CookieKita — GDPR Consent & Cookie Banner

שינויים

1.1.1

• Fix: the banner script (banner.js) was requested with the plugin version as a ?ver cache-buster. Because banner.js is a remote script that updates independently of the plugin, this could keep browsers on an older cached copy after a banner update until the plugin version changed. The plugin no longer pins a version to it and lets the script's own cache headers govern freshness, so improvements reach visitors right away.

1.1.0

• Improved: the accessibility toolbar (Settings → Accessibility toolbar) is now fully customizable from your CookieKita dashboard — the floating button's colours and corner, which controls the panel shows and the order they appear in. Existing sites keep the full default set until you change it.
• Improved: refreshed toolbar design — clearer controls with a level indicator on the steppers, proper switches, and a tidy header/footer.
• New: the Accessibility toolbar settings screen now links straight to the dashboard where you customize its appearance.

1.0.15

• New: optional accessibility toolbar (Settings → Accessibility toolbar). A floating button visitors can open to adjust text size, line height, letter spacing, contrast (dark/light/high), a readable font, stop animations, a big cursor, link/heading highlighting, a reading guide and hide images — choices are remembered on their device (localStorage), independent of cookie consent since no data leaves the browser. This is a comfort/customization toolkit, not an ADA/WCAG compliance claim — it complements real accessibility work rather than replacing it. Off by default.

1.0.14

• Fix: HubSpot's actual analytics beacon (js.hs-analytics.net) was accidentally bundled into the "HubSpot Forms" integration's domain list, which silently downgraded it from the correct "analytics" consent category to "preferences" — the least strict category. It now stays correctly gated behind analytics consent.
• Fix: the Matomo and PostHog custom-URL fields rejected otherwise-valid addresses that included a port number (e.g. a self-hosted Matomo on https://host:8080/), showing "does not look right" for valid input.
• Fix: Google Ads / Amazon Ads — the Amazon integration hardcoded the advertiser region to "EU", silently breaking attribution for any non-EU Amazon Ads account. A new optional "Account region (NA / EU / FE)" field lets you set the correct one; existing configs keep working unchanged (defaults to EU).
• Fix: Criteo was hardcoded to report every single page load as the homepage ("viewHome"), making its analytics/retargeting data wrong on every page except the actual front page. Criteo now gets real, page-aware WooCommerce events — viewItem on product pages, viewBasket on add-to-cart and checkout, trackTransaction on purchase (de-duplicated per order) — and "viewHome" only fires on the real front page.

1.0.13

• The Integrations tab now shows an "Extensions" section with a WooCommerce card, so the WooCommerce eCommerce tracking is discoverable there (it was previously only in Settings). The card shows whether WooCommerce is detected and links straight to its settings.

1.0.12

• New: shared Google tag settings (Settings → Google tag settings), applied to both the Google Analytics and Google Ads integrations.
• New: Google Tag Gateway measurement path — serve the Google tag first-party from your own domain to reduce ad-blocker loss. Requires a reverse proxy (currently Cloudflare's Tag Gateway); leave blank to load from Google directly.
• New: optional url_passthrough (link decoration) toggle, off by default. It stays consent-gated, so it only fires after the visitor consents.

1.0.11

• New: Google Ads conversion tracking for WooCommerce. Add your Purchase / Begin-checkout / Add-to-cart conversion labels on the Google Ads integration and CookieKita fires the matching gtag('event','conversion', …) with value, currency and (for purchases) the order id — marketing-consent-gated, and de-duplicated per order in the browser. Previously the plugin installed the Google Ads tag but never reported WooCommerce conversions to it.
• Diagnostics now recognises Google Ads conversions as a valid destination for eCommerce events.

1.0.10

• Fixed WooCommerce eCommerce values serializing as long floats (e.g. 19.899999999999999) on hosts with serialize_precision = 17; monetary values now emit as clean two-decimal numbers (19.9) to GA4 / Tag Manager and the ad pixels.
• Purchase events are now de-duplicated in the browser by order id (localStorage) instead of by an order meta flag written at page-render time. The previous approach could permanently suppress a purchase hit when the buyer reached the thank-you page before granting analytics consent; the event now fires exactly once, but only once it is actually allowed to run.
• Richer GA4 items: item_category, item_brand (WooCommerce product_brand) and item_variant are now included when available, across view_item, add_to_cart, begin_checkout and purchase.
• Diagnostics now flags when WooCommerce eCommerce tracking is enabled but no Google Analytics / Tag Manager integration is active — i.e. events are emitted but nothing collects them.

1.0.9

• New (opt-in): "Also block hand-pasted inline snippets" under Tracker blocking. The blocker previously only held back external tracker script files (<script src>); inline snippets pasted directly into a theme or header (Google Analytics/GTM config, Meta Pixel fbq, and others) ran before consent. When enabled, these inline snippets are rewritten to inert type="text/plain" with the correct consent category (analytics vs. marketing) and only execute after the visitor consents. Benign inline scripts and non-JS blocks (e.g. JSON-LD) are never touched. Off by default — enable and test your site, as it can affect custom inline scripts.
• Connection status is now verified, not just "a key is stored". The header badge and Diagnostics reflect three states — Connected, Key not recognized, and Not connected — based on the real handshake with CookieKita. A mistyped or wrong-domain Site Key now surfaces as "Key not recognized" instead of a misleading "Connected". The check reuses the existing hourly heartbeat, so there is no extra request on page load.
• Performance: the tracker-blocking output filter now skips the regex entirely on responses with no <script> tag.

1.0.8

• Admin UI no longer gates any panel behind the account connection. The Settings, Integrations and Shortcodes tabs are now always fully accessible and every option is editable and saved locally at all times — nothing is hidden or disabled while unconnected. A small, non-blocking hint simply notes that the consent banner goes live on the front-end once the site is connected (the banner script needs the Site Key to load its configuration). This addresses the review concern that locally-implemented features (tracker blocking, tag installer, shortcodes) appeared to be locked behind the service connection.
• Removed the last padlock icon from the Integrations activation modal (replaced with a shield), so no "lock" iconography remains anywhere in the admin.
• Full audit of every third-party terms/privacy URL in the External services section; refreshed the ones that had moved or now return an error: Criteo (privacy → /privacy/, terms → /terms-and-conditions/), Meta/Facebook (added trailing slashes so the pages return 200), Taboola (→ policies.taboola.com), Outbrain terms (→ /onyx/term-of-use/), Mouseflow (→ /legal/…), Inspectlet (→ /terms-of-service) and Segment (→ Twilio legal, since Segment's terms/privacy are now governed by Twilio). All remaining links were verified reachable.

1.0.7

• Removed the custom update checker (update_check_enabled / ajax_check_update / fetch_latest_version) — updates are handled exclusively through the standard WordPress.org update flow.
• Renamed render_lock_gate() to render_service_connection_notice() and replaced lock-icon UI with a neutral "connect your account" prompt. The tabs show a connection prompt because they are managed through the CookieKita external service (Guideline 6), not because features are locked behind a payment or licence.
• Removed lock-icon decorations from Integrations / Settings / Shortcodes tab buttons.
• Fixed dead readme URLs: Criteo terms updated; Mouseflow terms/privacy updated.

1.0.6

• No functional changes. Submitted in response to review R-29Jun26: confirmed that HubSpot (js.hs-scripts.com) and LiveChat (cdn.livechatinc.com) are fully documented in the External services section, including terms and privacy links. The privacy link for HubSpot (legal.hubspot.com/privacy-policy) is their official URL; the timeout reported by the automated checker is caused by HubSpot's CDN anti-bot protection on their legal subdomain, not an invalid URL.

1.0.5

• Branded the "Connect to CookieKita" button to match the CookieKita visual style.

1.0.4

• Fixed "Connection could not be completed" — the connect state token is now shared across all Connect buttons on the page instead of being regenerated per button.

1.0.3

• The admin now lands on the Connection tab first when the site is not yet connected (all tabs remain accessible).
• Updated the brand logo in the admin header.

1.0.2

• Text domain now matches the plugin slug (cookiekita-gdpr-consent-cookie-banner) so the plugin is translatable via the directory.
• Admin notice-hiding CSS is enqueued via wp_add_inline_style instead of an inline <style> echo.
• Public /ping endpoint no longer exposes configuration state, feature flags or secret status — it returns only a minimal reachability response.
• The tracker-blocking output buffer is now explicitly closed (paired ob_start/ob_end_flush).
• Removed an unnecessary require of a WordPress core admin file in the DSAR exporter path.
• Documented all optional third-party tag services (with terms/privacy links) in the External services section.

1.0.1

• Security hardening: proof-of-possession required to disconnect, stronger DSAR deletion guard (super-admins), reduced anonymous info in the health endpoint, and a hardcoded update link.

1.0.0

• Initial public release.
• Cookie consent banner with real tracker blocking (37+ services) until consent.
• Integrations directory + consent-aware tag installer (GA4, GTM, Meta Pixel, and more).
• WooCommerce eCommerce events (view_item, add_to_cart, begin_checkout, purchase), fully consent-gated.
• Google Consent Mode v2 + Microsoft UET Consent Mode, GPC/DNT signals.
• Cookie declaration and DSAR shortcodes, with optional auto-execution of verified requests.
• One-click "Connect to CookieKita" onboarding, with manual Site Key entry as a fallback.