Calucon Third-Party Embed Gate

Changelog

0.9.2

• The Status screen’s scan query parameter now carries the full plugin prefix (calucon-embed-gate-scan). No functional change.

0.9.1

• When “Gate the whole page output” is enabled, the plugin’s stylesheet and script are now delivered through the standard enqueue API on every front-end page instead of being written into the buffered document at shutdown. Direct tag injection is gone entirely.
• The translation bridge for the WordPress-free layers now resolves through a generated map of literal gettext calls (languages/strings.php), so no translation function in the plugin ever receives a variable argument.
• The provider descriptor key hint_hosts is now scrub_hint_hosts — a clearer name for what it always was: hostnames whose preconnect/dns-prefetch resource hints the plugin removes. Nothing is ever requested from them.
• Fixed the Cloudflare cache-purge integration: it now registers with the official Cloudflare plugin’s cloudflare_purge_everything_actions filter and fires the plugin’s own calucon_embed_gate_flush_caches action (the previous direct hook call never reached the Cloudflare plugin). The LiteSpeed purge hook now fires only when LiteSpeed Cache is installed.

0.9.0

• Before the WordPress.org listing goes live — while no installed sites exist to break — the plugin’s internal identifiers were aligned with its new name, with no legacy aliases: filters and actions are calucon_embed_gate_*, the shortcode is [calucon_embed_gate_withdraw], the block is calucon-embed-gate/withdraw, the WP-CLI namespace is wp calucon-embed-gate, the theme template override directory is {theme}/calucon-embed-gate/, and the settings option was renamed. If you somehow installed a pre-release build, update those references and re-save the settings.
• The .cg-embed CSS classes, --cg-* custom properties and data-cg-* attributes are unchanged.

0.8.1

• Renamed the plugin’s constants to match the plugin: CALUCON_EMBED_GATE_VERSION, FILE and _DIR. The previous CONSENT_GATE* names remain defined as aliases and will be removed no earlier than 0.9.0, in a release of their own.
• Updated the plugin page and demo links to their new addresses.
• Everything a site can depend on is unchanged: the calucon_embed_gate_* filters, the [calucon_embed_gate_withdraw] shortcode, the wp calucon-embed-gate CLI commands, the .cg-embed CSS classes and the theme template override path all keep their existing names. Nothing you have already set up needs changing.

0.8.0

• Renamed from “Consent Gate” to “Calucon Third-Party Embed Gate” (new slug calucon-third-party-embed-gate) during WordPress.org review, to make clear the plugin gates third-party embeds and is not a consent management platform. No functional change.
• Translations: the strings defined in the WordPress-free layers are now mirrored in languages/strings.php as literal gettext calls, so translate.wordpress.org can extract them. Removed the redundant load_plugin_textdomain() call (WordPress loads language packs automatically since 4.6).
• readme: added the “External services” section stating what the plugin does (and does not) contact.

0.7.5

• Compliance: documented the WordPress-free layer’s parse_url() usage and replaced a WordPress 6.5-only function with a version-agnostic equivalent, so the plugin passes WordPress Plugin Check cleanly on the 5.9 minimum. No functional change.

0.7.4

• Documentation: added Installation and Screenshots sections to the readme for the WordPress.org listing, and linked the plugin page and live demo. Plugin URI now points to the plugin’s home page. No functional change.

0.7.3

• Repository renamed to match the plugin (github.com/Calucon/consent-gate). Updated the Plugin URI and the issue/security-report links. No functional change.

0.7.2

• Added an optional way to support development: a Donate link, a support link in the plugin’s own settings footer, and a GitHub Sponsor button. Plain links only — no third-party widget or remote image loads, so the plugin still makes no outbound request from wp-admin.

0.7.1

• Security hardening (pre-submission audit). Closed a host-classification gap where a crafted embed URL using a backslash or irregular slashes in its authority (e.g. https://evil.example\@yoursite/) parsed to your own host in PHP but connects to the third party in every browser — such URLs are now gated, matching how browsers resolve them. The fallback link now rejects non-navigable schemes (javascript:, data:), the inline settings JSON is emitted with the same tag-escaping as the embed payload, and provider note/button overrides are length-capped.
• Robustness: when a script-strategy SDK (X/Twitter, Instagram, …) is blocked by the browser, the other embeds of that provider keep their panels and fallback links instead of disappearing until reload.
• Every plugin PHP file now carries a direct-access guard, and the plugin declares its Domain Path — housekeeping for the WordPress.org directory.

0.7.0

• Consent platform bridge (off by default): when an installed, tested consent platform — WP Consent API, Complianz, Cookiebot, CookieYes, Borlabs Cookie 3, or Real Cookie Banner — reports consent for the embeds’ category, gated embeds load without a second click, and a withdrawal in the platform re-gates what the bridge loaded (an embed the visitor clicked personally stays). Client-side and read-only: the bridge stores nothing, sends nothing, and with an untested platform or no answer gating stands unchanged.
• IAB TCF v2.2 signals can additionally be honoured behind their own experimental flag; only providers with a Global Vendor List entry can ever be granted that way.
• The Compatibility screen now distinguishes tested platforms (bridge available or active) from untested ones (fail-closed, as before).

0.6.1

• Legacy Google Maps embeds (maps.google.com/maps?q=…&output=embed, the older share form that is still widespread) are now recognised as Google Maps instead of falling back to the generic gate. They were already gated either way; they now get the Google Maps label, note and resource-hint scrubbing.

0.6.0

• Poster images: every embed block gains a “Set poster image” control (Calucon Third-Party Embed Gate panel in the block inspector). The chosen media-library image is shown behind the consent panel until the visitor loads the embed — served from your own site, never fetched from the provider, so the zero-third-party-requests guarantee is untouched. The panel keeps its solid background on top of the image, so text contrast is preserved.
• Theme placeholder templates receive the poster as a $poster variable; see docs/customizing.md.

0.5.0

• WP-CLI: wp calucon-embed-gate scan reports every embed in recent content and whether it is gated (--format=json for CI and automation); wp calucon-embed-gate providers lists providers as the gate resolves them. Both read-only, no outbound requests.
• Ships docs/customizing.md: a self-contained reference for customizing the plugin from functions.php or WP-CLI — descriptor keys, filter examples, the template contract, and the invariants a customization must keep. Written to serve developers and AI coding agents alike.

0.4.0

• The settings screen is now tabbed: Providers, Detection, Appearance, Consent memory, and a read-only Status & tools tab (Status scan, Compatibility, CSP snippet). One page, one Save button — saving returns you to the tab you were on.
• Tabs follow the ARIA tabs pattern (arrow keys, Home/End) and are an enhancement: without JavaScript the page renders as before, every section visible.

0.3.0

• Appearance made novice-friendly: the colour fields are now WordPress colour pickers (no hex typing), a corner-style choice (square, rounded, pill button) joins the panel-style presets, and the settings screen shows a live preview of the placeholder that updates as you change anything.
• The preview includes an automatic readability check: every colour pair (panel text, button text, fallback link) is measured against the WCAG 4.5:1 contrast minimum, in plain language, as you pick colours.
• The preview is rendered through the same pipeline as the front end — template overrides and text filters included — and is inert: the settings screen still makes no third-party request.

0.2.0

• Detection hardening: exclusion ranges are scanned sequentially, so a stray <!-- inside a script (JSON-LD, legacy script-hiding) or an unclosed <pre> can no longer disable gating for the rest of the page.
• Gates attribute-swapped lazy loading (data-src, data-lazy-src, data-original), legacy <embed>/<object> markup, and srcdoc embeds that reference third parties; invisible tracking iframes (zero-sized, display:none) are removed instead of becoming a visible dead panel.
• Gates content delivered to visitors over AJAX and REST (“load more”, infinite scroll); editors keep seeing original markup. New surfaces: Text-widget visual mode, comments and term/archive/author descriptions on classic themes.
• Whole-page gating repaired for page-builder sites: styles and scripts are injected into the buffered page (buttons work now), scanning is scoped to the body, and hint tags printed by performance plugins are scrubbed.
• Activation fixes: unknown widgets no longer share one consent/removal group (scoped per host); id, name, class and data-secret survive the rebuild, so the YouTube JS API, <form target> and WordPress-to-WordPress embed resizing work after consent; loading and error states are announced to assistive technology, with a link to the provider as the error fallback.
• Resource hints: preload/prefetch/prerender covered, the wp_preload_resources filter hooked, and providers’ sibling CDN hosts scrubbed.
• Feeds carry a plain fallback link where an embed was removed.
• New: per-block “Gate this embed” override and a withdrawal block in the editor; Appearance presets and colours; Compatibility and Status screens; always-gate host list; opt-in third-party image gating.
• Providers registered from a theme’s functions.php now appear in the settings table, the CSP snippet and hint scrubbing; five new documented hooks.
• Multisite-aware uninstall; page caches are flushed on deactivation.
• The full E2E, accessibility (axe) and real-WordPress integration suites now run in CI on every change.

0.1.0

• Initial release: core gate (minification-tolerant scanner, host matcher, iframe and script rules), built-in provider set with privacy-preserving load targets, server-rendered accessible placeholder, settings screen, template override, feeds/excerpts/widgets/resource-hint handling, opt-in consent memory with withdrawal shortcode, CSP snippet generator.