=== ZeeMee Cookie Consent ===
Contributors: zeemeemedia
Tags: cookies, consent, cmp, gdpr, consent-mode
Requires at least: 6.0
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.3.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Free consent banner with Google Consent Mode v2, language profiles, cookie documentation and import/export.

== Description ==

ZeeMee Cookie Consent is a lightweight consent management plugin for WordPress.

Features:

* Create one consent profile per HTML language code.
* Automatically match profiles to the current `<html lang="">` value.
* Choose any profile as a fallback.
* Supports Google Consent Mode updates.
* Optional Google Tag Manager / gtag.js loading from <head> with Consent Mode v2 (cookieless pings before consent, full measurement after).
* dataLayer events (`zmcc_consent_ready`, `zmcc_consent_update`) for GTM triggers.
* Built-in cookie documentation shortcode: `[cmp_cookie_documentation]`.
* Built-in Gutenberg block for the cookie documentation table.
* Cookie discovery for administrators while browsing the site.
* JavaScript-assisted frontend cookie scan for logged-in administrators.
* Optional cookie scan for all visitors (off by default): unknown first-party cookie names are reported after consent, rate-limited, and quarantined until an admin categorises them.
* Export and import cookie documentation as JSON.
* Manual cookie entry with per-language purposes.
* Design tab: colours (modal, text, links, buttons, floating button, hover states) and placement (9 positions) with a live WCAG AA contrast check.
* Privacy policy link in the banner (per profile, falls back to the WordPress privacy page).
* All ZeeMee plugins share one "ZeeMee Plugins" admin menu; this plugin lives under it with tabs.
* Optional, off by default: a small "Powered by ZeeMee" link in the banner.

== Installation ==

1. Upload the plugin folder to `/wp-content/plugins/`, or install the ZIP through the WordPress Plugins screen.
2. Activate the plugin through the WordPress Plugins screen.
3. Go to **Cookie Consent > Add New** and create one or more language profiles.
4. Set the HTML lang code for each profile, for example `en-US` or `da-DK`.
5. Go to **Cookie Consent > Settings** and choose a fallback profile.
6. Insert `[cmp_cookie_documentation]` on a page, or use the **Cookie Documentation** block.

== External services ==

This plugin can load Google Tag Manager or the Google tag (gtag.js) from `https://www.googletagmanager.com` — but only if you enter a tag ID in a consent profile. If the field is empty, nothing is loaded from Google by this plugin.

When a tag ID is set, the browser requests the container script from Google on every page view and, before the visitor has made a choice, Google receives consent-mode signals ("denied") and cookieless pings as described in Google's Consent Mode documentation. After the visitor's choice, the consent state is sent as a consent update. What Google then collects depends on the tags you have configured in your container.

* Google Tag Manager / Google tag terms: https://marketingplatform.google.com/about/analytics/tag-manager/use-policy/
* Google privacy policy: https://policies.google.com/privacy

The plugin sends no data to the plugin author or any other third party.

== Frequently Asked Questions ==

= How does the plugin choose a profile? =

The plugin compares the current `<html lang="">` value to the profile HTML lang code. If no exact match is found, it uses the selected fallback profile.

= Does the plugin translate text automatically? =

No. You create separate consent profiles and define the texts yourself per HTML lang code.

= Can I use Google Tag Manager? =

Yes. Add a GTM container ID to a profile and the plugin loads the container from `<head>` right after the Consent Mode default (Google's recommended order). Before consent, Google tags only send cookieless pings; after consent they measure normally. If your theme or another plugin already loads the container, leave the field empty.

To block the container entirely until consent is given, add `add_filter( 'zmcc_load_tags_before_consent', '__return_false' );` to your site.

= Which dataLayer events can I use in GTM? =

* `zmcc_consent_ready` — fired on page load when a stored consent was applied.
* `zmcc_consent_update` — fired when the visitor makes or changes a choice.

Both carry `zmcc_consent_functional`, `zmcc_consent_analytics` and `zmcc_consent_marketing` with the value `granted` or `denied`. Example: trigger a GA4 `page_view` on `zmcc_consent_update` where `zmcc_consent_analytics` equals `granted`, so the first page view after consent is not lost.

= Can I move cookie documentation between sites? =

Yes. Export the cookie register as JSON and import it on another site running ZeeMee Cookie Consent.

== Changelog ==

= 1.3.0 =
* Added: Design tab with colours, hover colours, icon colours and placement for the modal and the floating button, plus live WCAG contrast check.
* Added: privacy policy link in the banner (per profile; falls back to the WordPress privacy policy page).
* Added: shared "ZeeMee Plugins" admin menu; Profiles, Design, Settings and Cookie Documentation are now tabs on one page.
* Added: optional "Powered by ZeeMee" link (opt-in, off by default, UTM-tagged).
* Changed: frontend CSS uses custom properties; positioning no longer forced by JavaScript.

= 1.2.2 =
* Code now passes WordPress Coding Standards (WordPress-Extra). Head script printed via wp_print_inline_script_tag() for CSP support.
* Uninstall now also removes consent profiles and rate-limit transients.
* Admin cookie scan writes to the database only when something changed.
* Added: optional "Cookie scan for all visitors" (Settings). Visitors who gave consent report unknown first-party cookie names once per day. Same-origin check, per-IP throttle, hard caps, and new names are hidden from the declaration until reviewed.

= 1.2.1 =
* Fixed: consent cookie was read server-side, so page caches served one visitor's consent state to everyone. Now read in the browser.
* Fixed: a custom consent cookie name was ignored by the <head> consent default (private method), leaving returning visitors on "denied".
* Fixed: stored consent is now also pushed as a consent update in <head>, so it beats region-scoped defaults from Site Kit and others.
* Fixed: GTM container is loaded from <head> (with gtm.start) instead of the footer; <noscript> fallback printed at wp_body_open.
* Added: dataLayer events zmcc_consent_ready / zmcc_consent_update for GTM triggers.
* Fixed: no longer re-writes the consent cookie on every page view (sliding expiry).
* Fixed: GTM ID and cookie name are validated on save.

= 1.2.0 =
* Added server-side Consent Mode default, WP Consent API registration and Site Kit coexistence.
* Added support for gtag.js IDs (G-/AW-/DC-/GT-) in addition to GTM containers.

= 1.1.0 =
* Added JSON export and import for cookie documentation.
* Added a Gutenberg block for the cookie documentation table.
* Added uninstall cleanup for plugin options.
* Added JavaScript-assisted frontend cookie scanning for logged-in administrators.
* Added plugin settings link on the Plugins screen.
* Improved admin copy and packaging for WordPress.org submission.

= 1.0.6 =
* Fixed remaining Plugin Check warnings for POST array sanitization.

= 1.0.3 =
* Fixed Plugin Check warnings for unslashed and non-sanitized array POST input.

= 1.0.2 =
* Fixed Plugin Check issues for i18n placeholder comments, input sanitization, readme metadata, and WordPress.org language loading.

= 1.0.0 =
* Initial release.
