=== Cookie Rocket, Cookie Consent Banner and Script Blocker for GDPR, CCPA and LGPD ===
Contributors: templatesrocketwp
Tags: cookie consent, cookie banner, consent mode, consent mode v2, lfpdppp
Requires at least: 5.9
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 2.16.7
License: GPL-2.0-or-later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Lightweight cookie consent banner that actually blocks trackers until consent. Google Consent Mode v2, cookie scanner — GDPR, CCPA, LGPD & LFPDPPP.

== Description ==

**Cookie Rocket** is a WordPress cookie consent banner that **blocks** Google Analytics, Meta Pixel, Hotjar and other third-party tracking scripts until the visitor consents, with **Google Consent Mode v2**, a cookie scanner and a consent log included in the free version. It is for any site that has to comply with **GDPR**, **CCPA / CPRA**, **LGPD** (Brazil) or **LFPDPPP** (Mexico), each with its own banner wording and consent rules, selectable per site.

It is a fully **self-hosted alternative to cloud cookie-consent services**: no account, no monthly SaaS fee, and your visitors' browsers never call an outside server. Real script blocking, Google Consent Mode v2 and on-demand cookie scanning are free here — features that comparable consent tools typically gate behind a paid plan or a remote service.

* Automatic script blocking: common third-party trackers (Google Analytics, Meta Pixel, Hotjar, Microsoft Clarity, LinkedIn, TikTok and more) are blocked until consent, with Google Consent Mode v2 built in.
* Built-in cookie scanner: detect on demand which known tracking services are present on your site and the cookies they set.
* Automatic cookie policy / cookie declaration: a single shortcode (or one-click page) publishes a table of every cookie your site uses — provider, purpose and duration — grouped by category and updated from your scans.
* Consent audit log with an admin viewer: every consent decision is recorded and browsable for compliance.
* Editable cookie categories: rename, re-describe and reorder the categories shown on the banner.
* Unified Cookie Banner editor: layout, content (text and labels) and colors, all in one place.
* Zero external scripts and zero CDN dependencies — everything is served from your own site.
* Framework selector: GDPR, CCPA / CPRA, LGPD (Brazil) and LFPDPPP (Mexico), each with its own banner wording and consent behavior.
* 100% local — no consent data is sent to third-party servers.
* WooCommerce aware: respects shop pages and checkout.
* Fully customizable colors, fonts sizes, copy and banner position.
* WCAG 2.1 AA accessible: keyboard navigation, focus states, ARIA labels.
* Multisite compatible.
* Five banner layouts: bottom bar, top bar, floating card, modal and drawer.

= Shortcodes =

* `[cookie-rocket-preferences]` — renders a button that re-opens the cookie preferences modal.
* `[cookie-rocket-withdraw]` — renders a link that withdraws consent and clears stored preferences.
* `[cookie_rocket_policy]` — renders the automatic cookie declaration table (provider, purpose and duration per cookie, grouped by category).

== Installation ==

1. Upload the `cookie-rocket` folder to the `/wp-content/plugins/` directory, or install the plugin through the WordPress plugins screen directly.
2. Activate the plugin through the **Plugins** screen in WordPress.
3. Go to **Cookie Rocket** in the admin menu and answer one question: where your visitors come from. Nothing changes on your site until you answer; then the banner, the blocking and your cookie policy start in one click.
4. Optionally, place the `[cookie-rocket-preferences]` shortcode in your privacy policy page to let visitors update their choices at any time.

== Frequently Asked Questions ==

= Does this plugin send any data to external services? =

Not about your visitors. Cookie Rocket stores consent in the visitor's browser (cookie + localStorage) and logs events to your own WordPress database; your visitors never generate a request to an outside server. The one exception is in your admin and only if you choose it: the optional feedback form shown when you deactivate the plugin. See "External services" below.

= Why does Google Analytics show fewer visits after installing a consent banner? =

Because a banner that really blocks keeps Google Analytics off until the visitor's law allows it: where visitors must be asked first, those who do not answer or say no are not counted. They are still on your site; Analytics just cannot see them. Cookie Rocket tells you before it starts, in the answer you choose, and **Status → Reach Google Analytics** shows how many of every 100 page views reach Analytics, why the rest does not, how to measure more where the law allows it, and the date of every change to your rules, so a drop can be matched to its cause. That figure comes from an anonymous daily count on your own site: no cookie, no IP address and no identifier is stored.

= Is it compatible with caching plugins? =

Yes. The banner state is read from a first-party cookie, so caching (page cache, object cache, CDN) does not interfere with consent storage or display.

= Does it block third-party scripts automatically? =

Yes. The free version automatically blocks the most common third-party tracking scripts — Google Analytics, Meta (Facebook) Pixel, Hotjar, Microsoft Clarity, LinkedIn, TikTok, Google Ads and more — until the visitor accepts the matching cookie category, and it ships Google Consent Mode v2 (default denied) out of the box. Enqueued scripts are blocked by default; an optional setting also blocks scripts pasted directly into your theme or header. Cookie Rocket Pro adds scheduled monthly re-scans that email you when a new tracker appears, plus Google Consent Mode *advanced*, so Google can model the visits and conversions it loses to non-consent.

= Is it translation-ready? =

Yes. The text domain is `cookie-rocket` and a complete `.pot` file is included under `/languages/`. All banner and modal strings are wrapped for translation. The plugin ships in English by default with Spanish (es_ES) and Brazilian Portuguese (pt_BR) translations bundled, applied automatically on matching locales. WordPress also loads community translations for plugins hosted on WordPress.org, and you can translate the banner yourself with Loco Translate or Poedit, or via WPML/Polylang.

= Can it generate a cookie policy page? =

Yes. Add the `[cookie_rocket_policy]` shortcode to any page, or go to **Cookie Rocket → Cookie Policy** and create the page in one click. It publishes a cookie declaration table — each cookie with its provider, purpose and duration, grouped by category — built from your latest scan plus a built-in catalog of the most common third-party cookies. Strictly-necessary cookies are always listed, and the table updates automatically as you re-scan.

= Does it work on WordPress Multisite? =

Yes. Each site stores its own settings. Activate per-site or network-activate from the network admin.

== External services ==

This plugin connects to one outside service, and only from your admin, never from your visitors' browsers:

* **Deactivation feedback (Templates Rocket).** When you deactivate the plugin you are offered a short, optional form asking why. Only if you choose a reason and press "Submit & deactivate" does the plugin send it to `https://templatesrocket.com/cr-feedback/`: the reason, the text you typed (if any), and the Cookie Rocket, WordPress and PHP versions and the site language. No site address, no visitor data and no consent records are sent. Pressing "Skip & deactivate" sends nothing. Provided by Templates Rocket: [terms of service](https://templatesrocket.com/terms-of-service/), [privacy policy](https://templatesrocket.com/privacy-policy/).

== Screenshots ==

1. The scanner finds the trackers on your site and tells you exactly what happens to each one: blocked until consent, governed by Consent Mode v2, or pasted directly into your HTML — with the switch that fixes it.
2. The consent banner on a live site. Google Analytics, Meta Pixel and Hotjar stay blocked until the visitor chooses; the reject button sits on the first layer, one click away.
3. Granular preferences: visitors allow or deny each category, with strictly-necessary always on.
4. The consent log, included in the free version: every decision, the categories accepted, and the visitor identified only by a one-way hash.
5. Status at a glance — blocking, Consent Mode v2, the law applied, and your consent numbers.

== Changelog ==

= 2.16.7 =
**Rules that fit where your visitors are.** A new install asks "Where do your visitors come from?". From several countries, the recommended answer, visitors in the EU, the EEA, the UK, Switzerland and Brazil are asked first under their own law, and everyone else is measured from their first visit with Reject on screen. The country comes from the visitor's time zone, in their browser, so it works behind a page cache.
* Mexico: the LFPDPPP (2025) takes tacit consent for data that is neither sensitive nor financial, so a Mexican site can measure until the visitor rejects. The banner then says so and points to your privacy notice.
* Under opt-out, the banner text says the cookies are active until the visitor rejects them.
* A site that runs opt-out never applies it to visitors from the EU, the EEA, the UK, Switzerland or Brazil.
* Status offers the recommended rules to sites set up before, and changes nothing until you apply them.
* New optional "Statistics only" button, with the same look as Reject and Accept: accepts measurement and nothing else. Off unless you turn it on.
* The time-zone map now covers every US time zone and their older names.
* **Nothing changes on a new site until you answer.** The banner and the blocking start when you say where your visitors come from, and each answer tells you what it does to Google Analytics.
* **Status → Reach Google Analytics:** the share of page views Analytics can count, and a screen with why the rest does not, how to measure more, and the date of every change to your rules. An anonymous daily count on your own site, with no cookie, IP address or identifier.
* Sites already running Cookie Rocket keep working exactly as before after the update.

= 2.16.6 =
Older release notes are available in the plugin’s development history on WordPress.org.

== Upgrade Notice ==

= 2.16.7 =
Rules that fit where your visitors are, and Status shows what Google Analytics can count and since when. Existing sites keep working and keep their settings until they apply the recommended rules from Status.

= 2.16.6 =
The Side panel becomes a full preference center, the consent log can find a person's records by consent ID or IP address, and the first custom service is saved correctly. Recommended for every site.

= 2.16.5 =
The reopen button is now off unless you turn it on, deleting the plugin keeps your consent log unless you choose otherwise, and a rejected tracker stops at once. Recommended for every site.

= 2.16.4 =
Script blocking now holds every part of a tracker until consent, rejecting clears the cookies of every recognized service, and the preferences checkboxes stay visible on dark banners. Recommended for every site.

= 2.16.3 =
Page caches can store your pages again, Reject and Accept are equal on every screen, the opt-out model works, and consent records are never deleted before the consent they prove expires.

= 2.16.2 =
The preferences dialog no longer overlaps the banner on phones and tablets, its buttons are never cut off, and checkmarks sit centered. Admin fixes for phones, keyboards and screen readers.

= 2.16.1 =
An em dash in the consent log meaning "no categories" was drawn at 1.97:1 contrast, below the 4.5:1 WCAG AA asks for. Fixed. The admin palette is now twenty-eight named values instead of fifty-six hand-written colors; five near-identical grays were merged.

= 2.16.0 =
The scanner now recognizes 34 third-party services instead of 9, including reCAPTCHA, Jetpack Stats, live-chat widgets, share buttons and embedded Instagram, Spotify and Twitch. It also stops reporting the Facebook SDK as the advertising pixel. Run the scanner again.

= 2.15.17 =
The scanner never checked whether it had actually loaded your pages: an error page was read as your site and reported as "0 trackers detected", and that empty result could blank a published Cookie Policy. Both fixed.

= 2.15.6 =
Thorough audit: keyboard-focus fixes, hardened consent-endpoint rate limiting, reliable recording behind full-page caches, embeds that restore after consent, a closed script-blocking gap, timezone-correct log stats, and complete Spanish/Portuguese. No settings change.

= 2.14.0 =
A cleaner four-section admin, a one-time setup guide, and a new option to match the banner to your site's own font — with no external fonts ever loaded. All your settings carry over.

= 2.13.0 =
Accessibility and design pass: zero automated WCAG AA violations across the admin, visible field borders, and a save that tells you when it fails instead of losing your changes silently.

= 2.12.1 =
Accessibility fix: the banner's Reject and Customize buttons are now clearly legible (WCAG AA), as visible as Accept all.

= 2.12.0 =
Pick your law (GDPR/LGPD/LFPDPPP) in Settings and the banner's default legal text follows it — new installs detect it from the site language. Also fixes the framework resetting to generic on save.

= 2.11.2 =
Polish & fixes from a full audit: correct consent-duration in the cookie policy, modal description now shows, working privacy-policy link, salted (irreversible) IP hashes, and broader WordPress compatibility. No settings change.

= 2.11.1 =
Fixes consent texts being cut off at 200 characters (the GDPR/LFPDPPP templates were truncated). After updating, re-pick your template or re-save to store the full message.

= 2.11.0 =
Adds an opt-in "Quick feedback" prompt on deactivation. Skipping sends nothing; no personal data is ever collected. Your settings and banner are unchanged.

= 2.1.4 =
Fixes button readability and form spacing in the admin. Native, clean WordPress styling. No changes to settings or the banner.

= 2.1.3 =
Cleaner Settings and Banner Design screens (sub-navigation + accordions) and a fully neutral monochrome admin. Your settings and banner are unchanged.

= 2.1.2 =
A calmer, neutral admin palette (standard WordPress blue and grays). No changes to settings or the banner.

= 2.1.1 =
A cleaner, guided dashboard that makes setup obvious. Your settings and banner are unchanged.

= 2.1.0 =
Adds a compliance health dashboard, a visual banner layout picker, neutral style presets, click-to-load embed placeholders and a refreshed cookie scanner. Your saved settings are unchanged.

= 1.9.1 =
Adds a Brazilian Portuguese translation, auto-applied on Portuguese-language sites. No other changes.

= 1.9.0 =
Internationalization: English is now the default language, with a bundled Spanish translation auto-applied on Spanish sites (all es_* locales). Your saved banner copy and categories are unchanged.

= 1.8.2 =
Documentation and listing copy only — no code changes.

= 1.8.1 =
Housekeeping only: removes an unused legacy stylesheet that was never loaded. No change to the banner.

= 1.8.0 =
The "Drawer" banner layout is now a distinct right-side panel (it previously matched the floating card). Only affects sites using the Drawer layout; other layouts are unchanged.

= 1.7.0 =
Adds a live banner preview on the Banner Design screen. Safe update; no change to the banner shown to visitors.

= 1.6.0 =
New Categories editor lets you rename, re-describe and reorder the cookie categories shown on the banner. Safe update; existing categories are unchanged until you edit them.

= 1.5.0 =
The admin screens are now fully translatable. No visible change; safe update.

= 1.4.0 =
New Consent Log viewer under Cookie Rocket &rarr; Consent Log shows recorded consents for compliance. Safe update; read-only, no change to the banner.

= 1.3.0 =
Translation readiness: the banner and modal strings are now fully translatable and a complete .pot is included. No visible change by default; translate via Loco Translate, WPML/Polylang or translate.wordpress.org.

= 1.2.0 =
New Cookie Scanner under Cookie Rocket &rarr; Scanner: detects known tracking services on your site on demand and shows what is being blocked. Safe update; no change to the banner or blocking behavior.

= 1.1.2 =
Robustness fix: default categories and settings now self-heal if missing, so the preferences modal and "Accept all" work even on installs where activation never ran. Recommended.

= 1.1.1 =
Important fix for 1.1.0: "Accept all" and the preferences modal now correctly enable the chosen categories, so scripts blocked before consent are re-activated when the visitor accepts. Recommended for everyone on 1.1.0.

= 1.1.0 =
Major update: Cookie Rocket now actually blocks common tracking scripts (Google Analytics, Meta Pixel, Hotjar and more) until consent, with Google Consent Mode v2 built in. Review Settings &rarr; Script Blocking after updating, especially if you use a caching plugin.

= 1.0.5 =
Correctness fixes: custom banner copy and consent duration set in Settings are now actually applied, and the consent audit log records events again. Recommended update; the banner looks the same by default.

= 1.0.4 =
Post-consent floating button now defaults to OFF for a cleaner site. Installs that explicitly enabled it keep it enabled; re-enable any time in Settings. The [cookie-rocket-preferences] shortcode is always available as alternative.

= 1.0.3 =
Important fix: the preferences modal can now be closed (X button) after consent, the title typography no longer inherits the theme's heading font, and the floating button can be hidden via a new setting. Recommended update.

= 1.0.2 =
Adds a Pro features showcase panel at the bottom of the Settings page. Safe to update — no functional changes to the cookie banner itself.

= 1.0.1 =
Visual refresh only. Brand-aligned colors in the preferences modal. Safe to update.

= 1.0.0 =
First public release.

== Cookie Rocket Pro ==

Cookie Rocket Pro is a commercial extension built on top of the free plugin. It adds:

* **A catalog of 76 recognized services covering 340 cookies.** Every cookie comes with its purpose and duration already written, so the cookie declaration table fills itself in from a scan. The free version recognizes 34 services; anything else is described by hand under Your own services.
* **Rules per region.** Each visitor gets the law of their country, also behind page caching: GDPR in Europe, CCPA / CPRA in the United States, LFPDPPP in Mexico and LGPD in Brazil, each with its own consent model, Reject button, consent duration and banner text. Global Privacy Control is honored.
* **Google Consent Mode advanced and Google Tag Manager.** Google Ads and GA4 keep modeling conversions while consent is denied, and the Tag Manager container is added with consent already wired.
* **A tamper-evident consent ledger.** Every record is sealed and chained to the previous one, with CSV export and a one-click evidence report.
* **A deeper scan, every month.** The crawl goes beyond the key pages, and a monthly re-scan emails you when a new tracker appears.
* **Premium styles and finishes.** Glass, Branded, Frosted and Frosted Dark styles, a blurred backdrop, border color and thickness, shadow intensity, button text size and weight, spacing, and a reopen button made your way (text, icon or both, icon, side, distance, colors, shape, size and shadow).
* **Latin America pack.** A generated privacy notice for Mexico and Brazil and a self-hosted ARCO / DSAR rights request channel.

Cookie Rocket Pro is available at [templatesrocket.com](https://templatesrocket.com/cookie-rocket-pro). The free version published here is fully functional and does not require the Pro plugin to work.
