=== CookiePilot – Cookie Banner & Consent Mode v2 for GDPR ===
Contributors: mlemiesz
Tags: cookie banner, cookie consent, consent mode v2, gdpr, rodo
Requires at least: 6.0
Tested up to: 7.1
Stable tag: 1.6.0
Requires PHP: 8.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Cookie consent banner with Google Consent Mode v2, tracker blocking and a consent log. Built for GDPR, RODO and the Polish PKE. Free plan available.

== Description ==

CookiePilot adds a cookie consent banner to your WordPress site and connects it to Google Consent Mode v2. Tracking scripts wait until the visitor decides, every decision is logged as proof of consent, and you manage everything from your WordPress admin.

CookiePilot is a hosted service: the plugin connects your site to a CookiePilot account, which you can create without leaving WordPress. The free plan covers one domain and 10,000 pageviews per month, with no credit card required. Paid plans are listed on the [pricing page](https://cookiepilot.io/en/pricing?utm_source=wordpress-plugin&utm_medium=plugin&utm_content=wporg-readme).

= What you get =

* **A banner that matches your site** — position, layout, colours, fonts, texts and buttons, with a live preview. Accept, reject and settings buttons can be styled with equal weight.
* **Google Consent Mode v2** — analytics_storage, ad_storage, ad_user_data and ad_personalization start as denied before any Google tag runs, and the visitor's choice updates them.
* **Tracker blocking** — known analytics and marketing scripts (Google Analytics, Google Ads, Meta Pixel, Microsoft Clarity, Hotjar, TikTok, LinkedIn and others) wait until the visitor accepts the matching category.
* **Consent log** — each decision is stored with its time, banner version and chosen categories, so you can show proof of consent.
* **Cookie scanner** — once the banner is live, your site is scanned daily and the cookie declaration stays up to date. Reports export to CSV, HTML or JSON.
* **23 banner languages** — the banner follows the page language, including sites translated with WPML or Polylang.
* **WooCommerce support** — cart and checkout keep working, and a checklist shows whether GA4, Google Ads and Meta Pixel wait for consent.
* **Agency mode** — one-time installation codes for client sites and one dashboard for all of them.
* **Lightweight** — the banner script stays under 19 KB gzip (a limit enforced at build time).

= Made for Polish and EU rules =

CookiePilot is developed in Poland. The banner is designed around GDPR (RODO), the ePrivacy rules and art. 399 of the Polish Electronic Communications Law (PKE). Support is available in Polish and English, and invoices include Polish VAT.

A banner on its own does not make a site compliant: your privacy policy, the cookie descriptions and the tools you use matter too. CookiePilot covers the technical part — blocking, consent signals and records.

= How it works =

1. Install and activate the plugin.
2. Create a free CookiePilot account or log in, directly in WordPress.
3. Click "Add this domain" to connect the site.
4. Adjust the banner in the editor and save. The banner goes live straight away.

More about the WordPress integration: [cookiepilot.io/en/integrations/wordpress](https://cookiepilot.io/en/integrations/wordpress?utm_source=wordpress-plugin&utm_medium=plugin&utm_content=wporg-readme).

== Installation ==

= From your WordPress dashboard =

1. Go to Plugins → Add New Plugin.
2. Search for "CookiePilot".
3. Click Install Now, then Activate.

= Manual installation =

1. Download the plugin ZIP file.
2. Go to Plugins → Add New Plugin → Upload Plugin.
3. Choose the ZIP file, click Install Now, then Activate.

= Configuration =

1. Open CookiePilot in the WordPress admin menu.
2. Create a free account or log in with your CookiePilot account (not your WordPress account).
3. Click "Add this domain" to connect your site.
4. Customize the banner and save — it is live immediately.

== Frequently Asked Questions ==

= Do I need a CookiePilot account? =

Yes. CookiePilot is a hosted service and the plugin connects your site to it. You can create the account from the plugin screen without leaving WordPress.

= Is there a free plan? =

Yes. The free plan covers one domain and 10,000 pageviews per month, including the banner editor and Google Consent Mode v2. No credit card is required.

= How much do the paid plans cost? =

Pro (one domain, unlimited pageviews) costs 29 PLN or 7 EUR per month. Business (five domains, white-label, API access) costs 99 PLN or 25 EUR per month. Yearly billing is available. Current prices are on the [pricing page](https://cookiepilot.io/en/pricing?utm_source=wordpress-plugin&utm_medium=plugin&utm_content=wporg-readme).

= What is Google Consent Mode v2 and do I need it? =

Consent Mode v2 is how Google tags learn whether a visitor agreed to analytics and advertising. If you use Google Ads or Google Analytics for visitors from the EEA, Google expects these signals. CookiePilot sets the default (denied) state before Google tags run and updates it after the visitor decides, on every plan.

= Does CookiePilot make my site GDPR / RODO compliant? =

CookiePilot provides the technical measures a consent banner needs: no non-essential cookies before consent, a reject button that can be as visible as accept, separate categories, a way to change the decision later and a record of every consent. Full compliance also depends on your privacy policy and on the tools you use, so review those too.

= Will it slow down my site? =

The banner script is under 19 KB gzip and is served from a CDN. Consent Mode defaults are set by a small inline snippet, so they apply before other tags load.

= Does it work with caching plugins? =

Yes. CookiePilot works with WP Rocket, W3 Total Cache, LiteSpeed Cache and other popular caching plugins, because the banner is rendered in the visitor's browser.

= Does it work with WooCommerce? =

Yes. Cart and session cookies are treated as strictly necessary and are never blocked. The WooCommerce panel checks that GA4, Google Ads and Meta Pixel wait for consent and can apply store-safe settings in one click.

= Does the banner work on multilingual sites? =

Yes. The banner is available in 23 languages and follows the page language, including sites translated with WPML or Polylang.

= I am switching from another consent tool. Do visitors have to decide again? =

If your site used Cookiebot, CookiePilot can take over a visitor's explicit Cookiebot decision, so they are not asked twice. Rely on this only when the cookie categories and vendors stay the same. If they change, visitors should be asked again.

= What happens if the CookiePilot service is unavailable? =

The banner configuration is cached in the visitor's browser, so the banner keeps working during short outages.

= Can I manage several sites or client sites? =

Yes. The Business plan covers five domains. Agencies can generate one-time installation codes so each client site is linked to the agency account and managed from one dashboard.

= Is support available in Polish? =

Yes. CookiePilot is developed in Poland and support answers in Polish and English.

= What data does the plugin send? =

See the "External services" section below for the full list.

== Screenshots ==

1. The cookie banner on a WordPress site: visitors can accept, reject or choose categories.
2. Consent settings with separate categories: necessary, analytics, marketing and preferences.
3. The plugin dashboard in WordPress: connection status, domain and plan usage.
4. The banner editor with live preview: colours, layout, fonts and texts.
5. Google Consent Mode v2 default settings.
6. The WooCommerce panel with the pre-consent tracker checklist.

== Changelog ==

= 1.6.0 =
* New: after the banner has been running for 14 days, administrators see a one-time request to review the plugin on WordPress.org, with "Maybe later" and "Don't show this again". It appears only on the CookiePilot screen and the Dashboard.
* Links from the plugin to cookiepilot.io and the CookiePilot dashboard now carry source parameters (utm_source=wordpress-plugin, utm_medium=plugin). Account sign-ups made in the plugin report the same source. No personal data or site identifiers are added.
* Fixed the "Contact support" link on the loading screen, which pointed to a page that no longer exists.
* The bundled Polish translation now also covers PHP strings (compiled .mo and .l10n.php files added).
* Uninstalling the plugin now also removes the review-request state and the pending email verification.
* Rewritten plugin description, FAQ and screenshot captions.

= 1.5.0 =
* Fixed onboarding navigation: you can now return to the login screen from the "Sign up" and "Activate agency code" screens (previously a pending email verification could trap you on the register screen).
* New connection-status card on the dashboard: shows whether the API key is set, the detected domain and that the consent script is injected on the site.
* WooCommerce panel: tracker blocking and Google Consent Mode can now be turned off again, not only enabled.
* "Open CookiePilot dashboard" links added across the admin (dashboard, WooCommerce and agency views).
* Security hardening: authentication tokens and API keys are stored with autoload disabled (kept out of the always-loaded options cache), with a one-time migration for existing installs.
* Agency code field now validates inline (cpat_ + 32 hex characters) and shows a readable error instead of a browser popup.
* The admin screen no longer hides all WordPress notices — important error, warning and security messages stay visible.
* Added a loading/fallback state (and a no-JavaScript message) so the admin page never shows a blank screen if scripts fail to load.
* Clearer login copy ("use your CookiePilot account, not your WordPress account") and a "Forgot password?" link.
* Fixed the returning-visitor consent cookie match in the Google Consent Mode stub.

= 1.4.0 =
* New WooCommerce integration: the plugin now detects an active WooCommerce store and adds a dedicated "WooCommerce" panel to the admin.
* Pre-consent tracker checklist — confirms Google Consent Mode v2 denies analytics & advertising storage by default and that GA4, Google Ads and Meta Pixel are held back until the visitor consents.
* One-click "Apply WooCommerce-safe settings" — enables tracker autoblocking and denies all Consent Mode defaults in a single action.
* New free "WooCommerce Shop" banner template (store purple, explicit reject button).
* Cart and checkout stay functional: WooCommerce cart/session cookies are treated as strictly necessary and are never blocked.
* Recognises common store tracking plugins (Google for WooCommerce, Facebook for WooCommerce, PixelYourSite, GTM4WP) and shows how each is gated by consent.
* The consent banner and the Consent Mode stub now carry a WooCommerce page-type hint (data-page-type) and a `cookiepilot_should_inject` filter for advanced load-order control.

= 1.3.0 =
* Banner editor now supports all 13 panel languages (EN, PL, DE, FR, ES, IT, NL, PT, SV, CS, RO, EL, HU) with per-language placeholders — previously only Polish and English.
* New "Style" tab: corner radius, max width, padding, font family, title/description sizes, description colour, button radius/height/size, button layout, settings/reject button styles, and an optional emoji icon.
* Google Consent Mode: configure the default (pre-consent) state for analytics_storage, ad_storage, ad_user_data, ad_personalization and the wait-for-update delay.
* New overlay (modal backdrop) colour and a WCAG 2.1 AA accessibility mode.
* Billing tab reworked: always shows purchasable plans with their limits and features, marks your current plan, and supports upgrading from any plan (monthly/yearly Stripe checkout + customer portal).

= 1.2.0 =
* The admin panel now defaults to English and is fully translatable. Every label, button and message in the settings screen goes through WordPress i18n (`wp.i18n` + `wp_set_script_translations`), so the interface follows your site/admin language instead of being hard-coded. Polish translation is bundled; other languages can be added via standard `.po`/`.json` files.
* No more browser-translation workarounds for non-Polish users operating the plugin.

= 1.1.0 =
* Auto-detect the active page language from WPML and Polylang via the `wpml_current_language` filter and pass it to the banner — no more manual `data-locale` snippet on multilingual sites.
* Fall back to `determine_locale()` / `get_locale()` when no translation plugin is active, so single-language WordPress installs get the correct WP-core language out of the box.
* Banner widget now also honours `<html lang="...">` as a fallback locale signal for non-WordPress hosts.

= 1.0.0 =
* Initial public release
* User registration and login from WordPress admin
* Full visual banner editor with live preview
* Visual Effects: Glassmorphism, Floating Card 3D, Gradient Accents
* Entry animations: Slide Up, Slide Down, Fade
* Toggle animations: Spring, Smooth
* Consent button for re-opening settings
* Agency mode with one-time installation tokens
* Stripe payment integration
* Google Consent Mode v2 support
* Automatic script blocking for known trackers
* Multi-language support (Polish, English)
* Pageview usage tracking and limits display

== Upgrade Notice ==

= 1.6.0 =
Adds a one-time, dismissible review request after 14 days, source parameters on links to CookiePilot, a fixed support link and compiled Polish translations.

= 1.3.0 =
Adds 13-language banner editing, a full Style tab, Google Consent Mode defaults, WCAG mode, and an improved plan-upgrade/billing screen — reaching feature parity with the web dashboard.

= 1.2.0 =
The admin interface is now in English by default and fully translatable, so international users no longer need browser translation to configure the plugin.

= 1.1.0 =
Adds automatic WPML / Polylang language detection. WordPress multilingual sites now show the banner in the same language as the page without any extra configuration.

= 1.0.0 =
Initial public release of CookiePilot – cookie consent management plugin.

== External Services ==

This plugin connects your site to CookiePilot, a hosted consent management service. You choose to connect it by creating an account or logging in on the plugin screen; nothing is sent before that.

= What data is sent and when =

* **Account sign-up and login**: the email address, name, organization name and password you enter are sent to the CookiePilot API to create or open your account. Sign-ups made in the plugin also send the source "wordpress-plugin" (utm_source / utm_medium) so CookiePilot knows the account came from this plugin.
* **Domain registration**: when you add your domain, the site URL is sent to create your banner configuration.
* **Banner configuration**: the plugin and the banner fetch your banner settings (colours, texts, layout) from the API and the CDN.
* **Consent records**: when visitors interact with the banner, their choices are sent to the API to keep the consent log.
* **Pageview counting**: anonymous pageview counts are sent to measure usage against your plan limits.
* **Links**: links from the plugin to cookiepilot.io and the CookiePilot dashboard include utm_source=wordpress-plugin and utm_medium=plugin. They contain no personal data and no identifier of your site.

= Service details =

This service is provided by CookiePilot.

* API: https://api.cookiepilot.io
* CDN (banner script): https://cdn.cookiepilot.io
* Dashboard: https://app.cookiepilot.io
* Website: https://cookiepilot.io
* Terms of Service: https://cookiepilot.io/en/terms
* Privacy Policy: https://cookiepilot.io/en/privacy

The plugin needs a connection to the CookiePilot API to work. Without it, the banner cannot be displayed or configured.
