v1.25.0 — editable Cookie Policy, guided setup wizard, POPIA
The largest release so far. Highlights:
Editable Cookie Policy text. Rewrite any section of the generated policy from the admin — per jurisdiction and per language. Placeholders like {{COMPANY_NAME}} keep working inside your own wording; an empty box keeps the reviewed shipped text. You can also write the policy in a language the plugin ships no template for, which closes a long-standing gap for users who needed a policy in their own language and had no option but to edit plugin files.
Guided setup wizard. An eight-step first run that detects your environment (multilingual plugin, page cache, WooCommerce, existing consent data) and configures jurisdiction-correct defaults. Upgrading sites are treated as already onboarded and never nagged. The wizard's writes are transactional, so a failure rolls back rather than leaving the banner half-configured.
POPIA (South Africa). A conservative consent-based preset under s.11(1)(a), with Cookie Policy templates in all eight bundled languages. The copy states plainly that POPIA also permits the s.11(1)(b)-(f) justifications, which must be assessed separately.
A/B testing of banner variants. Run two or more of your active banners with a persistent split and read the accept rate per variant on the Dashboard. Only independently compliant banners take part, so optimising wording cannot become a dark pattern.
Schrems II transfer disclosure. Flag, per cookie, that a service sends data to a country without an EU adequacy decision, together with the safeguard you rely on — stated neutrally, never claiming that safeguard is legally sufficient.
Age-appropriate consent (GDPR Art. 8) and ad-blocker resilience for the notice, both optional and off by default.
Notable fixes. Provider scripts whose blocking pattern ended on a separator were never blocked — the HubSpot tracker ran before consent (#196). A banner cached under a previous site address kept requesting assets from the old origin (#195). The Geo-routing screen called its REST routes without the module base and every tab failed (#198). The setup wizard's cookie scan used a server-side crawl that could not see JavaScript-set cookies, and now runs the same browser engine as the Cookies page.
Full details in CHANGELOG.md.
Thanks to @roboes for the Smash Balloon and Elementor Video placeholder blocking, and to @wiredacorn for an exact diagnosis of the Geo-routing routes.
