mariastellatech

<p>Stella Cookies is a WordPress cookie consent plugin for managing a cookie banner, consent categories, and third-party content controls for analytics, marketing, and embedded services.</p>
<p>The plugin includes support for Google Consent Mode v2, configurable consent categories, script blocking patterns, iframe blocking, cookie policy content, and a built-in shortcode for displaying your cookie policy and cookie declaration page.</p>
<p>It is built for site owners who need a configurable cookie banner and for developers who need flexible controls for consent-based script loading.</p>
<h4>Free Features 🚀</h4>
<ul>
<li>Enable or disable the cookie banner from one settings screen.</li>
<li>Support for Google Consent Mode v2 workflows.</li>
<li>Block analytics and marketing scripts until consent.</li>
<li>Optional strict prior blocking for uncategorized third-party scripts.</li>
<li>Configure statistics and marketing script patterns.</li>
<li>Configure allowlist patterns for trusted scripts.</li>
<li>Optional iframe blocking for embedded third-party content.</li>
<li>Consent version control for resetting consent after policy changes.</li>
<li>Cookie Policy content editor.</li>
<li>Cookie declaration list for transparency pages.</li>
<li><code>[stella_cookies_policy]</code> shortcode for policy and consent reset display.</li>
<li>Banner design templates and custom styling controls.</li>
<li>Button text, color, and font size customization.</li>
<li>Preference manager with necessary, statistics, and marketing controls.</li>
<li>Floating badge option to reopen consent controls.</li>
<li>Live admin preview for banner design changes.</li>
<li>In-admin help guide and system status summary.</li>
</ul>
<h4>Who It Is For</h4>
<ul>
<li>Website owners who need a configurable consent banner.</li>
<li>Agencies managing privacy compliance across client sites.</li>
<li>Developers who need finer control over script loading behavior.</li>
<li>Businesses that want a clean free plugin and an upgrade path to advanced compliance workflows.</li>
</ul>
<h4>Upgrade to Pro⚡</h4>
<p>Stella Cookies Pro extends the free plugin with advanced compliance tools including cookie scanning, staged scan review, scan history, email alerts, consent logs, analytics reporting, geo targeting, Global Privacy Control support, GTM sync, and additional banner branding controls.</p>
<h3>External services</h3>
<p>This plugin does not make direct HTTP requests to any external service or API on its own.</p>
<p>However, the plugin includes built-in script-blocking pattern lists that reference well-known third-party domain strings. These strings are used <strong>locally</strong> to match and block scripts loaded by your own site before consent is granted. No data is sent to these domains by the plugin itself.</p>
<p>The following third-party domains are referenced in the built-in blocking pattern defaults:</p>
<h4>Google Tag Manager / Google Analytics</h4>
<p>Pattern used: <code>googletagmanager.com/gtag</code>, <code>google-analytics.com</code></p>
<p>These patterns allow the plugin to identify and block Google Analytics and Google Tag Manager scripts until the visitor consents to the Statistics category.</p>
<p>If your site loads Google tags, those tags will connect to Google’s servers. Please refer to Google’s own terms and privacy policy:<br />
* Terms of Service: https://marketingplatform.google.com/about/analytics/terms/us/<br />
* Privacy Policy: https://policies.google.com/privacy</p>
<h4>Meta (Facebook) Pixel</h4>
<p>Pattern used: <code>connect.facebook.net</code></p>
<p>This pattern allows the plugin to identify and block Facebook/Meta Pixel scripts until the visitor consents to the Marketing category.</p>
<p>If your site loads the Meta Pixel, it will connect to Meta’s servers. Please refer to Meta’s own terms and privacy policy:<br />
* Terms of Service: https://www.facebook.com/legal/terms/businesstools<br />
* Privacy Policy: https://www.facebook.com/privacy/policy/</p>
<h4>Other built-in patterns</h4>
<p>The plugin also includes built-in blocking patterns for other common analytics and advertising services including <code>clarity.ms</code> (Microsoft Clarity), <code>hotjar.com</code>, <code>doubleclick.net</code> (Google Ads), <code>googleadservices.com</code>, <code>googlesyndication.com</code>, <code>ads-twitter.com</code>, <code>platform.twitter.com</code>, <code>tiktok.com</code>, <code>snap.licdn.com</code>, <code>ct.pinterest.com</code>, <code>matomo</code>, <code>plausible.io</code>.</p>
<p>All of these patterns are used solely to match and block third-party scripts on your own site. The plugin itself does not transmit any data to these services. Data transmission to these services only occurs after the visitor grants consent, or if the scripts are loaded by other means outside the plugin’s control.</p>
<h3>Developer API (Hardcoded Scripts)</h3>
<p>The safest and most WordPress-native way to load scripts is using <code>wp_enqueue_script()</code>. Stella Cookies will automatically detect and block these enqueued scripts based on your consent settings.</p>
<p><strong>Please do not paste raw <code><script></code> tags directly into your theme templates (<code>header.php</code>, <code>footer.php</code>, etc.).</strong> Hardcoded raw scripts cannot be reliably blocked without causing conflicts with other plugins.</p>
<p>If you are a developer and absolutely must output a script manually, please use the provided helper functions. These functions will automatically enforce the user’s consent choice without rewriting the whole page.</p>
<p><strong>For external scripts:</strong><br />
    stella_cookies_script( ‘https://connect.facebook.net/en_US/fbevents.js’, ‘marketing’ );</p>
<p><strong>For inline scripts:</strong><br />
    <code>php<br />
stella_cookies_inline_script( "<br />
    window.dataLayer = window.dataLayer || [];<br />
    function gtag(){dataLayer.push(arguments);}<br />
    gtag('js', new Date());<br />
    gtag('config', 'G-XXXXXXXXXX');<br />
", 'statistics' );</code></p>


Stella Cookies

Cookie banner plugin for GDPR and CCPA with Consent Mode v2, script blocking, iframe blocking, cookie policy shortcode, and banner design controls.

Ontario

<p>Plain Cookie Consent is a no-frills GDPR + ePrivacy consent banner for WordPress. It ships a single banner, Google Consent Mode v2 defaults, a server-side audit log with pseudonymised subject hashing, a DSAR lookup helper, and constant-gated Meta Pixel / Microsoft Clarity / LinkedIn Insight Tag helpers — all under GPL v2, with no upsells and no external telemetry.</p>
<p>The plugin is designed to support a GDPR/ePrivacy-compliant consent setup. Final compliance depends on the site owner’s configuration and linked privacy policy.</p>
<h4>Core compliance features</h4>
<ul>
<li>Google Consent Mode v2 defaults injected at <code>wp_head</code> priority 1, before any tag manager or gtag snippet.</li>
<li>Early inline consent replay with a revision gate — consent recorded before a policy revision bump is not replayed; the banner re-prompts instead.</li>
<li>Server-side audit log (<code>wp_plain_consent_log</code>) with a privacy-preserving SHA-256 subject hash over a daily-rotating salt, and a 730-day default retention purge (filterable via constant).</li>
<li>Consent revision system with a “Force re-consent for all users now” admin action and strict rollback if the audit insert fails.</li>
<li>Two-step choice pattern: the first layer offers Accept All and Show Options; the preferences screen (one click away) offers equal-weight Accept All, Reject All, and Save Preferences buttons.</li>
<li>Server-mirror consent cookie via a cache-safe <code>GET /mirror-nonce</code> endpoint (<code>Cache-Control: no-store</code>), so full-page caching does not break nonce validation.</li>
<li>Geo targeting: the consent-required region set is the EEA (EU-27 plus Iceland, Liechtenstein, Norway) plus the United Kingdom. Detection uses the Cloudflare <code>CF-IPCountry</code> header when present, with a fail-safe default: if the country cannot be determined, the visitor is treated as in-scope.</li>
<li>CSV/JSON streamed export of the consent log, plus a pre-uninstall evidence warning with one-click export.</li>
<li>DSAR lookup admin tool: recompute a visitor’s subject hash from IP + User-Agent and list matching consent-log entries (GDPR Art. 15 support).</li>
</ul>
<h4>Integrations</h4>
<ul>
<li>Meta Pixel: define <code>PLAIN_COOKIE_CONSENT_FACEBOOK_PIXEL_ID</code> in <code>wp-config.php</code>.</li>
<li>Microsoft Clarity: define <code>PLAIN_COOKIE_CONSENT_CLARITY_PROJECT_ID</code> in <code>wp-config.php</code>.</li>
<li>LinkedIn Insight Tag: define <code>PLAIN_COOKIE_CONSENT_LINKEDIN_PARTNER_ID</code> in <code>wp-config.php</code>.</li>
<li>Public <code>window.plainCookieConsent</code> JavaScript API (<code>getCategories</code>, <code>hasConsent</code>, <code>onChange</code>, <code>onGrant</code>, <code>onRevoke</code>) for site-specific vendors.</li>
<li>Cookie cleanup on revoke with curated defaults for LinkedIn, TikTok, Hotjar, Clarity, Yandex Metrica, and Snapchat (<code>plain_cookie_consent_autoclear_cookies</code> filter).</li>
<li><code>localStorage</code> / <code>sessionStorage</code> cleanup on a real granted-to-revoked transition (<code>plain_cookie_consent_clear_storage_keys</code> filter).</li>
</ul>
<h4>Accessibility</h4>
<ul>
<li>The banner and preferences modal are attested against WCAG 2.1 AA.</li>
<li>axe-core smoke tests (<code>wcag2a</code>, <code>wcag2aa</code>, <code>wcag21aa</code> tags) run on every push and pull request via GitHub Actions.</li>
<li>Site-level accessibility remains the operator’s responsibility.</li>
</ul>
<h4>Languages</h4>
<p>Translation catalogs ship for nine languages: English, German, Russian, Spanish, French, Italian, Dutch, Polish, and Portuguese. Banner language auto-resolution covers all nine shipped languages, including regional variants (for example de-AT or pt-BR), with any other locale falling back to English. Any shipped catalog can also be selected explicitly, and translators can override strings the standard WordPress gettext way.</p>
<h4>Not included</h4>
<ul>
<li>TCF v2.2 (programmatic publishers).</li>
<li>Consent analytics dashboards beyond the read-only Consent Health widget.</li>
<li>Multi-domain consent sync.</li>
<li>Banner A/B testing.</li>
<li>Script auto-blocking beyond Consent Mode and the documented vendor helpers.</li>
</ul>
<h3>External services</h3>
<p>This plugin has no telemetry and never sends data to its own or the author’s servers. Consent records stay in your own WordPress database.</p>
<p>The plugin can optionally load three well-known third-party marketing/analytics tags <strong>on your behalf</strong>. Each one is OFF by default and only ever loads when BOTH of the following are true:</p>
<ol>
<li>You explicitly enable it by defining the matching constant in <code>wp-config.php</code>, and</li>
<li>The visitor grants the relevant consent category in the banner.</li>
</ol>
<p>If you do not define these constants, the plugin makes no third-party requests at all. Once enabled, the tag still loads only after the visitor grants the relevant consent category in the banner.</p>
<h4>Meta (Facebook) Pixel</h4>
<p>Optional advertising measurement. Enabled by defining <code>PLAIN_COOKIE_CONSENT_FACEBOOK_PIXEL_ID</code>. When a visitor grants <strong>advertising</strong> consent, the plugin loads <code>https://connect.facebook.net/en_US/fbevents.js</code> and initialises the Pixel with your Pixel ID. From then on, on each page view, Meta receives standard Pixel data: your Pixel ID, the page URL and referrer, the visitor’s IP address and browser/user-agent, and a PageView event. Nothing is sent before advertising consent.<br />
Provider: Meta Platforms, Inc. Privacy Policy: https://www.facebook.com/privacy/policy/ — Business Tools Terms: https://www.facebook.com/legal/terms/businesstools</p>
<h4>Microsoft Clarity</h4>
<p>Optional session analytics (heatmaps and session insights). Enabled by defining <code>PLAIN_COOKIE_CONSENT_CLARITY_PROJECT_ID</code>. When a visitor grants <strong>analytics</strong> consent, the plugin loads <code>https://www.clarity.ms/tag/<your-project-id></code>. From then on, on each page view, Microsoft receives Clarity analytics data: your project ID, the page URL, the visitor’s IP address and browser/user-agent, and interaction events such as clicks and scrolls. Nothing is sent before analytics consent.<br />
Provider: Microsoft Corporation. Privacy Statement: https://www.microsoft.com/privacy/privacystatement — Clarity Terms of Service: https://clarity.microsoft.com/terms</p>
<h4>LinkedIn Insight Tag</h4>
<p>Optional advertising measurement on LinkedIn. Enabled by defining <code>PLAIN_COOKIE_CONSENT_LINKEDIN_PARTNER_ID</code>. When a visitor grants <strong>advertising</strong> consent, the plugin loads <code>https://snap.licdn.com/li.lms-analytics/insight.min.js</code> with your Partner ID. From then on, on each page view, LinkedIn receives Insight Tag data: your Partner ID, the page URL, and the visitor’s IP address and browser/user-agent. Nothing is sent before advertising consent.<br />
Provider: LinkedIn Corporation. Privacy Policy: https://www.linkedin.com/legal/privacy-policy — LinkedIn Ads Agreement: https://www.linkedin.com/legal/ads-agreement</p>
<h3>Disclaimer</h3>
<p>This plugin is provided “as is”, free of charge, for evaluation and use at<br />
the site operator’s own discretion and risk.</p>
<ul>
<li>The site operator alone chooses which plugins to install and run on their<br />
site, and bears full responsibility for that choice and its consequences.</li>
<li>The plugin is offered for informational and evaluation purposes. The<br />
authors make no guarantees and no promises of any kind — including<br />
correctness, completeness, fitness for a particular purpose, or<br />
uninterrupted operation.</li>
<li>Software may contain errors. Any errors, malfunctions, data loss, or<br />
legal consequences arising from the use of this plugin are the sole<br />
responsibility of the site operator.</li>
<li>Nothing in this plugin or its documentation constitutes legal advice.<br />
The plugin is designed to support a GDPR/ePrivacy-oriented consent setup,<br />
but it does not and cannot guarantee legal compliance of any specific<br />
site — final compliance always depends on the operator’s configuration,<br />
vendors, and policies.</li>
<li>The warranty disclaimer and limitation of liability are governed by<br />
sections 11 and 12 of the GNU GPL v2 license that ships with this plugin.</li>
</ul>


Plain Cookie Consent

Minimal clean-room GDPR/ePrivacy consent banner with Google Consent Mode v2, early inline replay, DSAR helper, and no upsells.

Stella Cookies vs Plain Cookie Consent