CHANGELOG.md

Changelog

[1.7.3] - 2026-09-06

Fixed

• The release package and the Composer/Packagist dist no longer ship tests, docs or development configuration (.gitattributes export-ignore plus unified release excludes)
• Service Worker path resolution on subdirectory-core installs (Bedrock/Radicle). ServiceWorkerManager resolved the public webroot with core's get_home_path(), which derives the path from $_SERVER['SCRIPT_FILENAME'] and returns / whenever the entry point sits outside the core directory — every front-end request and every WP-CLI run on those installs. The per-request file_exists() check in the fallback registration therefore stat'd /lw-cookie-sw.js, emitting an open_basedir warning on every page view (reported: ~150k warnings/day, a 101 MB error.log). The webroot is now derived from the home/site URL path delta applied to ABSPATH, and falls back to ABSPATH on layouts it cannot resolve. Introduced in 1.7.0; consent blocking itself was unaffected.

Changed

• The Service Worker fallback route no longer touches the filesystem when it registers on init. The URI check in serve_sw() gates the work instead — when the static file really is in the webroot, the web server answers before WordPress boots, so the callback never runs. Removes one stat() from every request.

[1.7.2] - 2026-08-20

Changed

• Tested up to WordPress 7.1.

[1.7.1] - 2026-07-24

Added

• Blocked-embed placeholder (lwplugins/lw-lms#18). When content blocking removed a blocked iframe's src (YouTube, Vimeo, Maps, etc.), the visitor was left with a bare, blank frame and no signal that consent was required — most visibly on LW LMS lesson pages, whose Vimeo videos rendered as a black box (the plugin is headless, so it never rendered the iframe itself; the gap was here in LW Cookie all along). guard.js now replaces a blocked iframe with a placeholder that explains the block and offers an "Accept & load content" button; clicking it grants exactly the category that embed needs and loads it in place. The message and button label are admin-editable (Texts → Blocked Content) and translatable, with a bundled Hungarian translation.

Changed

• Granting consent — from the banner or the new placeholder — now restores already-blocked iframes in place via __lwGuard.refresh(), so loading an embed no longer depends on a full page reload.

[1.7.0] - 2026-07-18

Added

• Banner preview mode (issue #7): a "Preview banner on the site" button (General tab) opens the front-end with ?lw-cookie-preview=1, which forces the banner visible for administrators — even before it is enabled or after they have already consented — so it can be reviewed and tuned.
• "Hide the banner for logged-in users" option (Advanced tab, default off) so the consent banner never pops up for administrators while they work (issue #7).
• The consent banner and floating button are now hidden inside page-builder editor canvases (Bricks ?bricks=run, Elementor preview), so they no longer clutter the builder (issue #7).
• The built-in default banner texts now follow the site language (issue #7). The title, message, buttons and category names/descriptions were stored as literal English and rendered as-is; they are now text-domain-localized (with the bundled Hungarian translation) until the admin overrides them in the Texts tab.

Fixed

• Consent Service Worker now registers on subdirectory-core installs (issue #5). lw-cookie-sw.js 404'd on Bedrock/Radicle: serve_sw() never overrode the query's 404 status, and install() wrote the file to (and register_fallback() checked) ABSPATH — the wp/ core directory — instead of the public webroot the SW URL points to. It now sends status_header( 200 ) and resolves the webroot via get_home_path().
• Google Consent Mode signals now reach GTM-only setups (issue #6). guard.js only sent the consent update when a global gtag() existed, so on GTM-only sites (no gtag.js) it was never delivered and hits kept npa=1 despite consent. Consent commands now go onto the dataLayer directly (with a gtag fallback), a GCM v2 default is set before GTM processes its queue, and a returning visitor's granted signal fires immediately instead of waiting for DOMContentLoaded.

Changed

• Quality gates: PHPStan level 5 and PHPUnit tests are now enforced in CI alongside PHPCS; minimum PHP raised to 8.2. Bumped actions/checkout to v7 (PR #4).

[1.6.9] - 2026-05-03

Fixed

• Privacy Policy link, preferences modal title, "(Required)" badge, Cookie/Provider/Purpose/Duration/Type column headers, and the Manage Cookie Preferences / Delete All Cookies buttons now register with Polylang/WPML even when the Texts tab field is blank — previously they only appeared after a value was saved
• Translations of the above fields are now stable: registration uses the literal English source (e.g. "Privacy Policy") so subsequent edits in Polylang/WPML persist instead of being orphaned by source-string drift between requests

[1.6.8] - 2026-04-30

Changed

• Added missing 'default' => [] to top-level input_schema of lw-cookie/get-consent-stats so it can be invoked without arguments via the Abilities API

[1.6.7] - 2026-04-25

Added

• Privacy Policy link text is now editable from the Texts tab and translatable via Polylang/WPML
• Cookie preferences modal: title, "(Required)" badge, and the Cookie/Provider/Purpose/Duration column headers are now editable and translatable
• Cookie declaration page ([lw_cookie_declaration]): "Manage Cookie Preferences" button, "Delete All Cookies" button, and the Cookie/Provider/Purpose/Duration/Type column headers are now editable and translatable
• Texts tab is now grouped into Banner / Buttons / Preferences Modal / Cookie Declaration Page sections, with placeholders showing the built-in default for each field

Fixed

• Declared-cookie translations: cookie names containing characters that are not valid Polylang/WPML string identifiers (e.g. wordpress_sec_*, wp-settings-1) are now sanitized when building the registration key, so translations register and resolve consistently

[1.6.6] - 2026-04-23

Added

• Polylang, WPML, and TranslatePress integration — all admin-editable strings are registered for translation (banner texts, button labels, category names/descriptions, declared cookie provider/purpose/duration)
• Texts and Categories tabs lock source-text fields when a multilingual plugin is active, with a direct link to the matching translation UI and an "Unlock to edit source" button
• Inline lock-reason banner shown inside the disabled fieldset, naming the active multilingual plugin
• Necessary category name and description are now editable from the Categories tab
• Cookie list shown per category inside the Customize preferences modal (collapsible)
• [lw_cookie_declaration] category names and descriptions now go through the Polylang/WPML translation bridge
• Hungarian translation fully refreshed for the new strings
• New banner_box_alignment setting (Appearance → Floating Box Alignment): choose left or right for the floating box banner

Changed

• Floating "box" banner layout now defaults to the bottom-right corner (was bottom-left)
• Floating Button settings moved from Advanced to Appearance (visual grouping)
• With the Floating Box layout, the floating button now automatically mirrors the banner alignment — floating_button_pos still applies to the Full-width Bar layout

Fixed

• Floating button stays hidden while the consent banner is visible (CSS .lw-cookie-hidden now covers .lw-cookie-floating-btn too)
• Settings sanitizer now preserves the stored value for keys missing from the submitted form, so locked source strings are not reset to defaults when saving any other tab

[1.6.5] - 2026-03-22

Fixed

• Rename frontend CSS classes from lw-cookie-banner to lw-cookie-notice to prevent adblocker false positives

[1.6.4] - 2026-03-22

Added

• LW Site Manager integration - cookie consent abilities for AI agents
• lw-cookie/get-options ability - get cookie consent settings
• lw-cookie/set-options ability - update cookie consent settings
• lw-cookie/get-consent-stats ability - get consent statistics
• lw-cookie/scan-cookies ability - trigger cookie scan

[1.6.3]

Fixed

• Smarter autoloader fallback - supports root Composer dependency installs

[1.6.2]

Fixed

• Graceful error when autoloader is missing (shows admin notice instead of fatal error)

[1.6.1]

Added

• Inline fallback click handlers for cache-proof banner interaction

Fixed

• Cookie banner buttons now work on LiteSpeed Cache servers (JS delay/defer bypassed inline config)

Changed

• LiteSpeed exclusion patterns now cover lwCookieConfig inline script and lw-cookie prefix
• Added data-no-lazy attribute to prevent lazy loading of consent script

[1.6.0]

Added

• Service Worker for network-level request blocking
• MutationObserver for DOM element interception (script/iframe/img)
• document.cookie override to prevent tracking cookie writes
• Inline guard.js runs before any body element is parsed
• REST API endpoint for consent logging (replaces admin-ajax)
• Works with ANY full-page cache plugin (WP Rocket, LiteSpeed, Cloudflare, etc.)

Changed

• Major: Complete rewrite to client-side blocking architecture (cache-proof)
• Google Consent Mode v2 always defaults to denied (cache-safe)
• Banner always rendered in HTML with hidden class (guard.js toggles visibility)

Removed

• Server-side ScriptBlocker (replaced by client-side guard)
• Server-side ContentBlocker output buffering (replaced by MutationObserver and Service Worker)
• AJAX nonce for consent saving (nonces get cached - now uses REST with rate limiting)

[1.5.2]

Added

• Cache plugin compatibility layer for LiteSpeed Cache, WP Rocket, Cloudflare Rocket Loader, and PageSpeed

Fixed

• Cookie banner buttons now work correctly with LiteSpeed Cache and WP Rocket (JS delay/defer compatibility)

[1.5.1]

Fixed

• Minor fix

[1.5.0]

Added

• Hash-based tab navigation on settings page
• New cookie-bite icon
• Updated ParentPage with SVG icon support from registry

[1.4.9]

Fixed

• Replace dashicons with inline SVG on floating button (dashicons not available on frontend)

[1.4.8]

Fixed

• Minor fix

[1.4.7]

Fixed

• Minor fix

[1.4.6]

Fixed

• Admin notice isolation for notices relocated by WordPress core JS

[1.4.5]

Changed

• Isolate third-party admin notices on LW plugin pages

[1.4.4]

Added

• Fresh POT file and Hungarian (hu_HU) translation

[1.4.3]

Added

• Plugin registry fetched from central GitHub JSON (no more per-plugin registry updates)

Fixed

• Release ZIP now includes Composer autoloader for non-Composer installs
• Settings page now stays on the active tab after saving

[1.4.1]

Fixed

• "Accept & Load Content" button now properly saves consent and loads blocked iframes in-place
• Cookie banner now hides when accepting content via blocked content placeholder
• All blocked content of the same category loads when any placeholder is accepted

[1.4.0]

Added

• Google Consent Mode v2 now loads at -PHP_INT_MAX priority (before any other script)
• Meta Pixel (Facebook) consent API support - automatic revoke/grant calls
• dataLayer.push event for GTM triggers (lw_cookie_consent_update)
• WordPress filters for third-party plugin integration
• Script blocking override filter (lw_cookie_should_block_script)

[1.3.5]

Changed

• Scanner auto-enables all cookie categories during scan for complete detection

[1.3.4]

Added

• Deep scan using remote headless browser for better cookie detection

Changed

• Scanner now combines local and remote scan results automatically

[1.3.3]

Added

• "Delete All Cookies" button in cookie declaration shortcode

Fixed

• Preferences modal now always renders (floating button works after consent given)

[1.3.2]

Fixed

• ContentBlocker output buffer compatibility with AJAX and REST requests
• ContentBlocker now only processes HTML documents

[1.3.1]

Added

• Content Blocking - blocks YouTube, Vimeo, Google Maps, and other embeds until consent
• HTTP header cookie detection via wp_remote_head()

Changed

• Scanner now includes random blog posts (not just pages)
• External content scan limit removed (scans all posts)
• Native WordPress admin style for scanner UI

[1.3.0]

Added

• Server-side Cookie Scanner - detects all cookies including HttpOnly
• LW Plugins Cookie Database API integration (2000+ cookies)
• Automatic cookie enrichment with provider, purpose, and duration
• REST API endpoints for scan results
• Multi-page scanning (home, WooCommerce cart/checkout, posts)

Changed

• Modern scanner UI with networkidle detection

[1.2.0]

Added

• Hungarian (hu_HU) translation
• POT file for translations

[1.1.0]

Added

• Cookie Declaration admin tab for managing cookie list
• [lw_cookie_declaration] shortcode to display cookies on any page
• "Add Common Cookies" quick-add feature
• GDPR consent search by consent ID or IP address (CLI)
• GDPR consent deletion/erasure support (CLI)

Changed

• Full GDPR compliance with cookie transparency

[1.0.0]

Added

• Initial release
• GDPR-compliant cookie consent banner
• 4 cookie categories (Necessary, Functional, Analytics, Marketing)
• Customizable appearance (position, layout, colors)
• Script blocking for known tracking scripts
• Google Consent Mode v2 support
• Consent logging with anonymized IP
• Floating button for consent changes
• Modern tabbed admin interface
• Full WP-CLI support for settings, stats, and export