=== CookieFlame changelog ===

Changes in earlier versions. The latest release is in readme.txt.

= 5.4.0 =
* New: an option to show "Decline All" on the banner's first screen, next to Accept All. Off by default, and only on the opt-in banner (UK, EU/EEA, Switzerland, Brazil, South Africa), never on the US notice.
* Global Privacy Control now follows California's rules (§7025): OK only closes the US notice, the notice says the signal was honoured, the opt-out is saved, and visitors can opt back in only through a separate choice.
* "Do Not Sell or Share My Personal Information" now opens a real opt-out choice on the page, instead of linking to your privacy page.
* Cookie Monitoring is now two settings: "Watch for new cookies" On/Off, and "Email me about changes": Weekly (the default for new sites), Daily, Instantly (Pro) or Off. Your old setting carries over; 15 minutes, 1 hour and 4 hours become Instantly with Pro and Daily without it.
* New: [cookieflame_settings_link] shortcode and a cc-open-settings class for a "Cookie settings" link. The cookie declaration now has a "Change cookie preferences" button.
* New: "Visitor logins" setting. When ticked, the cookie declaration lists the WordPress login cookies under "If you log in". Otherwise they are left out, so every visitor sees the same declaration.
* The upgrade message at the top of the CookieFlame pages can now be dismissed.
* For developers: --cc-* CSS properties, two filters, an action and the cc:banner-rendered event (see For developers).
* The IAB TCF placeholder, which never carried a consent string, is now off by default.
* Fixed: a Re-consent Period below 1 day made the banner appear on every page. It now means the default of 365 days.
* Fixed: the US notice could run off the screen on phones.
* Fixed: the X (Twitter) embed placeholder also caught other sites whose names end in "x.com", such as netflix.com and box.com.
* Fixed: the WordPress cookie list: login cookie expiry, comment and protected-page cookies, the wp-settings-time description, and PHP and WooCommerce cookies listed as WordPress core.
* Fixed: saving Cookie Monitoring settings, or switching monitoring on or off, turned "Exclude staff from tracking" off.

= 5.3.0 =
* Cookie monitoring now ignores cookies that come with a visitor's browser rather than from your site. Some browser extensions write the "already accepted" cookies of other consent tools (such as Complianz, CookieYes, Cookiebot, OneTrust or Didomi) onto every site they visit, and these were being reported as your site's cookies. A consent tool's cookie is now ignored when that tool doesn't run on your site: its plugin isn't active, its script isn't on the page, and no script on the page wrote the cookie.
* Cookies written by a browser extension's own code are ignored too.
* Cookies ignored this way go on the Permanently Ignored list with the reason, and the list now shows why each cookie was ignored. Restoring one keeps it monitored from then on.
* The Cookie Manager and the Cookie Discovery count leave these cookies out too, including ones your own browser extensions add. Cookies that came with your browser during Cookie Discovery go on the Permanently Ignored list with the reason. Cookies on the Permanently Ignored list no longer show in the Cookie Manager just because they are in your own browser.
* On update, other consent tools' cookies that were already reported are moved to the Permanently Ignored list. Cookies you classified yourself are left alone.
* Fixed: the "consent plugin detected" conflict warning could be set off by CookieFlame's own list of cookie names rather than by another consent plugin on the page.
* Cookie Manager: the last column is now "Status". Each cookie shows one label for where it stands (Known, Auto-Identified, Classified, Added by you, Changed by you, or Not identified yet), and cookies that aren't identified yet say where they came from: found by your scan, reported by visitors, or seen in your own browser.
* Cookie Manager: Remove and Ignore permanently are now one "Remove…" link that asks why. "My site doesn't use it any more" takes the cookie off your list, and it comes back if it's seen again. "It's not from my site" puts it on the Permanently Ignored list for good.
* Cookie Manager: with CookieFlame Pro, the padlock is now a "Lock as correct" button. A locked cookie keeps its vendor, category and purpose, even when you re-identify.
* Cookie Manager: the small help buttons beside each link are gone. Each link explains itself when you hover over it, and the Status column's help button explains every label and action.
* Improved: when another consent tool's code is on your pages, the warning now says so in plain words ("Cookiebot found on your pages"), names the page and the text to look for, and lists where such code usually lives (plugins, page builder custom code such as Elementor > Custom Code, the theme's header, or a header and footer scripts plugin). It used to say a plugin was installed even when the code came from somewhere else.

= 5.2.0 =
* Cookie monitoring now records which script first wrote each new cookie: a third-party script's domain, or the WordPress plugin or theme that set it. Previously only the full list of third-party scripts on the page was known. Cookie values are never read or sent.
* Cookie monitoring now checks again later in the visit, a few seconds after the visitor changes their consent choice, and when they leave the page, so cookies set after consent or after the first few seconds are found.
* Fixed: when a page reported several new cookies at the same moment, some could be lost, because the reports overwrote each other when saving. Reports are now saved one at a time, so every new cookie is kept.
* The cookieflame_new_cookie_discovered action now fires after the cookie's details are saved and passes them as a fourth argument (pre-existing flag, value type, writer). Listeners using three arguments are unaffected.
* Tested up to WordPress 7.1.

= 5.1.1 =
* Cookie declaration shortcode tag is now [cookieflame_declaration] (previously [cookieconsent_declaration]). If you embed the cookie declaration on your Privacy Policy page, update the shortcode tag.
* URL fields on the Settings page (Privacy URL, CCPA URL, Consent log endpoint) now use esc_url_raw, the WordPress URL sanitiser, in place of sanitize_text_field.

= 5.1.0 =
* Cookie Monitoring tab redesigned for clarity. The page now leads with the two controls that matter (Monitoring on/off and Update interval) and trims the long-form intro and guidance copy that buried them.
* New: the Update interval dropdown shows CookieFlame Pro intervals (15 minutes, 1 hour, 4 hours) inline as disabled options labelled "(Pro)", so you can see at a glance what an upgrade adds without leaving the page. They unlock when CookieFlame Pro is active.
* Removed the Monthly interval. It was producing digests so far apart that newly discovered cookies were already weeks stale by the time the email arrived. Existing sites set to Monthly will move to Daily on update.
* Removed the in-page "Clear monitoring history" button. The 30-day auto-purge handles staleness without intervention; for the rare support case where a full reset is needed, the new WP-CLI command "wp cookieflame purge-beacon-seen" replaces the button.
* Filter contract change for developers extending the interval list: cookieflame_interval_buckets now passes tier-aware entries (each entry shaped ['minutes' => N, 'tier' => 'free'|'pro']). Plain integers from third-party filter contributors are still accepted and default to the free tier for back-compatibility.

= 5.0.2 =
* Fixed: Geo Detection now correctly recognises the Cloudflare CF-IPCountry header again. Sites fronted by Cloudflare without a MaxMind database installed were falling through to the GDPR opt-in safety default for every visitor, which meant CCPA-eligible US visitors saw the GDPR banner instead of the CCPA notice, and visitors in regions where no banner is required also saw the GDPR banner. The Geo Detection admin panel was reporting "Not configured" on Cloudflare-fronted sites for the same reason. No setting changes are required; geo detection resumes automatically on update.

= 5.0.1 =
* Hardened consent boot: the five wp_head injection hooks (consent defaults, config, frontend script, Google Tag Manager, Microsoft UET) now register at deep-negative priorities so other plugins cannot hook ahead of CookieFlame and push tags before consent signals are set.
* Beacon endpoint refactored: the per-IP rate limit now runs as a REST permission_callback, rejecting bursts at the routing layer above the request handler. The same check still runs inside the handler as a belt-and-braces guard.
* Defensive shutdown handler added for the output buffer: walks the buffer stack at end of request and flushes only CookieFlame's own buffer if it remains open, leaving any caching or optimisation plugin buffers above it untouched.
* Database queries against the beacon-seen table reworked to inline the WordPress table prefix directly in each SQL literal, with rationale comments on the remaining advisory warnings.
* wp_unslash applied consistently to display-only query parameters on the Cookie Monitoring tab.
* Readme: added an Upgrade Notice section.

= 5.0.0 =
* Initial public release.
