feat: support self-hosted OpenPanel instances

[eightam]

Summary

This PR adds support for self-hosted OpenPanel instances. Previously the proxy endpoint (https://api.openpanel.dev/) and tracking script URL (https://openpanel.dev/op1.js) were hardcoded, making the plugin unusable with self-hosted deployments.

Fully backward compatible: leaving both new settings empty keeps the current hosted behavior.

Changes

Settings (Settings → OpenPanel)

• API URL (optional) – base URL of your OpenPanel API for self-hosted setups (e.g. https://analytics.example.com/api). Empty = hosted https://api.openpanel.dev/.
• Tracking script URL (optional) – URL of op1.js for fully self-hosted setups. Empty = hosted https://openpanel.dev/op1.js.
• Both are validated/sanitized to http(s) URLs with a host at save time.

Filters (code-level overrides, take precedence over settings)

Filter	Purpose
openpanel_api_url	Override the API base URL the proxy forwards to
openpanel_script_url	Override the URL op1.js is loaded from
openpanel_proxy_allowed_hosts	Extend the hostname whitelist the proxy may forward to

Precedence everywhere: filter > saved setting > hosted default.

Security

• The proxy hostname whitelist is now derived from the effective API URL (plus the hosted openpanel.dev hosts, which remain allowed by default). A self-hosted API host is whitelisted automatically; arbitrary hosts are still rejected with 403 invalid_target.
• openpanel_proxy_allowed_hosts exists so operators can deliberately whitelist additional hosts (e.g. a dedicated ingest subdomain).

Caching

• The op1.js transient cache is now keyed by script URL (op_wp_op1_js_<md5(url)>), so switching between hosted/self-hosted never serves a stale cached script. The cache-clear action clears both the legacy and new keys.

Docs

• README.md: new "Self-Hosted OpenPanel" section with the filter reference table.
• readme.txt: installation steps, new FAQ entries (self-hosted + code-level overrides), updated External Services section, changelog and upgrade notice.

Testing

• php -l clean.
• 23 smoke checks against the plugin class (stubbed WP functions) covering: default URLs, setting overrides, filter precedence, whitelist derivation (hosted/self-hosted/http/https), rejection of arbitrary hosts and non-http schemes, and URL setting sanitization. All pass.

Example usage

add_filter('openpanel_api_url', fn () => 'https://analytics.example.com/api');

Or, non-technically: Settings → OpenPanel → API URL.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: ffc5beae-90af-4d7f-beb0-8a02cb4d21cf

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}