Google Reviews Widget

A WordPress plugin for displaying Google reviews from the Google Places API.

Built by Daniel Sputa at Comenium Consulting.

What It Does

• Displays Google reviews with the [google_reviews] shortcode.
• Supports a simple Places API source and an optional owner-authorized Google Business Profile source.
• Verifies the active Google connection from the WordPress settings page.
• Includes setup links for Google Maps Credentials, API key restrictions, and Google Place ID Finder.
• Supports list, responsive grid card, and arrow-controlled horizontal carousel layouts.
• Offers display controls for up to six columns, card style, review order, review count, minimum rating, summary card, avatars, rating header, and Google link.
• Displays Google-supplied reviewer photos and uses reviewer initials when a photo is missing or unavailable.
• Caches Google API responses, failed requests, and refresh locks to control API usage.
• Checks GitHub Releases for cryptographically signed WordPress plugin updates.

Requirements

• WordPress 6.0 or newer.
• PHP 7.4 or newer.
• A Google Maps Platform API key with Places API enabled.
• Billing enabled on the Google Cloud project.
• A valid Google Place ID for the business.
• For more than five reviews: approved Google Business Profile API access, a Web OAuth client, and owner or manager access to a verified location.

Installation

1. Copy the google-reviews-widget folder into wp-content/plugins/.
2. Activate Google Reviews Widget in WordPress.
3. Go to Settings -> Google Reviews.
4. Add your Google Maps API key and Google Place ID.
5. Click Verify API Key and Place ID.
6. Place this shortcode where reviews should appear:

[google_reviews]

For stronger API key protection, define the key above WordPress's "stop editing" line in wp-config.php instead of saving it in the database:

define('GRW_GOOGLE_MAPS_API_KEY', 'your_api_key_here');

Because the plugin calls Google from the WordPress server, restrict this key to Places API (New) and the server's outbound IP address. A browser referrer restriction is not appropriate for this server-side request.

Displaying More Than Five Reviews

The default Places API connection returns a maximum of five individual review records. To display up to 100 reviews:

1. Obtain approval for the Google Business Profile APIs.
2. In Google Cloud, create an OAuth Client ID with the Web application type.
3. In Settings -> Google Reviews, choose Google Business Profile as the Review Source.
4. Copy the plugin's Authorized Redirect URI into the OAuth client's authorized redirect URI list.
5. Save the OAuth Client ID and Client Secret in WordPress.
6. Click Connect Google Account and grant access using an owner or manager account for the verified location.
7. Select the Business Profile location, set Reviews to Display up to 100, save, and verify the connection.

OAuth secrets and refresh tokens are stored in separate non-autoloaded WordPress options and are never rendered back into the settings HTML. For stronger protection, they can be defined in wp-config.php:

define('GRW_GOOGLE_OAUTH_CLIENT_ID', 'your_client_id.apps.googleusercontent.com');
define('GRW_GOOGLE_OAUTH_CLIENT_SECRET', 'your_client_secret');
define('GRW_GOOGLE_OAUTH_REFRESH_TOKEN', 'your_refresh_token');

Shortcode Options

[google_reviews layout="carousel" card_style="classic" limit="5" order="newest" show_badge_card="true"]

Available options:

• layout: list, grid, or carousel.
• columns: Responsive grid columns, from 1 to 6.
• card_style: classic, compact, or spotlight.
• limit: Number of review records to show. Places supports 1 to 5; Business Profile supports 1 to 100.
• order: newest or oldest. Newest is the default.
• min_rating: Minimum star rating to display.
• show_header: Show the business rating header. Use true or false.
• show_badge_card: Show a Google-style business summary as the first card. Use true or false.
• show_avatars: Show reviewer photos. Use true or false.
• show_cta: Show a link to view reviews on Google. Use true or false.

Review Source Differences

Google can report the business's full rating count—for example, 50 total ratings—but Places API (New) returns a maximum of five individual review records, selected by relevance. The Google Business Profile API is different: an authorized owner or manager can retrieve reviews in pages of up to 50. This plugin follows pagination and caches up to 100 reviews for display.

Local API Verification

Create a local .env.local file in this repo:

GOOGLE_MAPS_API_KEY=your_api_key_here
GOOGLE_PLACE_ID=your_place_id_here

Then run:

php scripts/verify-google-places-key.php

The script checks that the key can call Place Details, that the Place ID is valid, and that the reviews fields are accessible. It does not print the API key.

GitHub-Based WordPress Updates

The plugin checks the latest GitHub Release at:

https://github.com/dsputa4197/wordpress-google-reviews/releases/latest

Starting with version 0.2.1, WordPress accepts an update only when the release includes all three assets:

google-reviews-widget.zip
google-reviews-widget.zip.manifest.json
google-reviews-widget.zip.sig

The zip must contain the google-reviews-widget plugin folder at the top level. The manifest binds the repository, version, asset name, and SHA-256 checksum together. Its detached Ed25519 signature is verified with the public key embedded in the installed plugin before WordPress extracts any PHP.

Creating a Signed Release

The offline private signing key is stored locally as .release-signing-private.key, is ignored by Git, and must be backed up securely. Do not upload or commit it.

After bumping the plugin version and building google-reviews-widget.zip, create the signed metadata:

php scripts/sign-release.php google-reviews-widget.zip 0.4.2
php scripts/verify-release.php google-reviews-widget.zip

Attach the zip, manifest, and signature to a draft GitHub Release, then publish the release after all three assets are present. Repository-level immutable releases provide an additional safeguard against published assets being replaced. Replace 0.4.2 with the version being released in future builds.