=== RISE2 Cookie Consent ===
Contributors: rise2studio
Tags: cookies, gdpr, cookie-consent, privacy, eprivacy, consent-mode
Requires at least: 6.0
Tested up to: 6.7
Requires PHP: 8.0
Stable tag: 2.10.0
License: GPLv2 or later

Powerful, standalone GDPR/ePrivacy cookie consent plugin with automatic script blocking, Google Consent Mode v2, consent analytics, and Croatian market support.

== Description ==

Self-hosted cookie consent management. No external services, no subscriptions, no API keys.

= Core Features =
* Automatic cookie scanning (50+ patterns) with scheduled re-scans
* Auto script & iframe blocker (60+ third-party services)
* Google Consent Mode v2 (cache-compatible)
* Privacy policy generator (EN/HR)
* Consent versioning — force re-consent on policy changes
* Analytics dashboard with Chart.js trends
* Croatian i18n + WPML/Polylang/TranslatePress support
* Import/Export settings as JSON
* 3 shortcodes for pages/posts
* Public JavaScript API

== Changelog ==

= 2.10.0 =
* Added: scripts and embeds are now two separate switches — "Auto-block Scripts" and "Auto-block Embeds (iframes)". Third-party scripts can stay blocked while an embed your theme drives with its own JavaScript (a video behind a custom play button, an interactive map) is left untouched, so it keeps working normally. Existing sites are unaffected: with the old single toggle on, embeds keep being blocked until you turn them off yourself. Turning embeds off means they load, and can set cookies, before consent — the setting says so.
* Fixed: the plugin could never update itself and had no "Check for updates" link on the Plugins page. The updater was only registered when signed-update metadata was configured, and since signature checking defaulted to required with no key set, that condition was never true — so no update, and no security fix, could ever reach a site. The updater is now always registered; signature verification is enforced when a public key is configured, and downloads stay locked to the trusted host either way.

= 2.9.0 =
* Added: "Re-init after consent" (General tab). With Auto-block on, a theme that drives an embed with its own JavaScript — a video behind a custom play button, a map — starts up while that content is still blocked, so its button stays dead until the page is reloaded, even though the content itself is restored the instant the visitor accepts. Name your theme's init function here and it is called right after the content comes back, so everything works without a reload.
* Added: "Reload page after consent" — a universal fallback for themes with no init function to call.
* Both are OPT-IN and empty/off by default: a site that configures neither behaves exactly as before. Callback names are reduced server-side to plain identifiers, and each one is called inside its own try/catch, so a missing, renamed or broken function can never break the consent flow.

= 2.8.0 =
* Fixed: with "Auto-block Scripts & Iframes" on, embeds that a theme controls with its own JS (a YouTube video behind a custom play button, for example) never played — permanently, even after accepting cookies and on later visits. The blocker replaced the <iframe> with a placeholder element, so by the time the theme initialised its iframe did not exist and its play button was never wired up. The iframe now stays in the page: only its src is taken away until consent, so the theme finds and binds to the very element it expects, and accepting cookies simply gives the src back.
* Fixed: lazy-loading attributes (data-src and the WP Rocket / LiteSpeed / a3 equivalents) were mangled by the blocker, breaking lazy-loaded embeds. They are now preserved and, while consent is missing, safely parked so no lazy loader can load the embed early — and an embed whose URL lives ONLY in such an attribute is now blocked too, which it previously was not.
* Fixed: a ">" inside an attribute value no longer breaks the rewritten iframe tag, self-closing iframes and fallback content are handled, and the default placeholder height is now valid CSS (it was unitless and silently ignored).
* Added: a `r2cc:iframes-restored` DOM event so a theme or plugin can re-initialise anything that depends on an embed the moment consent restores it.

= 2.7.0 =
* Added: heading & toggle colors (Banner & Design → Colors) so a light-background banner stays readable. New "Banner Title" and — separately — "Settings Title" color pickers (the settings title also recolors the category names), plus a "Settings Toggle (inactive)" color for the OFF switch track. Previously the titles and the inactive switches were hardcoded white/translucent-white and vanished on a light background. Leave the toggle color empty for Automatic — it adapts to your background (dark track on a light panel, light track on a dark panel) so switches never disappear; active switches use your Accept Button color. Defaults reproduce the previous look, so existing sites are unchanged.
* Added: "Reopen Settings Trigger" option (General tab) — choose how visitors reopen the cookie settings after they've made a choice. "Floating button" (default) keeps the built-in floating cookie icon; "Custom link / element" hides that icon and instead lets any element on your site open the settings modal when it carries a configurable CSS class (default `r2cc-reopen-custom-link`, editable). Put that class on a footer link — e.g. `<a href="#" class="r2cc-reopen-custom-link">Cookie Settings</a>` — and it opens the preferences panel. No duplicate IDs: the custom trigger is bound by class, never by the floating button's id. Backward compatible — existing sites keep the floating button until they switch.

= 2.6.0 =
* Added: "Show Delay (ms)" option (General tab) — delays the first appearance of the cookie banner by up to 60 seconds so a site intro animation can finish before the notice shows. Applies only to the first appearance for new visitors; reopening the settings is never delayed. Purely visual: blocked scripts stay blocked during the delay, so no tracking runs before consent.

= 2.5.0 =
* Added: per-button hover colors (Accept/Reject/Settings, background + text) under Banner & Design → Button Hover. Empty = Automatic: light backgrounds darken slightly on hover, dark ones lighten, text color never changes — fixes e.g. a white button with black text becoming unreadable on hover (the old CSS hardcoded a dark-theme overlay and an indigo shadow).
* Added: Hover Animation selector — Color change (default), Text slide + color change, Text slide only (background unchanged), or None. The text slide is a Wandia-style label roll (512ms) and respects the visitor's reduced-motion preference.
* Added: Button Font Weight setting (Inherit from theme / 400 / 500 / 600 / 700; default 600 = previous behavior).
* Changed: outline-button borders and the accept-button hover shadow are now derived from your actual colors instead of hardcoded dark-theme values.

= 2.4.1 =
* Fixed: Fatal TypeError on the front-end when WPML is freshly activated (setup wizard not completed). WPML defines ICL_LANGUAGE_CODE as NULL in that state; the language detector passed it through to string-typed translation helpers and crashed the page. Language detection now validates every multilingual plugin's answer (WPML null/'all', Polylang false, TranslatePress empty) and always falls back to the WordPress locale, guaranteeing a valid language code.

= 2.4.0 =
* Added: "Pages to scan" and "Per-page wait (ms)" controls in the Scanner tab so the headless Deep Scan can be tuned to your host's PHP timeout. The Deep Scan runs as one synchronous request (~10–25s per page); some shared hosts cap PHP/web-server execution at 30–60s, so a 6-page scan could outlast that and fail with a gateway timeout ("Deep scan failed: error") even though the scan itself completed. Fewer pages keeps the round-trip inside the host's window.
* Changed: Default Deep Scan page count lowered from 6 to 3 (clamped server-side to 1–10 pages / 500–10000 ms). Applies to both the manual Deep Scan and scheduled scans.

= 2.3.1 =
* Changed: Renamed the admin menu item to "R2 Cookie Consent" for easier identification in the wp-admin sidebar (no functional change).

= 2.2.0 =
* Added: Corner Style option in Banner & Design tab — choose between Rounded (default, current look) and Square (hard 0-radius) for the banner box, banner/settings-footer buttons, settings panel, and category cards.
* Added: Croatian translations for the new Corner Style UI (Stil kutova / Zaobljeni / Ravni + descriptions).
* Changed: Existing installs keep their current rounded look on upgrade — the new option defaults to "rounded" so nothing visually changes until an admin flips it.

= 2.1.3 =
* Added: Croatian (HR) translations for 60+ known cookie descriptions — descriptions now appear in the site's language (HR) instead of always showing English.
* Added: R2CC_I18n::translate_cookie_description() helper with wildcard pattern matching (_ga_*, _hj*, etc.).
* Changed: Frontend cookie table and admin cookie list now render translated descriptions at display-time. DB stays English as source of truth, so admin edits are preserved and easy to export/import across sites.

= 2.1.2 =
* Fixed: GTM container detection now auto-includes GA4 + Google Ads cookies.
* Fixed: Browser-based scan now uses one-time token to bypass auto-blocker so GTM/GA/Pixel tags can actually set cookies inside the scan iframe.
* Added: Extended known cookies DB with _gcl_*, FPGCLAW, FPGCLDC, FPGCLGB, FPID, FPLC, AEC.

= 2.1.1 =
* Security: Scanner bypass (?r2cc_scan) now requires one-time token.
* Security: Explicit sslverify on scanner HTTP requests.
* Security: Scanner API key excluded from settings export.
* Fixed: wp_unslash() on $_SERVER values in consent logger.

= 2.1.0 =
* New: Headless Browser Cookie Scanner — deep scan via R2 Cookie Scanner service.
* New: Reset All Cookies button.
* Fixed: Scanner false positives (exact plugin slug matching, script-only regex).

= 2.0.11 =
* Changed: Check for updates link moved to action links row (next to Deactivate).
* Added: Success notice after manual update check.

= 2.0.10 =
* Updated PHP requirement to 8.0
* Updated WordPress requirement to 6.0
* Modernized strpos()/substr() calls to PHP 8.0 string functions
* Added PHP/WordPress version gate on activation
* Fixed unescaped admin_url() in action links
* Used wp_date() instead of date() for timezone consistency

= 2.0.7 =
* Fixed: Accept All / Reject All in settings modal now visibly flips toggles with a pulse animation before the modal fades out (900ms delay + fade transition)
* Fixed: Duplicate cookie entries in database from repeated scans — auto-deduplicated on upgrade
* Improved: Settings modal closes with a smooth scale-down + fade-out animation instead of instant disappear

= 2.0.6 =
* Fixed: Cookie settings modal toggles now reflect saved consent state when reopened via floating cookie button
* Fixed: Chart.js race condition — declared as WP script dependency with fallback dynamic loader

= 2.0.5 =
* Fixed: "Accept Necessary" label stuck in database now force-updated to "Reject All" on upgrade
* Fixed: Modal toggle sync visible — Accept/Reject All from modal now shows toggles flipping before closing (600ms delay)
* Fixed: Browser scan PHP critical error — known cookies DB format mismatch resolved
* Fixed: Chart.js now properly enqueued via WordPress on dashboard tab (was failing to load from CDN)
* Fixed: Cache automatically purged on plugin upgrade (WP Rocket, W3TC, LiteSpeed, WP Super Cache)
* Improved: Known cookies database expanded to 50+ patterns (GA, FB, Hotjar, HubSpot, LinkedIn, TikTok, Bing, Matomo, etc.)
* Improved: Chart.js fallback with error message if CDN blocked

= 2.0.4 =
* New: Hybrid cookie scanner — browser-based detection via hidden iframe catches real cookies
* Fixed: Form plugins (CF7, WPForms, Gravity Forms) now detected individually with correct cookies
* Changed: Scanner results table shows Source column (Server/Browser)
* Unknown cookies from browser scan flagged for review in Cookies tab

= 2.0.3 =
* Fixed: Admin-only cookies (wordpress_logged_in, wp-settings, comment_author, yoast-seo, etc.) now automatically purged from cookie database on update
* Added: Version-based upgrade routine — runs cleanup once per version bump

= 2.0.2 =
* Fixed: Accept All / Reject All now visually sync toggle switches in settings panel
* Fixed: Duplicate identical consent actions no longer logged to database
* Consent cookie is always updated, but server log is skipped when categories and type are unchanged

= 2.0.1 =
* Fixed: Settings tabs no longer reset colors when saving other tabs
* Fixed: Modal scrollbar styling for dark theme
* Fixed: Category expand/collapse clipping in settings panel
* Changed: Button order — Cookie Settings, Reject All, Accept All
* Changed: Removed admin-only cookies from scanner (wordpress_logged_in, wp-settings, yoast-seo, etc.)
* Added: Plugin's own consent cookies (r2cc_consent, r2cc_consent_uid) auto-detected by scanner

= 2.0.0 =
* Auto script & iframe blocker (60+ services)
* Consent analytics dashboard
* Shortcodes: settings button, cookie table, consent status
* Consent version bump (force re-consent)
* Import/Export settings JSON
* Scheduled cookie re-scan via WP-Cron
* Email notifications for new cookies
* Cache-compatible GCM

= 1.0.0 =
* Initial release
