=== Cookie Consent Hub ===
Contributors: cookieconsenthub, emtiazzahid
Tags: cookie consent, gdpr, ccpa, privacy, cookie banner
Requires at least: 5.8
Tested up to: 7.0
Stable tag: 1.0.1
Requires PHP: 7.4
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

GDPR/CCPA cookie consent banner powered by CookieConsentHub. Server-side script blocking, cache-compatible, and fully managed.

== Description ==

Cookie Consent Hub is a WordPress plugin that connects your site to the
[CookieConsentHub](https://cookieconsenthub.com) service. It provides:

* **Cookie consent banner** — Customizable from your CookieConsentHub dashboard
* **Server-side script blocking** — Rewrites third-party scripts before they reach the browser
* **Cache compatible** — Works with WP Rocket, W3 Total Cache, LiteSpeed Cache, and WP Super Cache
* **Regional targeting** — Show banners only to EU, US, EEA+UK, or Brazil visitors, or globally
* **Google Consent Mode v2** — Supported via the CDN script and GTM integration

= Requirements =

This plugin is a client for a third-party service and does nothing on its own. It
requires:

* A [CookieConsentHub](https://cookieconsenthub.com) account with an active subscription
* An API key generated from your CookieConsentHub dashboard

See **External services** below for exactly what data is sent where.

= How It Works =

1. Install and activate the plugin — activation opens a short setup flow
2. Paste the API key from your CookieConsentHub dashboard
3. Choose who sees the banner, where it sits, and whether trackers are blocked
4. The plugin loads your own home page and confirms the banner is actually live

You can re-run those settings any time from **Settings > Cookie Consent Hub**, which
also has a "Check my banner is live" button for when something looks wrong.

== External services ==

This plugin relies on the third-party service **CookieConsentHub**
(https://cookieconsenthub.com) and does not function without it. Nothing is sent
anywhere until you enter an API key and click Connect.

Service terms: https://cookieconsenthub.com/terms-and-conditions
Privacy policy: https://cookieconsenthub.com/privacy

**1. Connecting your site — `POST https://cookieconsenthub.com/api/wp/validate`**

Fires once, when an administrator clicks "Connect" on the settings screen. Sends the
API key you pasted. Receives your site's banner configuration, script URL, and
subscription status. No visitor data is involved.

**2. Syncing settings — `PATCH https://cookieconsenthub.com/api/wp/settings`**

Fires when an administrator finishes the setup wizard or clicks "Sync to Dashboard".
Sends the API key and the banner settings shown on the settings screen (enabled, region,
position). No visitor data is involved.

**3. The consent banner script — loaded from `https://cdn.cookieconsenthub.com`**

Once connected, the plugin adds a `<script>` tag to the front end of your site. This
script runs in each visitor's browser and contacts CookieConsentHub directly. It
affects your visitors, so it is described in full:

* `GET https://cookieconsenthub.com/api/customization/{site-id}` — fetches the banner
  text, colors, and behavior you configured. Sends your site identifier only.
* `GET https://cookieconsenthub.com/api/geo-country` — resolves the visitor's country
  so that region-restricted banners are shown to the right people. The visitor's IP
  address reaches CookieConsentHub as part of this request and is used to derive the
  country. If your banner region is set to "Global", this lookup is not needed.
* `POST https://cookieconsenthub.com/api/consentlog/{site-id}` — records the consent
  choice so you have an auditable log, as GDPR requires. Sent only after a visitor
  interacts with the banner. Includes: the accept/reject action, which categories were
  granted, the page URL the choice was made on, an expiry timestamp, a generated event
  identifier, and the browser language, platform, and user agent string.

If you deactivate the plugin, the script tag is removed and none of the above occurs.

CookieConsentHub is the only service this plugin contacts. The tracker blocker holds a
list of third-party domain names — `connect.facebook.net`, `googletagmanager.com/gtag`,
`intercom.io` and so on — and the settings screen prints that same list under "What gets
blocked". Those are patterns matched against script tags your site is already serving, so
they can be switched off until a visitor agrees. They are not destinations: the plugin
sends no request to any of them, and adding one to the list is what stops it loading.

== Installation ==

1. Upload the `cookie-consent-hub` folder to `/wp-content/plugins/`, or install through
   the Plugins screen
2. Activate through the 'Plugins' menu in WordPress
3. Navigate to **Settings > Cookie Consent Hub** and enter your API key

== Frequently Asked Questions ==

= Do I need a CookieConsentHub account? =

Yes. The plugin connects to the CookieConsentHub service to load your consent banner
configuration and customizations, and to handle consent logging. See the External
services section above for what that entails.

= Does it work with caching plugins? =

Yes. The plugin is designed to work with WP Rocket, W3 Total Cache, LiteSpeed Cache,
and WP Super Cache. Scripts are blocked server-side so the cached HTML already has
scripts in a blocked state.

= What scripts are blocked? =

Google Analytics (including the GA4 gtag loader), Facebook Pixel, TikTok Pixel,
LinkedIn Insight Tag, Hotjar, Mixpanel, Intercom, Zendesk, HubSpot, and other common
tracking scripts. Scripts are categorized as analytics, marketing, or personalization.
The full list is shown on the plugin's settings screen.

= Is the Google Tag Manager container blocked? =

No, and deliberately. Consent Mode v2 works by letting the GTM container load and then
signalling the visitor's consent state to it, so that GTM itself withholds the tags
that need consent. Blocking `gtm.js` outright would stop those signals from ever being
delivered. Tags loaded directly rather than through GTM are still blocked as listed
above.

= Does server-side blocking slow down my site? =

Scripts added through the normal WordPress queue are rewritten as WordPress prints each
one, which costs almost nothing. On WordPress 6.9 and later there is additionally one
pass over the finished page; responses with no script tag at all are skipped entirely,
and on a cached site that pass runs once per cache build rather than once per visitor.
If you would rather not have it, turn the option off — the banner script still blocks
trackers in the browser.

= What is not blocked server-side? =

Only scripts registered through WordPress's own script queue can be rewritten as they
are printed. These cannot, and are left to the banner to hold back in the browser:

* Tracking code pasted directly into a theme file or a theme "header scripts" setting
* Tags another plugin prints into the page instead of queueing them
* Tags inside post or page content, such as a Custom HTML block
* Tags a script loads after the page has already reached the browser

On WordPress 6.9 and later, WordPress can also hand the plugin the finished page, which
covers the first three of those before anything is sent. Some page builders and
performance plugins switch that off for the whole site — Elementor is one — and on
earlier WordPress versions it does not exist at all. In those cases the tags are held in
the browser by the banner instead. Either way, running any of the four supported caching
plugins also hands the plugin the whole page while the cache is being built.

= Where do I customize the banner design? =

In the CookieConsentHub dashboard. The settings screen in WordPress covers the few
options that need to be available locally; everything else lives in the dashboard.

== Screenshots ==

1. Setup, step one — connecting your account with an API key
2. Setup, step three — confirming the banner is live on your site
3. The settings screen once connected, with subscription and sync status
4. The consent banner as visitors see it

== Changelog ==

= 1.0.1 =
* Tracker blocking no longer opens an output buffer of its own. Queued scripts are
  rewritten as WordPress prints them, and on WordPress 6.9 and later the finished page
  is read through the output buffer WordPress provides for the purpose
* Documented what server-side blocking cannot reach, on the settings screen and here
* Uninstall now also removes the stored subscription end date
* Removed an unused API call

= 1.0.0 =
* Initial wordpress.org release
* Guided setup on activation: connect, configure, and verify in three steps
* "Check my banner is live" — the plugin loads your own home page and reports
  whether the consent script is really there
* API key authentication with CookieConsentHub
* CDN script injection
* Server-side script blocking
* Cache plugin compatibility (WP Rocket, W3TC, LiteSpeed, WP Super Cache)
* Admin settings page with connection, banner, and blocking sections
