=== CodingFreaks Cookiemanager ===
Contributors: codingfreaks
Donate link: https://coding-freaks.com
Tags: GDPR, Cookie, Cookie Notice, DSGVO, Consent
Requires at least: 6.9
Tested up to: 7.1
Stable tag: 2.2.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html
Requires PHP: 8.1
Shows the cookie banner you configure in CodingFreaks and holds back scripts and embeds in its optional categories until the visitor agrees.

== Description ==

CodingFreaks Cookiemanager shows the cookie banner of your CodingFreaks project on your WordPress site. In the CodingFreaks app you scan your site, choose the services and categories of your banner and set its texts and design. When you publish, the plugin shows the new banner.

### Features

* A banner with categories that visitors accept, reject or choose one by one. Texts in Danish, Dutch, English, French, German, Italian, Polish, Portuguese and Spanish.
* Content blocker: scripts, embedded iframes and images of a service in an optional category wait until the visitor agrees to that category (for example Gravatar avatars in comments). Services you put in the required category are not held back.
* Cookie declaration: the shortcode [cf_cookie_declaration] or the block "Cookie Declaration" lists the cookies of your banner on any page, for example your privacy policy. It follows every publish.
* Google Consent Mode v2: when you switch it on in your project, the plugin sets the consent default first in the page head, and the banner passes the visitor's choice on to Google tags.
* WP Consent API and GTM4WP: with Consent Mode on, plugins that read the WP Consent API (for example Site Kit by Google) and GTM4WP follow the visitor's choice.
* A log of the choices that visitors' browsers send from the banner (consent ID, time, categories and banner revision), in your CodingFreaks project.
* Your site serves the banner from a local copy. If the CodingFreaks service cannot be reached, the last published banner keeps running.
* Changes you publish in CodingFreaks reach your site right away.

### Demo and guide

[Demo website](https://cookiedemo.coding-freaks.com/)
[Setup guide](https://coding-freaks.com/resources/documentation/start-your-cookie-onboarding/cookie-banner-settings/cookie-manager)
[Product website](https://coding-freaks.com/web-cookie-management-plugin)


== External services ==

This plugin connects to the CodingFreaks Cookie Manager service to deliver the cookie banner you configure there. It uses the API endpoint you enter in the plugin settings (https://app.coding-freaks.com).

* Banner sync: your server downloads your published banner configuration and banner files (manifest.json, config.json, the banner script and stylesheet) and serves them from your own site.
* Consent record: when a visitor accepts, rejects or changes their choice in the banner, the visitor's browser sends a record of that choice to the service (/api/v1/consent/log): a random consent ID, which the banner also keeps in a cookie in the visitor's browser (182 days, unless you set another lifetime in your project), the time of the choice, the accepted, rejected and changed categories and services, and the revision of the banner. Like every web request, it reaches the service with the visitor's IP address and user agent, which the service's web server writes to its access log. The service keeps the consent record for 24 months.
* Connection check: when you save the settings or update the plugin, it sends your API key and secret, the plugin version and the address of its sync endpoint (/wp-json/codingfreaks/v1/sync) to the service.
* Sync notification: after every publish, and once a day, the service sends a request signed with your API secret to that sync endpoint, so a change reaches your site right away.

Terms of use: https://coding-freaks.com/terms-of-use
Privacy policy: https://coding-freaks.com/privacy-policy

== Installation ==

1. In WordPress, go to Plugins > Add New Plugin, search for "CodingFreaks Cookiemanager", then install and activate it.
2. In the CodingFreaks app (https://app.coding-freaks.com), create a project for your site, choose WordPress as the platform and publish your banner.
3. In WordPress, open Settings > Cookiemanager, enter the API Key and API Secret of your project and https://app.coding-freaks.com as the API Endpoint, and save.
4. Saving checks the connection. Your banner shows on your site from the next page view.

== Frequently Asked Questions ==

= What does it cost? =
The plugin and the CodingFreaks service are currently free to use.

= Does the plugin make my website GDPR compliant? =
No plugin can decide that. The plugin shows the banner you configure and holds back the scripts, embeds and images you put in its optional categories until the visitor agrees. Which services on your site need consent, and what your banner has to say, depends on your site, on the GDPR and on the national law or laws that apply to it. That assessment lies with the controller of the website, if in doubt with advice from a lawyer. The plugin and this description give no legal advice, and neither the plugin nor the CodingFreaks service is certified or audited by an independent body.

== Screenshots ==
1. The banner on the first visit. The embedded YouTube video waits until the visitor agrees.
2. The preferences dialog with the categories and services of the banner.
3. The cookie declaration block on a page, filled from the published banner.
4. The plugin settings with API key, API secret and API endpoint.

== Upgrade Notice ==

= v2.2.0 =
Adds Google Consent Mode v2 with WP Consent API and GTM4WP support, and the cookie declaration: a shortcode and a block that list the cookies of your banner on any page.

= v2.1.1 =
Compatibility release for WordPress 7.1. Also removes about 2 MB of unused admin assets and fixes the config sync on fresh installs.

== Changelog ==

= v2.2.0 =
* New: setup without dead ends. After activation the plugin says what is missing and links to your CodingFreaks account. The settings name the fields like the app, hide the API secret, and an empty API endpoint falls back to https://app.coding-freaks.com
* Fix: the first save on a fresh site now checks the connection and syncs your banner at once. Before, the plugin stayed unconnected until you saved a second time
* New: with GTM4WP active, the settings ask who loads Google Tag Manager. By default GTM4WP's container waits for consent and the banner leaves out its own GTM code, so the container never loads twice
* Fix: the content blocker no longer lets scripts and embeds through on very large pages
* New: the content blocker also holds back images of a service in an optional category until the visitor agrees, for example Gravatar avatars in comments. Images of your own domain and of services the banner does not know stay as they are
* New: Google Consent Mode v2. When Consent Mode is switched on in your CodingFreaks project, the plugin sets the consent default first in the page head, before any other tag, and returning visitors start with their saved choice
* New: WP Consent API. With Consent Mode on, the plugin registers as your consent provider and passes the visitor's choice on, so Site Kit by Google and other plugins that read the API follow it
* New: GTM4WP. With Consent Mode on, the consent default GTM4WP prints stays denied for analytics and ads until the visitor has chosen
* New: cookie declaration. The shortcode [cf_cookie_declaration] or the block "Cookie Declaration" lists the cookies of your banner on any page, for example your privacy policy. The banner script fills it from your published configuration, so it follows every publish without manual upkeep
* [cf_cookie_declaration style="none"] or the block option "No styling" turns off the list's own styling, so your theme styles it alone
* Fix: a server error or rate limit on our side no longer removes the banner from your site. The last synced banner keeps running, and only a 404, 403 or 410 means the configuration is not published
* Fix: the content blocker no longer blocks the plugin's own loader script. When the loader's address matched a provider of one of your services (for example your own domain), the banner did not start
* New: changes you publish in CodingFreaks reach your site right away. Our server notifies the plugin after every publish, and the plugin then only checks a small file every five minutes as a safety net
* Fix: where that notification cannot reach your site (for example behind a firewall), the plugin checks the small file on every page view with a short timeout, and pauses for a minute when our server does not answer instead of slowing down your pages
* Fix: when the banner script or stylesheet cannot be downloaded, the last synced banner stays complete. Before, the new configuration was saved next to the old banner script
* Fix: an update of the banner script now reaches your site even when your configuration did not change
* Fix: after a sync, browsers and page caches load the new banner files instead of a cached copy
* Fix: a leftover call from the former built-in configurator could end in a fatal error
* Fix: the content blocker no longer holds back scripts and embeds of services in a required category. When your own domain was a provider of such a service, every script of your site waited for the banner, and WordPress script modules (for example the navigation block) broke

= v2.1.1 =
* Tested and compatible with WordPress 7.1
* The bundled configurator assets are no longer shipped or loaded: configuration moved to the CodingFreaks backend, so roughly 2 MB of JavaScript was being added to the admin page with nothing to render into
* Bug fix: the directory for the synced consent configuration is now created on demand, so a fresh installation can write its configuration

= v2.1.0 =
* Tested and compatible with WordPress 7.0
* Listed in the new WordPress 7.0 Connectors screen (Settings > Connectors) for discoverability (API credentials continue to be managed within the plugin's own settings page)
* Security: input sanitization for plugin settings, CSRF protection on the publish callback (nonce required), iframe-blocker now uses canonical site host instead of the request host
* i18n hygiene fixes
* Bug fix: plugin globals now work correctly under WP-CLI and other non-HTTP plugin load paths

= v2.0.0 =
* New backend design
* Improved Configuration options and Usability


= v1.0.2 =
* New API Service for Cookie-Manager and Auto-Configuration feature

= v1.0.1 =
* Release

= v1.0.0 =
* Initial release