SureCookie – GDPR Cookie Consent Banner, Cookie Scanner & Script Blocking

Registro de cambios

1.4.0 – 24-August-2026

• New: A «Data Requests» screen where visitor GDPR and CCPA requests arrive and are tracked against their response deadline. Answering them is a SureCookie Pro feature; the free screen explains the workflow. ( https://surecookie.com/docs/handling-data-requests/ )
• New: Import / Export for settings, cookie categories and custom cookies, so you can copy a configuration between sites or keep a backup. ( https://surecookie.com/docs/importing-and-exporting-surecookie-settings/ )
• New: AI assistants now reach most of the plugin: a diagnostic summary of your setup, blocked scripts and embeds, the Known Services library, and the pages and menus your settings point to. ( https://surecookie.com/docs/surecookie-mcp-abilities/ )
• New: Settings > Advanced > Blocked Content UI, for customizing the placeholder shown in place of blocked content. ( https://surecookie.com/docs/customizing-the-blocked-content-ui/ )
• New: «Hide Unused Categories» under Manage Categories hides categories that have nothing on your site from the visitor preferences modal. Off by default.
• New: Date filter on consent logs.
• New: «Astra Global Palette» for banner colors, matching the Astra theme palette.
• New: Ask an AI assistant to recategorize cookies in bulk, or to report your remaining scan allowance before it starts a scan.
• New: Verify your domain with a DNS TXT record, for sites where a firewall or security plugin blocks our scanner. Allowlisting the scanner still works too. ( https://surecookie.com/docs/verifying-your-domain-with-a-dns-record/ )
• Improvement: Every settings, Tracking Manager and Learn screen now links to its own documentation from the page header.
• Improvement: Settings offered to an AI assistant now describe their allowed values and flag the ones that change what visitors see before they consent.
• Improvement: Trackers that a plugin or theme injects with JavaScript after page load are now held behind consent, showing the usual «Accept & Load» placeholder.
• Improvement: Script and embed matching is no longer case-sensitive.
• Improvement: The «Managed by Google Consent Mode» list now notes that Consent Mode does not cover the non-Google tags you deploy through Tag Manager.
• Improvement: Presto Player videos and embeds now follow the category set on the Scripts and Embeds page.
• Improvement: Resources blocked by the built-in service list now appear on the Scripts and Embeds page, so you can change their category.
• Improvement: The blocked-content message now says the content would connect to the service, instead of saying it requires cookies.
• Compatibility: YouTube videos added with Elementor’s Video widget are now held behind consent, and play in place once accepted.
• Compatibility: Fixed the banner not appearing when a caching plugin combines JavaScript, most often LiteSpeed Cache.
• Compatibility: Improved cached CSS and JS handling with WP Rocket, W3 Total Cache, LiteSpeed Cache and Flying Press.
• Compatibility: Fixed the admin dashboard shrinking when MemberPress Courses is active.
• Fix: The Google Consent Mode screen now describes the rule actually in force, and warns you when a category is granted before the visitor answers the banner.
• Fix: Blocking did nothing on sites using a performance plugin that inlines scripts as data: URIs, such as Perfmatters. Those scripts are now blocked like any other.
• Fix: Sites using Google Consent Mode found almost no cookies when scanning. A scan now sees your site the way a visitor who has accepted would.
• Fix: An AI assistant could not read or change any setting.
• Fix: Banner and preferences modal descriptions now normalize non-breaking spaces and wrap long unbreakable content without overflowing.
• Fix: Asking an AI assistant to scan a specific list of pages scanned the site’s default pages instead.
• Fix: Changing a setting through an AI assistant no longer leaves caching plugins serving the old banner.
• Fix: Consent log filters offered to an AI assistant were missing several actions and columns.
• Fix: Blocking could silently stop on a page carrying one very large inline script, such as a page builder’s template data. Those pages are now rewritten correctly, and the limit is written to the scan log if it is ever reached.
• Fix: On sites serving files through a CDN, blocking could hold back WordPress core and theme files instead of a tracker. Core files now always load, browser import maps and speculation rules are never held back, and asset-delivery CDNs are treated as Essential: Bunny, Kinsta, NitroPack, Optimole, StackPath, ImageKit, EWWW Easy IO, RocketCDN, CDN77, Statically, Jetpack Site Accelerator and BootstrapCDN.
• Fix: Blocking and the consent banner did nothing on post types whose templates come from another plugin. Both now work whichever plugin renders the template.
• Fix: A category set on a script or embed was ignored when the match was made on the script’s contents rather than its address.
• Fix: «Do not block» was hidden whenever SureCookie Pro was active. There is now one option, on every site, that behaves the same with or without Pro.
• Fix: «Accept & Load» did nothing on blocked videos in pages cached before this release. Those placeholders are now repaired in the browser.
• Fix: The built-in service list stopped at 200 services, silently dropping later blocking patterns. The limit is raised and truncation is recorded in the scan log.
• Fix: The Known Services confirmation, the Scripts and Embeds notice and the Detected and Managed Resources table each described blocking incorrectly.
• Fix: When domain verification failed, SureCookie guessed at the reason and often guessed wrong. It now reports the reason the scanning service actually gave.

1.3.1 – 03-August-2026

• Fix: Prevented duplicate cookies by ensuring scanned cookies with the same name are update existing entries instead of being added again.

1.3.0 – 03-August-2026

• New: Introducing «Known Services», a library of popular third-party services (Google Analytics, Meta Pixel, YouTube, Stripe, Hotjar and more) that you can add in one click. Adding a service declares its cookies in your cookie list and cookie policy, and blocks its scripts and embeds until consent, without waiting for a scan to find them. The free plan includes 5 services; SureCookie Pro unlocks the full automated library of 150+ services. ( https://surecookie.com/docs/using-known-services/ )
• New: Introducing Assisted Scanner mechanism i.e. «Scan from Your Browser», a fallback scan for sites where the hosting firewall blocks SureCookie Scanner agent. ( https://surecookie.com/docs/scanning-your-site-from-your-browser/ )
• New: «Resource Blocking» has been rebuilt as the «Scripts and Embeds» page, a single list of every script and embed found on your site plus any you add yourself.
• New: You can now choose the consent state Google Consent Mode starts from before a visitor answers the banner. A «Worldwide» rule sets the baseline for Functional, Analytics and Marketing / Ads storage, and the regional rules below it override that baseline for the countries you list, so a region such as the EU can stay denied while other regions start from your own setting. Everything stays denied until you change it, so existing sites are unaffected.
• New: Under Scripts and Embeds, you can now add your own scripts and embeds to block, even if they are not detected by a scan. This is useful for scripts that only run on certain pages or under certain conditions, such as tag managers, marketing pixels, or custom embeds.
• New: You can now change the category of several cookies at once. Select them on the All Cookies page and move them together, with a reminder of what a category change means for visitor consent.
• New: Deleting a cookie category now asks where its cookies should go, with a «Move Cookies To» picker instead of always sending them to Uncategorized.
• Improvement: The built-in service catalog has grown to 150+ services with reviewed categories, so services such as Stripe, Cloudflare Turnstile, hCaptcha and Google Sign-In are treated as Essential or Functional instead of falling into Marketing. The catalog also refreshes on its daily schedule as intended.
• Improvement: The admin has been reorganized. «Cookie Manager» is now «Tracking Manager» and holds Scanning, Known Services, Cookies (All Cookies and Cookie Policy), Scripts and Embeds, Geographic Rules and Consent Sharing in one place.
• Improvement: Reduced the plugin’s footprint on every page load. The scan log, active scan state, connection details and notice state are no longer loaded on requests that do not need them, and the scan log is capped at 500 lines so sites running automatic scans no longer grow it without limit.
• Improvement: Hardened the security of the plugin.
• Improvement: The review request now waits until your site has logged 30 visitor consents, instead of appearing after your first cookie scan, so it only shows up once SureCookie has demonstrably done its job. It also steps aside when another SureCookie notice is already on screen, and once you rate the plugin or choose «I already did» it stays away for every administrator on the site rather than just the one who answered.
• Compatibility: If you use SureCookie Pro, update it to 1.1.0 or later alongside this release. Geographic Rules and Consent Sharing now live under Tracking Manager, and older Pro versions still register those pages at their previous location.
• Fix: Consent log PDF exports breaks in right-to-left languages such as Arabic and Hebrew.
• Fix: A cookie category you assign by hand is now remembered. Previously the next scan re-sorted that cookie using the scanner’s own classification and your change was lost, including when a cookie stopped being detected and came back later.
• Fix: Security cookies and scripts found by a scan, such as captcha, bot protection and CSRF tokens, were filed as Marketing or left Uncategorized. They are now treated as Essential, so a visitor who declines marketing no longer breaks logins, forms and captchas on your site. Run a scan to re-sort anything already detected.
• Fix: Google Consent Mode sent no consent signals at all on sites that load Google Tag Manager from their own domain or through server-side tagging. SureCookie looked for Google’s own script URLs to decide whether to act, and those setups have none, so neither the consent defaults nor the visitor’s later choice ever reached Google. With Google Consent Mode turned on, the consent defaults are now always set at the top of every page before your tags run, no matter how those tags are loaded, and the visitor’s choice is sent to Google as soon as they answer the banner.
• Fix: The Provider and Duration columns showed «-» for every scanned cookie. Both now fill in, including on cookies already stored, so no rescan is needed.
• Fix: Blocked embeds added to the page later, lazy loaded or loaded over AJAX, showed an empty box with no «Accept & Load» button.
• Fix: The Google Consent Mode conflict warning for Site Kit never appeared in the WordPress admin.
• Fix: Consent submissions returned an error when consent logging was turned off, even though the visitor’s choice was saved correctly.
• Fix: Screen readers announced every blocked embed on a page with the same «Accept & Load» label; each button now names the service it will load.
• Fix: Removed the «Replace data on next scan» toggle. It had no effect, as every scan already replaces the detected resource list.
• Fix: Deactivating or uninstalling the plugin now clears the scheduled tasks and cached service data added in this release.
• Tweak: Scan results now tell you what actually happened. Separate notices cover a scan blocked by your host, a scan that reached the site but found nothing, a scan taking longer than usual, and a scan that finished only part of its pages. A retry adds to what was already found instead of replacing it, and the completion notice now points at both places results land, the Cookies page and the Scripts and Embeds page.
• Tweak: The Consent Logs table header now wraps on narrow screens instead of overflowing.
• Tweak: Scans could sit at «Queued…» forever on hosts where WordPress cron does not run, even though the scan had already finished. Opening the Scanning screen now refreshes the status directly.
• Tweak: When a hosting firewall blocked our scanner, the Scanning screen simply reported 0 cookies with no explanation. It now says the host blocked the scan, links to the allowlisting guide, and lists anything it could still detect. An invalid, expired or self-signed SSL certificate is now reported as a certificate problem rather than a firewall problem.

1.2.4 – 21-July-2026

• Improvement: The banner button order setting now displays a notice, with a shortcut to your Geographic Targeting rules, explaining that visitors matched by a region-specific rule see that region’s button order instead of the global one.
• Improvement: The admin «What’s New» panel no longer loads its font from Google’s servers, removing an external request while keeping its appearance unchanged.
• Compatibility: SureCookie now blocks Presto Player video and audio embeds (YouTube, Vimeo, Bunny.net, self-hosted, and audio) until the visitor consents, showing an «Accept & Load» placeholder and restoring the player in place once the matching cookie category is accepted.
• Fix: Licensed users no longer see a misleading «5 pages per scan» limit before their site connects with SureCookie; the cookie scanner now prompts them to run their first scan to unlock their plan’s full scan limits.
• Fix: SureCookie Pro users can now activate their license during onboarding, so their premium plan and higher scan limits are detected correctly instead of the site being set up on the free tier.
• Fix: Re-consent entry points (the shortcode button and menu item) now open the cookie preferences even when the consent banner is turned off site-wide, instead of appearing as unresponsive controls.
• Fix: The SureCookie review request notice in the WordPress admin now displays its logo icon at the correct, compact size instead of appearing oversized.
• Developer note: Custom post types can now be included in the site scanner and Cookie Policy pickers (and the automatic «All Published Content» scan scope) via the surecookie_searchable_post_types filter, with picker results grouped by content type. ( https://surecookie.com/docs/including-custom-post-types-in-scanning-and-the-cookie-policy-picker/ )

1.2.3 – 14-July-2026

• Improvement: Added notification dot for unread consent logs in admin menu.
• Improvement: The consent banner stylesheet now loads without blocking page render (served asynchronously), taking it off the critical rendering path and improving FCP / LCP / Lighthouse scores.
• Improvement: The bundled Figtree fonts are now served as woff2 (about 60% smaller) and use font-display: swap, so banner text paints immediately in a fallback font and the fonts no longer sit on the critical path.
• Fix: Accessibility issue with focus outlines for buttons and links in the banner interface.
• Fix: Script blocking now works even if the remote list fails, using a built-in baseline of common third-party scripts.
• Compatibility: SureCookie now activates cleanly on SQLite-based WordPress installs by skipping MySQL-only steps, fixing prior index and column errors.

1.2.2 – 10-July-2026

• Fix: Enabling Resource Blocking could break the page layout on WordPress 7.0 sites using classic themes with block-based content – block and global styles were pushed into the page body instead of the header, inverting the CSS cascade and collapsing multi-column sections. Resource Blocking no longer interferes with WordPress 7.0’s on-demand block-style loading.
• Fix: Blocked video embeds (Vimeo, YouTube, and other WordPress responsive embeds) no longer leave a large empty gap around the «content is blocked» placeholder. The placeholder now overlays the embed’s reserved aspect-ratio space instead of adding its own height on top of it.

1.2.1 – 09-July-2026

• Improvement: Reduced the consent banner script (public.js) by over 96% – from ~1.4 MB to ~50 KB minified – by removing admin-only code that was bundled into the public page.
• Improvement: Frontend scripts now load with the defer strategy and no longer pull in WordPress’s api-fetch library, shrinking the script dependency chain and improving LCP / Lighthouse scores.
• Improvement: Consent-log delivery failures now log a console warning instead of failing silently.
• Improvement: A misbehaving surecookie-pro’s floating widget can no longer prevent the consent banner from rendering.
• Improvement: On local and development sites (localhost, .local, .localhost, and private/loopback IP ranges), cookie scanning is now blocked up front with a clear notice – instead of appearing to start and then failing – since the SureCookie agent app cannot reach a local site.
• Compatibility: The consent banner now renders reliably alongside JS-delay/optimization plugins (e.g. WP Rocket, Perfmatters) that run scripts after the page has loaded.
• Compatibility: The Cookie Policy page link, cookie category names and descriptions, and the Re-request Consent button label now translate via WPML and Polylang to match the active language.
• Fix: Consent-log entries are no longer silently lost on pages served from a long-lived page cache – the banner now automatically refreshes its security token and retries.
• Fix: Added .site, .test domain support to the SureCookie agent app for staging development environments for further testing and scanning.
• Fix: The bullet-number lists in the messages editor now renders correctly when the description text includes HTML.
• Fix: Deleting a core cookie category unable to process and stuck in the deleting state.
• Fix: SureCookie agent’s auth details not getting deleted when the plugin’s «Delete Data on Uninstall» option is enabled.
• Fix: «Powered by» label from the banner is not being translated with provided translation files.
• Developer note: window.surecookieManager is available from DOMContentLoaded (never at HTML parse time). Integrations should use the surecookie_* events, and third-party scripts registering surecookie.* filters should be enqueued with the defer strategy.

1.2.0 – 25-June-2026

• New: Introducing «Automatic Scanning» feature to keep your site compliant with regular interval scheduled scan.
• New: Introducing «Re-request Consent» feature to allow admins to trigger a new consent request for all visitors.
• New: Introducing «Background Overlay» option to the banner layout settings, which dims the page behind the banner until a choice is made.
• New: Added highlighting logs count to the SureCookie admin menu > Logs, to show the number of new consent logs since the last visit.
• Improvement: Added «Reset to Default» button for the Banner Content and Preference Modal Description fields, allowing admins to revert to default text easily.
• Improvement: Updated scanning capacity sync with the SureCookie agent app for a more consistent scanning experience.
• Fix: The content blocker scanner showed a block toggle for Google scripts managed by Google Consent Mode, even though the toggle had no effect. These resources now display an explanatory note instead, clarifying that Consent Mode manages them.
• Fix: Deactivation conflict with other plugins resolved on network setup level.
• Compatibility – Synced up Resource blocked scripts with Google consent mode scripts, so that the toggle is not shown for Google scripts managed by Consent Mode.

Older releases, including the 1.0.x and pre-release builds, are listed in the full SureCookie changelog.