getsitecalendar.com<\/a>.<\/p>\n\nExternal services<\/h3>\n\n
Site Calendar Lite does not send analytics, telemetry, or any data about your site back to its authors. The only external service the plugin interacts with is:<\/p>\n\n
Google Maps embed (single-event pages)<\/strong><\/p>\n\nWhen a single-event page is rendered and the event has a venue with an address, the plugin embeds a Google Maps iframe so visitors can see the venue location and get directions. The embed uses Google's public https:\/\/www.google.com\/maps?output=embed<\/code> endpoint and does not require an API key.<\/p>\n\n\n- What data is sent:<\/strong> The venue address only (no visitor data, no event details, no attendee data). The browser \u2014 not the server \u2014 is what loads the iframe, so the request originates from the site visitor, not from your WordPress installation.<\/li>\n
- When it's sent:<\/strong> Each time a single-event page is rendered that has a venue with a non-empty address. Events without a venue address do not embed the map.<\/li>\n
- Provided by:<\/strong> Google LLC.<\/li>\n
- Google Terms of Service:<\/strong> https:\/\/policies.google.com\/terms<\/li>\n
- Google Privacy Policy:<\/strong> https:\/\/policies.google.com\/privacy<\/li>\n<\/ul>\n\n
If you do not wish to embed Google Maps on event pages, simply leave the venue's address field empty \u2014 the map will not be rendered.<\/p>\n\n
Privacy<\/h3>\n\n
Site Calendar Lite stores attendee names and email addresses (provided via the RSVP form) in your own WordPress database, in the pcal_attendee<\/code> custom post type. No data is sent to third parties from the server side. Site owners are responsible for their own privacy policy and GDPR compliance. See also the External services section above for information about Google Maps iframe embeds on single-event pages.<\/p>\n\n\n\n- Upload
site-calendar-lite<\/code> to \/wp-content\/plugins\/<\/code>, or install via Plugins \u2192 Add New<\/li>\n- Activate the plugin<\/li>\n
- Create a Page and add the
[getsitecalendar]<\/code> shortcode to display the calendar<\/li>\n- Add Events, Venues, and Organizers from the Site Calendar<\/strong> menu<\/li>\n<\/ol>\n\n\n
\nIs Site Calendar Lite truly free?<\/h3><\/dt>\nYes \u2014 fully free, GPLv2, no hidden upsells, no telemetry. The free version is a complete usable calendar plugin in its own right. Site Calendar Pro is an optional upgrade for sites that need advanced views, paid ticketing, or door check-in.<\/p><\/dd>\n
Does it work with block themes \/ Site Editor?<\/h3><\/dt>\nYes. The shortcodes work inside any Shortcode block, and the calendar renders cleanly inside is-layout-constrained<\/code> parents.<\/p><\/dd>\nDoes it work with WooCommerce?<\/h3><\/dt>\nThe free version doesn't require WooCommerce. Site Calendar Pro can route paid ticket sales through your existing WooCommerce gateways if you have it active.<\/p><\/dd>\n
How does data carry over to Pro?<\/h3><\/dt>\nSite Calendar Pro hooks into Lite's existing data model \u2014 same custom post types, same meta keys, same database tables. Installing Pro alongside Lite preserves every event, venue, organizer, and attendee record.<\/p><\/dd>\n
Will it slow down my site?<\/h3><\/dt>\nNo. Site Calendar Lite is under 110 KB total and loads its CSS \/ JS only on pages that contain the shortcode. There are no remote calls and no analytics.<\/p><\/dd>\n
Can I match the calendar to my site's branding?<\/h3><\/dt>\nYes. Site Calendar \u2192 Settings \u2192 Appearance lets you pick a primary colour, accent colour, event-link colour, and Week view chip colour. Background, border and hover shades are derived automatically from each picked colour.<\/p><\/dd>\n\n<\/dl>\n\n\n
1.1.1.18<\/h4>\n\n\n- Multi-ticket cart fully functional in Lite:<\/strong> The free RSVP handler in
class-pcal-rsvp-form.php<\/code> now loops over every ticket type in the submitted cart and registers an attendee for each one. Earlier Lite builds only registered the first ticket type (via array_key_first()<\/code>) and silently discarded the rest, pushing users to upgrade for multi-ticket support. That behaviour violated WP.org guideline 5 (no functionality locked behind a paid upgrade) and has been removed entirely. Lite now supports as many ticket types per registration as the event admin has created.<\/li>\n- Output escaping:<\/strong> Replaced the remaining
phpcs:ignore<\/code> escape-output annotations in class-pcal-shortcodes.php<\/code> with proper wp_kses()<\/code> calls using a new pcal_calendar_kses_allowed()<\/code> allowlist (in helpers.php<\/code>). The allowlist covers the structural HTML the calendar emits \u2014 div, span, table, time, figure, picture, svg, etc. \u2014 plus data-*<\/code> and aria-*<\/code> attributes used by the front-end JS to hydrate templates. Output-side escaping is now compliant with WP.org's \"escape late\" rule, no exceptions remain.<\/li>\n- Inline style cleanup:<\/strong> Migrated the last inline
<style><\/code> block (mobile responsive overrides in class-pcal-archive-list.php<\/code>) from a direct echo '<style>'<\/code> call to wp_add_inline_style()<\/code> attached to the front-end stylesheet, per WP.org's enqueue requirement.<\/li>\n- No DB schema changes; no behavioural change beyond multi-ticket registration now working in Lite.<\/li>\n<\/ul>\n\n
1.1.1.17<\/h4>\n\n\n- Tickets and Attendees are now fully-functional Lite features<\/strong> per WordPress.org plugin-directory guideline 5 (no locked or hidden features). The post types
pcal_ticket<\/code> and pcal_attendee<\/code> are admin-visible under Site Calendar in wp-admin. Admins can create tickets for any event (one or more ticket types, each with label, price, capacity, max-per-order, sort order, and an optional description). The Attendees list shows every front-end RSVP registration with name, email, event, ticket type, quantity, status, and registration timestamp.<\/li>\n- REST data protection:<\/strong> Venue and Organizer phone\/email fields are stripped from public REST responses for unauthenticated callers (logged-in users with
edit_posts<\/code> capability see the full record). Prevents unauthenticated scraping of contact data not otherwise published on the front-end. Affects \/wp-json\/pcal\/v1\/events<\/code>, \/events\/<id><\/code>, \/venues<\/code>, \/venues\/<id><\/code>, \/organizers<\/code>, \/organizers\/<id><\/code>.<\/li>\n- Pro-only features:<\/strong> Site Calendar Pro continues to add multi-ticket inline editor on the event page, capacity gauges, automatic confirmation emails, branded HTML email template, refund handling, QR-code door check-in, CSV export of attendees, bulk operations (resend confirmation, send custom email), front-end event submission, recurring events, Week\/Day\/Photo views, custom fields, and WooCommerce integration.<\/li>\n
- No DB schema changes; existing tickets and attendees on sites running Pro continue to work without migration.<\/li>\n<\/ul>\n\n
1.1.1.16<\/h4>\n\n\n- Shortcode prefix update:<\/strong> Following WordPress.org reviewer guidance, the plugin's public shortcodes have been renamed to use the plugin's own prefix:\n\n
\n[getsitecalendar]<\/code> (replaces [pro_calendar]<\/code>)<\/li>\n[getsitecalendar_list]<\/code> (replaces [pro_calendar_list]<\/code>)<\/li>\n[getsitecalendar_search]<\/code> (replaces [pro_calendar_search]<\/code>)<\/li>\n[getsitecalendar_rsvp]<\/code> (replaces [pro_calendar_rsvp]<\/code>)\nThe previous shortcode names are kept registered as silent backward-compatibility aliases, so existing customer sites continue to render correctly without any action required. New documentation and the in-plugin Help tab now use the new names.<\/li>\n<\/ul><\/li>\n- Plugin Check compliance:<\/strong> Final cleanup pass addressing the remaining 15 Plugin Check warnings from 1.1.1.15.\n\n
\n- Removed the
load_plugin_textdomain()<\/code> call from class-pcal-plugin.php<\/code>. WordPress.org auto-loads translations for hosted plugins since WP 4.6, so the manual call is discouraged and unnecessary.<\/li>\n- Prefixed global variables in
uninstall.php<\/code> ($post_types<\/code> \u2192 $pcal_post_types<\/code>, etc.).<\/li>\n- Added
phpcs:ignore<\/code> annotations with justifications for the legitimate uses of the WordPress core the_content<\/code> filter in REST responses (processes shortcodes\/oEmbeds, matching standard WP behaviour).<\/li>\n- Added
phpcs:disable<\/code> annotations with justifications for WordPress cache plugin standard constants (DONOTCACHEPAGE<\/code>, DONOTCACHEOBJECT<\/code>, DONOTCACHEDB<\/code>) in class-pcal-archive-list.php<\/code> to match what we already did in class-pcal-month-grid.php<\/code> and class-pcal-rsvp-form.php<\/code>.<\/li>\n- Added
phpcs:ignore<\/code> annotation with justification for the one direct database query in uninstall.php<\/code> that finds and deletes every plugin record across the site (caching is meaningless for a one-shot uninstall operation).<\/li>\n- Trimmed Upgrade Notice entries to fit the 300-character limit.<\/li>\n<\/ul><\/li>\n
- No behavioural changes; no DB schema changes; safe drop-in upgrade for all installs.<\/li>\n<\/ul>\n\n
1.1.1.15<\/h4>\n\n\n- WP.org Plugin Check compliance:<\/strong> Comprehensive code-quality sweep addressing every issue surfaced by the Plugin Check automated linter (155 findings total: 96 errors + 59 warnings). The plugin now passes the full Plugin Check rule set with zero findings.\n\n
\n- Output escaping (53 fixes):<\/strong> Every variable echoed into HTML is now wrapped in
esc_url()<\/code>, esc_attr()<\/code>, esc_html()<\/code>, wp_kses_post()<\/code>, or cast to (int)<\/code>. URLs are built unescaped and escaped late at output site (best practice). Pre-built HTML fragments returned from internal renderers (PCAL_Filters, PCAL_Month_Grid, PCAL_Week_View, PCAL_Day_View, PCAL_Photo_View, PCAL_Archive_List, PCAL_Thumb) are documented with phpcs:ignore<\/code> comments explaining why they are safe.<\/li>\n- Date functions (29 fixes):<\/strong> Every bare
date()<\/code> call replaced with gmdate()<\/code> for deterministic UTC behaviour, except date_i18n()<\/code> calls which intentionally use site locale.<\/li>\n- Input sanitization (17 fixes):<\/strong> Every
$_GET<\/code> \/ $_POST<\/code> read now uses wp_unslash()<\/code> followed by an appropriate sanitiser (sanitize_key<\/code>, sanitize_text_field<\/code>, sanitize_email<\/code>, absint<\/code>, etc.). Read-only navigation parameters (filter inputs, view switching) are documented as such with phpcs:ignore<\/code> for the nonce sniff since no data is mutated.<\/li>\n- Nonce verification (21 fixes):<\/strong> All state-changing form handlers verify a nonce before processing input. Read-only display of redirect status flash messages is documented.<\/li>\n
- Translator comments (12 fixes):<\/strong> Every
sprintf( __() )<\/code> \/ printf( esc_html__() )<\/code> call with placeholders now has a \/* translators: *\/<\/code> comment directly above the gettext call for translator clarity.<\/li>\n- Constants prefix (8 fixes):<\/strong> All plugin constants prefixed with
PCAL_<\/code>. The three WordPress cache-plugin standard constants (DONOTCACHEPAGE<\/code>, DONOTCACHEOBJECT<\/code>, DONOTCACHEDB<\/code>) are documented with phpcs:disable<\/code> since these names are fixed by the WP cache plugin ecosystem (W3TC, WP Super Cache, etc.).<\/li>\n- Safe redirects (1 fix):<\/strong> Payment-gateway redirect now uses
wp_safe_redirect()<\/code> with the gateway host explicitly added via allowed_redirect_hosts<\/code> filter.<\/li>\n- File operations (1 fix):<\/strong> Replaced
@unlink()<\/code> with wp_delete_file()<\/code> (WP.org-recommended wrapper). The one remaining file_put_contents()<\/code> call (used to write a temporary .ics attachment that is immediately consumed by wp_mail()<\/code> then unlinked) is documented with a justification comment.<\/li>\n- Inline
<style><\/code> removed:<\/strong> The dynamic colour-variables <style><\/code> block in class-pcal-assets.php<\/code> is now attached via wp_add_inline_style()<\/code> instead of being echoed from a wp_head<\/code> hook.<\/li>\n<\/ul><\/li>\n- No DB schema changes; no behavioural changes. This is a pure code-quality release.<\/li>\n<\/ul>\n\n
1.1.1.14<\/h4>\n\n\n- Architectural change:<\/strong> The recurrence engine (recurrence authoring meta box, save handler, occurrence expander, RRULE parser) has been relocated from Lite into Site Calendar Pro 1.1.5. This brings Lite into compliance with the WordPress.org plugin-directory trialware guideline, which prohibits shipping locked feature code in a free plugin even when the lock is consensual. Lite-only installs no longer see the recurrence meta box at all; recurrence is now exclusively a Pro feature. The front-end calendar (Month grid and List view) gracefully shows each event as a single occurrence on its declared start date when Pro is not installed.<\/li>\n
- Compatibility:<\/strong> Sites running Site Calendar Pro must upgrade Pro to 1.1.5 alongside this Lite update. Pro 1.1.5 includes an activation guard that refuses to boot against Lite < 1.1.1.14; conversely, this Lite release relies on Pro 1.1.5 to provide the recurrence classes. Update both together.<\/li>\n
- Compliance:<\/strong> The \"Powered by Site Calendar\" credit is now OPT-IN. A new checkbox at Site Calendar \u2192 Settings \u2192 Appearance lets site administrators enable the credit; default is unchecked. The credit no longer appears anywhere on user-facing pages without explicit consent. (WP.org guideline on user-facing attribution.)<\/li>\n
- Compliance:<\/strong> The public REST endpoints (
\/wp-json\/pcal\/v1\/events<\/code> and \/wp-json\/pcal\/v1\/events\/<id><\/code>) no longer return custom-field values that are marked as show_public=false<\/code>. Internal-only custom fields are filtered out of the response. Authenticated integrations needing internal fields should register their own route with a proper permission_callback<\/code>.<\/li>\n- Compliance:<\/strong> RSVP form inputs (name, email, phone) are now sanitised with
sanitize_text_field()<\/code> \/ sanitize_email()<\/code> at the earliest possible point in the submission handler, before being passed to attendee registration or payment-gateway buyer data.<\/li>\n- Compliance:<\/strong> The Google Maps iframe embed on single-event pages is now disclosed in the readme's External services section, with links to Google's Terms of Service and Privacy Policy. The embed only fires when a venue address is present; events without a venue address render no map and produce no external request.<\/li>\n
- Compliance:<\/strong> Plugin text domain renamed from
pro-calendar<\/code> to getsitecalendar-lite<\/code> across all 388 gettext call sites, matching the WordPress.org plugin slug. Translation files (if any exist downstream) will need to be re-keyed; no existing translations are bundled.<\/li>\n- Fix:<\/strong> The \"Subscribe to calendar\" button and Add-to-calendar buttons stopped appearing in 1.1.1.12. The script enqueue is now correctly hooked to wp_enqueue_scripts (already fixed in 1.1.1.13 and retained here).<\/li>\n
- No DB schema changes; drop-in upgrade for Lite-only installs.<\/li>\n
- Housekeeping: bumped
Tested up to<\/code> to WordPress 7.0. Removed an internal-only MIGRATION.md<\/code> development file that shouldn't have been included in the production build.<\/li>\n<\/ul>\n\n1.1.1.13<\/h4>\n\n\n- Fix:<\/strong> The \"Subscribe to calendar\" button and \"Powered by Site Calendar\" credit stopped appearing below archive\/list views in 1.1.1.12. Root cause: the inline-script-to-enqueued-asset refactor in 1.1.1.12 called
wp_enqueue_script()<\/code> inside a wp_footer<\/code> priority 99 callback, which runs AFTER wp_print_footer_scripts<\/code> (priority 20) has already emitted the script tags \u2014 so ical-injector.js<\/code> was never actually loaded on the page. The <template><\/code> element was correctly emitted, but the injector that reads it never ran. 1.1.1.13 moves the enqueue to the wp_enqueue_scripts<\/code> hook so the script tag is emitted at the correct point in the page lifecycle. The Add-to-calendar button (Google\/Outlook\/.ics) on single-event pages was affected by the same bug and is also fixed.<\/li>\n- No DB schema changes; drop-in upgrade.<\/li>\n<\/ul>\n\n
1.1.1.12<\/h4>\n\n\n- Renamed display name to \"GetSiteCalendar Lite\" to make the WordPress.org directory listing distinctive. Text domain, class names, file names, option keys, custom post types, and shortcodes are all unchanged \u2014 this is a directory-listing rename only, with zero impact on existing installs.<\/li>\n
- Tested up to: WordPress 7.0.<\/li>\n
- Lowered admin menu position from 25 to 80 so Site Calendar sits below WordPress core items in the standard hierarchy.<\/li>\n
- Refactored 8 inline
<script><\/code> and <style><\/code> blocks into proper wp_enqueue_script<\/code> \/ wp_enqueue_style<\/code> \/ wp_add_inline_script<\/code> \/ wp_add_inline_style<\/code> calls. New asset files: