=== Attesso Cookie Consent ===
Contributors: attesso
Tags: cookie consent, gdpr, cookie banner, privacy, consent
Requires at least: 6.0
Tested up to: 7.0
Requires PHP: 7.4
Stable tag: 1.0.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Holds analytics, marketing and embed scripts until your visitor agrees, and keeps a signed record of every choice. Requires a free Attesso account.

== Description ==

Most cookie banners ask for permission after the tracking has already started. The visitor sees a box, the pixels have long since fired, and the consent record describes something that never happened.

This one runs before them. It prints its script at the earliest point WordPress allows in the page head, ahead of Google Analytics, Meta Pixel, Google Tag Manager, Hotjar, Clarity and the tag managers that load them, so those scripts are held rather than caught. Nothing third party runs until somebody chooses.

Anything it does not recognise is held too. A new pixel added by a marketing agency next month is blocked on the day it appears, without anyone updating a list.

= Setup =

1. Install and activate.
2. Attesso, in the sidebar.
3. Click **Protect this site**.

That is the whole setup. No account to create first, no key to copy: the plugin verifies the site with our servers and sets everything up, then emails you a link to claim the account whenever you like.

If you already use Attesso, **Connect your account** signs you in and attaches this site, or you can paste a pairing code from your dashboard. There is also a plain site-key field for hosts that block incoming requests.

**What gets held**

Trackers do not always arrive as a script tag, so a blocker that only looks for those misses the rest. This one also holds:

* Tracking pixels, including invisible ones created in the background
* Data sent as a visitor leaves the page, which is how some analytics tools report
* Background requests to other companies' servers
* Embedded video, maps and players, replaced by a placeholder that loads on click

Embeds are stopped in the page itself, before your visitor's browser ever sees them. Most tools cannot do this: a browser starts fetching an embedded video while it is still reading the page, before any blocking code has had a chance to run.

**What you get in WordPress**

The whole thing lives in your admin. There is no second dashboard to keep open.

* **Overview**: how many people answered, and what they chose
* **Banner**: wording, colours, position, with a live preview
* **Trackers**: everything found on your site, with a plain-English explanation of each and a dropdown to recategorise it
* **Consent log**: every choice, with CSV export
* **Cookie policy**: written from what the scan actually found, publishable as a real WordPress page in one click
* **Scans**: history, a live view while one runs, and control over how often they happen
* **Alerts**: anything new that turned up

= Caching and optimisation plugins =

Read this if you use one. A consent blocker that gets delayed is worse than no blocker: the analytics tags it was holding run first, so tracking happens before consent while the banner still claims otherwise.

The plugin ships with the documented opt-out attributes for **WP Rocket**, **LiteSpeed Cache** and **Cloudflare Rocket Loader**, so those leave it alone automatically.

**W3 Total Cache** and **Autoptimize** have no attribute-based opt-out. If you use either, exclude `a.js` from JavaScript minify, combine and defer in its settings. One line in an exclusion box.

== External services ==

This plugin connects to Attesso, a consent management service operated by Attesso. Using it requires an Attesso account, which the plugin can create for you during setup. Before setup, the plugin makes no external connections at all and adds nothing to your pages.

**The short version**: your visitors load one small script from our servers, and when somebody answers the banner their choice is saved with us as the record that proves consent was given. We never receive your WordPress login, your customers' names or email addresses, or the pages anyone visited. Everything below is the same thing said precisely, because a consent tool that is vague about its own data handling has not understood the problem.

**On every page of your site**

Once a site is connected, every page view loads one script from `https://cdn.getattesso.com/a.js`. That request carries your site key and the normal information any browser sends when fetching a file, including the visitor's IP address and user agent.

**When a visitor answers the banner**

Their choice, the categories they allowed, a timestamp, the version of your policy they saw and their coarse region are sent to `https://getattesso.com/api/consent` and stored as a consent record. This is the record that demonstrates consent was given, and it is the reason the plugin exists.

When the script holds a third-party host that Attesso has not seen on your site before, that hostname is sent to `https://getattesso.com/api/observed` so your cookie policy can describe it. The page URL is not sent, and no visitor identifier is sent.

**During setup**

* `https://getattesso.com/api/plugin/provision`: creates your account. Sends this site's address and name, your WordPress administrator email address, and a one-time secret.
* `https://your-site.com/wp-json/attesso/v1/challenge` (or `?rest_route=` on plain permalinks): this is a route on **your** own site, not ours. Our server fetches it once during setup to confirm you control the domain, the way a TLS certificate is validated. Nothing is sent to it; a one-time random value is read back and discarded.
* `https://getattesso.com/connect`: opened in your browser if you connect an existing account.
* `https://getattesso.com/api/plugin/pair`: exchanges a pairing code from your dashboard for this site's credentials.

**From the admin screens, when you open them**

These carry an access token issued to this site, and no visitor data.

* `/api/plugin/dashboard`: the figures and settings shown on the screens
* `/api/plugin/version`: a small check for whether anything changed, so the screens stay current without refetching everything
* `/api/plugin/scan-status`: live progress while a scan runs
* `/api/plugin/scan`: one scan in detail
* `/api/plugin/banner`: saves banner changes
* `/api/plugin/action`: saves a tracker category, resolves an alert, requests a scan, changes the scan schedule, or builds a CSV export
* `/api/plugin/checkout`: asks Stripe for a checkout link when you start a plan. Card details are entered on Stripe's own pages and never touch WordPress.

No WordPress login, password or user data is sent at any point.

Service terms: https://getattesso.com/legal/terms
Privacy policy: https://getattesso.com/legal/privacy

== Frequently Asked Questions ==

= Do I need an account before I install this? =

No. Click **Protect this site** and the plugin creates one, using your WordPress administrator email. You get a link to claim it whenever suits you; the banner works in the meantime.

= Do I need a paid account? =

There is a free trial, and pricing starts at $10 a month for one site, less per site as you add more. The plugin behaves the same either way; the banner stops serving when a trial ends without a plan.

= Will this slow my site down? =

It adds one script, around 10KB compressed, served from a CDN. It is deliberately a plain blocking script rather than a deferred one, because a consent blocker that loads late has already lost: the trackers it was meant to hold have run.

= Does it work with Google Analytics and Meta Pixel? =

Yes, and with Google Tag Manager, Hotjar, Clarity, LinkedIn, TikTok, Pinterest and the rest. It does not need to know about them individually. Anything third party is held unless a rule says otherwise, so new tools are covered from the moment they appear.

= Does it support Google Consent Mode v2? =

Yes. Consent state is pushed to Google's consent API before their tags run, which is the order Google requires. A stricter default is set for the EEA, the UK and Switzerland.

= Will it break my page builder or my embeds? =

Embedded video and maps are held until consent and show a small placeholder that loads them on click. Elementor, Divi, Beaver Builder and the block editor are unaffected, since the plugin touches nothing but the head and third-party iframes.

= How often is my site re-scanned? =

Weekly by default. You can change it to daily or monthly on the Scans screen, and scan on demand at any time. A tracker found by a re-scan is blocked from the moment it appears.

= Can visitors change their mind? =

Yes, and they must be able to: consent has to be as easy to withdraw as it was to give. A small tab sits at the edge of the page after somebody answers, and reopens the choices.

= I use a caching plugin. Anything to do? =

WP Rocket, LiteSpeed and Cloudflare Rocket Loader are handled automatically. For W3 Total Cache or Autoptimize, exclude `a.js` from JavaScript delay and combine. See the Description above.

= What happens if I deactivate the plugin? =

The banner stops appearing and nothing is held any more. Your consent records stay in your Attesso account. Deleting the plugin removes its settings from your WordPress database and nothing else.

= Setup did not work. What now? =

Some hosts block the incoming request we use to confirm you own the site. Open the Site key section on the Settings screen, copy your key from the Install screen of your dashboard, and paste it there. The result is identical.

== Screenshots ==

1. The whole thing runs inside wp-admin. No second dashboard to keep open.
2. Everything found loading on your site, and what happens to it before consent.
3. Opt-in rate, tags held, and what visitors actually chose this week.
4. A cookie policy written from the scan, publishable as a real page in one click.
5. The banner designer, with a live preview beside the wording.

== Changelog ==

= 1.0.0 =
* First release.

== Upgrade Notice ==

= 1.0.0 =
First release.
