danjed

<p>GDPR cookie consent with real script blocking.</p>
<p>Block Google Analytics, Google Tag Manager, Meta Pixel, Hotjar, YouTube embeds, and other third-party services before they reach the browser.</p>
<p>Unlike JavaScript-based consent tools, blocked scripts never reach the browser at all.</p>
<p>Most cookie consent plugins display a banner and rely on JavaScript to stop tracking scripts. In many cases, those scripts can begin loading before the visitor has made a choice.</p>
<p>COOKR takes a different approach.</p>
<p>Scripts are blocked server-side before page delivery. Third-party services cannot execute until consent is explicitly granted. This helps website owners meet GDPR and TTDSG requirements more reliably.</p>
<p>Avoids the client-side race conditions common to JavaScript-only consent tools. No script guessing. No “hope it loads in time.”</p>
<p>Consent enforcement instead of consent theatre.</p>
<p>✓ Server-side script blocking — blocked before the browser receives them<br />
✓ Google Consent Mode v2 support<br />
✓ No external consent cloud<br />
✓ No proxy infrastructure<br />
✓ No visitor data sent to third parties<br />
✓ Works entirely on your WordPress installation</p>
<p>Built for site owners, agencies, and developers who want real GDPR cookie consent enforcement.</p>
<p>COOKR CORE includes:</p>
<ul>
<li>Consent banner & preferences UI</li>
<li>Server-side script interception via PHP output buffer</li>
<li>Auto-Blocker for third-party scripts and iframes</li>
<li>Runtime Inspector</li>
<li>CSP-aware restoration with nonce propagation</li>
<li>Google Consent Mode v2 support</li>
<li>Full JavaScript API (<code>window.cookrConsent</code>)</li>
<li>Self-hosted operation — no external services required</li>
</ul>
<p>COOKR RADR additionally includes:</p>
<ul>
<li>Privacy Radar — runtime detection and classification of third-party services</li>
<li>Enforcement Verification Framework — structured protocol for proving enforcement claims</li>
<li>Compatibility Matrix — tested stack database with VERIFIED/PARTIAL/UNKNOWN/FAILED states</li>
<li>Automatic optimizer exclusions — LiteSpeed, WP Rocket, Autoptimize, FlyingPress</li>
<li>Curated signature database with automatic weekly updates</li>
</ul>
<h4>How It Works</h4>
<p>COOKR intercepts scripts in the PHP output buffer using <code>WP_HTML_Tag_Processor</code> before delivery to the browser. Matching script and iframe tags are neutralised server-side and restored only after the visitor grants consent.</p>
<p>There is no client-side race condition because blocking happens before the browser receives the page.</p>
<h4>Auto-Blocker</h4>
<p>Enable in Settings. Off by default.</p>
<p>When enabled, COOKR rewrites matching script tags and iframe tags server-side — setting <code>type="text/plain"</code> and preserving original attributes in <code>data-cookr-*</code> attributes for restoration after consent.</p>
<p>Test after enabling when using WP Rocket, LiteSpeed Cache, NitroPack, or Cloudflare Rocket Loader.</p>
<h4>Runtime Inspector</h4>
<p>The Runtime Inspector exposes third-party runtime activity directly in the browser — blocked scripts, restored services, iframe activity, detected domains.</p>
<p>Enable in Settings. Append <code>?cookr_debug=1</code> to any frontend URL while logged in as administrator.</p>
<h4>CSP-aware</h4>
<p>COOKR supports strict Content Security Policies without requiring <code>unsafe-inline</code>.</p>
<p>Restored scripts preserve CSP integrity via automatic nonce propagation. COOKR reads the nonce WordPress assigns to enqueued scripts at request time and passes it to restored scripts — no manual configuration required.</p>
<h4>Developer JS API</h4>
<pre><code>cookrConsent.has('analytics')
cookrConsent.require('marketing', callback)
cookrConsent.whenConsented('analytics').then(fn)
cookrConsent.on('consent' | 'change' | 'decline' | 'reset', handler)
cookrConsent.off(event, handler)
cookrConsent.getConsent()
cookrConsent.getExpiry()
cookrConsent.categories()
cookrConsent.reset()
</code></pre>
<h4>Consent Categories</h4>
<ul>
<li><strong>Necessary</strong> — Always active.</li>
<li><strong>Analytics</strong> — GA, GTM, Matomo, Hotjar, Clarity, etc.</li>
<li><strong>Marketing</strong> — Meta Pixel, Google Ads, TikTok, LinkedIn, etc.</li>
<li><strong>External Media</strong> — YouTube, Vimeo, Google Maps, etc.</li>
</ul>
<h4>Does COOKR require an external cloud service?</h4>
<p>No. COOKR runs entirely on your WordPress installation.</p>
<h4>Does visitor consent data leave the server?</h4>
<p>No. Consent data is stored locally on your site.</p>
<h4>Is the Auto-Blocker enabled by default?</h4>
<p>No. Enable and test it after installation, particularly when using caching or JavaScript optimization plugins.</p>
<h4>Which services can be blocked?</h4>
<p>Any third-party script or iframe matching configured domains. Examples: Google Tag Manager, Meta Pixel, YouTube embeds, TikTok Analytics.</p>
<h4>Does COOKR support Google Consent Mode v2?</h4>
<p>Yes. Enable in settings when using GTM or GA4.</p>
<h4>How do I inspect runtime activity?</h4>
<p>Enable the Runtime Inspector in settings and append <code>?cookr_debug=1</code> to any frontend URL while logged in as administrator.</p>
<h4>Does COOKR store personal data?</h4>
<p>The consent log stores a hashed IP (not the raw IP address), consent choices, and a timestamp. The raw IP address is never stored.</p>
<h4>Is COOKR compatible with strict CSP?</h4>
<p>Yes. COOKR automatically reads the nonce WordPress assigns to enqueued scripts and passes it to restored scripts, preserving compatibility with <code>strict-dynamic</code> CSP policies. No manual configuration is required.</p>
<h4>Will COOKR work with caching plugins such as LiteSpeed Cache, WP Rocket, or Cloudflare?</h4>
<p>Yes, but always test after enabling script optimization features such as JavaScript combine, defer, delay, or Rocket Loader. COOKR performs script blocking server-side, but aggressive optimization plugins may alter script delivery and should be verified on your site.</p>
<p>RADR v1.9.8 adds automatic exclusion filters for LiteSpeed Cache, WP Rocket, Autoptimize, and FlyingPress — COOKR registers itself as excluded from JS combination pipelines automatically.</p>
<h4>Does COOKR require HTTPS?</h4>
<p>Yes. COOKR requires HTTPS for consent state to persist correctly across page loads. Modern browsers restrict cookie behaviour on HTTP origins — on HTTP, the consent cookie may not persist, causing the banner to reappear on every page load. HTTPS is also a legal recommendation under GDPR for any site collecting consent.</p>
<h4>What WordPress version is required?</h4>
<p>WordPress 6.2 or higher. COOKR uses <code>WP_HTML_Tag_Processor</code> for safe, attribute-aware script rewriting, introduced in WP 6.2.</p>
<h3>External Services</h3>
<p>This plugin does not connect to any external service by default.</p>
<p>The auto-blocker contains a built-in list of known third-party domains (such as googletagmanager.com, connect.facebook.net, maps.googleapis.com, etc.) that is used purely as a local reference to identify and block scripts before consent. No data is sent to these domains by this plugin — the list is pattern-matching data stored locally in the plugin code.</p>


COOKR – Cookie Consent & Script Blocking

GDPR cookie consent with server-side script blocking. Prevent Google Analytics, GTM, Meta Pixel and third-party embeds from loading before consent.

wpTruss Plugins

<p>Truss Consent Manager is a full consent management plugin for WordPress and WooCommerce. It goes beyond a simple cookie banner to actively detect, categorise, and block tracking scripts until your visitors give consent.</p>
<p><strong>Core Features</strong></p>
<ul>
<li><strong>Three banner layouts</strong> — Cookie Bar (full-width), Card (corner), Floating Box (centred)</li>
<li><strong>Simple and granular consent modes</strong> — Accept All / Decline, or per-category toggles (Analytics, Marketing, Functional)</li>
<li><strong>Script Scanner</strong> — automatically detects tracking scripts on your site by scanning real frontend output. Identifies 14 known trackers including Google Analytics, Google Tag Manager, Meta Pixel, TikTok Pixel, Microsoft Clarity, Hotjar, Matomo, and more.</li>
<li><strong>Script Blocking Engine</strong> — prevents detected scripts from loading before consent is given. Rewrites script tags to <code>type="text/plain"</code> and re-activates them after consent.</li>
<li><strong>Google Consent Mode v2</strong> — injects the required <code>gtag consent default</code> call before any Google scripts load, then updates consent signals automatically when visitors accept or decline.</li>
<li><strong>Smart toggle visibility</strong> — granular toggles only appear for categories where trackers were actually detected on your site.</li>
<li><strong>Fully customisable</strong> — banner colours, button labels, privacy policy link, cookie expiry, card position.</li>
<li><strong>Developer API</strong> — <code>wpcm_register_script( $handle, $category )</code> for manual script registration.</li>
</ul>
<p><strong>Google Consent Mode v2 — Signal Mapping</strong></p>
<p>When Google Consent Mode is enabled (default), the plugin injects a denied default state before any Google scripts load and updates the following signals based on visitor consent:</p>
<ul>
<li>Analytics consent <span aria-hidden="true" class="wp-exclude-emoji">→</span> <code>analytics_storage</code></li>
<li>Marketing consent <span aria-hidden="true" class="wp-exclude-emoji">→</span> <code>ad_storage</code>, <code>ad_user_data</code>, <code>ad_personalization</code></li>
<li>Functional consent <span aria-hidden="true" class="wp-exclude-emoji">→</span> <code>functionality_storage</code>, <code>personalization_storage</code></li>
</ul>
<p>This works automatically with Google Analytics 4, Google Ads, and Google Tag Manager.</p>
<p><strong>Privacy-first design</strong></p>
<p>Consent is stored in a first-party browser cookie (<code>wpcm_consent</code>). No consent data is sent to any external server by this plugin. The Script Blocking Engine runs entirely server-side and client-side — no cloud dependency.</p>
<h3>External Services</h3>
<p>This plugin integrates with the following external services when Google Consent Mode v2 is enabled:</p>
<p><strong>Google Consent Mode / Google Tag Manager / Google Analytics</strong><br />
When Google Consent Mode is enabled (Settings <span aria-hidden="true" class="wp-exclude-emoji">→</span> Advanced <span aria-hidden="true" class="wp-exclude-emoji">→</span> Google Consent Mode v2), this plugin injects JavaScript that communicates with Google’s <code>dataLayer</code> and <code>gtag()</code> API. This sends consent signals to Google when a visitor interacts with the consent banner.</p>
<ul>
<li>What is sent: consent grant/deny signals (no personal data, no IP address, no identifiers)</li>
<li>When it is sent: when a visitor accepts, declines, or saves preferences; and on every page load for return visitors (to re-apply stored consent)</li>
<li>Google Privacy Policy: https://policies.google.com/privacy</li>
<li>Google Terms of Service: https://policies.google.com/terms</li>
</ul>
<p>If you disable Google Consent Mode in the plugin settings, no data is sent to Google by this plugin (though your own Google Analytics / GTM setup may still send data independently).</p>


Truss Consent Manager

Cookie consent banner with script detection, script blocking, and Google Consent Mode v2 — built for WooCommerce stores.

COOKR – Cookie Consent & Script Blocking vs Truss Consent Manager