Docs

Appearance

Changelog ​

All notable changes to NexusConsent will be documented here.

1.3.4 - 2026-08-14 ​

Fixed ​

  • Automatic inline-script heuristics now preserve inert script data, including Joomla's shared application/json script-options block, when it contains provider signatures. Executable JavaScript remains subject to the configured category heuristics

1.3.3 - 2026-07-25 ​

Fixed ​

  • Consent you have already given is no longer held back. Previously, if any category was denied, scripts belonging to categories the visitor had accepted were still delayed until JavaScript restored them.
  • Google Consent Mode signals are now sent before Google tags load, instead of shortly after. This closes a gap where advertising consent could be unset for the very first measurement on a page.
  • Config version now works. Increasing it retires earlier decisions and asks visitors to choose again, as the setting has always described. Previously it had no effect.
  • Page caching could show one visitor's consent state to another. Each consent state is now cached separately, so System – Page Cache can stay enabled.
  • With page caching enabled, consent records could silently fail to save. The consent form now requests a security token that matches the visitor's own session.
  • Behind a reverse proxy or CDN, all visitors were treated as a single address. NexusConsent now follows Joomla's Behind Load Balancer setting, so visitors are counted and logged individually.
  • A failed database write is no longer reported as success, and no longer triggers the developer events.
  • The "Powered by NexusConsent" link no longer appears unless you explicitly enable it.
  • Categories with no patterns configured can no longer block inline scripts.
  • Very large pages now receive the correct Consent Mode defaults.

Added ​

  • Rate limiting for the consent log, protecting the audit table from flooding. Enabled by default, with per-session and per-IP limits and a configurable time window under the Advanced tab. Visitor consent is always stored in the browser first, so limiting never affects what visitors see or choose.
  • Separate Texts and Patterns tabs in the plugin settings. Your existing settings move across untouched.

Improved ​

  • Noticeably lighter download: the installation package is around two-thirds smaller, as documentation images are no longer bundled.
  • Faster page rendering — the plugin's configuration is now built once per request instead of several times.
  • Consent Mode defaults respect Content Security Policy nonces.
  • Licensing information is now consistent across the plugin (GNU GPL version 3 or later).

Using a CDN or reverse proxy?

Joomla's own page cache is handled automatically. External caches are not: configure them to bypass or vary on the consent cookie, so the publicly cached page is always the "no consent yet" version.

1.3.2 - 2026-07-05 ​

Added ​

  • Added iframe blocking for embeds such as videos, maps, and widgets.
  • Site Scanner now detects iframe embeds and shows whether each result is a script, stylesheet, or iframe.
  • Added German, French, and Dutch language files to the installer.

Improved ​

  • Consent banner and modal text is now more translation-friendly.
  • Admin pattern help and product docs now explain iframe blocking.
  • Common map, chat, and widget snippets are handled better by the blocking engine.

Fixed ​

  • Improved consent revoke request hardening.
  • Fixed encoded ampersands in the frontend config URL.

1.3.1 - 2026-03-05 ​

Fixed ​

  • Google Consent Mode v2 revoke path now explicitly denies all required keys (analytics_storage, ad_storage, ad_user_data, ad_personalization) before page reload.

1.3.0 - 2026-02-20 ​

Changed ​

  • Migrated the plugin to Joomla's modern DI/bootstrap architecture and removed the legacy entry file.
  • Modernized inline JavaScript and switched event dispatch to Joomla's current dispatcher API.

Added ​

  • Legal disclaimer text and an index for efficient retention purges.

Fixed ​

  • Protocol-relative URLs now match in both blocking and site scanning.
  • Preset textareas no longer show literal \n sequences.
  • Consent upserts no longer report false negatives when data is unchanged.

Security ​

  • CSV exports now neutralize spreadsheet formulas.
  • Client-side blocking now closes the protocol-bypass gap.
  • Endpoint override validation now rejects same-prefix hostile domains.

1.2.0 - 2026-02-11 ​

Added ​

  • Microsoft Clarity Consent API v2 integration
  • Clarity added to default analytics block patterns
  • Preset Library for quick-add service patterns
  • Site Scanner for server-side detection of external scripts/styles
  • Empty category hiding in consent UI when no patterns exist
  • "Only essential cookies" message when all optional categories are empty
  • Per-category "Reset to defaults" actions for pattern fields

Changed ​

  • Pattern defaults now apply only on first install
  • Saved empty pattern fields remain empty after save
  • Frontend category payload now includes only categories with patterns

1.1.0 - 2026-01-30 ​

Maintenance release. Detailed notes were not recorded for this version.

1.0.2 - 2026-01-08 ​

Fixed ​

  • Minor bug fixes and stability improvements

1.0.1 - 2026-01-06 ​

Fixed ​

  • Compatibility improvements for Joomla 5.2+
  • Cookie path handling edge cases

1.0.0 - 2025-10-12 ​

Initial public release of NexusConsent for Joomla 4.x/5.x.

Added ​

  • Analytics (Google Analytics, Hotjar, Mixpanel, etc.)
  • Marketing (Facebook Pixel, LinkedIn, TikTok, etc.)
  • Functional (Google Fonts, Maps, OpenStreetMap)
  • Preferences (custom patterns)
  • Necessary (always enabled, non-optional)
  • Banner or full-screen modal (require-decision mode)
  • Light/Dark/Auto theme support
  • Custom accent colors
  • Repositionable floating "cookie settings" button
  • ARIA live regions and keyboard navigation
  • Focus trapping in modal mode

Server-Side Blocking ​

  • Blocks scripts, styles, and inline initialisers until consent
  • Pattern-based URL matching for third-party services
  • Preserves CSP nonces and integrity attributes
  • Works with strict Content Security Policy
  • Analytics and ad storage defaults to denied
  • Instant updates when visitors change choices
  • Compatible with Google Tag Manager

Privacy Features ​

  • Consent cookie contains only version, timestamp, UUID, and category map
  • IP addresses masked in audit log (IPv4 /24, IPv6 /64)
  • Configurable cookie name, path, and lifetime
  • Database retention controls with auto-cleanup

Audit Trail ​

  • Optional database logging of consent events
  • CSV export for compliance reporting
  • Configurable retention period

Developer Features ​

  • onNexusConsentGiven event hook
  • onNexusConsentRevoked event hook
  • Manual script guarding via data-consent attribute
  • Optional TCF v2 stub for ad platform compatibility

Security ​

  • First-party cookie only
  • No external dependencies for core functionality
  • CSRF protection on consent save endpoint