{"id":11191,"date":"2026-05-27T18:30:05","date_gmt":"2026-05-27T10:30:05","guid":{"rendered":"https:\/\/aeosub.com\/variolab-ab-testing\/"},"modified":"2026-05-27T18:30:05","modified_gmt":"2026-05-27T10:30:05","slug":"variolab-ab-testing","status":"publish","type":"post","link":"https:\/\/aeosub.com\/zh\/variolab-ab-testing\/","title":{"rendered":"Variolab \u2013 A\/B Testing"},"content":{"rendered":"
\"Variolab<\/div>\n
\n\n\n\n\n\n\n\n
Developer<\/th>\nGuillaume Ferrari<\/a><\/td>\n<\/tr>\n
Version<\/th>\nv0.15.0<\/td>\n<\/tr>\n
Active Installs<\/th>\n0 +<\/td>\n<\/tr>\n
Requires \/ Tested<\/th>\n6.0 \/ 6.9.4<\/td>\n<\/tr>\n
Last Updated<\/th>\n2026-05-27 9:58am GMT<\/td>\n<\/tr>\n
Official Link<\/th>\nView Details \u2192<\/a><\/td>\n<\/tr>\n<\/table><\/div>\n
Lightweight A\/B testing for pages: internal tracking, persistent-cookie 50\/50 split, GDPR-friendly. No third-party dependency.<\/div>\n

Run A\/B tests by pointing the plugin at two existing pages \u2014 one as the control (Variant A), one as the variant (Variant B). Visitors are split 50\/50 via a persistent cookie; once assigned, they always see the same variant.<\/p>\n

Tracking is fully internal: impressions and conversions land in a custom database table, and the wp-admin dashboard shows conversion rates, lift, and a basic statistical significance indicator (two-proportion z-test).<\/p>\n

Security-audited internally before every release (situated checklist + OWASP grid). See SECURITY.md on GitHub for the disclosure policy and the latest audit report (docs\/security\/latest.md<\/code>).<\/p>\n

Features<\/h4>\n
    \n
  • Page-level A\/B tests (entire page as variant \u2014 no Gutenberg surgery needed)<\/li>\n
  • Persistent cookie split (httponly, samesite=Lax)<\/li>\n
  • Internal tracking \u2014 no third-party dependency, no data leaving your site<\/li>\n
  • Conversion goals: URL visited or CSS selector clicked<\/li>\n
  • Auto bypass for logged-in editors and bots<\/li>\n
  • Two-proportion z-test for statistical significance<\/li>\n
  • abtest_event_logged<\/code> action hook ready for v2 GA4\/webhook integrations<\/li>\n<\/ul>\n

    Caching<\/h3>\n

    A\/B testing breaks under page caching: the first variant served gets cached for everyone, all subsequent visitors get that same response, the 50\/50 split dies. The plugin handles most cases automatically.<\/p>\n

    What the plugin does automatically<\/h4>\n
      \n
    1. Sends Cache-Control: no-store<\/code> headers<\/strong> on every page response under A\/B test. Respected by Cloudflare, Varnish, Kinsta edge cache, nginx page cache, and most server-level caches.<\/li>\n
    2. Hooks WP Rocket’s rocket_cache_reject_uri<\/code> filter<\/strong> when WP Rocket is detected \u2014 your test URLs are auto-added to the never-cache list.<\/li>\n
    3. Hooks LiteSpeed Cache’s litespeed_force_nocache_url<\/code> filter<\/strong> when LiteSpeed is detected \u2014 same idea.<\/li>\n
    4. Surfaces an admin notice<\/strong> when a cache plugin or known host (like Kinsta) is detected, with what to verify.<\/li>\n<\/ol>\n

      Hosting on Kinsta<\/h4>\n

      Kinsta uses a two-layer cache (nginx server-cache + Cloudflare Enterprise edge cache). The plugin’s no-store headers bypass both \u2014 but for 100% safety, also add your test URLs to MyKinsta \u2192<\/span> Tools \u2192<\/span> Cache \u2192<\/span> Cache Bypass<\/strong> as URL Patterns (e.g. ^\/promo\/$<\/code>). After publishing a new test, purge the Kinsta cache<\/strong> to flush any version cached before the experiment started.<\/p>\n

      Verify it works by inspecting headers on your test URL:<\/p>\n

      curl -I https:\/\/yoursite.com\/promo\/\n<\/code><\/pre>\n
      Look for X-Kinsta-Cache: BYPASS<\/code> (or MISS<\/code>). If you see HIT<\/code>, you’re getting the cached version and the split is broken \u2014 purge the cache.<\/p>\n
      Hosting on other CDNs \/ hosts<\/h4>\n
        \n
      • Cloudflare APO<\/strong>: Cache-Control headers from origin override the cache. Should work out of the box. Verify with curl -I<\/code> looking for cf-cache-status: BYPASS<\/code> or DYNAMIC<\/code>.<\/li>\n
      • WP Engine<\/strong>: Add the test URLs to the “Cache Exclusions” list in your User Portal.<\/li>\n
      • Pagely \/ Pantheon \/ Pressable<\/strong>: Cache-Control headers respected. Add manual URL exclusion in the host’s panel for safety.<\/li>\n<\/ul>\n
        Plugins not auto-supported<\/h4>\n
        For W3 Total Cache, WP Super Cache, WP Fastest Cache, and Cache Enabler \u2014 the plugin shows a notice but does not automatically exclude URLs (no clean public API). Manually add your test URLs to that plugin’s cache exclusion list.<\/p>\n
        REST API<\/h3>\n
        Pull stats programmatically from external tools (n8n, Make, Pipedream, dashboards).<\/p>\n
          \n
        • Endpoint: GET \/wp-json\/abtest\/v1\/stats<\/code><\/li>\n
        • Auth: WP Application Passwords (Basic Auth). The user must have manage_options<\/code>.<\/li>\n
        • Generate one in your WP profile \u2192<\/span> Application Passwords.<\/li>\n<\/ul>\n
          Optional query params:<\/p>\n
            \n
          • url=\/promo\/<\/code> \u2014 filter to a single test URL.<\/li>\n
          • experiment_id=38<\/code> \u2014 fetch a single experiment by ID.<\/li>\n
          • status=running|paused|ended|draft<\/code> \u2014 filter by status.<\/li>\n
          • from=YYYY-MM-DD&to=YYYY-MM-DD<\/code> \u2014 restrict event date range for the stats computation.<\/li>\n
          • breakdown=daily<\/code> \u2014 include per-day time series (for charting).<\/li>\n<\/ul>\n
            Example:<\/p>\n
            curl -u 'admin:xxxx xxxx xxxx xxxx xxxx xxxx' 'https:\/\/yoursite.com\/wp-json\/abtest\/v1\/stats?status=running'\n<\/code><\/pre>\n
            The response includes for each experiment: id, title, test_url, status, dates, control\/variant IDs, goal, and a stats block with A\/B impressions\/conversions\/rate, lift, p-value, significance, and 95% confidence interval bounds for both lift and absolute difference.<\/p>\n
            Privacy<\/h3>\n
            The plugin stores no raw IP, no User-Agent, no email, no name, and no cross-site tracking identifier. The events table contains: experiment_id, variant, test_url, event_type, created_at, and a visitor_hash<\/code> = first 16 hex chars (64 bits) of sha256(IP + UA + wp_salt('auth'))<\/code> \u2014 non-reversible, single-site, salt-rotated, dedup-safe. Cookies are httponly, samesite=Lax, secure on HTTPS, value = a single letter (a\/b\/c\/d), 30-day TTL.<\/p>\n
            A native WordPress privacy guide snippet is registered automatically \u2014 find it under Settings \u2192<\/span> Privacy \u2192<\/span> Policy Guide \u2192<\/span> Variolab \u2013 A\/B Testing to paste into your privacy policy.<\/p>\n
            For consent-banner sites: enable “Require consent” in the plugin settings and wire your banner to the abtest_visitor_has_consent<\/code> filter (return true to track, false\/null to block). Snippets for Complianz, CookieYes, and Cookiebot are in the README on GitHub.<\/p>\n
            Right to erasure: because no reversible identifier is stored, individual deletion isn’t possible. Use TRUNCATE wp_abtest_events<\/code> to erase all A\/B testing data.<\/p>\n
            External services<\/h3>\n
            This plugin connects to one external service, only when the site administrator opts in<\/strong> through the plugin’s Settings \u2192<\/span> Google Analytics 4 panel by entering a Measurement ID and API Secret. With the GA4 integration disabled (default), no data leaves your site.<\/p>\n
            Google Analytics 4 (Measurement Protocol)<\/h4>\n
            What it is and what it’s used for: when the GA4 integration is enabled, the plugin forwards A\/B-test impression and conversion events to Google Analytics 4 via the Measurement Protocol, so the test results can be analyzed alongside your existing GA4 reports.<\/p>\n
            What data is sent and when: on each impression and each conversion logged by the plugin, a single fire-and-forget HTTPS request is sent to https:\/\/www.google-analytics.com\/mp\/collect<\/code> with a JSON payload containing:<\/p>\n
              \n
            • client_id<\/code> \u2014 the plugin’s internal visitor hash (truncated salted SHA-256 of IP + User-Agent; never the raw IP or UA)<\/li>\n
            • events[].name<\/code> \u2014 abtest_impression<\/code> or abtest_conversion<\/code><\/li>\n
            • events[].params.experiment_id<\/code> \u2014 the WordPress post ID of the experiment<\/li>\n
            • events[].params.variant<\/code> \u2014 the variant served (a<\/code>, b<\/code>, c<\/code>, or d<\/code>)<\/li>\n
            • events[].params.test_url<\/code> \u2014 the URL path under test (e.g. \/promo\/<\/code>)<\/li>\n<\/ul>\n
              No raw IP address, User-Agent string, email, name, WordPress user ID, or page content is sent.<\/p>\n
              Service provided by Google. Please review their terms and policies before enabling the integration:<\/p>\n
                \n
              • Google Analytics terms of service: https:\/\/marketingplatform.google.com\/about\/analytics\/terms\/us\/<\/li>\n
              • Google privacy policy: https:\/\/policies.google.com\/privacy<\/li>\n<\/ul>","protected":false},"excerpt":{"rendered":"
                Lightweight A\/B testing for pages: internal tracking, persistent-cookie 50\/50 split, GDPR-friendly. No third-party dependency.<\/p>","protected":false},"author":1,"featured_media":9317,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[252],"tags":[1838,760,1495,1841,555],"class_list":["post-11191","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-trends","tag-a-b-testing","tag-analytics","tag-conversion","tag-split-testing","tag-wordpress-plugin"],"_links":{"self":[{"href":"https:\/\/aeosub.com\/zh\/wp-json\/wp\/v2\/posts\/11191","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/aeosub.com\/zh\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/aeosub.com\/zh\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/aeosub.com\/zh\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/aeosub.com\/zh\/wp-json\/wp\/v2\/comments?post=11191"}],"version-history":[{"count":0,"href":"https:\/\/aeosub.com\/zh\/wp-json\/wp\/v2\/posts\/11191\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/aeosub.com\/zh\/wp-json\/wp\/v2\/media\/9317"}],"wp:attachment":[{"href":"https:\/\/aeosub.com\/zh\/wp-json\/wp\/v2\/media?parent=11191"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/aeosub.com\/zh\/wp-json\/wp\/v2\/categories?post=11191"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/aeosub.com\/zh\/wp-json\/wp\/v2\/tags?post=11191"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}