ONiDEA Consenso Cookie Conforme Italia

ONiDEA Consenso Cookie Conforme Italia is a free, self-hosted alternative to subscription services like CookieYes or Cookiebot, covering the essential cookie consent features for WordPress sites:

• Consent banner with "Accept all" / "Reject all" buttons of equal visual prominence (as required by the Italian Data Protection Authority's — Garante Privacy — guidelines) plus a "Customize" option.
• Preferences panel with categories: Necessary (always on), Statistics, Marketing, Functional — enabled individually per site.
• Automatic blocking of scripts marked as non-essential until the user gives consent.
• Google Consent Mode v2: sets consent signals for Google Analytics 4 / Google Ads / AdSense before their scripts load, so they automatically honor the user's choice (only needs enabling where relevant).
• Server-side consent log (date, chosen categories, page, hashed IP — never stored in the clear) for the accountability record required by the GDPR, with CSV export.
• Engine built on the open-source "CookieConsent" library by Orest Bida (MIT license), served from your own site: no third-party calls, no subscription fee.

What it does NOT do (unlike paid services)

• No automatic recurring scan of the site's cookies: categories and the scripts to block are configured manually (see GUIDA-RAPIDA.md, in Italian, in the plugin folder).
• Not IAB TCF certified: suited to Google AdSense/Ads/GA4 (via Consent Mode) and to the general run of editorial/business/e-commerce sites, not to publishers selling ad inventory through multiple ad exchanges/SSPs that require IAB certification.
• Does not provide legal privacy/cookie policy text: that remains your responsibility or your legal counsel's.

1.7.0 Fix — the preferences panel flashed and did not open on the first click. The panel's stylesheet is fetched on demand, and two things went wrong before it arrived: the unstyled panel markup could be painted into the page, and the "panel is visible" rule depends on a .cc--anim class the library only adds 100 ms after creating the panel (measured 360-420 ms on a busy page), so the first open was invisible for that whole window. The banner stylesheet now carries a small always-present rule that keeps the panel out of sight until its own stylesheet applies, and the panel no longer waits for that timer on its first open. New — optional styling for the "Reject all" button (off by default). Under Appearance you can now give the reject button its own colours: a filled custom colour, or an outline. Only colours change: size, font weight, padding and position stay identical to "Accept all", so the button can never be shrunk or demoted from these settings. Contrast is measured on save — below 3:1 the style is not applied at all and the button stays identical to "Accept all", between 3:1 and 4.5:1 it is saved with a warning. The default remains two identical buttons, which is what the Italian DPA's 2021 cookie guidelines assume. 1.6.2 Second round of wordpress.org review fixes. The tools/ folder (developer-only scripts, .py/.mjs, not needed at runtime) is no longer included in the distributed package — it stays in the source repository for internal use. Hardened the unauthenticated consent-log REST endpoint: added strict per-argument validation (type, length, a whitelist of the four known category keys) so the log table can only ever receive well-formed rows, and the per-IP rate limit now reads only REMOTE_ADDR by default instead of also trusting the attacker-controllable X-Forwarded-For/CF-Connecting-IP headers (opt-in via the new occit_trust_proxy_ip_headers filter for sites that know they sit behind a trusted proxy/CDN). The endpoint remains intentionally public (no user account exists to authenticate against) — see the FAQ below for the full rationale. No visible change for site visitors. 1.6.1 Updated the "Tested up to" header to 7.1, per wordpress.org's automated submission scan (the previous 7.0 value was flagged as outdated). No functional change. 1.6.0 Renamed the plugin to "ONiDEA Consenso Cookie Conforme Italia" (previously "Consenso Cookie Conforme Italia"), per wordpress.org directory guideline 17 (distinctive naming) — the previous name was too close to the generic pattern used by many other cookie-consent plugins. Internal function/class/option/hook names were also renamed from the "occ_" prefix (3 characters) to "occit_", meeting the directory's minimum prefix length; existing settings and the consent-log table are migrated automatically and transparently on upgrade, no data is lost. The Dashboard page's CSS moved from an inline <style> block to a properly enqueued stylesheet. No visible change for site visitors; wp-admin menu URLs change (occ-dashboard → occit-dashboard, etc.) and any old bookmarks to them will need updating. 1.5.5 Text Domain header updated to match the wordpress.org-assigned slug (consenso-cookie-conforme-italia), fixing a textdomain_mismatch warning raised by the automated submission scan. No functional change. 1.5.4 Removed the Plugin URI header (it was identical to the Author URI, which wordpress.org's submission form does not allow — the two must point to different pages). Kept the Author URI pointing to the agency site, since there is no dedicated page for this specific plugin yet. No functional change. 1.5.3 Translated readme.txt into English, per wordpress.org's directory-listing language policy (July 2025): the readme is now the base language for community translations via translate.wordpress.org. The plugin itself — admin screens, banner text, settings, GUIDA-RAPIDA.md — remains entirely in Italian, as intended for its target audience. No functional change. 1.5.2 Fixed the findings from wordpress.org's official Plugin Check: prepared direct database queries are now documented with the matching phpcs exemption instead of being left unannotated; the CSV export's write to php://output (the HTTP response stream, not a real file — WP_Filesystem doesn't apply here) is documented the same way; removed GUIDA-RAPIDA.md from the distributed package (an internal guide for the agency, not required for the plugin to work — still available in the source repository). No functional change for site visitors. 1.5.1 Added a reference to the agency's site (ONiDEA adv, web agency in Milan) in the plugin header (Plugin URI/Author URI) and in the readme's Credits section. No functional change for site visitors. 1.5.0 Removed the Free/Pro distinction: the Dashboard with consent reporting and trends, previously reserved for the Pro tier, is now included and active for everyone. The wordpress.org directory guidelines (guideline 5, "trialware") do not allow functionality that already exists in the code but is disabled behind a license flag — this removal brings the plugin in line with that requirement ahead of submission. Any future premium extensions will be a separate add-on, never a hidden switch inside this same package. 1.4.1 Renamed the plugin to "Consenso Cookie Conforme Italia" (previously "Cookie Consent - by ONiDEA"), ahead of a future submission to the official wordpress.org repository — the previous name remains as the author/agency name, no longer as the plugin name. No change to how the plugin behaves for site visitors. Internal cleanup: code brought in line with the WordPress Coding Standards (complete docblocks, style conventions), added an FAQ section (justification for the log endpoint's nonce-free design, confirmation of no calls to external services), a Credits and licenses section for the bundled CookieConsent library, and a Screenshots section. 1.4.0 The "Powered by ONiDEA adv" credit is now disabled by default at every tier (previously always on in Free, only removable in Pro) and is a free-standing Settings option independent of tier. Also fixed the "|" divider between the banner footer links, which stayed stuck to the first link when only two remained (e.g. Privacy Policy and Cookie Policy with the credit off): spacing is now symmetric regardless of how many links are present. 1.3.2 The "Manage cookie preferences" button now works even where wp_kses_post() strips its inline onclick — i.e. in widgets, filtered content, and many theme templates, where it used to stay visible but inert. The click is now captured via delegation in occ-init.js, so the button no longer depends on an inline attribute (also useful under a Content-Security-Policy). 1.3.1 The banner's two JavaScript files now load with defer. Without it, they blocked the parser and the browser fetched them at high priority, taking bandwidth away from the render-blocking CSS: the banner can never appear before the page itself, so that priority bought nothing and cost something. 1.3.0 The preferences-panel stylesheet (roughly 41% of the library's CSS) is no longer loaded with the page: it's only fetched by visitors who actually open the panel. Everyone else never downloads it. The split is regenerated with tools/split-modal-css.py after a library update. 1.2.0 Banner settings now travel in a <script type="application/json"> block instead of via wp_localize_script: optimization plugins that combine JavaScript also swallow inline scripts, so excluding the banner script from the bundle (to make it appear earlier) left it without its settings and the banner failed to appear at all. The consent log no longer requires a nonce: it used to get baked into the HTML when the page cache was written and expired before that cache did, silently losing consents on every cached site. In its place: a same-origin check and a per-IP hourly limit. 1.1.0 Added the "Powered by ONiDEA adv" credit to the banner (removable in the Pro version) and a Free/Pro distinction (dashboard reporting reserved for the Pro version). 1.0.0 First release.