Changelog

The plugin was renamed from Brainrune Consent (Consent Manager in the admin menu) to Brainrune Cookie Consent, and Consent Pro is now Cookie Consent Pro. The versions below cover both names.

Brainrune Cookie Consent

1.8.2

• Security: the GDPR form’s proof is tied to the connection that fetched it, so one fetch can no longer be shared across many addresses.
• Security: request limits are taken before the request is created, in one step, so a burst of parallel posts cannot get past them. Ten requests an hour per connection, down from twenty.
• Security: the site-wide ceiling now limits confirmation emails, not the form. Past it a request is kept for the site owner, who gets one email about it, and the form stays open for everyone.
• Security: unconfirmed requests made through the form are deleted after 30 days.
• Security: behind Cloudflare and a local proxy (Docker, Traefik, nginx), the visitor is read from CF-Connecting-IP instead of the Cloudflare edge.
• Security: the iframe address is read the way a browser reads it, so a decoy address can no longer let a video or map load before consent.
• Security: settings keep only keys this version knows. A GitHub token stored by versions 1.0 to 1.6.1 is removed on update.
• Privacy: WooCommerce order attribution waits for the visitor’s answer in Opt-out and Notice mode too, so Necessary only stops it.
• Privacy: an answer an add-on keeps for the visitor lasts one day, so the region check runs again.
• A notice on the plugin screens when maps and social posts load before consent.
• Notice mode is reported to the WP Consent API as opt-out.
• Banner descriptions are stored as plain text, the way they are shown. The policy version is capped at 999999.
• A form field sent as an array no longer causes a server error.

1.8.1

• Security: the GDPR request form asks the page’s script for a short-lived proof before it sends. Without JavaScript the form says so and does not send.
• Security: a ceiling of thirty requests an hour for the whole site on the GDPR form, filterable with brl_consent_privacy_request_site_limit. An IPv6 visitor is counted per /64.
• Security: behind a trusted proxy, the visitor’s address is read from the right end of X-Forwarded-For. CF-Connecting-IP is believed only when the request comes from Cloudflare’s own ranges.
• Security: a request already waiting for confirmation is answered like a new one, so the form cannot tell which addresses have one open.
• Security: a held address (data-brl-consent-src) is only given to an iframe, image, video, audio or source element, and only over https.
• The request counters use the object cache when there is one.

1.8.0

• WooCommerce order attribution (the sbjs_ cookies) waits for Marketing in Opt-in mode, and still works on cached pages.
• The Dashboard warns when Brainrune Pixel Tracking is set to send without consent.
• Maps, music and social embeds wait for consent: Google Maps, Spotify, SoundCloud, Instagram, X and Facebook, with the same note and button as videos.
• Any script or iframe can be held by hand with type="text/plain", data-brl-consent and data-brl-consent-src. Held scripts start in page order.
• Google Consent Mode v2: advanced mode, consent asked only in Europe, ads_data_redaction and url_passthrough.
• Global Privacy Control is respected, in the browser and on the server.
• Ready banner texts in English, Romanian, German, French, Italian and Spanish. A new site starts in its own language.
• New shortcode [brl_privacy_request], a GDPR request form tied to WordPress’s privacy tools.
• The Video category is now External media. Sites still on the old default texts get the new ones; edited texts stay.
• A Dashboard tab that checks the setup, folder tabs for each section, and a fuller design editor with a live preview.
• Tooltips on every setting.
• Romanian translation of the admin screens.
• Fixes: a fresh install stores its banner texts in the site’s language; with Global Privacy Control on, ads start denied in Notice mode and outside Europe from the first Google tag on; YouTube embeds from m.youtube.com load again once allowed; held scripts no longer run out of order when the choice changes; a held script or iframe with no category waits for Marketing, not Analytics; sites updating from 1.7 keep maps and social posts showing, and blocking them is a switch on the Categories tab; the embed placeholder’s button follows the page’s language.

1.7.0

• Ready for wordpress.org. The cookie scanner, the cookie table and the consent log moved to the Brainrune Pixel Tracking Pro add-on, with their data unchanged.
• Updates come from wordpress.org.
• brl_consent_saved fires in the browser once per choice, and brl_consent_loaded fires when the plugin has booted.

1.6.1

• Fixes from two security and code audits.

1.6.0

• Cookie scanner, collector and scan report.

1.5.0

• Cookie icon for the reopen button, a design panel for shape and preview, and a scan for the privacy page.

1.0.0

• The consent manager, split out of Brainrune Pixel Tracking. Existing settings are taken over once on activation.

Cookie Consent Pro (Brainrune Pixel Tracking Pro)

0.4.0

• A Cookie Consent Pro key turns on the Cookie Consent Pro features only. A Pixel Tracking Pro key turns on both.
• Cookie Consent Pro starts with only the free Cookie Consent installed.

0.3.1

• Cookie scan: browsers of logged-in staff are no longer collected. They reported admin settings, debug panels and cookies left by removed plugins, which no visitor gets.

0.3.0

• Updates are verified before they are installed: each release is signed, and a package from any other host, or over plain http, is refused.
• Blocking, the consent log, regions and automatic scans keep running with the saved settings when the licence is off. Only the Pro tabs wait for it. The admin sees a notice and gets one email when the licence goes off.

0.2.0

• Automatic blocking of 45 known services, with your own rules and Block it from the cookie scan.
• The banner by country, WPML and Polylang texts, an A/B test of two banners, and what the refusals cost on the Dashboard.
• The cookie scan is a tab of the Consent screen, with a progress bar. Starting it reads your pages at once, then keeps collecting on real visits.
• Automatic scans every week or every month. They add to earlier results, so the cookie table on the policy page never shrinks.
• A report email with new findings, fixes and next steps, each linked to its screen. Preview it or send it to yourself from the scan tab.
• Provider logos in the scan and in the cookie table, and more cookies from WordPress, WooCommerce, Stripe and Brainrune plugins recognised out of the box.
• Consent log export to CSV.
• A cookie reported by one browser alone is marked unverified and stays off the policy page until the server’s own pass sees it or three browsers do.
• Romanian translation.

0.1.0

• First version, taken out of Pixel Tracking 1.8.7 and Cookie Consent 1.6.1.