Limited-Time Offer

Get Extra 20% off on FullCharge Yearly Plan — available for first 10 users only. Don’t miss out! 🚀

TrackWP

WP-UserOnline · Version history

WP-UserOnline changelog and version history

Latest version
4.0.2
Sep 1, 2026 (2 months ago)
Releases
47
since 2007
In the last year
4
about one every 12 days
Tested up to
WordPress 7.1.4
PHP 8.2 or later

Releases each year

  • 200711 releases
  • 20081 release
  • 20093 releases
  • 20103 releases
  • 20112 releases
  • 20121 release
  • 20143 releases
  • 20152 releases
  • 20161 release
  • 20171 release
  • 20181 release
  • 20191 release
  • 20202 releases
  • 20222 releases
  • 20233 releases
  • 20245 releases
  • 20251 release
  • 20264 releases

20264 releases

  1. WP-UserOnline 4.0.2Latest

    • NEW: A wp_useronline_needs_scripts filter, for code that renders the counters where WP-UserOnline cannot see it coming. The refresh script loads only when something on the page has rendered a counter or a listing, and it is enqueued from wp_footer — the one pass. Markup fetched over admin-ajax.php…
    • CHANGED: WP_UserOnline_Template::needs_script() and request_script() are now needs_scripts() and request_scripts(), plural, matching every other name the plugin uses for its front end assets. Neither was ever documented, but they are public, so a theme or plugin calling one by name needs the s.

  2. WP-UserOnline 4.0.1

    • NEW: A Settings link on the plugin’s row of the Plugins screen, opening the Users Online screen’s Settings tab.
    • FIXED: The address of a visitor arriving over IPv6 linked to a lookup that cannot read one. Every such visitor’s link answered “Malformed Domain or IP”, which is most of the detailed listing on a site whose host has IPv6 switched on. The lookups now go to ipinfo.io, which answers for IPv4 and IPv6…
    • NEW: wp_useronline_ip_lookup_url filters where an address is looked up, so a site can send it somewhere else — or return an empty string and keep the address as plain text with no link at all. See the FAQ
    • FIXED: Every page view read the whole table twice — dropping the visitor’s previous row and counting what their address holds both filter on columns the table’s only key does not start with. Keys on user_ip and user_id cover both now, and an existing install gains them on upgrade, so the per-reques…

  3. WP-UserOnline 4.0.0

    • FIXED: A recorded location could be a protocol-relative URL, which is an absolute one wearing a path’s clothes. https://example.com//evil.com/ parses with this site’s host, passed the host check, was stored as //evil.com/, and came out of esc_url() untouched — so the public listing carried a link t…
    • FIXED: The listing withheld the location of a visitor who was in the dashboard, but published their referrer from inside the same branch without ever looking at it. Anyone who clicked a front-end link from an admin screen therefore published the whole admin URL — screen, post ID and _wpnonce — to a…
    • FIXED: A single address could fill the table and permanently inflate “most users ever online” — a figure with no reset anywhere — by varying its user agent on each request, which defeated the de-duplication and left one row per second standing for the whole timeout. At most twenty rows per address…
    • FIXED: The refresh endpoint authenticates by cookie, so a cross-site form post ran it as whoever was signed in and replaced their row with a page and title of the attacker’s choosing, published under their name. A signed-in caller now needs a nonce; a logged-out one still does not, because an anony…
    • NEW: A wp useronline WP-CLI command — list and count. It reads and never writes.
    • NEW: A useronline/v1 REST API for reading the counts and for the visitor heartbeat. The admin-ajax.php wp_useronline action is unchanged and still supported.
    • NEW: A Users Online block, under Widgets in the editor, showing the same listing as [page_useronline]. The shortcode is unchanged and still supported; the block is an addition beside it, calls the same code, and records nobody when it renders.
    • BREAKING: Requires WordPress 6.8 and PHP 8.2.
    • BREAKING: Every filter the plugin fires is renamed and the old names are dropped, with no deprecation shims: useronline_bots, useronline_buckets, useronline_custom_template, useronline_page, useronline_display_user and useronline_trust_proxy all become wp_useronline_*. This voids the promise made i…
    • BREAKING: USERONLINE_TRUST_PROXY is now WP_USERONLINE_TRUST_PROXY. A site still defining the old name silently stops trusting its proxy and starts recording the proxy’s address for every visitor. See the FAQ.
    • BREAKING: The plugin has one screen, at admin.php?page=wp-useronline under a top-level WP-UserOnline menu, with three tabs: Users Online, Settings and Templates. The report used to be under Dashboard and the settings under Settings.
    • BREAKING: Every tab now requires manage_options. The users online listing previously needed only list_users. The new wp_useronline_capability filter puts it back, for that tab alone.
    • BREAKING: The option rows are renamed. useronline becomes wp_useronline_options and useronline_most becomes wp_useronline_most, which is no longer autoloaded. Your settings are migrated automatically on the first load after the update.
    • BREAKING: The shared, unprefixed stats_display option row is no longer read. WP-Stats integration is now a setting of this plugin’s own, and WP-Stats asks each plugin for its section through the wp_stats_sections filter rather than reading anybody’s options. Update all seven WP-Stats-aware plugins…
    • BREAKING: Every class is renamed to WP_UserOnline_*. UserOnline, UserOnline_Template, UserOnline_Options and the rest no longer exist under those names.
    • BREAKING: The refresh script is at js/wp-useronline.js rather than useronline.js, its localised object is wpUserOnlineL10n rather than useronlineL10n, and the admin-ajax action it posts is wp_useronline rather than useronline.
    • NEW: The upgrade markers live in their own wp_useronline_version option row, holding exactly plugin and db, and are written together in one update at the end of the upgrade.
    • NEW: WP-Stats integration is a setting of the plugin’s own, on the Settings tab under WP-Stats, instead of a checkbox added to the WP-Stats options page.
    • NEW: wp_useronline_capability filters the capability each tab requires, with a context saying which one is asking. The page itself is registered under the report’s capability and every tab checks its own, so widening the listing cannot hand over the settings form.
    • NEW: The templates are on a Templates tab of their own rather than below the settings. Both tabs post one setting into one option row, and the sanitiser merges what a tab submitted over what is stored, so saving one cannot blank the other.
    • NEW: The Restore Defaults behaviour is a proper enqueued script, js/wp-useronline-admin.js, rather than markup printed inside the page.
    • NEW: The JavaScript is covered by vitest and jsdom, and the PHP suite runs on the network as well as on a single site.
    • CHANGED: WP_UserOnline_Install owns the table, the migration and the markers, so install and uninstall sit beside each other and neither can drift.
    • FIXED: The upgrade markers no longer live inside the settings array. They were kept under a reserved versions key that the settings form never posted, so every save had to rescue them from the stored value by hand — which is the arrangement behind the 3.0.0 bug where the marker could not be saved a…
    • FIXED: The settings screen no longer emits an inline style attribute or an inline <script> block.
    • FIXED: The WP-Stats checkbox posts an explicit off. An unticked box posts nothing at all, and the sanitiser keeps whatever a tab did not submit, so without it the section could be switched on and never off again.
    • FIXED: The periodic refresh no longer nests the useronline-details container inside itself. The detailed report is answered as a whole container, and the refresh wrote that answer inside the container it was already in — so a page left open gained another copy of the same element id every timeout,…
    • NOTE: The template tags, the [page_useronline] shortcode and the useronline-count, useronline-browsing-site, useronline-browsing-page and useronline-details element ids are unchanged. Everything else that was public has moved; see the Upgrade Notice.
    • NOTE: The “on”, “url” and “referral” labels in the detailed listing carry translator context now, because a single word out of context is not enough to translate from. Those three msgids changed, so existing translations of them fall back to English until they are retranslated

  4. WP-UserOnline 3.0.0

20251 release

  1. WP-UserOnline 2.88.9

20245 releases

  1. WP-UserOnline 2.88.8

  2. WP-UserOnline 2.88.7

  3. WP-UserOnline 2.88.6

  4. WP-UserOnline 2.88.5

  5. WP-UserOnline 2.88.4

20233 releases

  1. WP-UserOnline 2.88.3

  2. WP-UserOnline 2.88.2

  3. WP-UserOnline 2.88.1

20222 releases

  1. WP-UserOnline 2.88.0

  2. WP-UserOnline 2.87.6

20202 releases

  1. WP-UserOnline 2.87.5

  2. WP-UserOnline 2.87.4

20191 release

  1. WP-UserOnline 2.87.3

20181 release

  1. WP-UserOnline 2.87.2

20171 release

  1. WP-UserOnline 2.87.1

20161 release

  1. WP-UserOnline 2.87

20152 releases

  1. WP-UserOnline 2.86

  2. WP-UserOnline 2.85

20143 releases

  1. WP-UserOnline 2.84

  2. WP-UserOnline 2.83

  3. WP-UserOnline 2.70

20121 release

  1. WP-UserOnline 2.82

20112 releases

  1. WP-UserOnline 2.81

  2. WP-UserOnline 2.80

20103 releases

  1. WP-UserOnline 2.73

  2. WP-UserOnline 2.72

  3. WP-UserOnline 2.62

20093 releases

  1. WP-UserOnline 2.50

  2. WP-UserOnline 1.50

  3. WP-UserOnline 2.40

20081 release

  1. WP-UserOnline 2.31

200711 releases

  1. WP-UserOnline 2.20

  2. WP-UserOnline 2.11

  3. WP-UserOnline 2.10

  4. WP-UserOnline 2.06

  5. WP-UserOnline 2.05

  6. WP-UserOnline 2.04

  7. WP-UserOnline 2.03

  8. WP-UserOnline 2.02

  9. WP-UserOnline 2.01

  10. WP-UserOnline 2.00

  11. WP-UserOnline 1.00

Questions about WP-UserOnline’s releases

What is the latest version of WP-UserOnline?

4.0.2, released on Sep 1, 2026 (2 months ago). It’s tested up to WordPress 7.1.4 and needs PHP 8.2 or later.

How often is WP-UserOnline updated?

4 releases in the last year, about one every 12 days. Its first release on WordPress.org dates from March 2007.

Know when your rivals ship

Track your plugin and its rivals: TrackWP sees each new release in the nightly snapshot and alerts you, with what it did to their rank.

Start free

Release dates come from the day each version’s folder was made in WP-UserOnline’s WordPress.org SVN repository; the notes from its readme’s changelog, as its authors wrote it.