GTM4WP – A Google Tag Manager (GTM) plugin for WordPress

Changelog

2.0.5

• Fixed: the data layer initialisation block no longer contains the word gtag. Since 2.0.3, a JavaScript delay plugin with gtag on its keyword list, such as Flying Scripts, delayed the whole block and the browser console showed dataLayer is not defined. The Google tag developer ID is still set.
• Fixed: a page with no data layer variables to report no longer pushes an empty array into the data layer; dataLayer_content is then an empty object and is not pushed. Content that is pushed is always an object, never an array, which GTM would read as a command.

2.0.4

• Fixed: on the classic WooCommerce checkout, an error in the plugin’s checkout step tracking could stop the order from being submitted the normal way, so a gateway that adds card details in the browser, such as Stripe, rejected it. Tracking errors can no longer interrupt the checkout or a variation selection, and still show in the browser console. (#472)

2.0.3

• Fixed: on a store that displays prices including tax, every cart line in view_cart, begin_checkout and the cart content carried a discount equal to the line’s tax, with no coupon or sale involved, so GA4 reported a share of the revenue as a discount on every order. The total side of the discount calculation read a key WooCommerce never writes on a cart item, so only the subtotal side gained the tax. An undiscounted line carries no discount again. Stores displaying prices excluding tax were never affected, and neither was the purchase event.
• Fixed: on a store whose product page runs the newer WooCommerce blocks (built on the WordPress Interactivity API), an add to cart the store refused could still be reported when a related-products or grid add was clicked within the next ten seconds, so add_to_cart fired twice for a single item. A list add now supersedes whatever the product form still had waiting.
• Fixed: on the same stores, a cart read over the Store API that came back with something other than a cart could report every item as removed; it is now treated as no reading at all.
• Fixed: a purchase was never reported when the customer reached the order received page while the order was still Pending payment, and “Reliable purchase tracking” did not recover it. This happens with a payment provider that confirms the payment through a webhook, such as the WooCommerce Stripe Gateway with webhooks enabled: the customer is redirected back a moment before the confirmation arrives, so the plugin sees a status that is not in “Order statuses that trigger the purchase event” and withholds the event, and the later change to Processing happens in a request the plugin cannot connect to the customer’s browser. With “Reliable purchase tracking” on, such an order is now remembered in the customer’s session and checked again on the pages they view next; the purchase is reported once, as soon as the status has become one of the tracked statuses, and the order is flagged as tracked at that moment. The wait ends by itself when the order is cancelled, refunded or fails, or once the order is older than the “Maximum order age” (30 minutes by default). Pending payment itself is still not counted as a sale, and every existing duplicate guard applies unchanged.
• Fixed: with a custom data layer variable name, the Google Consent Mode default block pushed its defaults to dataLayer instead of the configured variable, so the container never received them and the consent defaults did not apply. The block now uses the configured name and stays out of WP Rocket’s combined JavaScript.
• Fixed: on a subdomain multisite, or any site defining COOKIE_DOMAIN, the cache-safe data layer could not clear its event cookie after a one-shot event was delivered, so every later page view made a needless request. The cookie is now host-only.
• Fixed: a login or registration event was lost when the visitor’s next request was a REST call (the WooCommerce Store API, a headless front end) rather than a page view.
• Fixed: a user account created by a logged-in administrator through the REST API or an admin app fired gtm4wp.userRegistered in the administrator’s own browser instead of nowhere.
• Fixed: the form interaction and Contact Form 7 events reported a hidden action field instead of the form’s URL when the form contained a field named action, id or target.
• Fixed: the browser, OS and device data script reported all three signals when a page optimiser removed its inline configuration, ignoring which of them were enabled. It now reports nothing in that case.
• Fixed: with the cache-safe data layer, a logged-in visitor served a cached page kept requesting their visitor data on every page view after WordPress refused the page’s nonce. When WordPress itself reports the rejected nonce, the data is requested once more anonymously and that page stops asking.
• Updated: tested with WooCommerce 11.1.2.
• Added: the data layer initialisation block carries the plugin’s Google tag developer ID, gtag(‘set’, ‘developer_id.dNGJiYT’, true), so Google can tell which platform installed the tag. It identifies GTM4WP only and adds nothing about the site or its visitors.

2.0.2

• Updated: tested with WooCommerce 11.1.
• Fixed: a product category or brand name containing an ampersand reached the data layer as “Shirts & Ties” rather than “Shirts & Ties”, which is what GA4 then reported. WordPress encodes term names when they are saved, and the plugin now decodes that once when it reads the name.

• Fixed: item_id, sku and the dynamic remarketing id are now always strings. A product with no SKU falls back to its numeric id, and that fallback was written into the data layer as a number while the same fields are strings on every product that has a SKU. Check your GTM setup if a trigger or variable compares one of those fields against a number.

• Fixed: the begin_checkout event was missing on stores where WooCommerce reports the checkout page as the cart page as well, which happens when a plugin or a theme forces that decision or when a cart shortcode is left in the checkout page content. Such a checkout page pushed view_cart and begin_checkout never fired anywhere. The checkout is now decided first, so a page reported as both is treated as the checkout page. The order-received page is recognized ahead of both on both halves as well: on such a store the thank-you page used to be taken for the cart page by the block tracker, which loaded there in its cart context in place of the regular tracker.

• Fixed: add_to_cart and remove_from_cart never fired on a store whose product and cart blocks are built on the WordPress Interactivity API, the newer form of the WooCommerce blocks. Product pages now report the add once WooCommerce confirms that the item reached the cart, and cart changes made anywhere else are read back from the WooCommerce Store API and reported the same way as on a store using the older blocks. Variable products are covered as well: the interactive form publishes no variation data the plugin could read, so the event is completed from the cart line the add creates, which carries the data of the variation itself.
• Fixed: a GTM4WP_HARDCODED_* value in wp-config.php that ends in a newline character – typically an untrimmed file read feeding the define() – is now rejected and named in the existing admin notice, like any other malformed value. Previously a gtm_auth/gtm_preview value with a trailing newline passed validation, the newline reached the container loader script and broke the whole block, so the container silently did not load with nothing pointing at wp-config. A container ID with a trailing newline used to be silently repaired and kept working; it is now reported the same way instead – remove the stray newline from the define() and the override applies again.
• Fixed: a page whose author cannot be resolved no longer takes the whole page down with a critical error when PublishPress Authors is active. PublishPress reports such an author as no author at all, which happens when the author’s user account has been deleted, and the plugin passed that straight into the code reading the author name and ID, where it ended in a fatal error. The WooCommerce My Account page is the one most likely to hit it, since it is often the page nobody keeps an author on. An author that cannot be resolved is now skipped, so the page renders and the author variables are simply left out of the data layer, and a post that has one real author next to an unresolvable one is treated as having a single author.

2.0.1

• Fixed: on a block-based store, opening the Cart page pushed add_shipping_info and add_payment_info into the data layer with no interaction, and both events then fired again on the Checkout page. The block tracker told the two pages apart by the presence of the WooCommerce payment data store, which WooCommerce registers on the Cart page as well; the Cart and Checkout pages now each receive their own context and the checkout-step events fire only on the Checkout page.
• Fixed: a blank settings screen no longer stays silent about why it is blank. Some ad and privacy blocker filter lists block everything under the plugin folder, including the file that builds the settings screen in the browser, which left the settings page empty with no explanation. A static notice now appears after a few seconds whenever the settings app could not start, explaining the most likely cause and the workaround (pause the blocker for the admin area of the site, or add an exception for it).

2.0.0

Major rewrite of the plugin. Please read the announcement post on gtm4wp.com before upgrading. This section is a summary; wordpress.org truncates a changelog after 5,000 words, so the complete list of 2.0.0 changes with every detail lives in the changelog on GitHub: https://github.com/duracelltomi/gtm4wp/blob/master/CHANGELOG.md

• Changed: complete object-oriented rewrite. Every feature is a module that third-party plugins can extend. All public template functions, filter and action names, wp-config constants and the options storage key are unchanged, so existing integrations keep working.
• Changed: minimum requirements raised to PHP 8.0 and WordPress 6.3.
• Added: modern React-based settings screen with left pane navigation, tabbed option groups, option search, inline validation, a help link on every option, bookmarkable addresses and settings export and import.
• Added: every Google Tag Manager container ID has its own environment parameters, custom domain and custom path; a production-only kill switch for staging copies; validation of the hard-coded wp-config constants with a warning that names the wrong one.
• Changed: the tag restriction list is written under the documented gtm.allowlist / gtm.blocklist keys, the entity list is refreshed from Google’s documentation, and blocklist mode no longer blocks every tag.
• Added: cache-safe data layer mode for sites behind a full page cache, with the visitor specific values fetched separately.
• Changed: GA4 e-commerce tracking reworked for WooCommerce: reliable purchase tracking, custom order received page, order statuses that trigger the purchase event, list attribution across the funnel, block cart and checkout support, Store API data for the block trackers, and numeric-looking text values no longer turned into numbers.
• Added: an Axeptio consent management platform integration and a CookieYes consent bridge; the WebToffee v2.x integration is deprecated. Media events cover more embedded players, and a player’s script is requested only on pages that contain one of its embeds.
• Removed: the weather and geo data features and the scroll tracking feature (use the built-in Scroll Depth trigger of Google Tag Manager instead). Browser, OS and device data is now collected in the browser with User-Agent Client Hints, which replaces the bundled WhichBrowser library.
• Deprecated: the “YouTube video events” option (Google Tag Manager ships a native YouTube Video trigger) and the $gtp4wp_plugin_url, $gtp4wp_plugin_basename and $gtp4wp_script_path global variables, which will be removed in 2.1.

1.22.5

A maintenance release for the 1.x line. 1.22.4 was intended to be the last one before GTM4WP 2.0; this release exists because the fixes below are worth shipping to 1.x users rather than holding for 2.0.

• Fixed (security): hardened how the hidden product-data attribute is built for WooCommerce product lists and cart remove links, so that no product field value can affect the surrounding HTML. Certain values were not guaranteed to stay inside the attribute.
• Fixed: when a custom X-Forwarded-For header is configured as the visitor IP source, all entries of the header are now evaluated. Only the first entry was ever considered, because the remaining ones were not trimmed of the space that follows each comma and therefore failed IP validation.
• Fixed: the custom visitor IP header name is now validated in full. The check accepted any value that contained at least one valid character, so an invalid header name passed validation and was then simply never found. Setups with a working header name are unaffected.

1.22.4

• Fixed: hardened how values are encoded into the data layer and into inline script blocks. Script blocks are no longer HTML entity decoded after sanitization, and every value written into a script context is now JSON encoded with the full set of hex escaping flags. Thanks cyn
• Fixed: nonce attribute should not be sanitized. Thanks oxyc
• Fixed: avoid warnings when saving settings. Thanks mircobabini
• Fixed: only float number is returned in JavaScript processing. Thanks gkipouros
• Updated: only load plugin files on frontend or on admin when the admin user has sufficient permissions.
• Updated: WooCommerce 10.4+ compatibility – the checkout inline script no longer uses the deprecated wc_enqueue_js() function. The old function is still used as a fallback on setups where the tracker script is loaded in the page head.
• Updated: WordPress and WooCommerce compatibility.
• Deprecated: geo data (ipstack.com) and weather data (OpenWeatherMap) integrations. They still work in this version but will be removed in GTM4WP 2.0. There is no direct replacement: collect this data in Google Tag Manager or with a dedicated service instead.
• Deprecated: scroll tracking. It still works in this version but will be removed in GTM4WP 2.0. Use the Scroll Depth trigger built into Google Tag Manager instead.
• Deprecated: the “Custom tag/variable templates” blacklist option, plus the Universal Analytics and Mouseflow entries of the tag blacklist. These will be removed in GTM4WP 2.0.
• Added: a dismissable admin notice announcing the upcoming GTM4WP 2.0 release. If your site uses one of the deprecated features above, the notice names it.

1.22.3

• Fixed: when timeout for the select_item event with WooCommerce is set to 0, plugin does not halt the browser from loading the product page
• Fixed: properly reading timeout for select_item eventCallback

1.22.2

• Fixed: purchase event was not fired when is_order_received_page() WooCommerce tag was not supported by the template and the fallback method had to activate.

1.22.1

• Fixed: yet another fix to the purchase tracking. Thanks Khnaz35

Older releases are listed in the full changelog on GitHub: https://github.com/duracelltomi/gtm4wp/blob/master/CHANGELOG.md