=== CookieStart – GDPR Cookie Consent & CMP ===
Contributors: cookiestart
Tags: cookie consent, gdpr, consent mode, cookies, cmp
Requires at least: 6.0
Tested up to: 7.0
Requires PHP: 8.1
Stable tag: 1.0.12
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Connect WordPress with CookieStart CMP to scan cookies and scripts, manage consent categories, monitor compliance, and block scripts until consent.

== Description ==

CookieStart is a consent management platform for WordPress websites and WooCommerce stores.

The plugin connects your website to the CookieStart service and provides access to CMP configuration directly from the WordPress administration panel. It can display the CookieStart consent banner, detect scripts and cookies, classify them into consent categories, scan website URLs, review consent history, and control script behavior before consent is granted.

Main features:

* Cookie consent banner provided by the CookieStart platform.
* CookieStart account registration directly from WordPress.
* Connection of an existing CookieStart account using an API key and domain ID.
* Website status dashboard with integration status and scan information.
* Website compliance score and audit summary.
* Manual and automatic website scans.
* Scan progress, scanned URL list, errors, and scan history.
* Detection and classification of scripts used by the website.
* Detection and classification of cookies.
* Manual category overrides for scripts and cookies.
* Consent categories: necessary, preferences, statistics, and marketing.
* Consent records and consent change history.
* Automatic processing and transformation of supported scripts.
* Optional automatic blocking of scripts before consent.
* Optional blocking of unknown scripts.
* Script allowlist and blocklist rules.
* Default category for unrecognized scripts.
* Optional grouping of first-party scripts.
* Google Consent Mode v2 support.
* Local preview of scripts detected in WordPress output.
* Runtime configuration cache management.
* Debug mode and integration logs.
* Usage statistics and scan limits available in the dashboard.
* Support for WordPress and WooCommerce websites.

An active CookieStart account and a website configuration in the CookieStart platform are required. You can create or connect an account from the plugin administration panel.

The plugin requires PHP 8.1 or newer.

Important: Installing and configuring this plugin does not by itself guarantee compliance with GDPR, ePrivacy, or any other law. The website owner is responsible for the correct configuration of the service, classification of cookies and scripts, legal notices, and compliance with applicable laws.

Learn more:
https://cookiestart.pl/

CookieStart panel:
https://panel.cookiestart.pl/

Privacy policy:
https://cookiestart.pl/polityka-prywatnosci/

== Installation ==

1. Upload the plugin folder to `/wp-content/plugins/` or install the ZIP file through the WordPress Plugins screen.
2. Activate CookieStart through the Plugins screen in WordPress.
3. Open CookieStart in the WordPress administration menu.
4. Create a CookieStart account or connect an existing account.
5. Add or connect the current website.
6. Configure the consent banner, consent categories, script processing, and runtime settings.
7. Run a website scan and review the detected scripts and cookies.
8. Assign or verify the appropriate consent categories.
9. Test the consent banner and blocked scripts on the frontend.

== Frequently Asked Questions ==

= Do I need a CookieStart account? =

Yes. The plugin connects WordPress to the external CookieStart consent management service.

= Can I create an account from WordPress? =

Yes. The plugin includes an account registration and website onboarding flow. Registration data is sent to the CookieStart identity service after you submit the registration form.

= Can I connect an existing CookieStart account? =

Yes. You can connect an existing website configuration by entering the CookieStart API key and domain ID.

= Does the plugin work with WooCommerce? =

Yes. CookieStart can be used on WordPress websites and WooCommerce stores.

= Does the plugin block scripts before consent? =

The plugin can process the generated HTML, detect supported script elements, assign consent categories, and transform selected scripts so they can be activated after the relevant consent is granted. Automatic blocking and blocking of unknown scripts can be enabled in the settings.

= Can I exclude or completely block selected scripts? =

Yes. The plugin provides an allowlist and a blocklist based on one pattern per line.

= Does CookieStart scan my website? =

A website scan can be started from the WordPress administration panel. The scan is performed by the external CookieStart crawler service. Scan availability and limits depend on the connected CookieStart plan.

= Can I review detected scripts and cookies? =

Yes. Detected scripts and cookies are displayed in dedicated administration views. Their consent categories can be reviewed and changed.

= Can I review consent history? =

Yes. The plugin displays consent records and the history of consent changes retrieved from the CookieStart service.

= Does the plugin support Google Consent Mode v2? =

Yes. Google Consent Mode v2 can be enabled in the CookieStart runtime settings.

= Does installing CookieStart guarantee GDPR compliance? =

No. CookieStart provides consent management and auditing tools, but the website owner remains responsible for configuration, legal content, cookie classification, and compliance with applicable laws.

= Where can I review CookieStart's privacy policy? =

https://cookiestart.pl/polityka-prywatnosci/

== External services ==

This plugin connects to external CookieStart services that are required for account management, website configuration, scanning, consent management, and delivery of the consent banner.

The plugin may connect to the following services:

* `https://identity.cookiestart.pl` – account registration, login, authentication, and token renewal.
* `https://parameter.cookiestart.pl` – website configuration, runtime settings, script and cookie classification, statistics, integration status, and related CMP configuration.
* `https://crawler.cookiestart.pl` – website scans, scan status, scanned URLs, and scan results.
* `https://consent.cookiestart.pl` – consent records and consent history.
* `https://cdn.cookiestart.pl` – delivery of the CookieStart consent runtime SDK used on the website frontend.

Depending on the action performed and the enabled features, the following data may be transmitted:

* CookieStart account email address and password when the administrator registers or logs in through the plugin.
* The administrator's IP address during account registration.
* Authentication tokens and the CookieStart user identifier.
* Website URL, domain name, allowed domain, CookieStart domain identifier, and public API key.
* Plugin version, integration type, and website URL in an integration heartbeat sent approximately every six hours after the website has been connected.
* Detected script patterns, script assignments, cookie rules, consent categories, and manual category overrides.
* Website scan requests, scan identifiers, scan status, scanned URLs, and scan results.
* Consent records and consent history requested by an authorized website administrator.
* Standard technical request data processed by the service infrastructure, such as IP address, request headers, browser information, timestamps, and server logs.

The frontend loads the CookieStart runtime SDK from `cdn.cookiestart.pl`. After CookieStart credentials are configured, the SDK receives the connected website identifier and public API key and retrieves the consent configuration required to display and operate the banner.

These external services are provided by CookieStart and are required for the plugin's core functionality.

Service website:
https://cookiestart.pl/

Privacy policy:
https://cookiestart.pl/polityka-prywatnosci/

Terms of service:
https://cookiestart.pl/regulamin/

== Privacy ==

The plugin stores CookieStart configuration and authentication tokens in the WordPress database. Account passwords are transmitted only when the administrator registers or logs in and are not stored by the plugin. Session renewal uses a rotating access and refresh token pair.

The website administrator is responsible for:

* Informing website visitors about the use of CookieStart.
* Maintaining an accurate privacy policy and cookie policy.
* Correctly classifying cookies and scripts.
* Configuring consent categories and legal bases.
* Reviewing the data processing terms applicable to the CookieStart service.
* Testing the website after activation and after configuration changes.

For details about processing performed by CookieStart, see:
https://cookiestart.pl/polityka-prywatnosci/

== Screenshots ==

1. CookieStart settings after successful connection, including API, domain, script processing, Consent Mode, allowlist, and blocklist options.
2. CookieStart CMP dashboard with website status, compliance score, scan summary, and integration checks.
3. Dashboard displayed before the website is connected to CookieStart.
4. CookieStart account registration and manual connection settings.
5. Website scan in progress with URL scanning progress and current status.
6. Completed website scan with compliance score, scanned URLs, script statistics, and integration recommendations.
7. Script management view with filtering, categories, compliance status, and manual category assignment.
8. Cookie management view with detected cookies, services, categories, and compliance information.
9. Consent records and detailed consent change history.
10. Local WordPress script preview used for diagnostic purposes.

== Changelog ==

= 1.0.12 =
* Disabled frontend SDK loading until the plugin is explicitly enabled and fully configured.
* Removed the insecure encryption-key fallback and added authenticated AES-256-GCM storage with legacy-data migration.
* Added complete English source strings and a Polish translation catalog.
* Improved banner language selection using the current WordPress locale.
* Reworded audit results as a technical CMP assessment and added a clear legal-compliance disclaimer.
* Improved account connection messages and clarified that passwords are used only for the current request.

= 1.0.11 =
* Removed persistent storage of the CookieStart account password.
* Added session renewal through the rotating Identity refresh-token endpoint.
* Added one-time external login codes so authentication tokens are no longer placed in panel URLs.
* Added cleanup of passwords stored by earlier plugin versions.

= 1.0.10 =
* Added CookieStart account registration and login from WordPress.
* Added automatic website creation and connection flow.
* Added website scanning, scan progress, scan limits, and scan result views.
* Added compliance dashboard and audit summary.
* Added script and cookie category management.
* Added consent records and consent history views.
* Added runtime settings, script allowlist and blocklist, debug mode, and integration heartbeat.
* Added Google Consent Mode v2 support.
* Improved automatic script detection, transformation, and blocking.
* Improved WordPress.org validation compatibility.

== Upgrade Notice ==

= 1.0.12 =
Security hardening, complete internationalization, safer defaults, and clearer technical audit wording.

= 1.0.11 =
Security improvements for authentication renewal and CookieStart panel login.
