=== Consentfold ===
Contributors: devstine
Tags: cookie consent, gdpr, consent mode, cookie banner, privacy
Requires at least: 6.6
Tested up to: 7.1
Requires PHP: 8.1
Stable tag: 1.0.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Privacy-first cookie banner with script blocking, Google Consent Mode v2, a consent log and one-click import from CookieYes and Complianz.

== Description ==

Consentfold is a consent management plugin that keeps visitor data on your own site. It shows a cookie banner, blocks scripts and embeds until the visitor agrees, tells Google about the choice with Consent Mode v2, and keeps a consent log you can prove it with. Nothing is metered and your visitors' data is never sent to a third party; the only request a visitor's browser can make to one is an optional video preview they ask for with a click (see "External services").

= Banner designer =

* Three layouts: Bar, Popup and Side panel, with placement, entrance and exit animations, optional animated interactions, and a live preview.
* Palettes checked for contrast (WCAG AA) in light and dark, input styles, fonts, sizes, spacing and radius.
* A Google Fonts finder over the full list. The font you choose is downloaded once to your site and served from there, so visitors never contact Google.
* Banner regime: Automatic, Opt-in (EU / EEA), Opt-in (Brazil), Opt-out (United States) or No banner.
* An optional small "Powered by Consentfold" link at the foot of the banner. It is off unless you switch it on in the Banner designer or say yes in the setup wizard; nothing is shown by default.

= Setup wizard and Overview =

The Overview shows what needs attention (health checks, the last scan, the consent log). A fresh site gets a "Run setup" card that goes through who sees a banner, the design, Google Consent Mode, the policy page and a first scan, in a few minutes.

= Script blocking and Scanner =

* Known trackers, embeds and iframes (including srcdoc iframes) are held back until the matching category is accepted, with a placeholder the visitor can click.
* The Scanner finds the cookies and scripts your site really sets and sorts them into categories. It builds the cookie policy table.
* Works behind page caches and optimisers: WP Super Cache, Cache Enabler and Autoptimize are covered by end-to-end tests, as are Polylang, WooCommerce, Wordfence, GTM4WP and Site Kit.

= Google Consent Mode v2 =

Defaults are sent before any Google tag runs, and updated when the visitor decides. Works with gtag.js, Google Tag Manager, GTM4WP and Site Kit, and with the WP Consent API.

= Consent log =

One record per decision on your own site, with the retention you set. WordPress's personal data export and erase tools include it. A WP-CLI command (`wp consentfold log`) counts and prunes it.

= Import from another plugin =

The Import tab reads the saved settings of CookieYes and Complianz from the database, even when that plugin is not active, and shows a preview of what will change, what is kept and what is not supported. Apply it, and Undo import restores the settings from before your first import, even if you imported from both plugins. Consentfold never deactivates the other plugin on its own; a "Deactivate now" button does it when you say so.

= Accessible and light =

The banner is keyboard operable, announced to screen readers and checked with axe-core. It loads in under 15 KB of JavaScript and 4 KB of CSS, gzipped, and no jQuery.

The admin uses icons from Phosphor Icons (https://phosphoricons.com), copyright (c) 2023 Phosphor Icons, MIT License. The licence text is in `licenses/phosphor-icons.txt`. The icons are part of the plugin; nothing is loaded from a CDN.

== Privacy ==

Consentfold stores the consent cookie in the visitor's browser and, when the consent log is on, one record per decision on your own site: a random consent ID, the accepted categories, the method, the banner and policy versions, the region, the language and a coarse browser class. It never stores an IP address or a user agent; a one-way hash of both, salted and changing daily, is used only to limit the rate of the consent endpoint. Consent records are never sent to a third party. Records are deleted after the retention you set (365 days by default).

* Logged-in users: their consent IDs are kept in their user meta, so WordPress's Export Personal Data and Erase Personal Data tools (by email address) include and delete their records.
* Visitors: they can find their consent ID in the cookie settings panel; delete the records of an ID in the Consent log tab.
* Command line: `wp consentfold log count|prune`.

== External services ==

Consentfold contacts three external services. Two are contacted only from your admin: Google Fonts, when an administrator uses the font finder in the Banner designer or previews a Google font there (a font you choose is downloaded once to your own site and served from there), and Freemius, which handles the upgrade, checkout and license flow. The third, YouTube/Google or Vimeo, is contacted from a visitor's browser only when the visitor clicks **Show preview** on a blocked video embed.

**Google Fonts (fonts.googleapis.com and fonts.gstatic.com), operated by Google LLC**

* What it is used for: letting you search the Google Fonts list, see a sample of each font, preview the font you choose in the banner preview before it is on your site, and download it to your site. The list of fonts itself ships with the plugin.
* When: (1) while the finder is open in your admin, your browser asks fonts.googleapis.com for a small stylesheet with a sample of the fonts shown, and Google serves the matching font data; and while a chosen font is not saved yet, the banner preview in your admin loads that font from Google the same way. The preview loads fonts from Google in the admin only, never on your site's pages; (2) when you save the design with a Google font you chose, your server asks fonts.googleapis.com for the font's stylesheet and fonts.gstatic.com for its files. Nothing is requested when the finder is not used, on any visitor page, or by a cron job.
* What is sent: the name of the font and the weights you chose, the sample text you type (letters only, as a list of characters), and the technical data every web request carries: the IP address of your browser (samples) or of your server (download) and a browser user agent. No visitor data and no data about your site is sent.
* The fonts are open-source licensed (SIL Open Font License or Apache License 2.0), which allows hosting them yourself.
* Google's terms of service: https://policies.google.com/terms and privacy policy: https://policies.google.com/privacy (Google Fonts FAQ: https://developers.google.com/fonts/faq/privacy).

**Freemius (freemius.com), operated by Freemius, Inc.**

Consentfold bundles the [Freemius](https://freemius.com/) WordPress SDK, which handles the upgrade, checkout and license flow.

* What it is used for: the connect screen shown after activation, the **Upgrade** page, starting a purchase, license activation and plugin updates for the paid version.
* When: nothing is sent, and the SDK does not run its usage tracking, until you explicitly opt in on the connect screen shown after activation (or enter a license key). Choosing **Skip** there leaves the plugin fully functional and shares no usage data, user details or plugin list. Three things you do yourself still contact Freemius after a Skip: opening **Consentfold > Upgrade** loads pricing from the Freemius API, and every such request carries your site's address in its user agent; starting a checkout from there puts your WordPress user's first and last name, email address and your site's address in the checkout link; and submitting the feedback form shown when you deactivate the plugin sends Freemius an anonymous uninstall event with the reason you gave.
* What is sent if you opt in: your WordPress user's first and last name and email address; your site's homepage URL and title, WordPress and PHP versions and site language; the plugin and SDK versions and whether the plugin is active or uninstalled; and the names, slugs, versions and active state of your installed plugins and themes. A license activation shares your WordPress user's first and last name and email address (unless the license already has a known owner), the homepage URL, plugin and SDK versions and plugin state, plus the diagnostic details (WordPress and PHP versions, site language and title), which are ticked by default and can be unticked, and the plugin and theme list, which is unticked by default.
* Visitor data: none. Consent records and visitor information never go to Freemius.
* To stop sharing, open the **Plugins** screen and click **Opt Out** under Consentfold; this stops future sharing and does not recall what was already sent. If you chose Skip, the same place offers **Opt In** should you change your mind.
* Freemius terms of service: https://freemius.com/terms/ and privacy policy: https://freemius.com/privacy/

**YouTube video previews (i.ytimg.com), operated by Google LLC, and Vimeo video previews (vimeo.com and the i.vimeocdn.com image host), operated by Vimeo.com, Inc.**

* What it is used for: showing the thumbnail of a blocked YouTube or Vimeo embed in its placeholder, so the visitor can see which video it is before deciding to load it.
* When: only when a visitor clicks **Show preview** on the placeholder of a blocked YouTube or Vimeo embed, before they have agreed to the video's category. Nothing is requested when the page loads, when the visitor does not click, for any other embed, or from your server. Loading the video itself, or accepting the category, loads the embed from the provider as usual and is not part of this preview.
* What is sent: for YouTube, a request for the thumbnail image `https://i.ytimg.com/vi/<video id>/hqdefault.jpg`; for Vimeo, a request to `https://vimeo.com/api/oembed.json` with the video's address, followed by a request for the thumbnail image it returns. These requests carry the video id and the technical data every web request carries: the visitor's IP address and browser user agent. The browser sends no referrer, and no cookie of yours or consent record is sent. The provider may set or read its own cookies on its domain as for any request to it.
* Google's terms of service: https://policies.google.com/terms and privacy policy: https://policies.google.com/privacy
* Vimeo's terms of service: https://vimeo.com/terms and privacy policy: https://vimeo.com/privacy

Deleting the plugin with "delete data on uninstall" switched on also deletes the downloaded font files.

== Translations ==

Consentfold ships translations of the admin, the block editor and the default banner texts in Hungarian, German, French, Dutch, Spanish, Italian and Polish. **These translations are drafts that have not been reviewed by native speakers.** Check the wording of the banner and the policy before you rely on it, and edit the banner texts in the plugin where needed. Corrections are welcome on translate.wordpress.org.

== Installation ==

1. Upload the plugin folder to `/wp-content/plugins/`, or install it from the Plugins screen.
2. Activate the plugin through the "Plugins" screen in WordPress.

== Frequently Asked Questions ==

= Does the plugin load anything from Google or another third party on my visitors' pages? =

Not by itself. A Google font you choose in the Banner designer is downloaded once to your uploads folder and served from your site, and only the admin contacts Google, and only while you use the font finder. The one exception is the optional **Show preview** button on a blocked YouTube or Vimeo embed: when a visitor clicks it, their browser requests the video's thumbnail from YouTube (Google) or Vimeo. Nothing is requested without that click. See "External services".

= Does it work with page caching? =

Yes. The banner is a static script and style and the visitor's choice is read in the browser, so a cached page is the same for everyone. WP Super Cache, Cache Enabler and Autoptimize (including JavaScript minification) are tested. After changing the banner, clear your page cache once.

= Does it support Google Consent Mode v2? =

Yes. The four Consent Mode v2 signals start denied for visitors who must opt in, and are updated when they decide. Choose gtag.js or Google Tag Manager on the Consent Mode tab; GTM4WP and Site Kit are recognised.

= Can I move over from CookieYes or Complianz? =

Yes. Open the Import tab. Consentfold reads their saved settings from the database, shows a preview, and imports on your click. "Undo import" brings back the settings you had before your first import. The other plugin stays as it is until you deactivate it.

= What data is stored? =

The consent cookie in the visitor's browser and, when the consent log is on, a record per decision on your site: a random consent ID, the accepted categories, the method, the banner and policy versions, the region, the language and a coarse browser class. No IP address and no user agent are stored. See "Privacy".

= Is the banner accessible? =

It is keyboard operable, has labelled controls and focus handling, and is tested with axe-core for WCAG 2.2 AA.

= Are the translations reviewed? =

Not yet. See "Translations".

== Screenshots ==

1. The banner on the front page of a shop.
2. The Setup wizard: layout and palette.
3. The Banner designer with its live preview.
4. The Scanner, listing the services it found on the shop.

== Changelog ==

= 1.0.0 =
* Setup wizard: the step row scrolls on narrow screens, and the wizard got a visual polish.
* A new icon set across the admin screens.
* The last wizard step now says the free plugin is made by a small team and offers the optional credit under the banner.
* Fix: a script type written as `Module` in another case keeps working as a module once it is activated.
* Fix: a filter on the consent log record that drops a field no longer breaks the consent endpoint; the record is skipped.

= 1.0.0-rc.1 =
* Import tab: reads CookieYes (2.x and 3.x) and Complianz settings, previews what changes, applies them with a saved copy of your settings, and "Undo import". "Deactivate X now" switches the other plugin off on request.
* Setup wizard, started from the "Run setup" card on the Overview: banner regime, layout and palette, Consent Mode, policy page and a first scan.
* Banner designer: a Google Fonts finder with the full list, search and live samples. The font is downloaded once to your site, so visitors never contact Google.
* Compatibility scenarios tested: WP Super Cache, Cache Enabler, Autoptimize, Polylang, GTM4WP, Site Kit, WooCommerce, Wordfence, and Complianz or CookieYes installed next to Consentfold.
* Fix: the banner works with Autoptimize's JavaScript minification.
* Security: the consent endpoint's rate limit groups IPv6 visitors by /64, a shared proxy no longer exhausts one budget for everyone, and iframes with a srcdoc are blocked until consent.
* Draft translations in 7 languages (hu_HU, de_DE, fr_FR, nl_NL, es_ES, it_IT, pl_PL): admin, editor, default banner texts and the cookie policy table; pending native review.
* The banner is served from full-page caches; bundle-size and end-to-end checks cover this.

= 0.1.0 =
* Initial scaffold.
