CMPly
| 开发者 | cmplyapp |
|---|---|
| 更新时间 | 2026年8月3日 20:56 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 7.0 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
CMPly connects a WordPress site to CMPly.app.
The plugin prints the CMPly SDK in the public
<head> at a very early priority and intentionally does not add defer or async, matching CMPly's recommended integration for blocking third-party scripts before they execute.
Features:
- Connect button with a short-lived signed callback state and a single-use server-to-server authorization code.
- Live account plan and monthly pageview usage synchronized on connect and verification.
- Site ID configuration in Settings > CMPly.
- Auto-inject or manual embed mode for the CMPly SDK.
- HTTPS SDK loading from the official CMPly.app service.
- Optional SDK version query for cache busting.
- Optional language override with automatic browser-language detection by default.
- URL path exclusions with wildcard support.
- Editable Google Consent Mode v2 settings with global and regional consent defaults.
安装:
- Upload the plugin folder to
/wp-content/plugins/cmply. - Activate "CMPly" in WordPress.
- Go to Settings > CMPly.
- Click "Connect to CMPly" or paste the Site ID from the CMPly dashboard.
- Save settings and clear any page cache.
常见问题:
Why is the script not loaded with defer?
CMPly must execute during HTML parsing so it can intercept and block third-party scripts before they run. Adding defer or async would make blocking less reliable.
What if I already added the CMPly script manually?
Turn off Auto-inject SDK in Settings > CMPly and keep the manual script near the top of the document head. Keep only one CMPly SDK script on the page.
How does the Connect button work?
The button opens the CMPly web app with your WordPress site URL, return URL, and a signed WordPress callback-state token that expires after 30 minutes. CMPly separately returns a ten-minute, single-use authorization code. WordPress exchanges that code with CMPly over HTTPS and stores the resulting credentials server-side.
Can I disable CMPly on specific pages?
Yes. Add one path per line in Exclude Paths, for example:
/checkout/*
Does this plugin set cookies by itself?
The WordPress plugin stores only its admin settings in the WordPress database. The public consent cookie is created by the CMPly SDK in the visitor's browser.
更新日志:
1.0.21
- Fixed WordPress account connections when the web callback returns without the nested WordPress nonce.
- Kept the signed, administrator-bound callback state mandatory and continued validating a WordPress nonce whenever one is returned.
- Added authenticated editing of Google Consent Mode v2 and regional consent defaults from WordPress.
- Added validation, five-minute response caching, manual refresh, and actionable connection errors for GCM settings.
- Synchronized the GitHub release source with the reviewed WordPress.org package.
- Added automated, version-validated deployment to WordPress.org.
- Clarified the connection flow by distinguishing the signed WordPress callback state from the single-use CMPly authorization code.
- Reworded upgrade messaging to avoid implying guaranteed protection from legal risk.
- Hide Reconnect while the connection is healthy and show it only after a verification failure.
- Automatically refresh plan and pageview usage when CMPly settings open and the saved snapshot is older than 15 minutes.
- Keep Verify connection as an immediate manual refresh and diagnostic action.
- Show fractional pageview usage below ten percent instead of rounding it to zero.
- Preserve freshly synchronized pageview usage, limits, and connection ID through WordPress option sanitization.
- Hide dashboard upgrade promotions for paid plans.
- Allow Verify to repair a missing connection ID using the saved API key, Site ID, and domain.
- Store the connection ID separately from editable plugin settings.
- Hide the header upgrade button for paid plans.
- Synchronize pageviews from the same billing-period statistics used by the CMPly dashboard.
- Hide the dashboard connection prompt after a CMPly account has been connected.
- Use the saved connection ID as the persistent UI connection state.
- Show the safe CMPly API error and HTTP status when credential exchange fails.
- Pass callback state as a dedicated CMPly parameter so nested URL encoding cannot remove it.
- Added precise callback-state diagnostics for missing, malformed, expired, wrong-user, and invalid-signature failures.
- Use a stateless, administrator-bound HMAC callback state that survives navigation, caching, and multiple tabs.
- Store the one-time connection state in administrator metadata so it works independently of transient cache backends.
- Replaced the external callback nonce with a one-time administrator-bound state token.
- Fixed nonce encoding in the nested WordPress connection callback URL.
- Replaced the WordPress expired-link screen with an actionable plugin error message.
- Added visible connection success and error messages.
- Distinguished manual Site ID configuration from an authenticated CMPly account connection.
- Fixed duplicate upgrade button icon during cached asset transitions.
- Fixed admin icon rendering and enabled interactive FAQ answers.
- Added live plan and pageview usage synchronization from CMPly.
- Initial release.
- Added one-time connection exchange and server-side connection verification.
- Added live plan and pageview usage synchronization from CMPly.