From dc07b2d0d2ab3422e2369d3b52d5b62e335c77b5 Mon Sep 17 00:00:00 2001
From: Jasper Frumau <jasper@imagewize.com>
Date: Sat, 30 May 2026 10:44:44 +0700
Subject: [PATCH 1/4] Block analytics scripts before consent; move sbjs_* to
 analytics category
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Add script_loader_tag filter to block sourcebuster-js, wc-order-attribution,
  and wp_slimstat until analytics consent is given (type=text/plain +
  data-category attribute; vanilla-cookieconsent re-enables on accept)
- Move sbjs_* autoClear from necessary to analytics — these are WooCommerce
  traffic-source tracking cookies, not essential cookies; placing them in
  necessary meant they could never be cleared on rejection
- Expose warder_blocked_scripts filter for site-specific overrides
---
 inc/defaults.php | 11 +++++-----
 inc/frontend.php | 57 ++++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 62 insertions(+), 6 deletions(-)

diff --git a/inc/defaults.php b/inc/defaults.php
index c321b20..029f163 100644
--- a/inc/defaults.php
+++ b/inc/defaults.php
@@ -33,12 +33,7 @@ function warder_get_default_options() {
 				'description' => 'These cookies are essential for the proper functioning of the website and cannot be disabled.',
 				'enabled'     => true,
 				'readonly'    => true,
-				'cookies'     => array(
-					array(
-						'name'     => '/^sbjs_/',
-						'is_regex' => true,
-					),
-				),
+				'cookies'     => array(),
 			),
 			'analytics' => array(
 				'title'       => 'Performance and Analytics',
@@ -66,6 +61,10 @@ function warder_get_default_options() {
 						'name'     => '/^mtm_/',
 						'is_regex' => true,
 					),
+					array(
+						'name'     => '/^sbjs_/',
+						'is_regex' => true,
+					),
 				),
 			),
 		),
diff --git a/inc/frontend.php b/inc/frontend.php
index 07da73c..a46fd82 100644
--- a/inc/frontend.php
+++ b/inc/frontend.php
@@ -112,3 +112,60 @@ function warder_add_preferences_button() {
 	echo '</button>';
 }
 add_action( 'wp_footer', 'warder_add_preferences_button' );
+
+/**
+ * Blocks known analytics/marketing scripts until the matching consent category
+ * is accepted by rewriting their type to "text/plain" and adding data-category.
+ *
+ * vanilla-cookieconsent holds type="text/plain" scripts and re-executes them
+ * (as type="text/javascript") once the user accepts the named category. This
+ * prevents scripts like WooCommerce's SourceBuster (which sets sbjs_* cookies)
+ * and Slimstat from firing before consent.
+ *
+ * Site owners can extend or override the list via the warder_blocked_scripts filter.
+ *
+ * @param string $tag    The full <script> HTML tag.
+ * @param string $handle The registered script handle.
+ * @return string
+ */
+function warder_block_script_until_consent( $tag, $handle ) {
+	$options = warder_get_merged_options();
+	if ( empty( $options['enabled'] ) ) {
+		return $tag;
+	}
+
+	/**
+	 * Map of WordPress script handles to the consent category that must be
+	 * accepted before the script is allowed to run.
+	 *
+	 * @param array<string,string> $scripts handle => category slug.
+	 */
+	$blocked = apply_filters(
+		'warder_blocked_scripts',
+		array(
+			'sourcebuster-js'    => 'analytics',
+			'wc-order-attribution' => 'analytics',
+			'wp_slimstat'        => 'analytics',
+		)
+	);
+
+	if ( ! isset( $blocked[ $handle ] ) ) {
+		return $tag;
+	}
+
+	$category = esc_attr( $blocked[ $handle ] );
+
+	// Replace an explicit type="text/javascript" if present, otherwise inject.
+	if ( preg_match( '/\btype=["\']text\/javascript["\']/i', $tag ) ) {
+		$tag = preg_replace(
+			'/\btype=["\']text\/javascript["\']/i',
+			'type="text/plain" data-category="' . $category . '"',
+			$tag
+		);
+	} else {
+		$tag = str_replace( '<script ', '<script type="text/plain" data-category="' . $category . '" ', $tag );
+	}
+
+	return $tag;
+}
+add_filter( 'script_loader_tag', 'warder_block_script_until_consent', 10, 2 );

From 7bb794346195edd21e4b46d60d85bc45b6fdb2c6 Mon Sep 17 00:00:00 2001
From: Jasper Frumau <jasper@imagewize.com>
Date: Sat, 30 May 2026 10:46:51 +0700
Subject: [PATCH 2/4] Add WordPress and WooCommerce cookies to necessary
 defaults

Documents the cookies that are genuinely essential so they appear
correctly in the admin cookie table and are never auto-cleared:
- cc_cookie (consent record)
- wordpress_logged_in_*, wordpress_sec_*, wordpress_test_cookie (auth)
- wp-settings-* (admin bar / customizer state)
- wp_woocommerce_session_*, woocommerce_cart_hash,
  woocommerce_items_in_cart, woocommerce_recently_viewed (cart/session)
- PHPSESSID (PHP session)
---
 inc/defaults.php | 48 +++++++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 47 insertions(+), 1 deletion(-)

diff --git a/inc/defaults.php b/inc/defaults.php
index 029f163..2f0d87e 100644
--- a/inc/defaults.php
+++ b/inc/defaults.php
@@ -33,7 +33,53 @@ function warder_get_default_options() {
 				'description' => 'These cookies are essential for the proper functioning of the website and cannot be disabled.',
 				'enabled'     => true,
 				'readonly'    => true,
-				'cookies'     => array(),
+				'cookies'     => array(
+					// Consent record — must always be kept.
+					array(
+						'name'     => 'cc_cookie',
+						'is_regex' => false,
+					),
+					// WordPress login & security.
+					array(
+						'name'     => '/^wordpress_logged_in_/',
+						'is_regex' => true,
+					),
+					array(
+						'name'     => '/^wordpress_sec_/',
+						'is_regex' => true,
+					),
+					array(
+						'name'     => 'wordpress_test_cookie',
+						'is_regex' => false,
+					),
+					// WordPress admin bar / customizer.
+					array(
+						'name'     => '/^wp-settings-/',
+						'is_regex' => true,
+					),
+					// WooCommerce session & cart.
+					array(
+						'name'     => '/^wp_woocommerce_session_/',
+						'is_regex' => true,
+					),
+					array(
+						'name'     => 'woocommerce_cart_hash',
+						'is_regex' => false,
+					),
+					array(
+						'name'     => 'woocommerce_items_in_cart',
+						'is_regex' => false,
+					),
+					array(
+						'name'     => 'woocommerce_recently_viewed',
+						'is_regex' => false,
+					),
+					// PHP session.
+					array(
+						'name'     => 'PHPSESSID',
+						'is_regex' => false,
+					),
+				),
 			),
 			'analytics' => array(
 				'title'       => 'Performance and Analytics',

From 312bc5716d80a7de234c2230474bd743f1d60c02 Mon Sep 17 00:00:00 2001
From: Jasper Frumau <jasper@imagewize.com>
Date: Sat, 30 May 2026 10:58:18 +0700
Subject: [PATCH 3/4] bump version to 2.1.0; update changelog, readme, and
 package.json

---
 CHANGELOG.md              |  9 +++++++++
 package.json              |  2 +-
 readme.txt                | 12 +++++++++++-
 warder-cookie-consent.php |  4 ++--
 4 files changed, 23 insertions(+), 4 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 351dcd9..4432a1d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,15 @@
 
 All notable changes to Warder Cookie Consent are documented here.
 
+## [2.1.0] - 2026-05-30
+
+### Added
+- `warder_block_script_until_consent()` — a `script_loader_tag` filter that rewrites known analytics/marketing script tags to `type="text/plain" data-category="<category>"` before consent is given. vanilla-cookieconsent holds these scripts and re-executes them once the user accepts the matching category. Built-in handles: `sourcebuster-js`, `wc-order-attribution`, `wp_slimstat`. Site owners can extend or replace the list via the `warder_blocked_scripts` filter.
+- Expanded the `necessary` category cookie defaults to cover the full WordPress and WooCommerce session surface: `cc_cookie` (consent record), `wordpress_logged_in_*`, `wordpress_sec_*`, `wordpress_test_cookie`, `wp-settings-*`, `wp_woocommerce_session_*`, `woocommerce_cart_hash`, `woocommerce_items_in_cart`, `woocommerce_recently_viewed`, `PHPSESSID`.
+
+### Changed
+- `sbjs_*` (SourceBuster.js attribution cookies) moved from the `necessary` category to `analytics`, where they belong — they are set by an optional tracking script, not by WordPress core.
+
 ## [2.0.2] - 2026-05-30
 
 ### Security
diff --git a/package.json b/package.json
index 2a70ec4..931eadb 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "imwz-cookie-consent",
-  "version": "2.0.2",
+  "version": "2.1.0",
   "main": "webpack.config.js",
   "scripts": {
     "test": "echo \"Error: no test specified\" && exit 1"
diff --git a/readme.txt b/readme.txt
index a7c91aa..a3ae18a 100644
--- a/readme.txt
+++ b/readme.txt
@@ -4,7 +4,7 @@ Donate link: https://imagewize.com
 Tags: cookie, consent, gdpr, privacy, compliance
 Requires at least: 5.0
 Tested up to: 7.0
-Stable tag: 2.0.2
+Stable tag: 2.1.0
 Requires PHP: 8.0
 License: GPLv2 or later
 License URI: https://www.gnu.org/licenses/gpl-2.0.html
@@ -66,6 +66,13 @@ https://github.com/imagewize/warder-cookie-consent
 
 == Changelog ==
 
+= 2.1.0 =
+*2026-05-30*
+
+* Added: `warder_block_script_until_consent()` — rewrites known analytics/marketing script tags to `type="text/plain" data-category="<category>"` so they are held by vanilla-cookieconsent until the user accepts the matching category. Covers `sourcebuster-js` (SourceBuster.js), `wc-order-attribution` (WooCommerce order attribution), and `wp_slimstat` (Slimstat Analytics) out of the box. Extend or replace the list with the `warder_blocked_scripts` filter.
+* Added: expanded `necessary` category cookie defaults to cover the full WordPress and WooCommerce session surface: `cc_cookie`, `wordpress_logged_in_*`, `wordpress_sec_*`, `wordpress_test_cookie`, `wp-settings-*`, `wp_woocommerce_session_*`, `woocommerce_cart_hash`, `woocommerce_items_in_cart`, `woocommerce_recently_viewed`, `PHPSESSID`. Existing installs are unaffected (defaults only apply to new installs or when the necessary category has no cookies configured).
+* Changed: `sbjs_*` (SourceBuster.js attribution cookies) moved from the `necessary` category to `analytics` in the default configuration — they are set by an optional tracking script, not by WordPress core.
+
 = 2.0.2 =
 *2026-05-30*
 
@@ -194,6 +201,9 @@ https://github.com/imagewize/warder-cookie-consent
 
 == Upgrade Notice ==
 
+= 2.1.0 =
+Adds automatic script blocking for SourceBuster.js, WooCommerce order attribution, and Slimstat before consent is given. Necessary cookie defaults now include the full WordPress and WooCommerce session cookie set. The `sbjs_*` pattern moves to analytics — if you manually placed it under necessary, you can remove the duplicate.
+
 = 2.0.2 =
 Security and code-quality hardening: stronger input sanitization on settings save, nonce verification before delete actions, isset-guarded validation, and clearer source-code documentation. Recommended for all users.
 
diff --git a/warder-cookie-consent.php b/warder-cookie-consent.php
index e445f7a..0945da5 100644
--- a/warder-cookie-consent.php
+++ b/warder-cookie-consent.php
@@ -2,7 +2,7 @@
 /**
  * Plugin Name: Warder Cookie Consent
  * Description: GDPR-compliant cookie consent banner with category management and floating preferences toggle.
- * Version: 2.0.2
+ * Version: 2.1.0
  * Author: Jasper Frumau
  * Author URI: https://imagewize.com
  * Requires at least: 5.0
@@ -16,7 +16,7 @@
 
 defined( 'ABSPATH' ) || exit;
 
-define( 'WARDER_VERSION', '2.0.2' );
+define( 'WARDER_VERSION', '2.1.0' );
 define( 'WARDER_PLUGIN_FILE', __FILE__ );
 
 require_once plugin_dir_path( __FILE__ ) . 'inc/defaults.php';

From e45ab7acdaa52eef002ed1e83cc71554da5749ce Mon Sep 17 00:00:00 2001
From: Jasper Frumau <jasper@imagewize.com>
Date: Sat, 30 May 2026 11:00:56 +0700
Subject: [PATCH 4/4] fix: capitalize doc comment long description to pass
 phpcs

---
 inc/frontend.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/inc/frontend.php b/inc/frontend.php
index a46fd82..434a273 100644
--- a/inc/frontend.php
+++ b/inc/frontend.php
@@ -117,7 +117,7 @@ function warder_add_preferences_button() {
  * Blocks known analytics/marketing scripts until the matching consent category
  * is accepted by rewriting their type to "text/plain" and adding data-category.
  *
- * vanilla-cookieconsent holds type="text/plain" scripts and re-executes them
+ * Vanilla-cookieconsent holds type="text/plain" scripts and re-executes them
  * (as type="text/javascript") once the user accepts the named category. This
  * prevents scripts like WooCommerce's SourceBuster (which sets sbjs_* cookies)
  * and Slimstat from firing before consent.