=== ACookies – Cookie Consent, Scanner & Consent Mode ===
Contributors: accomplice
Tags: cookie consent, cookie banner, google consent mode, cookie scanner, woocommerce
Requires at least: 6.0
Requires PHP: 7.4
Tested up to: 7.0
Stable tag: 0.2.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Review what your WordPress site sets, ask before managed optional scripts run, and publish clearer cookie information.

== Description ==

ACookies provides a practical, review-first cookie consent workflow inside WordPress.

The useful Free core includes:

* A balanced banner with Accept, Reject, and Customize choices.
* Google Consent Mode v2 defaults and updates.
* Optional WP Consent API synchronization.
* 25 bundled visitor languages, WPML-aware matching, and RTL support.
* A managed five-page cookie scan once per calendar month.
* A seven-day import code from the free generator so onboarding can keep a completed scan.
* Editable cookie categories and descriptions.
* Conservative rules that can delay registered external scripts by WordPress handle or script URL.
* A Cookie Policy block for publishing reviewed cookie information.
* Local consent records for up to 30 days or 1,000 entries.
* No visitor or page-view limit.

ACookies stays inactive after a fresh installation. The public banner and managed scanner are enabled only after an administrator completes the setup flow.

Scanner and AI classifications are suggestions. ACookies does not provide legal advice or guarantee compliance with every law, site, theme, tag manager, or third-party integration.

= Free and Pro =

Free contains the essential visitor choices, Consent Mode integration, basic design, bundled languages, monthly scan, cookie list, local records, and policy publishing.

Pro is intended for scheduled monitoring, higher scan limits, multilingual AI description drafts, advanced styling, exports, longer retention, priority support, and multi-site licensing. The free plugin remains functional without a paid plan.

= Managed script controls =

ACookies can delay external scripts registered through WordPress when they match an administrator-defined handle or source URL rule. Version 0.2.0 deliberately does not use broad output buffering and does not claim to block every hardcoded inline script, iframe, or dynamically injected resource. Test the actual site before publication.

== External services ==

= ACookies managed scanner =

The managed scanner is optional and disabled by default. When an administrator enables it and accepts the linked data-processing terms, the plugin sends:

* A random installation identifier.
* The public WordPress site origin.
* Up to five selected public page URLs on Free.
* The plugin version, default language, and enabled languages.

The service loads those public URLs in an isolated browser and returns cookies, domains, providers, script URLs, and related evidence. Site-scoped access tokens are used instead of a credential shared inside the plugin. Server-side scan job data is scheduled for deletion after seven days. Results copied into WordPress remain in the site owner's database.

Service documentation and terms:

* https://acookies.com/external-services
* https://acookies.com/privacy
* https://acookies.com/terms

= OpenAI =

Paid AI-description workflows may send detected cookie names, providers, preliminary categories, script evidence, and requested languages to OpenAI. Page content, WordPress passwords, and private administrator data are not intentionally sent. AI output remains editable and must be reviewed.

* https://openai.com/policies/privacy-policy/
* https://openai.com/policies/terms-of-use/

= Freemius =

The bundled Freemius SDK provides optional product telemetry, account and license handling, paid checkout, and premium updates. Freemius presents its own opt-in permissions inside WordPress. The Free workflow can be used without purchasing a plan.

* https://freemius.com/privacy/
* https://freemius.com/terms/

== Installation ==

1. Install and activate ACookies from Plugins in WordPress.
2. Open Settings > ACookies. A fresh install remains inactive while you configure it.
3. Choose consent defaults and the visitor language.
4. Read and optionally accept the managed scanner terms, then run or skip the first scan. If you used the free generator, paste its seven-day import code in step 3.
5. Review cookies and script rules, create or select a Cookie Policy page, preview the banner, and activate ACookies.
6. Test Accept, Reject, Customize, withdrawal, mobile, keyboard navigation, and relevant tags in a private browser session.

== Frequently Asked Questions ==

= Does ACookies make a website legally compliant? =

No. ACookies provides technical consent, scanning, record, and publishing tools. The site owner must review the implementation, categories, policy language, regional requirements, and third-party services.

= Does the banner appear immediately after activation? =

No. Version 0.2.0 keeps the public banner disabled until the administrator completes the final setup step.

= Does ACookies scan private pages or my WordPress admin? =

No. The managed scanner accepts public HTTP/HTTPS pages on the registered public origin. Local, private, link-local, metadata, redirect-to-private, and private subresource targets are rejected.

= What does Free include? =

Free includes the balanced banner, Consent Mode v2, WP Consent API support, basic design, 25 bundled locales, one five-page scan per month, cookie review, a policy block, and limited local consent history without page-view limits.

= Does ACookies block every script automatically? =

No. It can delay registered external scripts that match explicit rules. Unknown hardcoded inline code and dynamic resources require manual integration and testing. ACookies reports this limitation instead of claiming universal automatic blocking.

= Can visitors change their choice? =

Yes. Add the ACookies preferences shortcode or a link with `data-acookies-open-preferences` so visitors can reopen their choices.

= Where is consent data stored? =

Visitor consent records are stored in the WordPress database. IP addresses are truncated and then hashed with the WordPress salt; user-agent values are hashed. Free retention is limited to 30 days or 1,000 records.

= Can I bring a free generator scan into the plugin? =

Yes. A completed free generator scan can show a seven-day import code. Accept the managed scanner terms, enable the scanner, and paste the code into step 3 of onboarding. The code is restricted to the same public site origin and expires automatically.

= Where can I find source code for the compiled JavaScript? =

The readable WordPress banner and policy-block source lives under `src/` in the public development repository:

https://github.com/Accomplicehq/accompliceCookies

== Screenshots ==

1. Five-step setup flow that keeps a fresh installation inactive.
2. Balanced visitor banner with Accept, Reject, and Customize choices.
3. Setup dashboard with banner, scan, review, and policy status.
4. Managed scan results with categories, providers, and editable descriptions.
5. Conservative script rules mapped by WordPress handle or source URL.
6. Cookie Policy block rendering reviewed cookie information.

== Upgrade Notice ==

= 0.2.0 =
Security and activation release: removes the shared scanner credential, adds explicit scanner opt-in, keeps fresh installs inactive, adds setup guidance, site-scoped scan access, Free limits, and managed script rules. Review settings before enabling the public banner.

== Changelog ==

= 0.2.0 =
* Removes the scanner API key from distributable plugin code.
* Adds site-scoped managed scanner registration and access tokens.
* Keeps the banner and recurring scans disabled on fresh activation.
* Adds a five-stage setup flow and setup dashboard.
* Adds Free quotas and 30-day/1,000-entry consent retention.
* Adds conservative external-script rules and basic-mode Google tag loading.
* Improves WordPress.org documentation and external-service disclosure.

= 0.1.19 =
Polishes banner cookie detail controls and adds a way back to the compact banner view.

= 0.1.18 =
Adds expandable cookie category details inside the banner customization view.

= 0.1.17 =
Restores the desktop cookie banner max width to 450px and shortens bundled banner action labels.

= 0.1.12 =
Improves multilingual banner language detection for WPML pages and page language fallback.

= 0.1.10 =
Improves generated cookie policies with clearer purpose, duration, first-party/third-party labels, and provider privacy links.

= 0.1.0 =
Initial implementation.
