Kansleri Cookie Consent

Rejestr zmian

1.8.7

• Fixed: YouTube and Vimeo videos added with Elementor’s Video widget are now blocked until marketing consent, including the image overlay and lightbox options. Elementor builds its YouTube player in the browser, so it used to load before consent. After consent the video appears without a page reload. Turning off embed blocking on the Script Blocking tab leaves these widgets to Elementor too

1.8.6

• Fixed: With Elementor and the Hello Elementor theme, the floating cookie settings button had shrunk to a narrow strip since 1.8.4; it is a centered round button again
• Fixed: Banner buttons, the × button and the blocked-video accept button now keep the colors from the plugin settings instead of taking Elementor’s global button colors and Hello Elementor’s borders and hover colors
• Note: If you recolored buttons with custom CSS, use #kncc-floating-btn for the floating button and prefix banner button rules with .kncc-banner (e.g. .kncc-banner .kncc-btn--primary), or add !important

1.8.5

• New: Advanced Consent Mode option on the Integration tab (off by default). When on, the Google tag and Google Tag Manager load right away with all consent signals denied, instead of being blocked until the visitor accepts. They set no cookies until the visitor accepts and send only cookieless pings until then, so Google Analytics and Google Ads receive the consent state of every visitor. Other tracking scripts stay blocked until consent. If Google Analytics or Google Ads shows your consent signals as not active, turn this on.
• New: YouTube and Vimeo embed blocking can be turned off on the Script Blocking tab (on by default)
• Fixed: With WP Rocket’s Delay JavaScript on, tracking scripts that WP Rocket had already delayed (current versions mark them text/rocketlazyloadscript), such as the Google Tag Manager snippet added by Site Kit, were not blocked and ran on the visitor’s first interaction, before consent. They now wait for consent, and delayed external scripts keep their URL so they load once the visitor accepts
• Fixed: With Google Site Kit’s consent mode on, a returning visitor’s saved choice was sent to Google before Site Kit’s consent default. Google expects the default first, so the update now follows it
• Changed: With Google Site Kit’s consent mode on, the plugin also sets a denied consent default for visitors outside Site Kit’s regions, so Google tags wait for their choice too

1.8.4

• Fixed: The floating cookie settings button no longer shrinks to a tiny icon on themes that add padding to buttons (e.g. Flatsome and Storefront), and the banner’s × button keeps its size on Flatsome
• Fixed: In the bottom bar banner, the × button no longer covers the Customize button at common laptop and tablet widths
• Fixed: Script blocking no longer breaks the LinkedIn Insight Tag and TikTok pixel (their loader code was being altered, so they never loaded after consent), and tracking scripts with any JavaScript type, such as type="application/javascript", are now blocked instead of running before consent
• Fixed: A Google Tag Manager snippet pasted in the same script block as a consent default is now blocked until consent
• Fixed: With Google Site Kit active, Consent Mode v2 defaults are printed again; the plugin assumed Site Kit was handling them even when Site Kit’s own consent mode was off. Consent Mode is now on whenever Site Kit is active, as the Integration tab already stated
• Fixed: Consent updates now reach Google tags even when no other script has defined gtag() yet
• Fixed: Scripts re-enabled after consent keep their attributes, so Plausible (data-domain) and Fathom (data-site) track again; module scripts run as modules
• Fixed: Accepting marketing cookies on a blocked video after „Reject all” now also updates the WP Consent API and the policy page consent status
• Fixed: WP Rocket’s Delay JavaScript no longer delays the plugin’s own consent scripts
• Fixed: Multilingual sites — Consent Mode is one site-wide setting on every language, and saving the Policy Page tab on a secondary language no longer removes that language’s policy link
• Fixed: A visitor who changes their choice within a minute is now recorded in the consent log and statistics
• Fixed: Consent log times were shown shifted by the site’s time zone offset
• Fixed: Banner texts are saved in the site’s language on activation, even when the activating admin uses another profile language
• Fixed: The blocked-video placeholder text no longer appears in automatic excerpts and RSS feeds
• Fixed: Google Analytics cookies are no longer declared on sites that use Site Kit without Google Analytics
• Fixed: Scanned HubSpot cookies __hstc, __hssc and __hssrc now get their own category and duration
• Fixed: Uninstalling on multisite now removes the plugin’s data from every site
• Security: Cookie names are escaped correctly in the Scan Cookies results

1.8.3

• Fixed: Saving the General tab silently switched off Google Consent Mode v2, and saving the Integration or Policy Page tab silently switched off the floating settings button. Please open the Integration tab and confirm Consent Mode v2 is still enabled after updating.
• Fixed: Blocked YouTube and Vimeo embeds are now blocked identically for every visitor, so a page cache can no longer serve an unblocked embed to someone who never consented. Visitors who already consented still get their videos back automatically.
• New: Embeds added through page builders (Bricks, Elementor, custom code) are now blocked too, not only those in post content
• Fixed: The consent log table could never be upgraded because CREATE TABLE IF NOT EXISTS confused WordPress’s schema updater
• Security: The public consent-recording endpoint now validates the submitted categories, throttles repeat submissions, and no longer stores raw client input
• Security: Consent log CSV export escapes quotes and neutralizes spreadsheet formula characters
• Security: Visitor identifiers in the consent log are now keyed with the site salt, so they cannot be brute-forced back to an IP address
• Fixed: Consent statistics stopped recording on cached sites once the embedded nonce aged out
• Fixed: The Copy button next to the [kncc_cookie_settings] shortcode did nothing; the Copy CSS template button no longer mangles the template in a single-line prompt
• Improved: Banner keyboard accessibility — focus moves into the banner when it is reopened, returns to the control that opened it, Escape closes it, and Tab stays inside the centered modal
• Improved: aria-modal is now only applied to the centered modal style, which is the only style that blocks the page
• Fixed: Running Scan Cookies no longer leaves the administrator’s own browser with accept-all consent
• Fixed: Scanning could fail with a PHP 8 error on unexpected input
• Improved: Faster translation loading via a bundled .l10n.php file
• Tested up to WordPress 7.1

1.8.2

• Fixed: WPML String Translation of banner texts ([kncc_settings]*) works again on secondary languages after the 1.8.0 per-language defaults change — overrides in kncc_texts_{lang} still take priority, then WPML ST, then language plugin defaults

1.8.1

• Changed: Default banner style is now Corner popup instead of Bottom bar (existing sites keep their saved style)
• New: WordPress Playground Live Preview blueprint (assets/blueprints/blueprint.json) for the official plugin directory preview button

1.8.0

• Improved: Accept / Reject / Save preferences activate blocked scripts and iframes immediately — no page reload required
• Fixed: After Reject all, Accept all can re-activate the same blocked scripts without refreshing the page
• Fixed: Cookie scanner needed two manual runs to find WP Consent API bridge cookies (wp_consent_*) and other consent-gated trackers — one Scan click now seeds consent, reloads once, then collects
• Changed: Plugin no longer auto-creates a Cookie Policy page — the Cookie policy page dropdown defaults to the WordPress Privacy Policy page (Settings → Privacy)
• Fixed: Polylang/WPML secondary languages no longer inherit banner texts from the default language — each language uses its own plugin defaults, with English as fallback when a language is unsupported
• Fixed: Modal close (×) no longer pushes banner content to the left on mobile — only the heading reserves space for the icon
• Improved: Blocked iframe message / accept button fields use per-language defaults (same as other banner texts)

1.7.2

• Fixed: wp_consent_statistics could stay deny after Accept All — WP Consent API cookies now sync server-side from kncc_consent on every request, with an early wp_head fallback and hardened client-side sync (including statistics-anonymous)
• Fixed: wp_consent_statistics deny persisting due to a URL-encoded kncc_consent cookie — the server now URL-decodes the cookie before syncing, and the consent choice (accept/reject/custom) is stored so a missing category key can no longer leave statistics stuck on deny
• Fixed: WP Consent API client sync now writes cookies even when the WP Consent API script is delayed, dispatches a consent-change event for Google Site Kit, and clears stale statistics cookies on parent domains
• Improved: Cookie policy page notes the technical WP Consent API cookie names (wp_consent_functional, wp_consent_statistics, etc.) so the mapping from banner labels is clear
• Fixed: Scanner no longer flags wp_consent_statistics-anonymous as unknown — it is now auto-recognized and described as a consent-record cookie
• Fixed: Copy AI Prompt now includes every cookie the plugin knows about — the scan returns the full saved cookie list, which is unioned with the scan results and the current table rows (your live edits take priority) so no cookies are dropped due to scan/save/reload timing
• Fixed: Copy AI Prompt on the Cookies and Policy Page tabs no longer uses a browser prompt dialog — the full prompt is shown in a selectable textarea below the button, with reliable clipboard copy on both http and https (fixes truncated/garbled JSON on local sites)
• Improved: AI cookie prompt now asks the AI to verify and correct each cookie’s category (not just the description), with clear category definitions so tracking cookies are not mislabeled as Necessary
• Changed: Default banner typography is now Plugin style (strict sizes/colors) instead of Theme style — the select field remains so you can switch back
• Unchanged: Cookie policy page still defaults to Theme style so it matches your site typography; only the consent banner/popup uses Plugin style by default
• Improved: WP Consent API bridge cookies (wp_consent_functional, wp_consent_statistics, wp_consent_marketing, wp_consent_preferences, wp_consent_statistics-anonymous) are now categorized as Necessary — they only store consent choices, they do not perform tracking
• Improved: Jetpack stats cookies (tk_ai, tk_qs) are auto-categorized as Analytics; WooCommerce Order Attribution / Sourcebuster cookies (sbjs_*) are auto-categorized as Marketing
• Improved: Admin JS/CSS assets use file modification time for cache busting so updated scripts load immediately after plugin updates
• Fixed: Custom save with hidden empty categories now explicitly denies missing optional categories so stale consent keys cannot linger
• Fixed: Floating cookie settings button no longer hardcodes white for the icon — background and icon colors now follow the Primary button and Primary button text settings
• New: Cookie scanner detects cookies whose tracking provider is no longer on the homepage (e.g. after removing Google Analytics) and lists them under „Possibly removed”
• New: Admin can review and confirm removal of stale cookies from the scan results — nothing is deleted automatically
• New: Cookie policy page shows your current consent status (allowed, denied, or not chosen) above the „Edit cookie preferences” button
• Changed: Frontend banner close control is now a × icon in the top-right corner, matching the admin banner preview — the text „Close” link in the button row is removed
• Changed: „Close button text” setting renamed to „Close button label” — it sets the screen reader label only; the visible button is always ×
• Improved: Banner preview and live frontend now share the same close-button styling via consent.css

1.7.1

• Fixed: Google Analytics cookies (_ga, _ga_*, _gid) could remain visible after rejecting analytics or withdrawing consent — stale cookies are now cleared on page load when analytics is denied, on Reject all, and when analytics is turned off in custom preferences
• Fixed: Non-essential cookies for rejected categories (analytics, marketing, preferences) are now removed using registered cookie categories and built-in scanner patterns — not just Google Analytics
• Fixed: Google Site Kit Google Tag Gateway scripts (google_gtagjs-* handles and gtg/measurement.php) were not blocked before consent
• Fixed: WP Rocket Delay JavaScript could rewrite blocked scripts to rocketlazyloadscript, bypassing consent blocking — HTML script blocking now normalizes those tags back to text/plain
• New: WP Rocket compatibility — registers kncc_consent as a dynamic cache cookie and excludes consent/GA scripts from Delay JS
• Improved: Accept all now reloads the page after saving consent so blocked scripts and tracker cookies load reliably on the next request (same pattern as Reject all)
• Improved: Custom save always reloads the page after saving preferences so blocked scripts and category cookies apply correctly (same pattern as Accept all and Reject all)
• Improved: WP Consent API bridge cookies (wp_consent_functional, wp_consent_statistics, wp_consent_marketing, wp_consent_preferences) are now auto-described in the Cookies tab when scanned or inferred
• Improved: Known cookies that were previously saved without descriptions are backfilled automatically when the Cookies tab loads or during scan/cron sync

1.7.0

• Fixed: Google Analytics and other consent-blocked tracker cookies not appearing during cookie scan
• New: Service-based cookie inference — expected cookies are registered automatically when tracking scripts are detected on your site, even before consent is granted
• New: Cookie inference runs on Scan Cookies, when opening the Cookies tab, and during the daily cron check
• New: Custom Code blocking for page builders and header/footer injectors (Bricks, Elementor, etc.) — toggle on Script Blocking tab, enabled by default
• New: Microsoft Clarity auto-blocking and cookie inference
• Fixed: GA4/gtag snippets pasted into Custom Code fields running before consent
• Improved: Browser scan waits up to 8 seconds and grants temporary scan consent so runtime cookies can be discovered
• Improved: Scan results now show inferred cookies and filtered browser-only cookies separately
• Improved: Script Blocking tab copy simplified for non-technical users, with guidance on when to turn off Custom Code blocking

1.6.2

• Fixed: WordPress 6.7+ „Translation loading for the kansleri-cookie-consent domain was triggered too early” notice. Two early triggers were calling __() before the init action: the Consent Mode class was reading settings (and therefore the translated defaults) in its constructor on plugins_loaded, and the one-time default-text localization migration ran on plugins_loaded:20. The Consent Mode setting check now happens inside the wp_head callback, and the migration is hooked on init:5.

1.6.1

• New: „Close” button text is now a customizable setting in the General tab — previously it was a hardcoded translation string, which made it impossible to override per language on sites using Polylang or WPML. Add or edit it like any other banner button label, with per-language overrides via the admin-bar language filter. Reported by a multilingual user running Catalan / Spanish / English.
• Tested with WordPress 7.0.

1.6.0

• New: Empty cookie categories — when a category (e.g. Marketing) has no registered cookies, the banner can now either hide that category from the customize panel or show it with a locked (disabled) switch. Default is „Show but lock” so visitors still see what categories exist while being clearly told nothing is collected. Switch in Settings → Cookie Consent → General → Empty cookie categories, with live preview.
• New: Per-category empty note — locked empty categories display a small italic note such as „No marketing cookies are used on this site.” (translatable per category, so Finnish and other inflected languages get proper wording).
• Fixed: WP Consent API integration was non-functional and could break analytics when Google Site Kit Consent Mode was active. The bridge that syncs kncc_consent to WP Consent API now loads after the WP Consent API script, so wp_set_consent actually runs and dispatches the wp_listen_for_consent_change event that consent-aware integrations (Site Kit, Complianz, others) listen for.
• Fixed: The plugin now declares itself as an opt-in consent manager via the wp_get_consent_type filter. Without this, window.wp_fallback_consent_type was empty and Site Kit’s Consent Mode JS short-circuited — leaving analytics_storage stuck at denied even after visitors accepted analytics cookies. Other consent-aware plugins now also receive correct wp_has_consent() results instead of an always-true response. The filter yields to any other plugin that already set the consent type.
• Fixed: WP Consent API registration filter used the wrong handle (slug only instead of the full plugin basename), so the plugin appeared as „not registered” in Site Health > WP Consent API. Now uses the correct basename.

1.5.1

• New: Documentations tab now ships a Custom CSS template — every selector the plugin uses, presented as one copy-paste-ready CSS block with a one-click „Copy CSS template” button. Uncomment the rules you want to customize, paste into Customizer or your child theme, save.
• Improved: Category toggles redesigned with an outlined „off” state that tracks the body text color, and an „on” knob that tracks the primary text color — so the on/off states stay visible at any color combination, including pure-white primary buttons.
• Improved: „Customize” and „Close” link buttons in the banner now have a clear hover state — subtle background tint with rounded corners and a thicker underline, so the click target is obvious instead of relying only on a small color shift.
• Improved: „Close” button now uses the body text color so it reads as a quiet dismissal action rather than competing for attention with „Customize” and the primary buttons.
• Improved: Banner preview’s close (×) icon follows the body text color picker, so it stays visually integrated as the admin tunes the palette.
• Removed: „Border / divider” color picker and the matching divider line in the details panel — one less rarely-changed setting in the General tab, and a cleaner banner layout.

1.5.0

• New: Integration tab now recommends Google Site Kit (Google’s official WordPress plugin) for adding Google Analytics 4 or Google Tag Manager — Site Kit handles Consent Mode v2 natively alongside Kansleri, so no manual GTM snippet, script blocking tweaks, or container ID management is needed. A one-click link takes you straight to the Site Kit install page.
• New: Cookie scanner filters out „browser-only” third-party cookies — when the scanner sees a tracker cookie (GA, Meta Pixel, HubSpot, LinkedIn, Hotjar, Plausible) but the matching script is not actually in the homepage HTML, the cookie is silently dropped. Fixes false positives on subdomain installs where parent-domain cookies (like _ga) bleed into the admin’s browser even though this site has no tracker.
• New: Live banner preview reworked from a fullscreen lightbox into an in-place floating popup — the „Open banner preview” button sits at the top of the General tab, and clicking it shows the banner in its real position (bar at bottom, modal centered, corner at corner). Colors, text, banner style, and typography updates appear in the preview in real time while the form stays editable behind it.
• Improved: Banner preview „Centered modal” variant now positions itself in the actual screen center.
• Improved: Banner preview Customize button toggles the categories panel like the real frontend banner; the panel starts collapsed.
• Improved: Banner preview Necessary-category toggle no longer shows a stray native checkbox alongside the custom toggle UI.
• Improved: Banner preview is automatically disabled when Theme style is selected, with a clear notice that Theme style depends on the frontend theme’s CSS which doesn’t load inside /wp-admin/.
• Improved: Color picker grid in the General tab — each color swatch now shows its purpose label (Banner background, Primary button, etc.) above it.
• Improved: Blocked YouTube iframe placeholder — switched from hqdefault.jpg (4:3 with baked-in black letterbox bars) to mqdefault.jpg (native 16:9), and added defensive resets so theme styles like .entry-content img { margin: 2em 0; border-radius: 4px; } no longer leak into the thumbnail and create gaps or rounded edges. A subtle radial gradient keeps the message text and Accept button readable against any thumbnail.
• Improved: Iframe placeholder mobile layout — tighter padding under 600px and box-sizing: border-box on the overlay so the message text no longer overflows the right edge on narrow screens.
• Improved: Integration tab copy rewritten for non-technical users — fewer technical terms, clearer recommendations.
• Improved: Removed the now-discouraged load_plugin_textdomain() call — translations on translate.wordpress.org are loaded automatically by WordPress core.

1.4.0

• New: Empty banner text fields fall back to the visitor’s locale default at render time — each language gets its own locale-appropriate defaults (English by default, Finnish only on the Finnish version). Cleared fields stay empty in the database, so the admin can leave a field empty to „use the default” without the form filling itself back in on save.
• New: Default values shown as placeholders in the admin form so it’s obvious what visitors would see if a field is left empty
• New: Graceful fallback to default-language policy page when a language is missing its own translation (both Polylang and WPML)
• New: Dead policy-page links are no longer rendered — if the selected page is deleted, trashed, or unpublished, the banner omits the link instead of pointing to a 404
• Improved: Admin language notice is clearer — a warning when editing a secondary language (saves target that language only), and an info notice when editing the default language so the active save target is never ambiguous
• Improved: Polylang’s „Show all languages” admin-bar filter is now treated as the default language, including under Polylang’s WPML compatibility mode — no more misleading „language: ALL” warnings
• Improved: WPML policy-page resolution now uses the same default-language fallback logic as Polylang, with explicit publish-status checks for every resolved translation
• Removed: Admin warning about missing policy-page translations (no longer needed, replaced by the graceful fallback)
• Updated: Finnish translations for all new and changed admin strings

1.3.0

• New: Policy page style setting — choose theme or plugin styling for the [kncc_cookie_policy] cookie declaration table
• Improved: Cookie policy table is now mobile-responsive — stacks into card layout on small screens
• Improved: Policy page theme mode adapts to dark and light backgrounds
• Improved: „Edit cookie preferences” button moved to top of policy page
• Fixed: Daily cron check not re-scheduling after plugin updates
• Updated: Finnish translations

1.2.1

• Fixed: Direct file access protection added to uninstall.php
• Updated: Finnish translations for documentation tab strings

1.2.0

• New: Full WPML and Polylang multilingual support — per-language banner texts, cookie descriptions, banner style, colors, and policy page
• New: Per-language cookie descriptions — cookie structure is shared, only descriptions are translatable
• New: AI prompts auto-generate in the current admin language
• Improved: Reliable language detection during AJAX saves for Polylang compatibility
• Improved: Iframe placeholder sizing — proper min-height and no overflow on mobile
• Improved: Documentation tab with multilingual guide, shortcode reference, and iframe blocking docs
• Fixed: Cookie deletion not persisting when saving from a secondary language
• Fixed: Scanner result strings showing mixed languages

1.1.0

• New: YouTube and Vimeo iframe blocking — video embeds are blocked until marketing cookies are accepted
• New: [kncc_cookie_settings] shortcode to add a cookie settings link anywhere (footer, menu, widgets)
• New: Shortcode info box with copy button in admin settings
• Improved: Page reload on „Reject all” to ensure blocked content is properly hidden
• Improved: Server-side consent cookie check to avoid unnecessary placeholders for returning visitors
• Updated: Finnish translations for all new strings

1.0.0

• Initial release