Beschreibung

Contentpass is a privacy-focused monthly subscription for readers. With one registration, Contentpass users visit participating websites ad-free and without being tracked, while publishers receive subscription revenue that matches lost ad revenue at ad market rates.

The Contentpass Integration plugin integrates Contentpass with your site so you can combine consent management, script control, and Contentpass configuration from the WordPress admin.

Features

Integration – Configure your Contentpass property by Property ID (the Contentpass host is loaded from the property configuration), set up Consentmanager (CMP), and manage staging vs production behaviour.
CMP support – Consentmanager only in the current admin UI (dropdown temporarily hidden). Existing installs keep their previously saved CMP. Choose whether Consentmanager is already on your site or should be loaded by the plugin (validated snippet paste).
Blocking Rules – Define patterns to scan for or exclude, with admin UI for script blocking aligned with your consent setup.
Request Contract – Quick link to the Contentpass publisher contact flow with tracking parameters for support context.
Staging mode – During onboarding, Contentpass is limited to logged-in editors and administrators (or an authorized URL debug flag). Production for all visitors begins automatically once your property is approved and live in the Contentpass publisher dashboard.

Admin screens require the manage_options capability by default (filterable via cp4wp_required_capability).

External services

This plugin connects to third-party services so you can integrate Contentpass and Consentmanager (CMP) with WordPress. Only the services that match your plugin settings are used (Consentmanager when configured for new setups; existing installs may still use a previously saved CMP, plus Contentpass when configured and not in a disabled/staging-only state). No data is sent to CMP vendors you have not selected.

Contentpass (API and CDN)

Used to load the Contentpass integration (now.js), CMP-specific JavaScript stubs, and property configuration.

What it is used for: Subscription and consent integration on the front end; loading your property config.json and verifying that now.js is reachable during setup and admin saves.
now.js (mandatory): The plugin always loads now.js from the publisher’s Contentpass host when Contentpass is active. This is part of the official Contentpass integration contract, not user-supplied executable code. The host is taken from the hostname field of your property config.json (not a free-text script field).
What data is sent and when:
- From the WordPress server (admin/setup): HTTP GET requests to https://static.contentpass.net/properties/{property-id}/config.json when you save settings, enter a Property ID, or when the plugin refreshes cached configuration. These requests include the plugin User-Agent (Contentpass-WP/{version}) and your configured property ID. They do not include front-end visitor form input.
- From the visitor browser (front end, when Contentpass loading is active): Scripts from your Contentpass base URL (for example {base-url}/now.js) and from https://static.contentpass.net/stubs/… to connect Contentpass with the selected CMP. The browser may send standard web request metadata (IP address, User-Agent, cookies, consent/subscription signals) to Contentpass as described in their documentation.
Service provider: Content Pass GmbH (Contentpass)
Terms of service: https://www.contentpass.net/en/terms
Privacy policy: https://www.contentpass.net/en/privacy

Consentmanager

Loaded when Consentmanager is selected as the CMP in plugin settings (current releases default the admin UI to Consentmanager; existing non-CM installs keep their saved CMP).

What it is used for: Displaying the Consentmanager cookie/consent banner and passing consent signals to ads and tags.
Third-party script: The plugin loads Consentmanager’s semi-automatic CMP loader from the validated src URL in your pasted snippet (typically https://cdn.consentmanager.net/delivery/js/semiautomatic.min.js). Only allowlisted data-cmp-* attributes are used; pasted markup is parsed and not echoed raw. Paste the external semi-automatic script from Consentmanager Get Code in the plugin settings when Plugin should also load the CMP is selected.
What data is sent and when: From the visitor browser to Consentmanager hosts (cdn.consentmanager.net, delivery.consentmanager.net, and related endpoints) when the CMP script loads and when visitors interact with the banner. Data typically includes the configured Code-ID, page URL, consent choices, and standard request metadata (IP address, User-Agent, cookies). The WordPress server does not proxy visitor consent to Consentmanager.
Service provider: consentmanager AB (consentmanager.net)
Terms of service: https://www.consentmanager.net/en/general-terms-and-conditions/
Privacy policy: https://www.consentmanager.net/en/privacy/

<!– Temporarily hidden from WordPress.org listing while admin UI is Consentmanager-only.
Code paths remain for existing installs that already selected another CMP.

Didomi

Loaded when **Didomi** is selected as the CMP.

* **What it is used for:** Didomi consent banner and preference management via the Didomi SDK.
* **What data is sent and when:** From the visitor browser to `https://sdk.privacy-center.org/` (loader and related Didomi endpoints) when the CMP is enqueued. Requests include your Didomi API key, the site hostname (`target` parameter), and—depending on configuration—geo hints, consent state, and standard request metadata. Contentpass stub scripts may also load from `https://static.contentpass.net/stubs/didomi/latest.js` when Contentpass integration is active.
* **Service provider:** Didomi SAS
* **Terms of service:** https://tos.console.didomi.io/
* **Privacy policy:** https://www.didomi.io/privacy-policy

CCM19

Loaded when **CCM19** is selected as the CMP.

* **What it is used for:** CCM19 cookie consent banner and consent storage.
* **What data is sent and when:** From the visitor browser to `https://cloud.ccm19.de/app.js` (with your configured API key and domain ID as query parameters) when the CMP loads and when visitors give or change consent. Standard request metadata (IP address, User-Agent, cookies, consent records) may be processed by CCM19. Contentpass stub scripts may load from `https://static.contentpass.net/stubs/ccm19/latest.js` when Contentpass integration is active.
* **Service provider:** Papoo Software & Media GmbH (CCM19)
* **Terms of service:** https://www.ccm19.de/agb.html
* **Privacy policy:** https://www.ccm19.de/en/wissen/datenschutzerklaerung.html

OneTrust

Loaded when **OneTrust** is selected as the CMP.

* **What it is used for:** OneTrust cookie consent banner and category/vendor consent via `otSDKStub.js`.
* **What data is sent and when:** From the visitor browser to `https://cdn.cookielaw.org/` (OneTrust Cookie Consent CDN) using your configured domain script ID when the CMP loads and when visitors interact with the banner. Standard request metadata and consent choices may be sent to OneTrust. Contentpass stub scripts may load from `https://static.contentpass.net/stubs/onetrust/latest.js` when Contentpass integration is active.
* **Service provider:** OneTrust (Cookie Consent / Cookie Law)
* **Terms of service:** https://legal.onetrust.com/#masterterms
* **Privacy policy:** https://www.onetrust.com/privacy-notice/

Usercentrics

Loaded when **Usercentrics V2 or V3** is selected as the CMP.

* **What it is used for:** Usercentrics consent banner and TCF/consent management.
* **What data is sent and when:** From the visitor browser to Usercentrics endpoints (for example `https://web.cmp.usercentrics.eu/` or `https://app.usercentrics.eu/`, depending on version) with your settings ID when the CMP loads and when visitors interact with it. Consent records, page context, and standard request metadata may be processed by Usercentrics. Contentpass stub scripts may load from `https://static.contentpass.net/stubs/usercentrics/latest.js` when Contentpass integration is active.
* **Service provider:** Usercentrics GmbH
* **Terms of service:** https://usercentrics.com/terms-and-conditions/
* **Privacy policy:** https://usercentrics.com/privacy-policy-cmp/

Sourcepoint

Loaded when **Sourcepoint** is selected as the CMP (or when Sourcepoint helper scripts are used in Manual mode).

* **What it is used for:** Sourcepoint consent messaging and privacy manager (`wrapperMessagingWithoutDetection.js`).
* **What data is sent and when:** From the visitor browser to `https://cdn.privacy-mgmt.com/` (and related Sourcepoint endpoints configured in your account) when messaging scripts load and when visitors give or update consent. Account/property identifiers, consent strings, page URL, and standard request metadata may be sent. Contentpass stub scripts may load from `https://static.contentpass.net/stubs/sourcepoint/latest.js` when Contentpass integration is active.
* **Service provider:** Sourcepoint Technologies, Inc.
* **Terms of service:** https://sourcepoint.com/terms-of-use/
* **Privacy policy:** https://sourcepoint.com/privacy-notice/

–>

Post-consent ad / tag URLs (optional publisher setting)

Some publishers need specific third-party ad or analytics scripts to load only after consent (for example GPT, Prebid, or network tags). The plugin provides optional URL fields for this purpose.

What it is used for: Loading external JavaScript files by URL after the CMP reports full consent, alongside the plugin’s script-blocking unblock flow.
What publishers can enter: Only http:// or https:// script source URLs in structured admin fields (max 20). No inline JavaScript, HTML, PHP, or CSS can be saved.
How the plugin outputs scripts: It builds <script src="…" async defer class="cpnotblocked"> tags programmatically from validated URLs. javascript:, data:, and other non-URL schemes are rejected at save time.
What data is sent and when: From the visitor browser to the hosts in the configured URLs, only after consent, when those tags are injected.

Optional admin links

The plugin admin may link to Contentpass documentation and the publisher dashboard (for example https://docs.contentpass.net/ and https://publisher.contentpass.net/). These open in the browser when an administrator clicks them; they are not automatic background requests to third parties.

Screenshots

Contentpass admin – Integration settings (Consentmanager, URLs, staging).

Blocking Rules – script scan and exclude configuration. — Contentpass admin – Integration settings (Consentmanager, URLs, staging).

Installation

Upload the contentpass-integration folder to the /wp-content/plugins/ directory, or install the ZIP from your distribution package.
Activate Contentpass Integration through the Plugins screen in WordPress.
Open Contentpass in the admin menu and complete Integration: enter your Property ID first, then configure Consentmanager.
If you use script blocking, review Blocking Rules and save your patterns.
Once your property is approved and live in the Contentpass publisher dashboard, verify consent and Contentpass behaviour on the front end. Staging mode ends automatically when both statuses are active (config refresh may take up to 10 minutes).

FAQ

Do I need a Contentpass publisher account?: Yes. You need a Contentpass property and its Property ID and the domain setup completed in the publisher dashboard. Use Request Contract in the admin menu if you need to contact Contentpass.
Why does the plugin load now.js from my Contentpass base URL?: now.js is required by the Contentpass platform. It is not optional custom code and not pasted by the publisher. The plugin loads it only from the Contentpass host listed as hostname in your property config.json (for example https://cp.example.com/now.js). This script powers subscription and consent integration together with the official Contentpass stubs from static.contentpass.net. Without now.js, Contentpass cannot function on the site.
What are “Scripts to load after consent”?: This is an optional list of external script URLs only (for example your ad network’s https://…/ads.js). Publishers enter URLs in dedicated fields; the plugin does not accept arbitrary HTML, inline JavaScript, PHP, or CSS. Each value is sanitized (esc_url_raw), must use http:// or https://, and is output only as a programmatic <script src="…" async defer> tag after consent. Legacy free-form “custom code” markup was removed in favour of this structured URL list. This matches the consent workflow: third-party tags blocked before consent may be loaded again after the visitor accepts.
What is staging mode?: While your Contentpass property is not yet approved or not yet live, staging mode is active automatically: Contentpass is shown only to logged-in users with Editor or Administrator roles, or to visitors using an authorized ?cpdebug=staging URL. You cannot turn staging off manually during onboarding. Once Contentpass has approved your property and you have set it to live in the publisher dashboard, staging ends automatically and Contentpass is served to all visitors. Changes from the dashboard may take up to 10 minutes to apply.
Which WordPress and PHP versions are supported?: The plugin header declares WordPress 6.3+ and PHP 7.4+. Newer releases may raise these; check the plugin main file after updates.
Can I change who may access the plugin settings?: Yes. Developers can use the cp4wp_required_capability filter to require a different capability than manage_options.
Does this plugin send data to external services?: Yes, when configured. See the External services section above for each provider, what is transmitted, and links to terms and privacy policies. Only your selected CMP and Contentpass endpoints are used.

Rezensionen

Zu diesem Plugin liegen noch keine Rezensionen vor.

Mitwirkende und Entwickler

„Contentpass Integration“ ist Open-Source-Software. Folgende Menschen haben an diesem Plugin mitgewirkt:

Contentpass

Übersetze „Contentpass Integration“ in deine Sprache.

Interessiert an der Entwicklung?

Durchstöbere den Code, sieh dir das SVN-Repository an oder abonniere das Entwicklungsprotokoll per RSS.

Änderungsprotokoll

1.3

Load property config.json from the Contentpass static CDN (https://static.contentpass.net/properties/{id}/config.json).
Replace the CNAME/DNS onboarding step with a Property ID field; Base URL is taken from config hostname.
Property ID on Integration is prefilled from step 1 and remains editable.
Property ID autosave now loads config.json and continues to the Integration form automatically once the property is found; step 1 shows a Continue button instead of Check again / CNAME skip.
Show Integration status notices from config.json (isDomainReady, isVerified) with a link to the publisher dashboard.
config.json verification cache is keyed by Property ID only; no fallback Base URL derived from the site domain.
Hide the Save Changes button while step 1 is shown; remove CMP integration mode hint texts.
Update admin wording (onboarding checklist, site-host error, config debug messages) for the Property ID flow.
Tested up to WordPress 7.1.2.

1.2.17

Contentpass gate: CM preview Accept no longer opens UnlockAll / MarkConsentGranted (placeholders stay behind the wall until onFullConsent).
onFullConsent always unlocks CP placeholders even if Dynamic Blocking scripts already finished loading.
Watchdog prepares late-injected Dynamic Blocking scripts instead of letting executable src tags run before consent.

1.2.16

Activate Dynamic Blocking scripts on CM vendorconsent (official event when a content preview is accepted) — click-class matching was missing Accepts.
Fallback: trusted clicks on controls inside CM wraps; clearer one-line Dynamic Blocking diagnostics.

1.2.15

After CM content Accept: clear data-cmp-preview-mode / set data-cmp-haspreview=0 and strip overlays (mode=1 was keeping Accept visible forever).
Broader Accept-button detection + treat post-boot cmplazyloaded as Accept if the click handler missed CM’s control.

1.2.14

Dynamic Blocking wraps use data-cmp-preview-mode=“1″ so CM always shows the content Accept UI (even if the vendor cookie already exists). Without this, prior vendor consent hid the preview while dependency scripts stayed inert empty box.
Add Dynamic Blocking state diagnostics in the console (wraps / preview buttons / pending scripts).

1.2.13

Stop hiding CM Dynamic Blocking wraps during Contentpass auth (CSS hide prevented CM content previews empty box after login).
Do not treat placeholder unlock / watchdog-off as full consent (removes spurious UnlockAll ignored logs).

1.2.12

Keep Dynamic Blocking generic: remove MapPress/Leaflet-specific waits, remounts, and text matching.
Subscription/login no longer auto-activates CM Dynamic Blocking — only onFullConsent or explicit CM preview Accept does.

1.2.11

Do not unlock Dynamic Blocking on CM/TCF consent while the Contentpass wall is open (cmp_noscreen was loading MapPress behind the wall).
Unlock only after Contentpass onFullConsent, valid subscription, or an explicit CM content-preview Accept.

1.2.10

Stop self-unblocking: no auto-click on CM Accept; only activate after real user Accept, Accept All, or valid Contentpass subscription.
Hide CM content previews briefly while Contentpass authenticate runs (avoids flash then auto-unlock for subscribers).

1.2.9

Fix fatal parse error on activation (unescaped quote in watchdog JS string).

1.2.8

Remove leftover Consentmanager content-preview cards after subscription/full unlock (auto-Accept + DOM cleanup) so MapPress is not shown under a second CM banner.
Stop repeated UnlockAll spam once Dynamic Blocking scripts are active.

1.2.7

Unlock Dynamic Blocking when Contentpass reports a valid subscription (subscribers often never fire onFullConsent).
Add [CP4WP] debug logs for UnlockAll / script activation / reveal / remount; avoid revealing wrappers before dependency scripts load.

1.2.6

Fix content/preview accept: observe CM wrapper accept state, remount MapPress embeds after script load, and tighten preview-button detection.

1.2.5

Harden CM content/preview accept (inline): activate dependency scripts immediately on preview button click, mark wrappers cmplazyloaded, and trigger resize after load.

1.2.4

Load Dynamic Blocking dependency scripts in strict order without CM cmplazyload (prevents Leaflet/MapPress race: L is not defined).
Wait for Leaflet before loading MapPress bridge/main scripts after consent.

1.2.3

Activate Consentmanager Dynamic Blocking scripts on Accept All / full consent (not only CP placeholders).
On preview accept, load remaining vendor scripts in order and reveal CM-wrapped content.

1.2.2

Fix CM Dynamic Blocking accept: do not let the watchdog re-block scripts CM just activated after preview click.
Avoid nesting cmplazyload wrappers inside an existing CM wrapper; activate remaining vendor scripts in order if CM leaves them inert.

1.2.1

Dynamic Blocking: wrap custom elements whose tag name matches the rule (e.g. mappress mappress-map) so Consentmanager can show a content preview.
Do not auto-add data-cmp-preview on scripts; preview is only set when configured (or for iframes/wrapped content as needed).

1.2

Add Consentmanager Dynamic Content Blocking per block rule (checkbox + CMP vendor ID + optional preview size).
When Dynamic Blocking is enabled, matched scripts/iframes are prepared for Consentmanager (cmplazyload, data-cmp-src, data-cmp-vendor) instead of Contentpass placeholders.
Watchdog prepares dynamically inserted matching tags the same way; Contentpass unlock skips CM-managed elements.

1.1

Temporarily hide the CMP dropdown in the admin UI; existing CMP selections (e.g. Sourcepoint) are preserved.
Unconfigured sites default to Consentmanager in the UI only.
Docs/readme list Consentmanager as the offered CMP; other CMP external-service sections are commented out for now.

1.0.9

Sanitize Base URL and Property ID more strictly; clarify Base URL must match the dashboard CNAME.
Remove debug password; open ?cpdebug=staging and ?cpdebug=settings without a key.
Make CNAME skip permanent; speed up Property ID autosave debounce.
Add Doc/Dashboard buttons on Blocking Rules; remove the top Save button.

1.0.8

Show the Integration debug password in plain text so it can be shared without resetting.
Default new installs to “CMP already integrated”; existing sites keep their current mode.
Auto-save when the CMP dropdown or integration mode radios change.
Rename post-consent field to “Script” and allow a single URL only.
On the CNAME setup screen, auto-save the Property ID after typing stops (1s) or on Enter, with a toast confirmation.

1.0.6

Fix frontend verification cache: saving Integration settings now verifies config.json and now.js so Contentpass scripts can load.

1.0.5

Fix staging detection: read isApproved and isLive from funnelConfig in config.json (fixes live properties stuck in staging mode).

1.0.4

Fix CNAME onboarding detection: gate on config.json only; now.js remains required for front-end script loading.
Add editable Base URL field on the CNAME setup screen for custom CNAME hosts.
Improve Integration debug output (config vs frontend readiness).

1.0.3

Fix config availability check on the Integration page (force_fresh cache logic).
Remove unreachable now.js script tag filter; load now.js async via the safe inline loader.

1.0.2

Prevent front-end crashes when Base URL is misconfigured (e.g. WordPress site URL instead of Contentpass CNAME).
Load Contentpass scripts only after config.json and now.js are verified for the configured property.
Reject saving a Base URL that matches the WordPress site host; add admin tooltip and error notice.
Load now.js via a safe dynamic loader with console errors on failure instead of blocking the page.

1.0.1

Add CMP integration mode (already on site vs plugin loads CMP) and Consentmanager semi-automatic snippet paste with validation.
Load Consentmanager semi-automatic CMP script from Consentmanager CDN instead of a bundled minified loader; clarify Code-ID (data-cmp-cdid) in admin settings.
Fix post-consent script unlock and watchdog race conditions with OneTrust and dynamic ad scripts.
Asset cache busting via updated plugin version query string.
Document third-party/external services in readme (WordPress.org compliance).
Scope elevated PCRE backtrack limit to script-scan replacements only; restore previous value after use.
Replace global output-buffer callback with WordPress 6.9 template enhancement filter; legacy buffers are explicitly closed on shutdown.
Add legacy output-buffer fallback on WP 6.9+ when the core template enhancement buffer is skipped or cancelled.
Limit DONOTCACHEPAGE to staging/debug requests that actually load Contentpass, not all front-end pages.
Sanitize Accept-Language header and placeholder language cookie input before validation.
Escape SVG branding, custom ad code, and placeholder CSS on output (late escaping).
Harden admin output escaping in script scan and settings screens (esc_attr, wp_kses, sanitized query args).
Protect ?cpdebug=staging and ?cpdebug=settings with an Integration debug password (?cpdebug_key); limit anonymous cache bypass to staging sites only; sanitize admin preview HTML in JS.

1.0

Current stable release (see plugin header and repository for detailed changes).