=== KEKSONAUT Consent ===
Contributors: keksonaut
Tags: consent, cookies, gdpr, privacy, cookie-banner
Requires at least: 6.0
Tested up to: 7.1
Requires PHP: 7.2
Stable tag: 0.5.4
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Connect WordPress to KEKSONAUT for cookie banners, Google Consent Mode v2 signals and script/iframe gating.

== Description ==
KEKSONAUT is a consent management service at https://keksonaut.com.
This plugin connects your WordPress site to that service, loads its browser
runtime early in the page head, and provides settings and manual connection
diagnostics under Settings → KEKSONAUT.

Configure banner layout, texts, colours, categories and services in the
KEKSONAUT web app. The plugin needs the website's public Settings ID; an API
key is optional and is used only for administrator-requested diagnostics.
A KEKSONAUT business account and a configured website are required for the
hosted service. The data processing agreement (AVV) is incorporated into the
terms accepted during registration; no separate acceptance step is needed.

**Free plan:** one website with 5,000 page views per month, free of charge
with no time limit. Paid plans and their limits are listed at
https://keksonaut.com/en/pricing.

**Scope:** Google Consent Mode v2 signals and configurable script/iframe
blocking. KEKSONAUT is not a TCF-certified CMP. Configure the relevant services
and their script integrations, and verify the result on your site. Scripts or
iframes that start before the runtime has loaded its settings cannot be
blocked retroactively. Site owners remain responsible for their consent setup
and legal obligations.

No runtime or consent defaults are added until a valid Settings ID and HTTPS
API base are configured. Simply opening the plugin settings makes no requests
to the KEKSONAUT API.

= Configuration =
* **Settings ID** — the public settings ID shown in the KEKSONAUT dashboard.
  This is different from the internal website ID.
* **API base URL** (optional) — leave empty to use
  `https://api.keksonaut.com`. Dedicated or self-hosted deployments may use an
  HTTPS base URL with an optional path, without a query, fragment or embedded
  credentials.
* **API key** (optional, diagnostics only) — prefer a constant in
  `wp-config.php` to keep the key out of the WordPress options table:

  `define( 'COOKIEMONSTER_API_KEY', 'cm_live_...' );`

  The constant takes precedence over a key saved in the settings. The key is
  never included in the site's front-end markup. Leave the password field
  empty to keep a saved key; use Remove stored API key to delete it. That
  button does not change a key defined in wp-config.php.

== Installation ==
1. In WordPress, go to Plugins → Add Plugin ("Add New" in older versions),
   search for "KEKSONAUT Consent", click Install Now and then Activate.
2. Go to Settings → KEKSONAUT and enter the Settings ID from your dashboard.
3. Save changes. Use Run diagnostics to check the connection if needed.
4. Test your site while logged out in a private window, including accepting,
   rejecting and reopening preferences. Check that your configured optional
   services wait for the appropriate consent.

Alternatively, download the plugin ZIP and upload it through Plugins → Add
Plugin → Upload Plugin, then activate KEKSONAUT Consent.

Avoid installing multiple copies of the plugin. For a migration from an older
`cookiemonster` folder, see the release installation instructions before
switching folders; both copies use the same configuration options.

== Frequently Asked Questions ==

= Where is the banner configured? =
In the KEKSONAUT web app at https://app.keksonaut.com. Layout, texts, colours,
categories and services are managed in the app. Publish and verify the banner
there before relying on it on a public website.

= Do I need an API key? =
No. The browser uses the public Settings ID. An API key enables the optional
API authentication check from the WordPress server, only after you request
diagnostics.

= Does the plugin store visitor decisions in WordPress? =
The plugin stores configuration in WordPress: Settings ID, optional API base
URL and optional API key. The service's runtime stores the visitor's decision
in the browser and may send consent evidence to the service as described below.
Uninstall removes configuration options for the current WordPress site.
Network-wide multisite cleanup is not implemented; options on other sites may
remain. Uninstall does not remove browser storage or external-service records.

= Does installing the plugin automatically block every tracker? =
Configure categories and services in KEKSONAUT and follow the runtime integration
instructions. Automatic blocking is limited to configured services once settings
are available. Use explicit deferred script/iframe markup for integrations that
could run earlier, and check conflicts with caching or script optimisation tools.

= Can visitors change their choice? =
The runtime offers a preferences button. If you disable it in the dashboard,
provide an accessible link such as `<a href="#" data-cm-open>Cookie settings</a>`
on your site and verify that it works.

= Is KEKSONAUT a TCF-certified CMP? =
No. KEKSONAUT implements Google Consent Mode v2 signals and script/iframe
blocking; it does not provide IAB TCF certification.

= Can I self-host or use a dedicated endpoint? =
Set the API base URL to the HTTPS base URL of your deployment. Server-side
diagnostics accept public HTTPS endpoints and reject unsafe destinations.
The external-service details below describe the default hosted service; a
self-hosted deployment has its own operator and policies.

== Screenshots ==

1. Configure your public Settings ID and optional connection diagnostics under Settings → KEKSONAUT.

== External services ==

This plugin integrates with **KEKSONAUT**, https://keksonaut.com, to deliver a
configured consent banner and retain consent evidence. Saving a Settings ID
connects your site's visitors to the configured service. Until it is configured,
the plugin adds no front-end integration and makes no diagnostic requests.

What is loaded or sent, and when:

* **Runtime and banner assets** — on front-end page views with a valid
  configuration, the browser requests `https://api.keksonaut.com/runtime.js`
  (or the configured API host). Banner branding and configured logo assets may
  also be requested. HTTP requests expose the visitor's IP address, user agent
  and browser-controlled referrer information to the asset host.
* **Banner settings and page counts** — the runtime requests
  `/runtime/settings/{Settings ID}` from that API host on page load. The
  service receives the Settings ID and normal HTTP request information. It
  records aggregate page counts per website and day for service statistics
  and plan quotas.
* **Browser storage** — the runtime stores category/service choices, banner
  version and decision validity in `localStorage` (`cm:consent`) by default.
  Depending on the service plan and website settings, `sessionStorage` or a
  first-party consent cookie (`cm_consent_{Settings ID}`) can be used instead.
  Decision validity is configurable in the service (default: 365 days).
* **Consent evidence** — when a decision grants at least one optional category
  or service, the runtime posts the Settings ID, decision type, banner version
  and category/service choices to `/runtime/consent/update`. The current
  service records the website host, origin verification result, user agent,
  timestamp, banner version and a truncated, salted IP hash scoped to that
  website. The raw IP address is not stored in the consent event. Showing the
  banner, rejecting all optional processing or fully withdrawing consent does
  not create a consent event. Retention is configured per website (default:
  365 days); infrastructure request logging is governed by the service policy.
* **Manual diagnostics** — only when an administrator with `manage_options`
  requests diagnostics, the WordPress server fetches the public settings
  endpoint. If an API key is configured, it also requests `/api/v1/websites`
  with that key in an Authorization header. The API host receives the server's
  IP address and HTTP headers, the Settings ID and, for the authentication
  check only, the API key. Diagnostics use a bot user agent so that the current
  service excludes them from page counts. This does not send the key to site
  visitors.

Service provider: rocket-ship, Inhaber Florian Bischof, An der Halde 7,
89081 Ulm, Germany. Contact: support@keksonaut.com
Legal notice: https://keksonaut.com/de/impressum
Terms of service: https://keksonaut.com/de/agb
Privacy policy: https://keksonaut.com/de/datenschutz

== Changelog ==

= 0.5.4 =
* Plugin URI points to the plugin page on keksonaut.com.
* The readme describes installing from the WordPress plugin directory and the free plan.

= 0.5.3 =
* Use keksonaut.com for new default connections and service links.
* Preserve saved API endpoints, including api.keksonaut.de, settings IDs and API keys.

= 0.5.2 =
* Keep the public banner configuration available when script optimisers remove data attributes or URL parameters.
* Exclude the runtime and early configuration/defaults from PageSpeed Ninja optimisation using its supported ress-safe marker.
* Support runtime 0.6.2 with public configuration fallbacks. API keys remain server-side only.

= 0.5.1 =
* Allow installation on PHP 7.2 hosts while retaining the WordPress 6.0 minimum.
* Remove the duplicate optional plugin URL from the plugin header for WordPress.org submission.

= 0.5.0 =
* Show settings validation notices once, using the WordPress settings screen.
* Validate API endpoints as HTTPS base URLs and protect manual diagnostics against unsafe requests and redirects.
* Keep saved API keys out of settings HTML and retain the wp-config.php constant option.
* Set Google Consent Mode defaults before the early runtime, using WordPress script APIs.
* Prepare the keksonaut-consent translation domain and first directory distribution while preserving existing configuration keys.
* Correct installation instructions, blocking limitations and external-service disclosures.

= 0.4.0 =
* Renamed the service to KEKSONAUT. New installs use https://api.keksonaut.de; saved custom endpoints and existing option keys remain unchanged.

= 0.3.0 =
* License changed to GPLv2 or later.
* API base URL became optional, defaulting to the service's former endpoint.
* Added API URL validation, uninstall cleanup, translations and external-service documentation.

= 0.2.0 =
* Corrected the runtime URL to /runtime.js and added the data-settings-id attribute.
* Added optional wp-config.php API key storage, settings ID sanitisation and a settings shortcut.

= 0.1.0 =
* Initial release: runtime integration, settings and diagnostics.

== Upgrade Notice ==

= 0.5.4 =
Plugin information and documentation only; the banner and its settings are unchanged.

= 0.5.3 =
The default endpoint for an empty API base URL is now https://api.keksonaut.com. Saved endpoints and credentials are preserved. Clear page caches after updating and verify your banner.

= 0.5.2 =
Clear page and script optimisation caches after updating. Verify your Settings ID and test the banner in a private window.

= 0.5.1 =
The plugin now supports PHP 7.2 and newer. Existing settings are preserved.

= 0.5.0 =
Custom API endpoints must use HTTPS. Recheck your configured services and deferred markup after updating. Folder migrations require care because old and new copies share settings.
