Vendors YahnisElsts/plugin-update-checker v5.7 under vendor/ and wires
it to poll updates.json on the repo main branch. WP surfaces new
versions via Dashboard → Updates on its normal twice-daily cadence.
PUC is vendored (not a submodule) so Gitea's archive/main.zip — the
download target — includes it.
Also relicenses from GPL-2.0-or-later to a proprietary licence granting
use only to authorised sites, with all other rights reserved. Plugin
URI + Author URI switched from the placeholder github.com URL to the
canonical Gitea repo.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
10s was unnecessarily long — any EEA user with Funding Choices properly
loaded will have __tcfapi within 3s. Reducing the timeout means non-TCF
visitors (Americas etc.) receive the granted fallback 7 seconds sooner.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Visitors outside EEA/UK/CH (e.g. Americas) have no __tcfapi injected by
Google Funding Choices, causing the TCF bridge poll to time out and leaving
them permanently at the default denied state. After the 10s timeout, grant
full consent — GDPR opt-in doesn't apply to these visitors and CCPA is
an opt-out model, so granted is the correct default.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Denied consent was being stored with the full 365-day expiry, preventing
the banner from re-appearing for users who initially declined. Now when
analytics is denied the cookie expires in 3 days so those users are
re-prompted automatically.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
FC accepts the IAB __tcfapi('displayConsentUi', 2, …) command without
throwing but silently no-ops, which caused the previous order (IAB first,
FC-specific fallback second) to swallow the click. Reorder so that
googlefc.showRevocationMessage() is tried first whenever window.googlefc
is present, with the IAB call kept as the fallback for non-FC CMPs
(Sourcepoint, Didomi, etc).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
New cmp_mode setting toggles between the built-in banner (default,
unchanged) and a bridge mode that defers banner UX to an external
IAB TCF v2.2 certified CMP — e.g. Google's free Privacy & messaging
(Funding Choices) or Tarteaucitron.js — and listens to __tcfapi to
keep custom-script gating, attribution preservation, the att_cc_consent
cookie cache and the WP Consent API bridge in sync. Lets sites that
need a Google-certified CMP for EEA/UK AdSense/AdMob serving keep
using this plugin for everything except the consent UI itself.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Move linker config into gtag('config') call with accept_incoming and
decorate_forms for reliable cross-domain linking. Capture _gl parameter
in sessionStorage to preserve attribution across navigation. Add
referrer-based attribution replay fallback so GA4 reports source/medium
instead of (not set) when UTMs are absent. Add "Always" script category
that executes without waiting for consent.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add linker domains setting to Advanced tab for cross-domain measurement.
Outputs gtag('set','linker') before config call so GA4 appends the _gl
parameter to links pointing at configured domains.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Address findings from security audit: wrap inline JSON.parse in
try/catch to prevent consent flow failure on corrupted cookies,
allowlist admin tab parameter, clamp consent_expiry server-side,
escape all server values in admin JS table builder, fix focus trap
listener cleanup, add aria-labelledby and banner focus for screen
readers, skip frontend loading during AJAX.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Custom scripts are now rendered as inert <script type="text/plain"
data-att-cc-category="..."> tags in the page HTML. On consent,
consent-manager.js scans the DOM and activates matching elements.
This replaces the JSON-in-config approach and allows third-party
plugins (e.g. HFCM) to output consent-gated scripts using the
same data attribute convention.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
New checkbox in General settings to conditionally expose window.gtag()
for compatibility with third-party scripts (e.g. HFCM). Defaults to
off, keeping only window.attCCGtag() available.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Anchor the vertical widget at bottom: 150px with transform-origin at
the bottom-right corner so it sits fully visible along the right edge.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Allow visitors to reopen the cookie preferences modal after making
their choice via a configurable floating button (bottom-right or
right-side vertical) or any anchor link with href="#att-cc-preferences".
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Google Consent Mode v2 cookie consent plugin with session attribution
preservation, custom script management, and gtag.js/GTM support.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
