Consent cookies and the audit table are renamed (wgc_ to gpcg_ prefix). If you added the old cookie names to a cache exclusion list, update them to gpcg_consent and gpcg_gpc_js.<\/p>","1.4.0":"
The plugin is now GPC Guard for WooCommerce. Licensing activates out of the box via the bundled Freemius SDK, uninstall cleanup is multisite-complete, and Cloudflare visitor headers are only trusted from verified Cloudflare edge IPs.<\/p>","1.3.0":"
Adds configurable audit-log retention with daily pruning (default 2 years) to bound table growth, inline-script stripping in Pro Full Coverage Mode, CDN-aware rate limiting, and a fix for a duplicated thank-you notice on block checkout.<\/p>","1.2.0":"
Opt-outs are now logged for non-purchasers (banner + GPC), IP hashing uses a dedicated salt that survives auth-key rotation, and consent-dependent pages are auto-excluded from full-page caches. TikTok, Bing, and multi-state jurisdiction blocking are now Pro features.<\/p>","1.1.0":"
Database schema update: run the upgrade to add visitor_state column and order_id index to the audit log table. The plugin handles this automatically on activation.<\/p>","1.0.0":"
Initial release.<\/p>"},"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3613817,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3613817,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3613817,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3613817,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.5.1"],"block_files":[],"assets_screenshots":{"screenshot-1.png":{"filename":"screenshot-1.png","revision":3613817,"resolution":"1","location":"assets","locale":"","width":1280,"height":540},"screenshot-2.png":{"filename":"screenshot-2.png","revision":3613817,"resolution":"2","location":"assets","locale":"","width":1280,"height":620},"screenshot-3.png":{"filename":"screenshot-3.png","revision":3613817,"resolution":"3","location":"assets","locale":"","width":1440,"height":714},"screenshot-4.png":{"filename":"screenshot-4.png","revision":3613817,"resolution":"4","location":"assets","locale":"","width":1440,"height":478},"screenshot-5.png":{"filename":"screenshot-5.png","revision":3613817,"resolution":"5","location":"assets","locale":"","width":1440,"height":478}},"screenshots":{"1":"Consent banner (bottom position)","2":"WooCommerce thank-you page opt-out confirmation notice","3":"Plugin settings page - GPC detection and script blocking","4":"Plugin settings page - consent banner customization","5":"Monthly compliance summary on the settings page"}},"plugin_section":[],"plugin_tags":[166295,20011,272358,396,286],"plugin_category":[45,54],"plugin_contributors":[271094],"plugin_business_model":[],"class_list":["post-339990","plugin","type-plugin","status-publish","hentry","plugin_tags-ccpa","plugin_tags-consent","plugin_tags-gpc","plugin_tags-privacy","plugin_tags-woocommerce","plugin_category-ecommerce","plugin_category-security-and-spam-protection","plugin_contributors-harborplugins","plugin_committers-harborplugins"],"banners":{"banner":"https:\/\/ps.w.org\/harbor-privacy-guard-for-woocommerce\/assets\/banner-772x250.png?rev=3613817","banner_2x":"https:\/\/ps.w.org\/harbor-privacy-guard-for-woocommerce\/assets\/banner-1544x500.png?rev=3613817","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/harbor-privacy-guard-for-woocommerce\/assets\/icon-128x128.png?rev=3613817","icon_2x":"https:\/\/ps.w.org\/harbor-privacy-guard-for-woocommerce\/assets\/icon-256x256.png?rev=3613817","generated":false},"screenshots":[{"src":"https:\/\/ps.w.org\/harbor-privacy-guard-for-woocommerce\/assets\/screenshot-1.png?rev=3613817","caption":"Consent banner (bottom position)"},{"src":"https:\/\/ps.w.org\/harbor-privacy-guard-for-woocommerce\/assets\/screenshot-2.png?rev=3613817","caption":"WooCommerce thank-you page opt-out confirmation notice"},{"src":"https:\/\/ps.w.org\/harbor-privacy-guard-for-woocommerce\/assets\/screenshot-3.png?rev=3613817","caption":"Plugin settings page - GPC detection and script blocking"},{"src":"https:\/\/ps.w.org\/harbor-privacy-guard-for-woocommerce\/assets\/screenshot-4.png?rev=3613817","caption":"Plugin settings page - consent banner customization"},{"src":"https:\/\/ps.w.org\/harbor-privacy-guard-for-woocommerce\/assets\/screenshot-5.png?rev=3613817","caption":"Monthly compliance summary on the settings page"}],"raw_content":"\n
Harbor Privacy Guard for WooCommerce enforces visitor privacy choices on the server. Instead of setting a client-side consent flag for tracking scripts to read, it detects the visitor's consent state in PHP and dequeues known tracking script handles before WordPress renders the page, so scripts that were declined never load.<\/p>\n\n
GPC Browser Signal Detection<\/strong><\/p>\n\n GPC (Global Privacy Control) is a browser-level opt-out signal that is legally binding in 12 US states. When a user enables it \u2014 through their browser settings or a privacy extension \u2014 their browser sends Google Consent Mode v2<\/strong><\/p>\n\n The plugin emits California CPRA Opt-Out Audit Trail<\/strong><\/p>\n\n California's CPRA regulations (effective January 2026) require stores to log opt-out signals with a timestamped record. This plugin stores consent decisions in a dedicated database table ( Minimal Performance Impact<\/strong><\/p>\n\n On the fast path \u2014 consent granted, no GPC signal \u2014 there is no output buffering and no HTML rewriting; the expensive work never runs. To keep per-visitor consent state correct, responses that depend on a consent cookie or GPC signal are automatically excluded from full-page caches (and the consent cookies are registered with WP Rocket and LiteSpeed Cache); first-visit pages remain cacheable. Output buffering for script stripping is a Pro feature and is never activated for consented users.<\/p>\n\n Free vs Pro<\/strong><\/p>\n\n\n\n\n Feature\n Free\n Pro\n\n\n\n\n GPC header detection (Sec-GPC)\n \u2713\n \u2713\n\n\n GPC JavaScript detection\n \u2713\n \u2713\n\n\n Block WooCommerce Google Analytics integration\n \u2713\n \u2713\n\n\n Block Facebook \/ Meta Pixel\n \u2713\n \u2713\n\n\n Block TikTok Pixel\n \u2014\n \u2713\n\n\n Block Bing \/ Microsoft UET\n \u2014\n \u2713\n\n\n Google Consent Mode v2 dataLayer defaults\n \u2713\n \u2713\n\n\n Consent banner (accept \/ decline)\n \u2713\n \u2713\n\n\n Opt-out confirmation on WooCommerce thank-you page\n \u2713\n \u2713\n\n\n Audit log of banner, GPC, and checkout consent events (hashed IP, order ID, state, source)\n \u2713\n \u2713\n\n\n Output-buffer script stripping (catches inline + third-party injected scripts)\n \u2014\n \u2713\n\n\n Custom domain blocklist\n \u2014\n \u2713\n\n\n CSV compliance export\n \u2014\n \u2713\n\n\n Multi-state consent UI (California vs Virginia vs Colorado)\n \u2014\n \u2713\n\n\n\n\n How It Works<\/strong><\/p>\n\n This plugin stores consent decisions in the database table Sec-GPC: 1<\/code> on every HTTP request. This plugin detects that header server-side, requiring no user interaction with a banner. A small JavaScript snippet also reads navigator.globalPrivacyControl<\/code> and sets a first-party cookie (gpcg_gpc_js<\/code>) so GPC is honored even when the header is absent (some proxies strip it).<\/p>\n\ngtag('consent','default',{...})<\/code> before GTM loads, at wp_head<\/code> priority 1 \u2014 the integration point Google's Consent Mode v2 documentation requires. Google's GA4 behavioral modeling needs this consent signal to be present even for visitors who deny tracking; the plugin supplies it so modeling continues to work for users who have denied or not yet responded.<\/p>\n\n{prefix}gpcg_opt_out_log<\/code>) rather than wp_options<\/code>. Opt-outs are recorded where they happen \u2014 when a visitor declines (or accepts) the banner, when an automatic GPC signal is detected (deduplicated to once per visitor per day), and at WooCommerce checkout \u2014 so the trail covers non-purchasers, not only completed orders. Each row records the hashed IP address (SHA-256 with a dedicated, stored plugin salt kept separate from WordPress auth keys so it survives key rotation \u2014 the raw IP is never written to disk), the consent state (granted \/ denied \/ gpc), the signal source (banner \/ gpc_header \/ gpc_js \/ default), the WooCommerce order ID, the page URL, and a UTC timestamp. A confirmation notice is displayed on the WooCommerce thank-you page to satisfy the California requirement that users receive visible confirmation of their opt-out.<\/p>\n\n\n
Sec-GPC<\/code> header and the gpcg_gpc_js<\/code> cookie (set by a tiny JS snippet that reads navigator.globalPrivacyControl<\/code>).<\/li>\ngtag('consent','default',{ad_storage:'denied',...})<\/code> fires before GTM at wp_head<\/code> priority 1.<\/li>\nPrivacy<\/h3>\n\n
{prefix}gpcg_opt_out_log<\/code>. Visitor IP addresses are hashed with SHA-256 and a site-specific salt before storage \u2014 raw IPs are never written to disk. The hashed IP, consent state (granted\/denied\/gpc), signal source (banner\/gpc_header\/gpc_js\/default), WooCommerce order ID (when applicable), and page URL are retained until the plugin is uninstalled or the site administrator exports and purges the table. This plugin transmits nothing to external servers; the bundled Freemius SDK is opt-in only, used solely for Pro license activation if you choose to enter a license key.<\/p>\n\n\n\n
.zip<\/code> file.<\/li>\n\n