=== Cybexo CMP ===
Contributors: cybexo
Donate link: https://cybexo.com
Tags: consent, privacy, gdpr, compliance, cookies
Requires at least: 5.8
Tested up to: 7.1.2
Requires PHP: 7.4
Stable tag: 0.3.1
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Consent Management Platform for WordPress. Inject Cybexo loader and manage/reset consent via a simple admin UI while the core CMP engine controls Consent Mode behavior.

== Description ==
Cybexo CMP makes it easy to integrate the Cybexo Consent Management Platform into WordPress.

**Highlights**
- Auto-injects the official Cybexo loader via the WordPress script pipeline.
- **Reset Consent** clears this browser's CMP choices and reloads; server consent history and unrelated site storage are preserved.
- **Debug view** to inspect configuration and event flow.
- Google **Consent Mode v2** starts optional consent denied before Google tags; the core CMP engine applies configured and saved choices through updates.
- Shortcodes `[cybexo_preferences]` and `[nexaguard_preferences]` open the preferences modal.
- Admin dashboard status panel and debug shortcuts.
- Clean uninstall — removes plugin settings.

== External services ==
This plugin depends on Cybexo CMP cloud services to render the consent banner and store consent preferences.

Service endpoints:
- `https://cmp.cybexo.com` (loader script and static assets)
- `https://edge.cybexo.com` (CMP runtime configuration and vendor-list assets)
- `https://api.cybexo.io` (configuration and consent APIs)

Data sent and when:
- When the CMP loads on the front end (after you configure an App ID and enable auto-inject, shortcode, or block output), the browser requests `loader.js` from `cmp.cybexo.com` and runtime configuration from `edge.cybexo.com`.
- The loader sends the configured App ID (`settings-id`), page/domain context, and consent interaction events/choices to `api.cybexo.io` so the correct banner behavior can be applied and consent choices can be persisted.

Terms of Service: https://cybexo.com/terms-of-service/
Privacy Policy: https://cybexo.com/privacy/

Cybexo may set cookies such as `cybexo_cmp_consent` (and legacy `nexaguard_cmp_consent` during migration) to store user choices.

== Installation ==
1. Install the plugin and activate it.
2. Go to **Cybexo CMP** (left menu).
3. Enter your **App ID (settings-id)** from your Cybexo dashboard: `CYB-` followed by ten lowercase letters or digits. Retired NXG IDs cannot load the CMP; obtain the replacement from your dashboard without changing its prefix.
4. Install and activate the WP Consent API plugin for WordPress category integration. Use WordPress as the default CMP installer, disable Site Kit's separate Consent Mode writer, and remove duplicate CMP scripts.
5. If Google Tag Manager installs your CMP, choose **Engine installed by Google Tag Manager**, use the matching Cybexo template with the same App ID on Consent Initialization, and remove other CMP tags. WordPress retains privacy controls and category protection; GTM owns Google consent.
6. Open your site and verify the configured banner, accepted/rejected choices, reload and privacy controls.

Use `[cybexo_preferences]` (or legacy `[nexaguard_preferences]`) to place a “Privacy settings” link. In WordPress installation mode it enqueues the loader even when auto-inject is off. In GTM mode the template remains the only installer. Early optional-consent denials also apply while an App ID is missing or retired. Stored settings and consent history are not erased by an upgrade.

WP Consent API integration supports categories, including conservative marketing denial unless all three Google advertising keys allow. It does not map per-service decisions. Explicit preference choices survive reload when the CMP validates the matching App ID and applicable saved TCF decision. In other regions, Accept All or Reject All sets preferences for the current page; after reload, preferences stay denied while verified analytics and marketing choices can restore. No advertising or analytics choice is used to invent a preference grant. The bridge denies existing optional category cookies while the declared API is unavailable and retries a delayed API for up to one minute; load the API normally and reload after fixing delivery failures. Outside-region Google defaults do not themselves constitute a WordPress category choice.

== Frequently Asked Questions ==
= I don’t see the banner =
A saved choice may hide the banner. Use **Review privacy choices** or your Privacy settings link to review it without deleting data. If privacy settings are unavailable, check your App ID, installation mode and script delivery. In GTM mode, confirm that the matching Cybexo template is installed and uses the same App ID. Ensure no other CMP is injecting.

= Does this store personal data in WordPress? =
No. The plugin stores only configuration options (App ID, toggles). User choices are stored client-side (cookies/storage) by the CMP.

= Multisite? =
Yes, activate per-site and set each site’s App ID.

== Upgrade Notice ==
= 0.3.1 =
Uses the shared CYBEXO Web engine with platform-specific WordPress integration. Saved settings, choices and category mapping are unchanged.
= 0.3.0 =
Uses a selected engine release and validated consent state. Saved settings and choices are preserved. Some older US choices require review before optional WordPress categories can be allowed; the plugin provides a visible review control. Check your installation mode and test privacy choices after updating.
= 0.2.8 =
This release requires a real CYB App ID from your Cybexo dashboard. Obtain it before upgrading, then save it in Cybexo CMP after the upgrade. Never rewrite an NXG prefix. Optional consent starts denied until valid setup allows the runtime to apply your configuration. Saved settings and consent history are retained.

== Screenshots ==
1. Cybexo CMP admin screen.
2. Example banner/preferences on the front-end.

== Changelog ==

= 0.3.1 =
* Uses the shared loader and compatible platform contract without an engine release selection.
* Preserves saved site settings, choices and WordPress category mapping.
* Avoids historical loader caches and keeps the separate Analytics choice authoritative for Google.

= 0.3.0 =
* Selects an exact consent engine release and uses its validated consent state for WordPress categories.
* Adds a single-installer Google Tag Manager option and a visible privacy review control.
* Preserves saved site settings and explicit preference choices.

= 0.2.9 =
* Update the managed loader URL so returning browsers adopt the current consent runtime. Saved choices and integration settings are preserved.
= 0.2.8 =
* Fix - Establish denied Google defaults and the canonical TCF stub before head tags, even during incomplete App ID setup, without disabling later engine updates.
* Migration - Require current CYB App IDs for delivery while preserving retired saved IDs and settings with dashboard migration guidance.
* Fix - Resolve the official WP Consent API dependency, clear stale optional grants during startup, replay the latest delayed decision, and treat unknown states as denied.
* Fix - Restore explicit WordPress preference choices after validated reload and deny stale category cookies while the official API loads late.
* Fix - Keep reset scoped to CMP browser state without unregistering unrelated site service workers.
* Documentation - Category integration is not a certification or per-service consent claim.
* Fix - Privacy settings shortcodes now reopen the CMP without changing saved consent, including links added after page load.
* Improvement - Added explicit `data-cdn-url="https://edge.cybexo.com"` loader metadata so WordPress installs expose the full Cybexo runtime contract.
* Documentation - Disclosed `edge.cybexo.com` as the runtime configuration endpoint used by the loader.

= 0.2.7 =
* Improvement - Aligned the WordPress loader tag with the Cybexo runtime contract by passing the locked Google developer ID as loader metadata.
* Maintenance - Canonicalized the Git source and WordPress.org SVN mirror paths to the approved `cybexo-cmp` slug.

= 0.2.6 =
* Maintenance - Restored the WordPress.org display name to Cybexo CMP.

= 0.2.5 =
* Fix - Removed WordPress-side hard Consent Mode denied default enforcement.
* Improvement - CMP Engine is now the single source of truth for regional Consent Mode defaults.
* Improvement - Preserved early `dataLayer`/`gtag` bootstrap and `developer_id` signaling for compatibility.

= 0.2.4 =
* Maintenance - release and audit hardening updates with no functional behavior change to CMP runtime injection.

= 0.2.3 =
* Fix - WP Consent bridge debug logs now enable when either plugin Debug Mode is ON or `?cybexo_debug=1` is present.

= 0.2.2 =
* Fix - WP Consent bridge logs now print only when both plugin debug is enabled and `?cybexo_debug=1` is present.

= 0.2.1 =
* Fix — Always-on WP Consent API bridge listener with safe defaults.
* Fix — Ensures bridge enqueues after official WP Consent API script.
* New — Registers “marketing”, “statistics”, “statistics-anonymous” categories via `wp_register_consent_category`.
* Fix — Aligns WP Consent bridge categories and mapping with Core CMP Engine contract.
* Fix — Uses `developer_id.<id>` format and guards duplicate Consent Mode default pushes via `__cybexoCMDefaultSet`.
* Fix — Corrects loader dependency handle for deterministic script ordering.
* UX — Removes WP admin certification warning notice for cleaner plugin experience.
* Improvement — Added local category integration verification. This is not a certification claim.

= 0.2.0 =
* New: WordPress Consent API category integration. Cybexo consent states now sync to WP plugins via `wp_set_consent()/wp_has_consent()`.
* Improvement: Bridge script auto-detects API presence and maps GCM v2 keys: analytics_storage → statistics, ad_storage/ad_user_data/ad_personalization → marketing.
* Dev: Filter `cybexo_cmp_wp_consent_mapping` allows site-specific category remaps.

= 0.1.1 =
* Nonce alignment, enqueue/escaping polish.

= 0.1.0 =
* First public release.
