Terms & Conditions Consent Log — Full changelog

For each release, see the entries below. The latest version is always at the top.
The current release notes also live in readme.txt under "== Changelog ==".

= 1.4.1 =
* Improved: the public consent REST endpoint (`POST /tccl/v1/consent`) is now rate-limited per IP, so a logged-out visitor can no longer script it to flood the consent log with bogus records. It returns HTTP 429 once the limit is reached; tunable with the new `tccl_consent_rate_max` and `tccl_consent_rate_window` filters.
* Fix: the CSV export now neutralises spreadsheet formula/CSV injection. Any cell whose value begins with `=`, `+`, `-`, `@`, a tab or a carriage return is prefixed with a single quote, so Excel, LibreOffice and Google Sheets render it as literal text instead of executing it. This matters because the accepted text and the user agent can be supplied by anonymous visitors through the public consent endpoint, and the export is the GDPR evidence an admin is expected to open.

= 1.4.0 =
* New: native WordPress login integration. Captures successful logins through wp-login.php as `consent_type = wp_login` whenever the submission carries a ticked consent checkbox. The "Remember me" checkbox is excluded by design — it is an ePrivacy / persistent-cookie preference, not a GDPR Article 7.1 consent. Opt-in toggle in Settings → Integrations, off by default in fresh installs (a normal login form has no consent checkbox, so logging every login would only add noise).
* New: native WordPress registration integration. Captures registrations through wp-login.php?action=register as `consent_type = wp_register` whenever the registration form carries a ticked consent checkbox. Opt-in toggle, on by default in fresh installs.
* New: native WooCommerce login integration. Captures the My Account login as `consent_type = wc_login`. Routed by inspecting the submission for WC-specific markers and the HTTP referer, so it is reliably distinguished from the WP-admin login that shares the same underlying hook.
* New: native WooCommerce registration integration. Captures customer creations through the My Account register form as `consent_type = wc_register`, with email + source URL.
* New: optional "Inject a required consent checkbox" toggle for both the WP and the WC registration forms. WooCommerce does not ship a consent checkbox out of the box (only a privacy-policy paragraph), so this option fills that gap for sites without a separate GDPR plugin. The injected checkbox blocks the registration on the server side if it is left unticked.
* New: configurable "Consent text for login / registration" (used as the stored `consent_text` on every login/registration record, and also as the label of the injected checkbox).
* New: configurable "Custom consent field names" — a comma-separated list that overrides the built-in name heuristic for sites whose GDPR plugin uses unusual field names.
* New: heuristic detector for consent checkboxes. Names containing `consent`, `gdpr`, `privacy`, `terms`, `acceptance`, `agreement`, `accept`, `rgpd`, `politica`, `privacidad` or `terminos` are treated as the consent checkbox (case-insensitive). `rememberme` and standard nonce / referer keys are always excluded.

= 1.3.0 =
* Improved: the three Integrations toggles (WordPress comments, Contact Form 7, WPForms) are now on by default on new installs, aligned with GDPR Article 7.1 (the data controller must be able to demonstrate that consent was given). Existing installs keep whatever value the admin already had — the new default only applies to fresh installations. Each toggle remains independently disengageable from Settings → Integrations (e.g. for sites using Disqus or Jetpack Comments, or with no [acceptance]/GDPR Agreement fields in their forms). The Integrations section intro now spells out the GDPR Article 7.1 rationale so the admin understands the change.
* Improved: section intros on the Settings tab no longer cap at 640 px — they now extend to match the width of the field descriptions, removing a visual inconsistency that forced unnecessary scrolling on wide screens.

= 1.2.0 =
* New: native WPForms integration. Opt-in toggle in Settings → Integrations; once enabled, every submission of a form that contains a ticked GDPR Agreement field is logged automatically, with the first email field of the form as subject. Stored as consent_type `wpforms_form_{ID}`, one type per form, same pattern as the existing Contact Form 7 integration. Works with WPForms Lite and Pro; no snippets or `accepted_args=4` boilerplate to maintain.
* New: the records filter now also searches inside `consent_text`. A new "Text contains" field on the filters bar runs a LIKE on the accepted text; the live filter, the AJAX pagination and the filtered CSV export all honour it. Useful to find records by a phrase that appeared in a previous version of your terms.
* New: hover tooltip on the "Outdated" badge in the records list — shows the document version stored in the record and the current version side by side, so you can tell at a glance how far back that consent was signed.
* Improved: the admin menu now always lives under Users → Consent log, with or without WooCommerce (previously it lived under the WooCommerce parent when WC was active). One single location, less clutter inside the WooCommerce submenu and one fewer condition to remember.
* Improved: the capability required to manage the plugin defaults to `manage_options` on every install (previously `manage_woocommerce` when WC was active). If you grant access to Shop Managers, add a one-line filter: `add_filter( 'tccl_admin_capability', fn() => 'manage_woocommerce' );`. Both `tccl_admin_menu_parent` and `tccl_admin_capability` filters keep working as before for any other customisation.

= 1.1.0 =
* New: the site icon (Settings > General > Site Icon, available in both classic and block/FSE themes since WordPress 6.5) is now shown on the printable consent certificate, next to the site name. Works for both new and previously stored records — the icon is rendered on demand each time the certificate is opened. Falls back gracefully when no site icon is set.
* Docs: clarified that [tccl_consent_box] is a self-contained form — not meant to be nested inside another form builder's form. Updated the FAQ and the source-file docblock.
* Docs: expanded the WPForms snippet in the FAQ — full example with the mandatory `accepted_args=4`, reading `consent_version` from the global setting, and the multi-form `id_form => [email, checkbox]` pattern. Same fix applied to the Gravity Forms snippet (now reads the version from the setting instead of hardcoding a date).
* Docs: clarified the version bump FAQ — the Settings string must match the document text character by character; pre-bump records are deliberately marked Outdated as the GDPR audit trail demands; do NOT delete Outdated rows.
* Docs: clarified that the certificate is rendered as a print-optimised A4 view — no PDFs are stored on disk and the plugin owns no uploads folder.
* Docs: clarified anonymisation vs deletion in the FAQ; documented the SQL escape hatch for cleaning up test rows without promoting it as a regular flow.

= 1.0.0 =
* Initial release.
* Works with or without WooCommerce. Menu under WooCommerce > Consent log when WC is active, otherwise under Users > Consent log. Capability defaults to manage_woocommerce or manage_options accordingly. Filterable via tccl_admin_menu_parent and tccl_admin_capability.
* Activation notice on the plugins screen with quick links to the Records and the Settings tabs.
* WooCommerce checkout capture (timestamp UTC, IP, user agent, version, source URL, exact text). Order metabox, "Consent" column on the orders list, optional consent lines in the New order admin email and the customer order email. HPOS compatible.
* Contact Form 7 integration (opt-in): captures every form submission that ticks an [acceptance] field, including the source URL of the page that hosted the form. Stored as cf7_form_{ID}, one type per form.
* WordPress comments integration (opt-in): captures the native wp-comment-cookies-consent checkbox (WP 4.9.6+) along with the post permalink. Stored as comment_consent.
* [tccl_consent_box] shortcode and Gutenberg block: stand-alone consent checkbox with REST endpoint, drop-in anywhere. The default text falls back to a configurable site-wide value in Settings > Integrations.
* Public tccl_save_consent() function (now accepting an optional source_url) for any other source (Gravity Forms, WPForms, custom flows…).
* Source URL recorded with every acceptance and shown on the records list, the PDF certificate, the CSV export and the Privacy Tools export.
* SHA-256 integrity sealing per record.
* Printable A4 certificate per record (browser saves it as PDF).
* Native WordPress Privacy Tools integration (export and erase).
* Live partial-match filters (email, order, date range, type) with filtered CSV export.
* Optional opt-in deletion of plugin data on uninstall (off by default).
