Yes! The plugin allows you to easily generate UTM parameter query strings<\/strong> for your marketing campaigns. You can create both plain and coded UTM query strings<\/strong> with simple click options. If you only need to generate and use UTM parameters without decoding, you can do so without enabling the decoding feature.<\/p><\/dd>\nCan I use plain UTM parameters instead of coded ones?<\/h3><\/dt>\nYes! The plugin supports both plain and coded UTM parameters<\/strong>. If you don\u2019t enable decoding, your standard UTM parameters will work as usual. If you want extra protection against ad blockers, you can enable decoding in the plugin settings.<\/p><\/dd>\nHow do I enable coded UTM decoding?<\/h3><\/dt>\nGo to Settings > WP inPIPE<\/strong> and turn on the option for Coded UTM Processing<\/strong>. When enabled, the plugin will detect and decode coded UTM query strings, replacing them with the full UTM parameters in the URL bar and pushing them to the dataLayer.<\/p><\/dd>\nHow does this help with Google Tag Manager (GTM)?<\/h3><\/dt>\nBy pushing decoded UTM parameters<\/strong> directly into the dataLayer<\/strong>, Web GTM can receive the data without requiring extra configurations to extract and manage UTM values. This simplifies tracking setup and ensures cleaner data in your analytics.<\/p><\/dd>\n\n<\/dl>\n\n\n1.1.1 - 2026-02-12<\/h4>\n\n
UTM Import, Dropdown Options Management, Edit UX Overhaul, Validation & Security Enhancements<\/strong><\/p>\n\nNEW FEATURES<\/h4>\n\n\nQuick Import UTM<\/strong>: Paste any URL containing UTM parameters and auto-fill the form<\/p>\n\n\n- Supports full URLs, query-only strings, bare parameters, and URLs without protocol<\/li>\n
- Six-step validation chain: empty check, 512-char length cap, multiple URL detection, dangerous protocol blocking, URL parsing with fallbacks, and UTM parameter extraction<\/li>\n
- Extracts standard UTM parameters (source, medium, campaign, term, content, id)<\/li>\n
- Now also picks up all non-standard query parameters as custom parameters (up to 3), not just
utm_*<\/code> prefixed ones<\/li>\n- Domain validation: rejects URLs that don't match the site domain<\/li>\n
- Warning toast when custom parameters exceed the limit, showing how many were skipped<\/li>\n
- Landing path extracted from URL and auto-confirmed<\/li>\n
- Import UTM button in card header next to Reset All<\/li>\n<\/ul><\/li>\n
UTM Dropdown Options Management<\/strong>: Custom dropdown values for all six UTM parameter fields<\/p>\n\n\n- New
inpipe_utm_options<\/code> database table with seeded defaults and user-added values<\/li>\n- Add custom values inline via dropdown input (auto-saved to server immediately)<\/li>\n
- Delete any option (including defaults) via delete icon in dropdown<\/li>\n
- Options loaded from server on mount via
InPipe_UTM_Options_Manager<\/code> with 24-hour object caching<\/li>\n- Toast feedback on add (\"{value} added\") and delete (\"{value} removed\")<\/li>\n<\/ul><\/li>\n
Landing Page Path Confirmation<\/strong>: Confirm-before-edit workflow for the landing page path<\/p>\n\n\n- Three-state field: editable input with checkmark \u2192 confirmed display \u2192 live query preview<\/li>\n
- Five-layer path validation: query characters (
?#&=<\/code>), UTM parameter patterns, character allowlist, path traversal\/dot abuse, consecutive slashes<\/li>\n- UTM params lock overlay when path is typed but not confirmed (prevents editing UTM fields until path is confirmed)<\/li>\n
- Users can skip the path entirely and go straight to UTM params<\/li>\n<\/ul><\/li>\n
Live UTM Query Preview<\/strong>: Real-time preview of the URL being built inside the landing page field<\/p>\n\n\n- Shows
page\/subpage?utm_source=google&utm_medium=cpc&custom_key=value<\/code> as params are selected<\/li>\n- Replaces the editable input once any UTM parameter has a value<\/li>\n<\/ul><\/li>\n<\/ul>\n\n
UTM EDIT UX OVERHAUL<\/h4>\n\n\n- Editing State Indicator<\/strong>: Blue banner below card header when editing a stored UTM\n\n
\n- Shows pencil icon, \"Editing UTM:\" label, and the UTM ID in a monospace badge<\/li>\n
- Cancel button to exit edit mode and clear the form<\/li>\n<\/ul><\/li>\n
- Save Button Context<\/strong>: Button changes from \"Save UTM\" to \"Update UTM\" with pencil icon when editing<\/li>\n
- Active UTM Highlight<\/strong>: Stored UTM item being edited gets a blue border and tint<\/li>\n
- Saved UTM Highlight<\/strong>: Newly saved or updated UTM gets a primary-color highlight with 3-second fade-out animation, auto-scrolls into view<\/li>\n
- Auto-Copy on Save<\/strong>: Coded URL is automatically copied to clipboard after saving\n\n
\n- Toast message: \"UTM saved \u2014 coded URL copied to clipboard!\"<\/li>\n
- Graceful fallback if clipboard access is denied<\/li>\n<\/ul><\/li>\n
- Param Value Indicators<\/strong>: UTM parameter cards show primary-color border when they have a value<\/li>\n
- Scroll Behavior<\/strong>: Edit and import scroll to the top of the UTM Parameters card; save scrolls to the highlighted stored UTM<\/li>\n<\/ul>\n\n
EDIT BUG FIXES<\/h4>\n\n\n- Fixed hasUnsavedChanges<\/strong>: Now compares against a snapshot of the loaded UTM values instead of static empty defaults<\/li>\n
- Fixed Coded URL Regeneration<\/strong>: Editing a UTM no longer generates a new random coded URL value on every keystroke \u2014 preserves the original coded URL so shared links aren't broken<\/li>\n
- Fixed Watcher During Edit Load<\/strong>: Added
isLoadingEdit<\/code> guard to prevent the deep watcher from firing multiple times while populating the form during edit<\/li>\n- Fixed Custom Params Shallow Copy<\/strong>: Edit now deep-copies custom parameters to prevent mutation of stored UTM data<\/li>\n<\/ul>\n\n
SECURITY ENHANCEMENTS<\/h4>\n\n\nAllowlist-Based Sanitization<\/strong>: Replaced blocklist sanitizeUtmValue()<\/code> with normalize-and-allowlist approach<\/p>\n\n\n- NFKC normalization collapses fullwidth characters (e.g.,
\uff47\uff4f\uff4f\uff47\uff4c\uff45<\/code> \u2192 google<\/code>)<\/li>\n- Strips zero-width characters, directional overrides, and BOM marks<\/li>\n
- Allowlist filter: only
a-z<\/code>, 0-9<\/code>, _<\/code>, -<\/code>, .<\/code>, space survive<\/li>\n- Blocks emoji, non-standard whitespace, control characters, and all non-Latin input<\/li>\n<\/ul><\/li>\n
Strict Custom Key Sanitization<\/strong>: New sanitizeCustomKey()<\/code> function for custom parameter keys<\/p>\n\n\n- Only
a-z<\/code>, 0-9<\/code>, _<\/code>, -<\/code> allowed (no spaces or periods)<\/li>\n<\/ul><\/li>\nCustom Parameter Input Validation<\/strong>: Blur-based validation for custom parameter keys and values<\/p>\n\n\n- Key validation: rejects invalid characters, standard UTM name collisions,
utm_<\/code> prefix, and duplicate keys<\/li>\n- Value validation: rejects query-breaking and injection characters<\/li>\n
- Immediate feedback via warning toasts \u2014 invalid input is rejected and field is cleared on blur<\/li>\n
- Uppercase input silently normalized to lowercase on blur (e.g.,
TEST<\/code> \u2192 test<\/code>)<\/li>\n- Save-time sanitization via
sanitizeCustomKey()<\/code> \/ sanitizeUtmValue()<\/code> as final safety net<\/li>\n<\/ul><\/li>\nDropdown Value Sanitization<\/strong>: handleAddFromDropdown()<\/code> sanitizes via allowlist before setting v-model<\/p>\n\n\n- Strict equality check rejects any input altered by sanitization (e.g.,
<script>alert(1)<\/script><\/code> \u2192 rejected)<\/li>\n- Dirty value guard in watcher silently clears pre-existing dirty options on selection<\/li>\n<\/ul><\/li>\n
Landing Page Path Hardening<\/strong>: Five-layer validation for the landing page path<\/p>\n\n\n- Layer 3: Character allowlist \u2014 only
a-z<\/code>, 0-9<\/code>, -<\/code>, _<\/code>, .<\/code>, \/<\/code> allowed (rejects commas, spaces, special chars)<\/li>\n- Layer 4: Path traversal protection \u2014 blocks
..\/<\/code>, .\/<\/code>, leading\/trailing dots, \/.<\/code> patterns<\/li>\n- Layer 5: Malformed path detection \u2014 blocks consecutive slashes (
\/\/<\/code>)<\/li>\n<\/ul><\/li>\nImport Domain Validation<\/strong>: Imported URLs are validated against the site domain \u2014 mismatched domains are rejected with a clear error message<\/p><\/li>\n<\/ul>\n\nIMPROVEMENTS<\/h4>\n\n\ninPipeBaseSelect Component<\/strong>: Complete rebuild with custom dropdown mode<\/p>\n\n\n- Custom dropdown with deletable options, inline custom value input, keyboard navigation<\/li>\n
- ARIA combobox\/listbox roles for accessibility<\/li>\n
- Click-outside close, escape key handling, arrow key navigation with highlighted index<\/li>\n
- Falls back to native
<select><\/code> when deletableOptions<\/code> is not provided<\/li>\n<\/ul><\/li>\nCoded URL Landing Path<\/strong>: Both full URL and coded URL now include the landing page path<\/p><\/li>\n- Placeholder Update<\/strong>: Landing page placeholder changed to
page\/subpage<\/code><\/li>\n- Emoji to Lucide Icons<\/strong>: Replaced all emoji icons in UTM Coder with Lucide icon components (Download, RefreshCcw, Pencil, Trash2, Save, Copy, Check, Loader, Plus, Zap, CircleAlert, Rocket)<\/li>\n
- Stored UTMs Spacing Fix<\/strong>: Fixed
space-y<\/code> (Tailwind-only utility) not working in plain CSS \u2014 replaced with flexbox gap for proper spacing between stored UTM items and URL rows<\/li>\n<\/ul>\n\nNEW FILES<\/h4>\n\n\nincludes\/core\/class-inpipe-utm-options-manager.php<\/code> \u2014 UTM dropdown options CRUD with WordPress object caching<\/li>\n<\/ul>\n\nTECHNICAL<\/h4>\n\n\n- Bumped
INPIPE_DB_VERSION<\/code> from 1.0.0<\/code> to 1.1.0<\/code> to trigger database upgrade for users updating from v1.1.0 \u2014 ensures inpipe_utm_options<\/code> table is created via dbDelta<\/code><\/li>\n- Added
inpipe_utm_options<\/code> table: id<\/code>,