=== Scruter CMP ===
Contributors: scruter
Tags: cookies, consent, gdpr, cookie banner, privacy
Requires at least: 6.7
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.1.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Cookie consent banner and automatic blocking of trackers by Scruter CMP, a European consent management platform. One site code, no code to write.

== Description ==

Scruter CMP shows a consent banner on your site, holds back the trackers until the visitor agrees, and keeps a proof of every choice. This plugin installs it on WordPress:

* prints the Scruter tag **first in the head** of every page, before any other script, so trackers are blocked before they can run;
* « Connect to Scruter »: one click opens your Scruter account, you choose the site and come back with its code filled in (or paste the code yourself, Settings › Scruter CMP);
* shares the visitor's choice with the [WP Consent API](https://wordpress.org/plugins/wp-consent-api/), so that plugins that follow it (analytics, maps, forms…) respect the banner;
* keeps the tag in place against caching and optimisation plugins (it is never deferred, delayed or combined).

The banner, its texts, its colours, the classification of the trackers, Google Consent Mode and the IAB TCF are set in the Scruter console, not in WordPress. A change reaches visitors within five minutes.

You need a Scruter CMP account and a site: [scruter.net/cmp](https://scruter.net/cmp).

= How the choice reaches the WP Consent API =

When the WP Consent API plugin is active, the choice made in the banner is copied to its categories on each page load and on each decision:

* necessary: functional (always allowed);
* functional and personalization: preferences;
* analytics: statistics and statistics-anonymous;
* advertising: marketing.

Embedded contents and custom purposes have no category in the API: the Scruter script holds them back itself.

== External services ==

This plugin connects your site to Scruter CMP, a consent management service operated by Scruter (a European company, servers in the European Union). It is the plugin's purpose: without a Scruter CMP site, the plugin prints nothing.

**1. The Scruter CMP site script, on the public pages of your site.** Once a site code is set and the tag is switched on, every page of the public site includes `https://cdn.scruter.net/cmp/<site code>.js` (not the WordPress admin, the feeds or the embeds). The visitor's browser loads it from the Scruter CDN on each page view: it shows the consent banner, blocks the trackers until the visitor agrees and records the choice. What reaches Scruter: the usual HTTP request (the visitor's IP address and user agent are used to answer and are not stored), the address of the page, and, when the visitor decides, the choice made (consent proof: date, banner version, purposes accepted or refused). Scruter sets no cookie other than the first-party `scruter_consent` cookie that stores the visitor's choice (and `scruter_tcf` when the IAB TCF is enabled for the site).

**2. The Scruter console, when an administrator clicks « Connect to Scruter ».** The browser of the administrator goes to `https://app.scruter.net/integrations/connect` with the address of this settings page and a random, single-use value; after signing in and choosing the site, the console sends the browser back with the site's public code. Nothing about your WordPress installation, its users or its content is sent, and nothing happens unless the administrator clicks the button.

The plugin itself makes no request from your server.

Service provided by Scruter: [terms of use](https://scruter.net/en/legal/terms), [privacy policy](https://scruter.net/en/legal/privacy), [data processing agreement](https://scruter.net/en/legal/dpa).

== Installation ==

1. Install and activate the plugin.
2. Go to Settings › Scruter CMP and click « Connect to Scruter »: sign in to your Scruter account (or create one: the free plan covers one site), choose the site and confirm. You come back with the site code filled in. The site must cover the domain of your WordPress admin; you can also paste the code yourself (for example `ATMONA01`, shown in the Scruter console, Integration page of your site).
3. Deactivate any other cookie banner plugin.
4. Open your site in a private window: the banner shows and nothing optional runs before you choose.

Optional: install the WP Consent API plugin so that plugins that follow it respect the choice.

== Frequently Asked Questions ==

= Where do I find my site code? =

« Connect to Scruter » fills it in. Otherwise: in the Scruter console, open your site, then Integration. It looks like `ATMONA01`. You can paste the script address or the whole tag, the plugin extracts the code.

= « Connect to Scruter » says that no site matches. =

The console only sends the code back to a domain the site covers: the site's domain, its subdomains, or a domain added to the covered domains (Scruter console › your site › Integration). Add the domain of your WordPress admin there, or paste the code by hand.

= Do I need a Scruter account? =

Yes. Scruter CMP is a service: the banner, the blocking rules and the consent proofs live in your Scruter account. The free plan covers one site; the paid plans are described on [scruter.net/cmp/pricing](https://scruter.net/en/cmp/pricing).

= The banner does not show. =

Check that the site code is right, that the tag is switched on, and that no caching plugin serves an old copy of the page. View the page source: the first `script` in the head must be `https://cdn.scruter.net/cmp/<your code>.js`. The Integration page of the console can also verify the installation.

= A caching or optimisation plugin moved the tag. =

The tag carries the attributes those plugins recognise to leave it alone. If yours still moves it, exclude `cdn.scruter.net` from its JavaScript options (deferral, delay, combination).

= Can I add a "Manage my cookies" link? =

Yes: `<a href="#scruter-consent">Manage my cookies</a>` opens the preference centre. In JavaScript, `window.scruterCmp.open()` does the same from your own code.

= Which filters can I use? =

`scruter_cmp_should_print` (bool) to keep the tag off some requests, and `scruter_cmp_script_nonce` (string) to add a CSP nonce to the tag.

== Screenshots ==

1. Settings › Scruter CMP: « Connect to Scruter », or the site code typed by hand.
2. In the Scruter console, choose the site this WordPress belongs to.
3. The console names the destination before sending the public site code back.
4. Back in WordPress: connected, the tag is printed first in the head of every page.

== Changelog ==

= 1.1.0 =
* « Connect to Scruter »: the site code is filled in from your Scruter account.

= 1.0.0 =
* First release.

== Upgrade Notice ==

= 1.1.0 =
Connect the plugin to your Scruter account in one click.

= 1.0.0 =
First release.
