okitoapp

<p>Okito Cookie Consent is a lightweight WordPress plugin that connects your website to the <strong>Okito</strong> cookie consent platform. A single CDN script handles banner display, consent management, Google Consent Mode v2, IAB TCF v2.3, and automatic language detection.</p>
<h4>How it works</h4>
<ol>
<li>Install the plugin</li>
<li>Get your <strong>Website Key</strong> from <a href="https://app.okito.com" rel="nofollow ugc">app.okito.com</a></li>
<li>Paste the key into Settings and save</li>
</ol>
<p>The plugin injects a single <code>script</code> tag into your site’s <code>head</code>. Banner rendering is handled by Okito’s script, not by PHP on your server.</p>
<h4>Key features</h4>
<ul>
<li>Full compliance — GDPR, CCPA, LGPD, IAB TCF v2.3</li>
<li>Single async CDN script in the document head</li>
<li>Visual banner builder in the Okito dashboard</li>
<li>Automatic language detection (many languages)</li>
<li>Google Consent Mode v2 integration</li>
<li>Analytics and consent metrics in the Okito dashboard</li>
<li>Cookie scanning and categorization via Okito</li>
<li>Responsive banner layout</li>
<li>Optional script blocking until consent (configured in Okito)</li>
</ul>
<h4>Pricing</h4>
<p>Okito offers several plans including a free tier. See <a href="https://app.okito.com/pricing" rel="nofollow ugc">pricing on app.okito.com</a> for current options.</p>
<h3>External services</h3>
<p>This plugin relies on Okito, a third-party cookie consent and compliance platform operated by Okito (https://okito.com). It is required for the plugin to function: the banner, consent storage, IAB TCF v2.3 signals, Google Consent Mode v2 and the cookie scanner are all delivered by Okito’s service. A free plan is available.</p>
<p>The plugin contacts the Okito service in two ways:</p>
<ol>
<li><strong>CDN script load (visitor’s browser, public pages only when the banner is enabled)</strong></li>
</ol>
<ul>
<li><strong>Endpoint:</strong> <code>https://cdn.okito.com/js/{WEBSITE_KEY}</code></li>
<li><strong>When:</strong> On every public page view in the visitor’s browser, after the plugin is enabled and a Website Key is configured.</li>
<li><strong>What is sent:</strong> The visitor’s browser performs a standard HTTPS request for the script file. This means Okito receives the Website Key (as part of the URL), the visitor’s IP address, User-Agent and the standard <code>Referer</code> header sent by the browser. While the banner is displayed, it stores the visitor’s consent choices in the browser (cookies / local storage) and reports anonymized consent metrics to Okito so they can be shown in your Okito dashboard.</li>
<li><strong>Why:</strong> This is what renders the cookie consent banner, captures the visitor’s choice, blocks/unblocks tagged third-party scripts and feeds the Okito analytics for that website.</li>
</ul>
<ol>
<li><strong>Admin “Test Connection” request (server-side, WordPress admin only)</strong></li>
</ol>
<ul>
<li><strong>Endpoint:</strong> <code>https://cdn.okito.com/js/{WEBSITE_KEY}</code></li>
<li><strong>When:</strong> Only when an administrator clicks the “Test Connection” button on the Okito <span aria-hidden="true" class="wp-exclude-emoji">→</span> Settings page.</li>
<li><strong>What is sent:</strong> A standard HTTPS GET request from your server containing only the Website Key entered in the form. No visitor data, posts or user information is transmitted.</li>
<li><strong>Why:</strong> To verify that the Website Key is valid against the Okito CDN.</li>
</ul>
<p>The plugin does not send any other data to Okito or any other third party. No personal data of WordPress visitors is transmitted by PHP code in this plugin.</p>
<p>Use of the Okito service is subject to:</p>
<ul>
<li>Okito Terms of Service: https://okito.com/terms-of-service/</li>
<li>Okito Privacy Policy: https://okito.com/privacy-policy/</li>
</ul>
<p>Site administrators are responsible for ensuring their own privacy policy describes the use of Okito where required by law. Suggested wording is registered with WordPress and visible under <strong>Settings <span aria-hidden="true" class="wp-exclude-emoji">→</span> Privacy</strong> after this plugin is active.</p>
<h3>Privacy</h3>
<p>This plugin:</p>
<ul>
<li>Saves your <strong>Okito Website Key</strong> and an <strong>enabled/disabled</strong> flag in the WordPress options table.</li>
<li>When enabled, loads the script described in <strong>External services</strong> on public pages so visitors see the cookie banner and consent features.</li>
</ul>
<p>Suggested wording for your Privacy Policy is available in WordPress under <strong>Settings <span aria-hidden="true" class="wp-exclude-emoji">→</span> Privacy</strong> after this plugin is active.</p>


Okito Cookie Consent

Professional cookie consent management with GDPR, CCPA, LGPD, and IAB TCF v2.3 compliance. Connects your site to the Okito platform.

danjed

<p>GDPR cookie consent with real script blocking.</p>
<p>Block Google Analytics, Google Tag Manager, Meta Pixel, Hotjar, YouTube embeds, and other third-party services before they reach the browser.</p>
<p>Unlike JavaScript-based consent tools, blocked scripts never reach the browser at all.</p>
<p>Most cookie consent plugins display a banner and rely on JavaScript to stop tracking scripts. In many cases, those scripts can begin loading before the visitor has made a choice.</p>
<p>COOKR takes a different approach.</p>
<p>Scripts are blocked server-side before page delivery. Third-party services cannot execute until consent is explicitly granted. This helps website owners meet GDPR and TTDSG requirements more reliably.</p>
<p>Avoids the client-side race conditions common to JavaScript-only consent tools. No script guessing. No “hope it loads in time.”</p>
<p>Consent enforcement instead of consent theatre.</p>
<p>✓ Server-side script blocking — blocked before the browser receives them<br />
✓ Google Consent Mode v2 support<br />
✓ No external consent cloud<br />
✓ No proxy infrastructure<br />
✓ No visitor data sent to third parties<br />
✓ Works entirely on your WordPress installation</p>
<p>Built for site owners, agencies, and developers who want real GDPR cookie consent enforcement.</p>
<p>COOKR CORE includes:</p>
<ul>
<li>Consent banner & preferences UI</li>
<li>Server-side script interception via PHP output buffer</li>
<li>Auto-Blocker for third-party scripts and iframes</li>
<li>Runtime Inspector</li>
<li>CSP-aware restoration with nonce propagation</li>
<li>Google Consent Mode v2 support</li>
<li>Full JavaScript API (<code>window.cookrConsent</code>)</li>
<li>Self-hosted operation — no external services required</li>
</ul>
<p>COOKR RADR additionally includes:</p>
<ul>
<li>Privacy Radar — runtime detection and classification of third-party services</li>
<li>Enforcement Verification Framework — structured protocol for proving enforcement claims</li>
<li>Compatibility Matrix — tested stack database with VERIFIED/PARTIAL/UNKNOWN/FAILED states</li>
<li>Automatic optimizer exclusions — LiteSpeed, WP Rocket, Autoptimize, FlyingPress</li>
<li>Curated signature database with automatic weekly updates</li>
</ul>
<h4>How It Works</h4>
<p>COOKR intercepts scripts in the PHP output buffer using <code>WP_HTML_Tag_Processor</code> before delivery to the browser. Matching script and iframe tags are neutralised server-side and restored only after the visitor grants consent.</p>
<p>There is no client-side race condition because blocking happens before the browser receives the page.</p>
<h4>Auto-Blocker</h4>
<p>Enable in Settings. Off by default.</p>
<p>When enabled, COOKR rewrites matching script tags and iframe tags server-side — setting <code>type="text/plain"</code> and preserving original attributes in <code>data-cookr-*</code> attributes for restoration after consent.</p>
<p>Test after enabling when using WP Rocket, LiteSpeed Cache, NitroPack, or Cloudflare Rocket Loader.</p>
<h4>Runtime Inspector</h4>
<p>The Runtime Inspector exposes third-party runtime activity directly in the browser — blocked scripts, restored services, iframe activity, detected domains.</p>
<p>Enable in Settings. Append <code>?cookr_debug=1</code> to any frontend URL while logged in as administrator.</p>
<h4>CSP-aware</h4>
<p>COOKR supports strict Content Security Policies without requiring <code>unsafe-inline</code>.</p>
<p>Restored scripts preserve CSP integrity via automatic nonce propagation. COOKR reads the nonce WordPress assigns to enqueued scripts at request time and passes it to restored scripts — no manual configuration required.</p>
<h4>Developer JS API</h4>
<pre><code>cookrConsent.has('analytics')
cookrConsent.require('marketing', callback)
cookrConsent.whenConsented('analytics').then(fn)
cookrConsent.on('consent' | 'change' | 'decline' | 'reset', handler)
cookrConsent.off(event, handler)
cookrConsent.getConsent()
cookrConsent.getExpiry()
cookrConsent.categories()
cookrConsent.reset()
</code></pre>
<h4>Consent Categories</h4>
<ul>
<li><strong>Necessary</strong> — Always active.</li>
<li><strong>Analytics</strong> — GA, GTM, Matomo, Hotjar, Clarity, etc.</li>
<li><strong>Marketing</strong> — Meta Pixel, Google Ads, TikTok, LinkedIn, etc.</li>
<li><strong>External Media</strong> — YouTube, Vimeo, Google Maps, etc.</li>
</ul>
<h4>Does COOKR require an external cloud service?</h4>
<p>No. COOKR runs entirely on your WordPress installation.</p>
<h4>Does visitor consent data leave the server?</h4>
<p>No. Consent data is stored locally on your site.</p>
<h4>Is the Auto-Blocker enabled by default?</h4>
<p>No. Enable and test it after installation, particularly when using caching or JavaScript optimization plugins.</p>
<h4>Which services can be blocked?</h4>
<p>Any third-party script or iframe matching configured domains. Examples: Google Tag Manager, Meta Pixel, YouTube embeds, TikTok Analytics.</p>
<h4>Does COOKR support Google Consent Mode v2?</h4>
<p>Yes. Enable in settings when using GTM or GA4.</p>
<h4>How do I inspect runtime activity?</h4>
<p>Enable the Runtime Inspector in settings and append <code>?cookr_debug=1</code> to any frontend URL while logged in as administrator.</p>
<h4>Does COOKR store personal data?</h4>
<p>The consent log stores a hashed IP (not the raw IP address), consent choices, and a timestamp. The raw IP address is never stored.</p>
<h4>Is COOKR compatible with strict CSP?</h4>
<p>Yes. COOKR automatically reads the nonce WordPress assigns to enqueued scripts and passes it to restored scripts, preserving compatibility with <code>strict-dynamic</code> CSP policies. No manual configuration is required.</p>
<h4>Will COOKR work with caching plugins such as LiteSpeed Cache, WP Rocket, or Cloudflare?</h4>
<p>Yes, but always test after enabling script optimization features such as JavaScript combine, defer, delay, or Rocket Loader. COOKR performs script blocking server-side, but aggressive optimization plugins may alter script delivery and should be verified on your site.</p>
<p>RADR v1.9.8 adds automatic exclusion filters for LiteSpeed Cache, WP Rocket, Autoptimize, and FlyingPress — COOKR registers itself as excluded from JS combination pipelines automatically.</p>
<h4>Does COOKR require HTTPS?</h4>
<p>Yes. COOKR requires HTTPS for consent state to persist correctly across page loads. Modern browsers restrict cookie behaviour on HTTP origins — on HTTP, the consent cookie may not persist, causing the banner to reappear on every page load. HTTPS is also a legal recommendation under GDPR for any site collecting consent.</p>
<h4>What WordPress version is required?</h4>
<p>WordPress 6.2 or higher. COOKR uses <code>WP_HTML_Tag_Processor</code> for safe, attribute-aware script rewriting, introduced in WP 6.2.</p>
<h3>External Services</h3>
<p>This plugin does not connect to any external service by default.</p>
<p>The auto-blocker contains a built-in list of known third-party domains (such as googletagmanager.com, connect.facebook.net, maps.googleapis.com, etc.) that is used purely as a local reference to identify and block scripts before consent. No data is sent to these domains by this plugin — the list is pattern-matching data stored locally in the plugin code.</p>


COOKR – Cookie Consent & Script Blocking

GDPR cookie consent with server-side script blocking. Prevent Google Analytics, GTM, Meta Pixel and third-party embeds from loading before consent.

Okito Cookie Consent vs COOKR – Cookie Consent & Script Blocking