[Dan0sz]

Plausible's infrastructure uses Accept-Language and the User-Agent Client Hints (Sec-CH-UA*) headers to detect and block bots. Requests sent through the WordPress proxy only carried the User-Agent and X-Forwarded-For, so bots couldn't be detected there.

Change

• New Proxy::get_forwarded_headers() collects the visitor's Accept-Language and every Sec-CH-UA* header present (e.g. Sec-CH-UA, Sec-CH-UA-Mobile, Sec-CH-UA-Platform, and high-entropy hints like Sec-CH-UA-Full-Version-List when the browser sends them). Values are sanitized like the User-Agent and empty headers are skipped.
• Proxy::send_event() merges them into the request to Plausible, so this also applies to server-side events (WooCommerce, EDD, Contact Form 7, Gravity Forms).

Note: browsers only send the low-entropy hints (Sec-CH-UA, -Mobile, -Platform) by default; high-entropy ones only arrive if the site requests them via Accept-CH, which the plugin doesn't do (yet). I've asked whether that's needed.

Tests

• New testGetForwardedHeaders (header name mapping, empty and unrelated headers skipped) and testSendEventForwardsHeaders (headers end up in the outgoing request, via pre_http_request).
• PHP 7.4 syntax check passes. The two AssetsTest errors I get locally also occur on a clean develop.

Summary by CodeRabbit

• Bug Fixes
  • Improved proxied-request bot detection by forwarding supported browser language and client-hint headers.
  • Ensured forwarded headers are sanitized and consistently formatted.
  • Preserved existing forwarding of client IP and JSON request metadata.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 6b93b102-319f-4981-854a-57b1c9379f42

📥 Commits

Reviewing files that changed from the base of the PR and between d98a268 and 6f81ec2.

📒 Files selected for processing: 3

• readme.txt
• src/Proxy.php
• tests/integration/ProxyTest.php

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

The proxy now forwards sanitized Accept-Language and Sec-CH-UA* request headers with event requests. Integration tests cover header selection and outgoing requests. The changelog records the change.

Changes: Proxy header forwarding

Layer / File(s)	Summary
Select and forward browser headers src/Proxy.php, tests/integration/ProxyTest.php, readme.txt	get_forwarded_headers() selects and sanitizes Accept-Language and Sec-CH-UA* server headers. send_event adds them to the existing X-Forwarded-For and JSON content headers. Integration tests verify selection and outgoing headers. The changelog records the change.

Priority: ⬇️ Low

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 6f81e

The header-forwarding change is mergeable after normal checks; no actionable issue remains identified.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: forwarding Accept-Language and Sec-CH-UA* headers in proxied requests.
Docstring Coverage		Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 5 functions across 2 files. (1 skipped: 1 …
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 5 functions across 2 files. (1 skipped: 1 unsupported.)

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!