from the wordpress.org plugins team, applied in full. Every function, option, hook, and constant now carries the myvita prefix; live sites migrate their stored settings automatically and clean both prefixes on uninstall.
The Keap Opt-in Forms listener refuses crafted requests: it captures nothing unless the Keap plugin’s own handler is registered behind it, holds a burst cap so admin-ajax floods cannot pollute the capture log, and accepts only scalar form values.
The Update URI header is gone, per directory policy for hosted plugins.
1.4.0
Settings panel for what this plugin sends: visitor tracking, form leads, and WooCommerce order sync each get their own switch.
The daily heartbeat reports the store environment (WooCommerce version, currency, commerce extensions by name and version only) so the dashboard can warn when an extension changes what order data means.
1.3.2
The enqueued script carries the plugin version, so Plugin Check runs completely clean.
1.3.1
Plugin Check pass. The tracking script is enqueued through the script strategy API with async, superglobal reads are unslashed, and the form listener hooks document why another plugin’s nonce is not ours to verify.
Now requires WordPress 6.3, where the script strategy API arrived.
1.3.0
First release in the WordPress.org directory. Earlier versions were distributed directly by MyVitalAssistant.
First party tracking path with full cookie lifetime in Safari.
Form capture for Contact Form 7, WPForms, Gravity Forms, Fluent Forms, Ninja Forms, Formidable, Elementor Pro, and Keap Opt-in Forms.
Optional WooCommerce order sync with an allow listed payload.
