TomAwesome Review Widgets

TomAwesome Review Widgets lets you connect multiple businesses, synchronize reviews, and create unlimited shortcode widgets with independent layouts and filters.

The plugin connects directly from your WordPress server to Google. It does not use a TomAwesome cloud service, does not send review data to the plugin author, and does not include advertising or paid feature gates.

Before you install: Google setup is required

This is not a plugin that displays Google reviews immediately after activation.

TomAwesome does not provide a shared API key, preapproved Google Cloud project, OAuth application, or shortcut around Google’s approval process. Before any reviews can appear, the site owner must create their own Google connection, add a Review Source, and synchronize it.

There are two very different setup paths:

• Google Places API — easier, but limited: Requires a billing-enabled Google Cloud project, Places API (New), an API key, and a Place ID. It does not require Business Profile API approval or OAuth. Google supplies at most five reviews selected by relevance.

• Managed Business Profile — advanced, but complete: Requires an eligible verified Business Profile, a dedicated Google Cloud project, Google’s Basic API Access approval, seven enabled Business Profile APIs, Google Auth Platform configuration, and an OAuth web client. It can retrieve the complete paginated review list for locations the connected account owns or manages.

Managed setup is substantially harder and is not a one-click process. Google controls project approval, may take days or longer, and does not guarantee a completion date. Installing this plugin does not begin or accelerate that approval.

If five Google-selected reviews are enough, Places is normally the best starting point. A widget can be switched to a synchronized managed source later.

The complete beginner walkthrough is available after activation under Review Widgets > Getting Started and in the project’s installation and Google setup guide.

Review sources

• Google Business Profile: for verified locations you own or are authorized to manage. With approved Google API access, all required APIs, and OAuth, the plugin can retrieve the complete paginated review list.

• Google Places API (New): for a public Place ID. Google currently returns at most five reviews selected by relevance.

Unlimited widget configurations

• Grid, list, carousel, or single featured review

• Independent business/source selection

• Review count and minimum rating

• Newest, oldest, highest-rated, or randomized order

• Written reviews only

• Expandable long review text

• Reviewer photo and date controls for managed Business Profile sources; Places sources always show available author attribution

• Business rating summary

• Google business-name heading with an optional custom public heading per widget

• Read-all and leave-a-review links

• Responsive desktop, tablet, and mobile columns

• Built-in color, margin, padding, border, and corner-radius controls

• Optional custom CSS classes

• Shortcodes such as [tomawesome_reviews id="123"]

Healthcare Privacy Mode

Healthcare Privacy Mode is an optional, conservative workflow intended for healthcare and other privacy-sensitive organizations. When enabled for a widget, the plugin:

• Displays only reviews separately approved by an administrator in the Review Library.

• Requires privacy-reviewed display copy.

• Replaces the imported reviewer name with “Google Reviewer.”

• Hides reviewer photos, profile links, exact review dates, and owner responses.

• Suppresses links that could lead visitors directly back to the unsanitized review listing.

• Keeps privacy-reviewed copy separate from the untouched synchronized review.

Healthcare Privacy Mode is not available for Google Places sources because current Google Maps policies require Places reviews to retain author attribution and individual source links.

This feature is a technical safeguard. It is not legal advice, a certification, or a guarantee that a site or organization complies with HIPAA or any other law. Site owners remain responsible for authorizations, policies, risk analysis, workforce training, Google API terms, and legal review.

Data handling

API credentials and OAuth tokens are encrypted locally using a key derived from the site’s WordPress salts. Imported review content is stored in the site’s WordPress database for no more than 30 days and is refreshed during synchronization. Owner responses are not stored.

The plugin adds suggested disclosure text to Tools > Privacy Policy Guide.

External services

This plugin connects to Google services only after an administrator configures a Google connection or API key.

For Google Business Profile, the plugin sends the administrator through Google’s OAuth consent flow, sends the OAuth client credentials and authorization code to Google’s token endpoint, and sends authorized account/location identifiers to Google Business Profile API endpoints. Google returns account, location, aggregate rating, reviewer attribution, rating, review text, and review timestamps.

Requests occur when an administrator connects or discovers locations, during a manual synchronization, and during the daily scheduled synchronization.

For Places API (New), the plugin sends the configured Place ID and API key to Google. Google returns Place details, aggregate rating data, reviewer attribution, review text, timestamps, individual review links, and any required third-party data-provider attributions. Requests occur during manual and daily synchronization.

For Places sources, available reviewer photos and profile links are required attribution and are always displayed; a visitor’s browser requests those images from Google’s URL. For managed Business Profile sources, reviewer photos remain optional and Healthcare Privacy Mode prevents them from loading.

Sites that publish Places API content must maintain publicly accessible Terms of Use and a Privacy Policy that incorporate Google’s Terms of Service and Privacy Policy. Places widgets display Google Maps attribution, all available author attribution, returned data-provider attribution, individual review links, and a description of review selection and filtering.

Why Places widgets contain extra public information

Google’s current Places policies require sites displaying Places reviews to identify Google Maps as the content source, credit authors and returned data providers, give visitors direct access to each source review, and clearly explain how the reviews are selected, filtered, and ordered. The plugin enforces these elements only when a widget uses a Google Places source. They are not advertising and should not be hidden with CSS or removed by a theme override.

The selection/filter notice is placed beside the Google Maps attribution in the widget footer and updates automatically with the widget settings. ”

After Business Profile API access is approved, import and synchronize the managed location as a new Review Source, then edit the widget and select that managed source. The Places selection notice, Google Maps Places attribution, returned provider credit, and individual Places-review links disappear automatically. Managed sources can retrieve the complete review list, make reviewer photos optional, and allow Healthcare Privacy Mode.

com/terms

com/privacy

com/my-business/content/policies

com/maps/documentation/places/web-service/policies

TomAwesome Review Widgets is not affiliated with, sponsored by, or endorsed by Google LLC. Google and Google Business Profile are trademarks of Google LLC.

com/drumhead39/tomawesome-review-widgets