=== GSCookie ===
Contributors: gradespace
Tags: cookie consent, gdpr, ccpa, privacy, compliance
Requires at least: 6.0
Tested up to: 7.1
Requires PHP: 8.0
Stable tag: 1.3.1
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Cookie consent that lists only the cookies your site really uses, blocks trackers and embeds until visitors agree, and keeps proof of every choice.

== Description ==

GSCookie is built to make consent management practical for real sites:

* A clear banner where "Reject all" is exactly as easy as "Accept all", a cookie settings dialog and a small cookie button to change your mind later
* An accurate cookie list: a full scan records the cookies your server sets and the cookies scripts set in the browser. Only cookies actually found (or ones you add and confirm) are shown to visitors; unknown ones wait as "Unclassified" for you to review, and cookies that stop appearing are hidden unless you pin them
* Known trackers (Google Analytics and Tag Manager, Meta Pixel, Hotjar, Clarity, LinkedIn, TikTok…) and embeds (YouTube, Vimeo, Google Maps…) wait for consent automatically; embeds show a placeholder in their own space
* Google Consent Mode v2 (and Microsoft UET consent), Global Privacy Control, and re-consent when you start using a new kind of cookie. Google tags load in Consent Mode by default: every signal starts as "denied", so they set no cookies until the visitor agrees (or choose to block them outright)
* Consent records with a random consent ID and retention period; CSV export of the latest 30 records (free) or of every record and any date range (Premium)
* Colour presets, "Match my site", custom colours with an automatic WCAG AA contrast check, and a live desktop and phone preview
* GDPR opt-in (free), CCPA opt-out and location-based rules (Premium)
* Premium workflow with checkout, email licence delivery and in-plugin sync

Service note:
This plugin integrates with thegradespace.com for checkout and license delivery.
It also checks thegradespace.com for plugin updates for private distribution installs.

== Installation ==

1. Upload the plugin folder to `/wp-content/plugins/gscookie/` or install the zip in WordPress admin.
2. Activate the plugin.
3. Open **GSCookie** in WordPress admin.
4. Configure legal framework and preferences.
5. (Optional) Upgrade in **GSCookie → License**.

== Frequently Asked Questions ==

= How does premium activation work? =
Upgrade from WP admin, complete checkout, then return to WP where license sync runs automatically.

= What if activation does not appear instantly? =
Use the **Sync license now** button in the License page.

= Do I need an account first? =
No. The license email is used for checkout identity and recovery.

= How are updates delivered if the plugin is not on WordPress.org? =
The plugin uses a private update endpoint from thegradespace.com. WordPress admins receive update notices in the Plugins screen when a newer version is available.

== For developers ==

GSCookie exposes a stable API from the top of every page:

    gscookie.has( 'analytics' )        // true or false ('necessary' is always true)
    gscookie.get()                     // { necessary, functional, analytics, marketing }
    gscookie.decided()                 // has the visitor chosen?
    gscookie.consentId()               // the visitor's consent ID, or null
    gscookie.on( function ( categories, detail ) { … } )   // after every change; returns an "off" function
    gscookie.ready( fn ), gscookie.open(), gscookie.set( { marketing: true } ), gscookie.acceptAll(), gscookie.rejectAll()
    document.addEventListener( 'gscookie:consent', function ( e ) { e.detail.categories … } )

Category aliases: essential = necessary, preferences = functional, statistics = analytics.

Make your own script or embed wait for consent:

    <script type="text/plain" data-gscookie-category="analytics" data-gscookie-src="https://example.com/t.js"></script>
    <template data-gscookie-category="marketing" data-gscookie-label="Instagram feed">…</template>

Add data-gscookie-ignore to a script GSCookie should leave alone. Any element with data-gscookie-open, or a link to #gscookie-settings, opens the settings dialog.

PHP: gscookie_has_consent( 'marketing' ). Filters: gscookie_services (recognised trackers and embeds), gscookie_categories (visitor wording), gscookie_scan_urls, gscookie_autoblock, gscookie_applies. Action: gscookie_consent_logged.

Shortcodes: [gscookie_declaration] (the cookie list by category, for a cookie policy page) and [gscookie_settings_link text="Cookie settings"].

Gradespace Core: when GSCookie is active, Core's own banner steps aside and its embeds follow GSCookie's choices.

== Changelog ==

= 1.3.1 =
* Fix: blocked videos and other embeds (e.g. a pasted 640×360 YouTube iframe) no longer run off the side of the page on phones. The consent placeholder, and the video once it's allowed, shrink to fit the screen and keep the iframe's aspect ratio
* Fix: the placeholder tightens its layout in a small embed, so its text and buttons stay visible
* Sites that already size their embeds keep their sizes (the new CSS has no specificity, so existing rules win)

= 1.3.0 =
* New: the cookie list shows only cookies a scan actually found on your site, or that you add and confirm. Dictionary entries only describe found cookies; they are never added on their own
* New: full scan with a browser pass (hidden, credentialless frames with everything allowed) as well as the server pass, so cookies set by scripts such as Google Analytics are found
* New: unknown cookies are listed as "Unclassified: please review"; cookies missed by several scans in a row are flagged "Not found recently" and then hidden unless pinned
* New: code found in your pages (a gtag.js tag, a YouTube video) becomes a prompt ("its cookies will be listed once seen"), with one click to list an embed's own third-party cookies
* New: categories with no cookies are left out of the banner (except Essential); "Accept all" only agrees to categories the visitor was shown
* New: automatic blocking of known trackers and embeds until consent, with size-keeping placeholders and order-preserving unblocking. On for new installs; sites updating from an earlier version keep their previous behaviour (blocking off) until you turn it on
* New: after updating, a notice ("Turn on automatic blocking — trackers and embeds wait for consent. Recommended.") and an Overview checklist item offer one-click "Turn it on" and "Preview what gets blocked"; the notice can be dismissed per user, the checklist item stays until blocking is on
* New: Google tags load in Consent Mode by default (every Consent Mode v2 signal starts as "denied", so Google sets no cookies until the visitor agrees); "Block Google tags until consent" is still available. Existing sites keep any saved choice, otherwise Consent Mode
* New: Google Consent Mode v2 and Microsoft UET consent signals; Global Privacy Control support; re-consent when a new category is used
* New: consent records with consent ID, method, categories shown, page and GPC flag; retention setting with daily clean-up; visitors can see their consent ID
* New: CSV export of consent records is free for the latest 30 records; Premium exports every record or a date range
* New: redesigned admin with tabs (Overview, Banner & design, Categories & cookies, Scan, Consent records, Legal & regions, Licence), live desktop and phone preview, colour presets, Match my site, WCAG AA contrast checks with suggested fixes, sticky save bar and on-brand dialogs
* New: banner positions (card left or right, bottom bar, centre), equal-weight button styles, corner styles, cookie button icon, position and size
* New: window.gscookie JavaScript API and gscookie:consent event, gscookie_has_consent() in PHP, [gscookie_declaration] and [gscookie_settings_link] shortcodes
* Improved: accessibility (banner first in the page, focus management, Esc, labelled switches, 44px targets, no scroll lock), translation-ready strings throughout, deferred script
* Improved: all styles scoped to gsck- prefixes so nothing clashes with Gradespace Core or themes
* Upgrade note: after updating, run a full scan from GSCookie → Scan. Cookies from older scans stay visible until then; seeded dictionary entries that were never found are hidden. Then preview what automatic blocking would change (GSCookie → Scan) and turn it on from the notice or the Overview

= 1.2.1 =
* Maintenance release

= 1.2.0 =
* Added first-visit consent banner with Accept All / Reject All / Customise flow
* Floating icon hidden on first visit; revealed with pop animation after consent
* Redesigned floating icon: lime gradient donut ring with spinning dashed orbit
* Overhauled cookie scanner: crawls up to 5 pages, detects noscript/img pixels, gtag/dataLayer
* Expanded provider detection to 32 providers and 47 cookie dictionary entries
* Admin UI: dark/light theme support with CSS variables throughout
* Admin UI: pill-shaped buttons and improved card styles

= 1.0.1 =
* Added automatic post-checkout license sync in WordPress admin
* Added manual "Sync license now" fallback action
* Improved checkout/license flow reliability

= 1.0.0 =
* Initial public release
* Core consent modal and cookie controls
* Premium checkout and licensing flow
