danjed

<p>GDPR cookie consent with real script blocking.</p>
<p>Block Google Analytics, Google Tag Manager, Meta Pixel, Hotjar, YouTube embeds, and other third-party services before they reach the browser.</p>
<p>Unlike JavaScript-based consent tools, blocked scripts never reach the browser at all.</p>
<p>Most cookie consent plugins display a banner and rely on JavaScript to stop tracking scripts. In many cases, those scripts can begin loading before the visitor has made a choice.</p>
<p>COOKR takes a different approach.</p>
<p>Scripts are blocked server-side before page delivery. Third-party services cannot execute until consent is explicitly granted. This helps website owners meet GDPR and TTDSG requirements more reliably.</p>
<p>Avoids the client-side race conditions common to JavaScript-only consent tools. No script guessing. No “hope it loads in time.”</p>
<p>Consent enforcement instead of consent theatre.</p>
<p>✓ Server-side script blocking — blocked before the browser receives them<br />
✓ Google Consent Mode v2 support<br />
✓ No external consent cloud<br />
✓ No proxy infrastructure<br />
✓ No visitor data sent to third parties<br />
✓ Works entirely on your WordPress installation</p>
<p>Built for site owners, agencies, and developers who want real GDPR cookie consent enforcement.</p>
<p>COOKR CORE includes:</p>
<ul>
<li>Consent banner & preferences UI</li>
<li>Server-side script interception via PHP output buffer</li>
<li>Auto-Blocker for third-party scripts and iframes</li>
<li>Runtime Inspector</li>
<li>CSP-aware restoration with nonce propagation</li>
<li>Google Consent Mode v2 support</li>
<li>Full JavaScript API (<code>window.cookrConsent</code>)</li>
<li>Self-hosted operation — no external services required</li>
</ul>
<p>COOKR RADR additionally includes:</p>
<ul>
<li>Privacy Radar — runtime detection and classification of third-party services</li>
<li>Enforcement Verification Framework — structured protocol for proving enforcement claims</li>
<li>Compatibility Matrix — tested stack database with VERIFIED/PARTIAL/UNKNOWN/FAILED states</li>
<li>Automatic optimizer exclusions — LiteSpeed, WP Rocket, Autoptimize, FlyingPress</li>
<li>Curated signature database with automatic weekly updates</li>
</ul>
<h4>How It Works</h4>
<p>COOKR intercepts scripts in the PHP output buffer using <code>WP_HTML_Tag_Processor</code> before delivery to the browser. Matching script and iframe tags are neutralised server-side and restored only after the visitor grants consent.</p>
<p>There is no client-side race condition because blocking happens before the browser receives the page.</p>
<h4>Auto-Blocker</h4>
<p>Enable in Settings. Off by default.</p>
<p>When enabled, COOKR rewrites matching script tags and iframe tags server-side — setting <code>type="text/plain"</code> and preserving original attributes in <code>data-cookr-*</code> attributes for restoration after consent.</p>
<p>Test after enabling when using WP Rocket, LiteSpeed Cache, NitroPack, or Cloudflare Rocket Loader.</p>
<h4>Runtime Inspector</h4>
<p>The Runtime Inspector exposes third-party runtime activity directly in the browser — blocked scripts, restored services, iframe activity, detected domains.</p>
<p>Enable in Settings. Append <code>?cookr_debug=1</code> to any frontend URL while logged in as administrator.</p>
<h4>CSP-aware</h4>
<p>COOKR supports strict Content Security Policies without requiring <code>unsafe-inline</code>.</p>
<p>Restored scripts preserve CSP integrity via automatic nonce propagation. COOKR reads the nonce WordPress assigns to enqueued scripts at request time and passes it to restored scripts — no manual configuration required.</p>
<h4>Developer JS API</h4>
<pre><code>cookrConsent.has('analytics')
cookrConsent.require('marketing', callback)
cookrConsent.whenConsented('analytics').then(fn)
cookrConsent.on('consent' | 'change' | 'decline' | 'reset', handler)
cookrConsent.off(event, handler)
cookrConsent.getConsent()
cookrConsent.getExpiry()
cookrConsent.categories()
cookrConsent.reset()
</code></pre>
<h4>Consent Categories</h4>
<ul>
<li><strong>Necessary</strong> — Always active.</li>
<li><strong>Analytics</strong> — GA, GTM, Matomo, Hotjar, Clarity, etc.</li>
<li><strong>Marketing</strong> — Meta Pixel, Google Ads, TikTok, LinkedIn, etc.</li>
<li><strong>External Media</strong> — YouTube, Vimeo, Google Maps, etc.</li>
</ul>
<h4>Does COOKR require an external cloud service?</h4>
<p>No. COOKR runs entirely on your WordPress installation.</p>
<h4>Does visitor consent data leave the server?</h4>
<p>No. Consent data is stored locally on your site.</p>
<h4>Is the Auto-Blocker enabled by default?</h4>
<p>No. Enable and test it after installation, particularly when using caching or JavaScript optimization plugins.</p>
<h4>Which services can be blocked?</h4>
<p>Any third-party script or iframe matching configured domains. Examples: Google Tag Manager, Meta Pixel, YouTube embeds, TikTok Analytics.</p>
<h4>Does COOKR support Google Consent Mode v2?</h4>
<p>Yes. Enable in settings when using GTM or GA4.</p>
<h4>How do I inspect runtime activity?</h4>
<p>Enable the Runtime Inspector in settings and append <code>?cookr_debug=1</code> to any frontend URL while logged in as administrator.</p>
<h4>Does COOKR store personal data?</h4>
<p>The consent log stores a hashed IP (not the raw IP address), consent choices, and a timestamp. The raw IP address is never stored.</p>
<h4>Is COOKR compatible with strict CSP?</h4>
<p>Yes. COOKR automatically reads the nonce WordPress assigns to enqueued scripts and passes it to restored scripts, preserving compatibility with <code>strict-dynamic</code> CSP policies. No manual configuration is required.</p>
<h4>Will COOKR work with caching plugins such as LiteSpeed Cache, WP Rocket, or Cloudflare?</h4>
<p>Yes, but always test after enabling script optimization features such as JavaScript combine, defer, delay, or Rocket Loader. COOKR performs script blocking server-side, but aggressive optimization plugins may alter script delivery and should be verified on your site.</p>
<p>RADR v1.9.8 adds automatic exclusion filters for LiteSpeed Cache, WP Rocket, Autoptimize, and FlyingPress — COOKR registers itself as excluded from JS combination pipelines automatically.</p>
<h4>Does COOKR require HTTPS?</h4>
<p>Yes. COOKR requires HTTPS for consent state to persist correctly across page loads. Modern browsers restrict cookie behaviour on HTTP origins — on HTTP, the consent cookie may not persist, causing the banner to reappear on every page load. HTTPS is also a legal recommendation under GDPR for any site collecting consent.</p>
<h4>What WordPress version is required?</h4>
<p>WordPress 6.2 or higher. COOKR uses <code>WP_HTML_Tag_Processor</code> for safe, attribute-aware script rewriting, introduced in WP 6.2.</p>
<h3>External Services</h3>
<p>This plugin does not connect to any external service by default.</p>
<p>The auto-blocker contains a built-in list of known third-party domains (such as googletagmanager.com, connect.facebook.net, maps.googleapis.com, etc.) that is used purely as a local reference to identify and block scripts before consent. No data is sent to these domains by this plugin — the list is pattern-matching data stored locally in the plugin code.</p>


COOKR – Cookie Consent & Script Blocking

GDPR cookie consent with server-side script blocking. Prevent Google Analytics, GTM, Meta Pixel and third-party embeds from loading before consent.

MaxtDesign

<h4>The MaxtDesign Cookie Consent Manager That Actually Works</h4>
<p>Most WordPress consent plugins either don’t actually control tracking (they just show a form) or they’re so bloated they slow down your site significantly. <strong>MaxtDesign Cookie Consent is different</strong>: proper Google Consent Mode v2 implementation in under 10KB.</p>
<h4>Why This Plugin?</h4>
<p><strong>For Site Owners:</strong><br />
You need CCPA/GDPR compliance but don’t want to sacrifice site performance or deal with complex configuration.</p>
<p><strong>For Developers:</strong><br />
You want clean, efficient code that follows WordPress standards and doesn’t conflict with other plugins.</p>
<p><strong>For Agencies:</strong><br />
You manage multiple client sites and need a reliable, lightweight solution that just works.</p>
<h4>Key Features</h4>
<p><strong>✓ Actually Controls Tracking</strong><br />
Unlike “checkbox theater” plugins that only show forms, this plugin properly implements Google Consent Mode v2, ensuring GA4 and Google Ads respect user choices.</p>
<p><strong>✓ Blazing Fast (<10KB)</strong><br />
Zero performance overhead. No database queries during page load. Pure localStorage-based consent management.</p>
<p><strong>✓ Three Style Presets</strong><br />
Choose from Minimal, Modern, or Bold popup styles. Customize colors to match your brand.</p>
<p><strong>✓ Works Everywhere</strong><br />
Compatible with any theme. Works with Elementor (optional). Mobile responsive. Accessibility compliant (WCAG 2.1 AA).</p>
<p><strong>✓ Developer-Friendly</strong><br />
Clean code following WordPress standards. Two shortcodes for easy integration. No jQuery dependency. Vanilla JavaScript.</p>
<p><strong>✓ Privacy-First</strong><br />
No server-side user tracking. No external API calls. User consent stored locally. GDPR/CCPA compliant by design.</p>
<p><h4>What is Google Consent Mode v2?</h4>
</p>
<p>Google Consent Mode v2 (GCM v2) became mandatory in March 2024 for GA4 and Google Ads in the EU. It’s Google’s framework for managing user consent signals across their advertising and analytics products.</p>
<p><strong>This plugin implements all four required consent types:</strong></p>
<ul>
<li><strong>analytics_storage</strong> – Google Analytics cookies</li>
<li><strong>ad_storage</strong> – Advertising cookies  </li>
<li><strong>ad_user_data</strong> – User data for advertising</li>
<li><strong>ad_personalization</strong> – Personalized advertising</li>
</ul>
<p>Without proper GCM v2 implementation, your GA4 and Google Ads tracking may be unreliable or non-compliant.</p>
<h4>How It Works</h4>
<ol>
<li><strong>Visitor arrives</strong> <span aria-hidden="true" class="wp-exclude-emoji">→</span> Consent popup appears (customizable position, style, timing)</li>
<li><strong>User chooses</strong> <span aria-hidden="true" class="wp-exclude-emoji">→</span> Three options: Accept All, Analytics Only, or Decline All</li>
<li><strong>Consent stored</strong> <span aria-hidden="true" class="wp-exclude-emoji">→</span> User choice saved in localStorage (privacy-friendly, no server tracking)</li>
<li><strong>GCM signals updated</strong> <span aria-hidden="true" class="wp-exclude-emoji">→</span> Google Analytics and Ads respect the user’s choice immediately</li>
<li><strong>No repeat popup</strong> <span aria-hidden="true" class="wp-exclude-emoji">→</span> Cookie remembers they’ve seen popup (configurable duration)</li>
</ol>
<h4>Popup Customization</h4>
<p><strong>Style Presets:</strong><br />
* <strong>Minimal</strong> – Clean and subtle<br />
* <strong>Modern</strong> – Rounded and polished<br />
* <strong>Bold</strong> – Strong and prominent</p>
<p><strong>Position Options:</strong><br />
* Top banner<br />
* Bottom banner<br />
* Center modal</p>
<p><strong>Animation Options:</strong><br />
* Slide in<br />
* Fade in<br />
* No animation</p>
<p><strong>Color Customization:</strong><br />
Primary color picker to match your brand</p>
<h4>Shortcodes</h4>
<p><strong>Display Current Status:</strong></p>
<pre><code>[mdcc_consent_status]
</code></pre>
<p>Shows consent chips: “Analytics: On/Off” and “Ads: On/Off”</p>
<p><strong>Manage Consent Interface:</strong></p>
<pre><code>[mdcc_manage_consent title="Your Privacy Choices"]
</code></pre>
<p>Full consent management with Accept/Analytics/Decline buttons and current status display.</p>
<p>Both shortcodes update in real-time when consent changes.</p>
<h4>Optional Elementor Integration</h4>
<p>Prefer to use a custom Elementor popup? Simply enter your Elementor Popup ID in settings, and the plugin will use your custom popup instead while maintaining proper GCM v2 functionality.</p>
<h4>Technical Specifications</h4>
<ul>
<li><strong>Size:</strong> <10KB total (CSS + JS combined, gzipped)</li>
<li><strong>Performance:</strong> Zero database queries during page load</li>
<li><strong>Storage:</strong> localStorage-based (no server-side user tracking)</li>
<li><strong>Dependencies:</strong> None (vanilla JavaScript, no jQuery)</li>
<li><strong>Compatibility:</strong> WordPress 5.8+, PHP 7.4+</li>
<li><strong>Standards:</strong> WCAG 2.1 AA accessible, mobile responsive</li>
</ul>
<p><h4>Perfect For</h4>
</p>
<ul>
<li>WordPress sites using GA4 or Google Ads</li>
<li>CCPA/GDPR compliance requirements</li>
<li>Performance-conscious developers</li>
<li>Agency client sites needing scalable consent management</li>
<li>Anyone tired of bloated consent plugins</li>
</ul>
<h4>What This Plugin Doesn’t Do</h4>
<ul>
<li><strong>Not a cookie scanner</strong> – Doesn’t automatically detect all cookies on your site</li>
<li><strong>Not a full compliance suite</strong> – Focuses on consent management for Google tracking</li>
<li><strong>Not multi-platform tracking</strong> – Free version handles GA4/Ads only (Pro version coming with Facebook, Hotjar, etc.)</li>
</ul>
<p>For comprehensive cookie auditing and multi-platform tracking control, consider our Pro version (launching 2025).</p>
<h4>Coming in Pro Version</h4>
<ul>
<li>Facebook Pixel control</li>
<li>Hotjar tracking control</li>
<li>LinkedIn Insight Tag</li>
<li>TikTok Pixel</li>
<li>Custom script control</li>
<li>Consent analytics dashboard</li>
<li>Geolocation-based prompts</li>
<li>White-label mode for agencies</li>
</ul>
<h3>Privacy Policy</h3>
<p>MaxtDesign Cookie Consent does not collect, store, or transmit any user data. All consent preferences are stored locally in the user’s browser using localStorage. No information is sent to external servers.</p>
<p>However, this plugin manages consent for third-party services (Google Analytics, Google Ads). Those services have their own privacy policies:</p>
<ul>
<li>Google Analytics Privacy Policy: https://policies.google.com/privacy</li>
<li>Google Ads Privacy Policy: https://policies.google.com/technologies/ads</li>
</ul>
<p>It is your responsibility to include appropriate disclosures in your site’s privacy policy about the tracking services you use.</p>
<h3>Support</h3>
<p>For support, please use the <a href="https://wordpress.org/support/plugin/maxtdesign-cookie-consent" rel="ugc">WordPress.org support forum</a>.</p>
<h3>Credits</h3>
<p>Developed by MaxtDesign – <a href="https://maxtdesign.com" rel="nofollow ugc">https://maxtdesign.com</a></p>
<p>Special thanks to the WordPress community for feedback and testing.</p>


MaxtDesign Cookie Consent – Google Consent Mode v2


Installed, tested and validated. Works like a charm. I use it with Google Tag Manager - just pasted in the Google-supported small scripts in the page headers, installed this plugin, and things work.



My first use is with a site built with Bricks Builder. I have put the shortcode 'mdcc_manage_consent' in a Bricks off-canvas which slides in when activating a small trigger icon at the bottom of the page. A trigger icon is not automatically provided by this plugin, but can very easily be fixed this way if you want to allow visitors to revisit their consent settings.



I have had a few support questions, and replies and fixes are immediate and perfect. Bravo!


Excellent plugin with great support

Free cookie consent that actually controls Google Analytics & Ads (not just a banner). 10x lighter than $50/month alternatives. GDPR/CCPA.

COOKR – Cookie Consent & Script Blocking vs MaxtDesign Cookie Consent – Google Consent Mode v2