=== CookiesMan Consent ===
Contributors: xyz-ks
Tags: cookies, consent, gdpr, privacy, cookie banner
Requires at least: 5.8
Tested up to: 6.7
Requires PHP: 7.4
Stable tag: 0.4.3
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Connect your WordPress site to CookiesMan: onboard, scan cookies, and inject the consent banner automatically.

== Description ==

CookiesMan Consent links your WordPress site to [CookiesMan](https://cookiesman.app) so you can:

* Register or sign in from wp-admin
* Connect the current site and store a valid Site ID
* Launch a cookie scan from WordPress
* Inject the CookiesMan consent banner on the front end automatically after connect

No theme edits are required for the banner. After you complete the connect step, the plugin enqueues `banner.js` with your Site ID in the footer.

Docs: https://cookiesman.app/docs/installation#wordpress

== Installation ==

1. Download `cookiesman-consent.zip` from https://cookiesman.app/downloads/cookiesman-consent.zip (or copy the `cookiesman-consent` folder).
2. In WordPress admin go to Plugins → Add New → Upload Plugin and select the zip.
3. Activate **CookiesMan Consent**.
4. Open **CookiesMan** in the admin sidebar.
5. Complete Step 1 (account) and Step 2 (connect this website).
6. Optionally launch a scan from Step 3.

== Frequently Asked Questions ==

= Do I need to paste a banner script into my theme? =

No. After you connect the website in the CookiesMan admin page, the plugin injects the correct banner script automatically on the public front end. You do not need to hardcode a script tag in the theme.

= Where are auth tokens stored? =

Access and refresh tokens are stored in a separate WordPress option that is not autoloaded on every page request. Public settings (Site ID, website ID, scan status) live in a different option.

= What happens when I uninstall the plugin? =

Uninstall removes public settings, secrets (tokens), and related transients so connection data does not remain in the database.

= Which banner URL does the plugin use? =

`https://banner.cookiesman.app/banner.js?site_id=<32-char-hex>` with `defer`. Invalid or empty Site IDs are not enqueued.

== Changelog ==

= 0.4.3 =
* Updates now come from the plugin's own repository (GitLab project 97). Installs update to this version automatically; nothing to do.
* Onboarding, login and stats calls now go to `https://api.cookiesman.app/functions/v1/integration-onboarding` instead of the old hosted backend. Sign in again once after updating: tokens saved by older versions are no longer accepted.
* Stop auto-injecting the TCF/GPP sync stub in `wp_head`. A permanent stub without a loaded TCF CMP (real IAB CMP ID) can stall Prebid. The plugin now injects `banner.js` only (Consent Mode / category banner).

= 0.4.2 =
* Sync stub in `wp_head` now installs both `__tcfapi` and `__gpp` (cmpId 0 / command queues / `__tcfapiLocator` + `__gppLocator`) before deferred banner.js for Prebid and GPP 1.1 callers. GPP stub advertises `2:tcfeuv2` only (no deprecated uspv1).

= 0.4.1 =
* Inject sync TCF `__tcfapi` stub in `wp_head` (cmpId 0 / command queue / `__tcfapiLocator`) before deferred banner.js for Prebid compatibility.

= 0.4.0 =
* Security hardening: auth tokens moved to a separate non-autoloaded option; public option no longer stores secrets.
* Frontend banner enqueue reads only the public Site ID (tokens never loaded on the public site).
* Connected state requires a valid 32-character hex Site ID.
* Admin UI: system font stack (no external Google Fonts import); safer result messaging (textContent).
* Uninstall cleans public settings, secrets, and refresh lock transient.
* One-time migration moves legacy tokens out of the public option.

= 0.3.x =
* Progressive onboarding, scan launch, stats panel, disconnect, and banner inject via wp_footer / defer strategy.

== Upgrade Notice ==

= 0.4.3 =
Recommended: moves the plugin to the new CookiesMan API (sign in again once after updating) and removes the always-on TCF/GPP stub so Prebid is not left waiting on an unfinished CMP. Banner injection is unchanged.

= 0.4.0 =
Recommended update: separates secrets from public settings and hardens banner inject / admin UI. Existing installs migrate tokens automatically on load.
