=== SureCookie - Smarter Cookie Consent solution ===
Contributors: brainstormforce
Tags: cookie consent, gdpr, ccpa, privacy, cookie banner
Requires at least: 6.7
Tested up to: 7.0
Requires PHP: 7.4
Stable tag: 1.2.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html
Donate link: https://www.paypal.me/BrainstormForce

Real cookie consent for WordPress. Browser-based scanning, smart categorization, strict script blocking, and consent logs stored in your database.

== Description ==

Most cookie plugins either:

* Just show a banner
* Or make setup feel like preparing for a law exam

SureCookie exists because there should be something better.

Something accurate.
Something simple.
Something modern.
Something built properly for WordPress.

SureCookie automatically detects the cookies running on your website, categorizes them intelligently, blocks non-essential scripts before consent, and stores consent logs directly inside your WordPress database.

No traffic limits.
No SaaS visitor caps.
No complicated configuration maze.

Just clean, real enforcement.

<a href="https://app.zipwp.com/blueprint/surecookie-n9i" target="_blank" rel="">Try the live demo of SureCookie.</a>

== How SureCookie Actually Works ==

There are 4 things that matter when it comes to consent:

1. **Detection has to be accurate:** If you do not know what cookies are actually running on your site, everything else falls apart. SureCookie scans with a real browser, not guesswork.
2. **Enforcement has to be technical:** A banner asking for permission means nothing if scripts are already firing. SureCookie blocks non-essential scripts at the code level before consent is given.
3. **Data has to stay under your control:** Consent logs belong on your server. Not locked inside a third-party SaaS dashboard you cannot fully control.
4. **Setup has to be simple:** Compliance should not require a weekend of configuration. SureCookie gets you from install to enforcement in minutes.

Everything in SureCookie revolves around that.

== Real Browser Cookie Detection ==

This is important.

Most tools try to guess cookies by scanning HTML.

That is not accurate.

SureCookie uses a Playwright-powered scanning engine at [https://library.surecookie.com/](https://library.surecookie.com/).

When you run a scan, it loads your website in a real browser environment. Not static source code. An actual browser session.

That means it detects:

* Cookies injected dynamically
* Scripts loaded after interaction
* Conditional third-party trackers
* Tag manager injected scripts
* Things that only appear after page load

It visits your website like a real user would.

That is the difference.

Once detected, cookies are categorized intelligently and automatically.

== Smart Categorization ==

After detection, SureCookie categorizes cookies into:

* Essential
* Functional
* Analytics
* Marketing

Most cookies are categorized automatically using a continuously improving detection database.

Everything is editable.

The goal is simple:

Nobody should have to manually research every random cookie string just to get compliant.

== Script Blocking Before Consent ==

This part is critical.

Showing a banner is not compliance.

Before consent:

* Analytics does not run
* Marketing pixels do not fire
* Tag managers do not execute
* Embedded videos do not load tracking
* Social widgets are paused

Consent is enforced at execution level.

Not just visually.

== Consent Logs Stored Locally ==

All consent logs are stored inside your WordPress database in a dedicated custom table.

* View logs from the admin dashboard
* Export for compliance documentation
* Delete anytime
* Control retention periods

Compliance data stays on your server. Not in an external SaaS dashboard.

== Performance by Design ==

SureCookie is lightweight from the ground up.

* No jQuery dependency
* Minimal frontend footprint
* Dedicated database table for logs
* No heavy background processing

Blocking non-essential scripts before consent also reduces unnecessary third-party requests, which improves page load performance as a side effect.

== Designed in 2026, Not 2019 ==

Many WordPress plugins are outdated.

Too many toggles.
Too much legal jargon.
Too much friction.

SureCookie is designed to feel modern.

The onboarding is structured:

1. Scan your site
2. Review detected cookies
3. Confirm categories
4. Activate enforcement

That is it.

Setup should feel good, not overwhelming.

== No Visitor-Based Limits ==

Whether a site has 1,000 visitors or 1,000,000 visitors, SureCookie works the same way.

No caps.
No surprises.
No usage-based pricing tiers.

== Built for the WordPress Ecosystem ==

SureCookie works with:

* SureCart
* WooCommerce
* Easy Digital Downloads
* Page builders
* Analytics tools
* Marketing integrations
* Multisite setups

Consent logic applies across your site.

== Who This Is For ==

* Site owners who want real enforcement, not just a banner
* eCommerce stores handling customer data
* Agencies managing multiple client sites
* Developers who care about clean implementation
* Businesses operating in regulated regions

If the goal is just the simplest possible banner without caring about detection accuracy, SureCookie is probably not the right fit.

If the goal is modern, accurate, performance-conscious consent management, it is.

== Important Note ==

SureCookie provides the technical infrastructure for consent management. Legal compliance depends on your policies and jurisdiction. Always consult a qualified legal professional when needed.

== External Services ==

**Cookie Scanning:** SureCookie connects to [https://library.surecookie.com/](https://library.surecookie.com/) to provide real browser-based cookie scanning and smart categorization.

When you run a cookie scan, SureCookie sends the URLs of your selected pages to the scanner. A real Playwright-powered browser visits those pages, just like an actual user would, and detects every cookie, tracking script, and third-party service running on your site. Detected cookies are then automatically categorized using a continuously improving detection database.

**Scanner Registration & Authentication:** Before your first scan, SureCookie performs a one-time registration handshake with `library.surecookie.com/api/register`. The request includes your site URL, the WordPress administrator email, and the SureCookie plugin version so the SaaS can associate scan results with your site. The SaaS issues a per-site credential which is stored locally in your WordPress database (the `surecookie_site_credentials` option) and used to sign every subsequent scan request with HMAC-SHA256. To prove that the registration is initiated by an admin who actually controls the domain, the SaaS makes a single follow-up GET request to `https://yoursite.example/wp-json/surecookie/v1/site-verify/{token}` and confirms the token matches before issuing the credential. No user content or personal data is sent during this handshake — only the site URL, the administrator email, and the plugin version. Credentials are automatically invalidated and re-issued if the site moves to a new domain.

**Consent IP Logs:** For region-aware consent, visitor IP addresses are processed through MaxMind integration to determine country-level location, so the correct Country gets into the consent log.

**PDF Export (PDFObject):** SureCookie allows administrators to download consent logs as PDF files. This feature uses the [PDFObject](https://pdfobject.com/) library, loaded from the cdnjs Cloudflare CDN: `https://cdnjs.cloudflare.com/ajax/libs/pdfobject/2.1.1/pdfobject.min.js`. PDFObject is used solely to render the consent log data as a PDF in the browser. No user data is sent to the CDN — the library file itself is fetched and executed locally in the browser. PDFObject is MIT-licensed and GPL-compatible.

== Data Stored Locally ==

All consent data is stored inside your WordPress database:

* User consent choices (categories accepted or rejected)
* Timestamps of consent actions
* Masked IP address, country and user session ID
* Cookie scan results
* Plugin configuration settings

== Installation ==

1. Go to Plugins → Add New
2. Search for "SureCookie"
3. Click Install
4. Activate
5. Complete onboarding

== Frequently Asked Questions ==

= Will this slow down my website? =

No. SureCookie is designed to be lightweight. Blocking unnecessary scripts before consent can actually improve initial page load performance.

= How does the cookie scanner work? =

SureCookie uses a Playwright-powered browser engine at library.surecookie.com. It loads your site like a real visitor, detecting cookies that static HTML scanning would miss, including dynamically injected cookies, conditional trackers, and tag manager scripts.

= What data is sent to external servers? =

When running a cookie scan, page URLs are sent to library.surecookie.com for real browser-based analysis. For consent logging, visitor IP addresses are processed for geolocation via MaxMind. All data is transmitted over HTTPS. Full details are in the External Services section above.

= Can users change their consent choices? =

Yes. SureCookie provides a preferences panel that visitors can access at any time to review and modify their consent choices.

= Does this guarantee compliance? =

No plugin can guarantee compliance on its own. SureCookie enforces consent technically. Legal documentation and jurisdiction-specific requirements are the responsibility of the website owner.

= Can I export consent logs? =

Yes. Consent logs can be exported for compliance documentation purposes.

= Are there visitor limits? =

No. SureCookie works the same whether a site receives 1,000 or 1,000,000 visitors.

== Screenshots ==

1. SureCookie Dashboard: Overview of consent activity and recent logs
2. Cookie Scanner: Scan selected pages to detect cookies and services in use
3. All Cookies: Review detected cookies and organize them by category
4. Cookie Policy: Generate or link a policy page for your website
5. Banner Content: Customize the cookie banner text and actions
6. Banner Layout: Control the banner type, position, and animation
7. Consent Logs: View and manage recorded user consent choices

== Changelog ==
= 1.2.0 - 25-June-2026 =
- New: Introducing "Re-request Consent" feature to allow admins to trigger a new consent request for all visitors.
- New: Introducing "Background Overlay" option to the banner layout settings, which dims the page behind the banner until a choice is made.
- New: Added highlighting logs count to the SureCookie admin menu > Logs, to show the number of new consent logs since the last visit.
- Improvement: Added "Reset to Default" button for the Banner Content and Preference Modal Description fields, allowing admins to revert to default text easily.
- Improvement: Upgraded pages scanning limit and total scanning limit are now synced with the SureCookie agent app, ensuring consistent scanning limits across platforms.
- Fix: The content blocker scanner showed a block toggle for Google scripts managed by Google Consent Mode, even though the toggle had no effect. These resources now display an explanatory note instead, clarifying that Consent Mode manages them.
- Fix: Deactivation conflict with other plugins resolved on network setup level.
- Compatibility - Synced up Resource blocked scripts with Google consent mode scripts, so that the toggle is not shown for Google scripts managed by Consent Mode.

= 1.1.0 - 15-June-2026 =
- New: Introduced AI Assistants integration using MCP (Model Context Protocol), along with WordPress Abilities APIs for AI-powered SureCookie management.
- New: "Banner Message" and "Preference Modal Description" fields in the Banner Content settings now support HTML tags for enhanced formatting options.
- Improvement: Improved the Settings dashboard by organizing configurations into well-defined categories for better clarity and user experience.
- Improvement: Added "Last updated" timestamps support to the Cookie Policy page.
- Fix: Cookie policy page with RTL language had layout issues on the frontend. This has been resolved to ensure proper display in RTL languages.

= 1.0.0 - 08-June-2026 =
- Official public release of SureCookie.
- Improvement: SureCookie is now ready with translations for 20 languages, including English, Spanish, Indonesian, Portuguese (Brazil), French, German, Russian, Italian, Turkish, Dutch, Japanese, Chinese (Simplified), Polish, Arabic, Swedish, Vietnamese, Hebrew, Thai, Greek, and Czech.
- Fix: Admin cookie category labels and banner content placeholders now translate via WPML/Polylang to match the active locale.

= 0.0.1-beta.4 - 20-May-2026 =
- Improvement: Added a credential reset notice to existing users to re-connect site with SureCookie agent app after security improvements.
- Improvement: WordPress 7.0 compatibility.

= 0.0.1-beta.3 - 19-May-2026 =
- New: Introduced "Learn" section in the dashboard with educational resources about cookie compliance.
- Improvement: Hardened the security of the plugin.

= 0.0.1-beta.2 - 1-May-2026 =
- New: Cookie Policy custom post type for managing policy pages within the plugin.
- New: Type-module script blocking until user grants consent.
- New: Dynamic script detection and blocking when consent is previously given or denied.
- New: Block and manage `<embed>` and `<object>` tags via the resource blocking system.
- New: Scan quota API, client, and UI support for the cookie scanner.
- New: 1-hour page visitor token to maintain blocking state before consent is given.
- New: Editable preference modal text with translation support and live preview in the banner.
- Improvement: UTM-tagged upgrade links across the plugin via helper functions for better attribution.
- Improvement: Internal libraries updated for better maintainability.
- Improvement: Added a clear action for the selected Cookie Policy page.
- Improvement: Routed dashboard support ticket link based on free/pro plan.
- Improvement: Added scroll support for the preference modal on larger screen sizes.
- Improvement: Added accessibility (a11y) support for cookie consent text.
- Improvement: Moved Resource Blocking under Advanced settings for better organization.
- Improvement: Refetch scanned cookies with a success notice after a scan completes.
- Improvement: Enforced Accept All button visibility and ordering across banner layouts.
- Improvement: "Copy Logs" button now only shows while scanning is in progress.
- Improvement: Hardened the security of the plugin.
- Fix: Consent log action filter not working due to a reserved REST parameter.
- Fix: Button rendering delay on the consent banner.
- Fix: Prevent early textdomain load notice on WordPress 6.7.
- Fix: Script type preservation issue when blocking and unblocking scripts.
- Fix: WPML improvements for multilingual sites.
- Fix: Banner reappear issue and consent log filter issue with naming.
- Fix: Brand casing in the consent PDF legal text.
- Fix: URL stripped issue for custom CSS.
- Fix: Null template handling in the script blocking interceptor.

= 0.0.1-beta.1 =
- New: WP Consent API integration for standardized consent management across plugins.
- New: Multilingual compatibility for admin texts with WPML and Polylang for global reach.
- New: Introduced geo-based rules specification for Google Consent Mode.
- Improvement: Admin dashboard translations added for multiple languages: Spanish (es_ES), Portuguese (pt_BR), French (fr_FR), German (de_DE), Dutch (nl_NL), Italian (it_IT), Polish (pl_PL), Indonesian (id_ID), and Russian (ru_RU).
- Improvement: Admin dashboard UI enhancements for better user experience and accessibility.
- Improvement: Dashboard UI/UX refinements to improve better user experience.

= 0.0.0-alpha.3 =
- Fix: Removed unnecessary files from the plugin package.

= 0.0.0-alpha.2 =
- New: Geographic Targeting introduced.
- New: Auth system to connect plugin to surecookie agent app for scanning and geolocation.
- Improvements in alpha.1 release.

= 0.0.0-alpha.1 =
Alpha public release of SureCookie.

== Upgrade Notice ==

= 0.0.0-alpha.1 =
Alpha public release of SureCookie.

== Privacy Policy ==

SureCookie processes data through its API service at library.surecookie.com to empower cookie scanning and region-aware consent. Here is exactly what happens and why.

**What we send to surecookie.com:**

When your site is connected to the billing portal, the plugin sends only:

* An opaque account identifier (UUID) — never your email address.
* The site URL, plugin version, and the URLs you're scanning.
* For Pro users: an HMAC signature derived from your license key (the license key itself never crosses the wire after activation).

Your admin email is never transmitted on scan requests, scan polling, or any other recurring call after authentication completes.



**What Is Processed and Why:**

* **Cookie Scanning:** When you run a scan, page URLs are sent to the scanning service where a real browser detects cookies and scripts. Detected cookie information (names, domains, durations) is used to categorize cookies and improve detection accuracy across all SureCookie installations.
* **Region Detection:** Visitor IP addresses are processed through MaxMind to determine country-level location for applying the correct Country into logs. IP addresses are masked before being stored in your database.
* **Consent Records:** Consent choices, timestamps, and user session ID details are logged locally in your WordPress database for compliance documentation.

**Where Data Lives:**

* All consent logs, scan results, and settings are stored in your WordPress database
* Data sent to library.surecookie.com for scanning and geolocation may be temporarily stored for processing
* Nothing is sold, shared with third parties, or used for advertising

Since visitor data is processed through SureCookie's services, this should be mentioned in your site's privacy policy. Full details: [https://surecookie.com/privacy-policy/](https://surecookie.com/privacy-policy/)

**Data Retention and Control:**

* Consent logs and scan results can be viewed, exported, or deleted anytime from your WordPress admin
* Retention periods are configurable in plugin settings

**Security:**

* All data transmission uses HTTPS encryption
* API communications are secured with authentication tokens

For questions about data processing, visit [https://surecookie.com/support/](https://surecookie.com/support/)

== About Brainstorm Force ==

SureCookie is built by Brainstorm Force, the team behind Astra and other widely used WordPress products.

== Support ==

* [Support Forum](https://wordpress.org/support/plugin/surecookie/)
* [Documentation](https://surecookie.com/docs/)
