Deliberate choice, not an oversight. A WordPress nonce is generated when the page is rendered: on a site with page caching (practically all of them, in production) it ends up baked into the cached HTML and is replayed identically by every visitor for as long as that cache lives \u2014 often longer than the nonce's own lifetime. The practical result, observed during development: consents silently rejected by the endpoint (a 200<\/code> response with {\"logged\":false}<\/code>, no visible error) for the entire lifetime of the cache.<\/p>\n\nA nonce, in this specific case, does not protect anything worth protecting: the route is public by design (permission_callback<\/code> is __return_true<\/code>, deliberately \u2014 it must be callable by an anonymous visitor who has no account yet), it doesn't write anything privileged (only a row in an accountability-only log), and for a logged-out visitor the token is identical for everyone anyway. In its place: strict per-argument validation (type, length, and a category whitelist, so only well-formed rows can ever be written), a same-origin check on the request, and a 20-calls-per-hour-per-IP limit against abuse \u2014 computed from REMOTE_ADDR<\/code> only by default, since request headers like X-Forwarded-For<\/code> are attacker-controllable and are not trusted unless a site explicitly opts in via the occit_trust_proxy_ip_headers<\/code> filter (for sites that know they sit behind a proxy\/CDN they control). None of this is a substitute for authentication; it bounds the worst case to \"some extra rows in a low-sensitivity accountability log,\" which is the actual risk on this endpoint. Details in the code, in class-occ-frontend.php<\/code> and the REST handler.<\/p><\/dd>\nDoes the plugin send data to external services?<\/h3><\/dt>\nNo. The banner engine (the \"CookieConsent\" library by Orest Bida) is downloaded once during development and distributed inside the plugin itself: it runs entirely on your own site, with no call to any third-party service either at runtime or during configuration. The consent log is a table in your own database.<\/p><\/dd>\n\n<\/dl>\n\n\n
1.6.2<\/h4>\n\n
Second round of wordpress.org review fixes. The tools\/<\/code> folder (developer-only scripts, .py<\/code>\/.mjs<\/code>, not needed at runtime) is no longer included in the distributed package \u2014 it stays in the source repository for internal use. Hardened the unauthenticated consent-log REST endpoint: added strict per-argument validation (type, length, a whitelist of the four known category keys) so the log table can only ever receive well-formed rows, and the per-IP rate limit now reads only REMOTE_ADDR<\/code> by default instead of also trusting the attacker-controllable X-Forwarded-For<\/code>\/CF-Connecting-IP<\/code> headers (opt-in via the new occit_trust_proxy_ip_headers<\/code> filter for sites that know they sit behind a trusted proxy\/CDN). The endpoint remains intentionally public (no user account exists to authenticate against) \u2014 see the FAQ below for the full rationale. No visible change for site visitors.<\/p>\n\n1.6.1<\/h4>\n\n
Updated the \"Tested up to\" header to 7.1, per wordpress.org's automated submission scan (the previous 7.0 value was flagged as outdated). No functional change.<\/p>\n\n
1.6.0<\/h4>\n\n
Renamed the plugin to \"ONiDEA Consenso Cookie Conforme Italia\" (previously \"Consenso Cookie Conforme Italia\"), per wordpress.org directory guideline 17 (distinctive naming) \u2014 the previous name was too close to the generic pattern used by many other cookie-consent plugins. Internal function\/class\/option\/hook names were also renamed from the \"occ_\" prefix (3 characters) to \"occit_\", meeting the directory's minimum prefix length; existing settings and the consent-log table are migrated automatically and transparently on upgrade, no data is lost. The Dashboard page's CSS moved from an inline <style><\/code> block to a properly enqueued stylesheet. No visible change for site visitors; wp-admin menu URLs change (occ-dashboard \u2192 occit-dashboard, etc.) and any old bookmarks to them will need updating.<\/p>\n\n1.5.5<\/h4>\n\n
Text Domain header updated to match the wordpress.org-assigned slug (consenso-cookie-conforme-italia), fixing a textdomain_mismatch warning raised by the automated submission scan. No functional change.<\/p>\n\n
1.5.4<\/h4>\n\n
Removed the Plugin URI header (it was identical to the Author URI, which wordpress.org's submission form does not allow \u2014 the two must point to different pages). Kept the Author URI pointing to the agency site, since there is no dedicated page for this specific plugin yet. No functional change.<\/p>\n\n
1.5.3<\/h4>\n\n
Translated readme.txt into English, per wordpress.org's directory-listing language policy (July 2025): the readme is now the base language for community translations via translate.wordpress.org. The plugin itself \u2014 admin screens, banner text, settings, GUIDA-RAPIDA.md \u2014 remains entirely in Italian, as intended for its target audience. No functional change.<\/p>\n\n
1.5.2<\/h4>\n\n
Fixed the findings from wordpress.org's official Plugin Check: prepared direct database queries are now documented with the matching phpcs exemption instead of being left unannotated; the CSV export's write to php:\/\/output<\/code> (the HTTP response stream, not a real file \u2014 WP_Filesystem doesn't apply here) is documented the same way; removed GUIDA-RAPIDA.md from the distributed package (an internal guide for the agency, not required for the plugin to work \u2014 still available in the source repository). No functional change for site visitors.<\/p>\n\n1.5.1<\/h4>\n\n
Added a reference to the agency's site (ONiDEA adv, web agency in Milan) in the plugin header (Plugin URI\/Author URI) and in the readme's Credits section. No functional change for site visitors.<\/p>\n\n
1.5.0<\/h4>\n\n
Removed the Free\/Pro distinction: the Dashboard with consent reporting and trends, previously reserved for the Pro tier, is now included and active for everyone. The wordpress.org directory guidelines (guideline 5, \"trialware\") do not allow functionality that already exists in the code but is disabled behind a license flag \u2014 this removal brings the plugin in line with that requirement ahead of submission. Any future premium extensions will be a separate add-on, never a hidden switch inside this same package.<\/p>\n\n
1.4.1<\/h4>\n\n
Renamed the plugin to \"Consenso Cookie Conforme Italia\" (previously \"Cookie Consent - by ONiDEA\"), ahead of a future submission to the official wordpress.org repository \u2014 the previous name remains as the author\/agency name, no longer as the plugin name. No change to how the plugin behaves for site visitors. Internal cleanup: code brought in line with the WordPress Coding Standards (complete docblocks, style conventions), added an FAQ section (justification for the log endpoint's nonce-free design, confirmation of no calls to external services), a Credits and licenses section for the bundled CookieConsent library, and a Screenshots section.<\/p>\n\n
1.4.0<\/h4>\n\n
The \"Powered by ONiDEA adv\" credit is now disabled by default at every tier (previously always on in Free, only removable in Pro) and is a free-standing Settings option independent of tier. Also fixed the \"|\" divider between the banner footer links, which stayed stuck to the first link when only two remained (e.g. Privacy Policy and Cookie Policy with the credit off): spacing is now symmetric regardless of how many links are present.<\/p>\n\n
1.3.2<\/h4>\n\n
The \"Manage cookie preferences\" button now works even where wp_kses_post()<\/code> strips its inline onclick<\/code> \u2014 i.e. in widgets, filtered content, and many theme templates, where it used to stay visible but inert. The click is now captured via delegation in occ-init.js, so the button no longer depends on an inline attribute (also useful under a Content-Security-Policy).<\/p>\n\n1.3.1<\/h4>\n\n
The banner's two JavaScript files now load with defer<\/code>. Without it, they blocked the parser and the browser fetched them at high priority, taking bandwidth away from the render-blocking CSS: the banner can never appear before the page itself, so that priority bought nothing and cost something.<\/p>\n\n1.3.0<\/h4>\n\n
The preferences-panel stylesheet (roughly 41% of the library's CSS) is no longer loaded with the page: it's only fetched by visitors who actually open the panel. Everyone else never downloads it. The split is regenerated with tools\/split-modal-css.py<\/code> after a library update.<\/p>\n\n1.2.0<\/h4>\n\n
Banner settings now travel in a <script type=\"application\/json\"><\/code> block instead of via wp_localize_script: optimization plugins that combine JavaScript also swallow inline scripts, so excluding the banner script from the bundle (to make it appear earlier) left it without its settings and the banner failed to appear at all.\nThe consent log no longer requires a nonce: it used to get baked into the HTML when the page cache was written and expired before that cache did, silently losing consents on every cached site. In its place: a same-origin check and a per-IP hourly limit.<\/p>\n\n1.1.0<\/h4>\n\n
Added the \"Powered by ONiDEA adv\" credit to the banner (removable in the Pro version) and a Free\/Pro distinction (dashboard reporting reserved for the Pro version).<\/p>\n\n
1.0.0<\/h4>\n\n
First release.<\/p>","raw_excerpt":"Self-hosted GDPR cookie consent banner: category-based blocking, Google Consent Mode v2, and a server-side proof-of-consent log.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/351571","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=351571"}],"author":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/onideaadv"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=351571"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=351571"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=351571"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=351571"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=351571"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=351571"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}