Brainstorm Force

<p>Most cookie plugins either:</p>
<ul>
<li>Just show a banner</li>
<li>Or make setup feel like preparing for a law exam</li>
</ul>
<p>SureCookie exists because there should be something better.</p>
<p>Something accurate.<br />
Something simple.<br />
Something modern.<br />
Something built properly for WordPress.</p>
<p>SureCookie automatically detects the cookies running on your website, categorizes them intelligently, blocks non-essential scripts before consent, and stores consent logs directly inside your WordPress database.</p>
<p>No traffic limits.<br />
No SaaS visitor caps.<br />
No complicated configuration maze.</p>
<p>Just clean, real enforcement.</p>
<p><a href="https://app.zipwp.com/blueprint/surecookie-n9i" rel=" nofollow ugc">Try the live demo of SureCookie.</a></p>
<h3>How SureCookie Actually Works</h3>
<p>There are 4 things that matter when it comes to consent:</p>
<ol>
<li><strong>Detection has to be accurate:</strong> If you do not know what cookies are actually running on your site, everything else falls apart. SureCookie scans with a real browser, not guesswork.</li>
<li><strong>Enforcement has to be technical:</strong> A banner asking for permission means nothing if scripts are already firing. SureCookie blocks non-essential scripts at the code level before consent is given.</li>
<li><strong>Data has to stay under your control:</strong> Consent logs belong on your server. Not locked inside a third-party SaaS dashboard you cannot fully control.</li>
<li><strong>Setup has to be simple:</strong> Compliance should not require a weekend of configuration. SureCookie gets you from install to enforcement in minutes.</li>
</ol>
<p>Everything in SureCookie revolves around that.</p>
<h3>Real Browser Cookie Detection</h3>
<p>This is important.</p>
<p>Most tools try to guess cookies by scanning HTML.</p>
<p>That is not accurate.</p>
<p>SureCookie uses a Playwright-powered scanning engine at <a href="https://library.surecookie.com/" rel="nofollow ugc">https://library.surecookie.com/</a>.</p>
<p>When you run a scan, it loads your website in a real browser environment. Not static source code. An actual browser session.</p>
<p>That means it detects:</p>
<ul>
<li>Cookies injected dynamically</li>
<li>Scripts loaded after interaction</li>
<li>Conditional third-party trackers</li>
<li>Tag manager injected scripts</li>
<li>Things that only appear after page load</li>
</ul>
<p>It visits your website like a real user would.</p>
<p>That is the difference.</p>
<p>Once detected, cookies are categorized intelligently and automatically.</p>
<h3>Smart Categorization</h3>
<p>After detection, SureCookie categorizes cookies into:</p>
<ul>
<li>Essential</li>
<li>Functional</li>
<li>Analytics</li>
<li>Marketing</li>
</ul>
<p>Most cookies are categorized automatically using a continuously improving detection database.</p>
<p>Everything is editable.</p>
<p>The goal is simple:</p>
<p>Nobody should have to manually research every random cookie string just to get compliant.</p>
<h3>Script Blocking Before Consent</h3>
<p>This part is critical.</p>
<p>Showing a banner is not compliance.</p>
<p>Before consent:</p>
<ul>
<li>Analytics does not run</li>
<li>Marketing pixels do not fire</li>
<li>Tag managers do not execute</li>
<li>Embedded videos do not load tracking</li>
<li>Social widgets are paused</li>
</ul>
<p>Consent is enforced at execution level.</p>
<p>Not just visually.</p>
<h3>Consent Logs Stored Locally</h3>
<p>All consent logs are stored inside your WordPress database in a dedicated custom table.</p>
<ul>
<li>View logs from the admin dashboard</li>
<li>Export for compliance documentation</li>
<li>Delete anytime</li>
<li>Control retention periods</li>
</ul>
<p>Compliance data stays on your server. Not in an external SaaS dashboard.</p>
<h3>Performance by Design</h3>
<p>SureCookie is lightweight from the ground up.</p>
<ul>
<li>No jQuery dependency</li>
<li>Minimal frontend footprint</li>
<li>Dedicated database table for logs</li>
<li>No heavy background processing</li>
</ul>
<p>Blocking non-essential scripts before consent also reduces unnecessary third-party requests, which improves page load performance as a side effect.</p>
<h3>Designed in 2026, Not 2019</h3>
<p>Many WordPress plugins are outdated.</p>
<p>Too many toggles.<br />
Too much legal jargon.<br />
Too much friction.</p>
<p>SureCookie is designed to feel modern.</p>
<p>The onboarding is structured:</p>
<ol>
<li>Scan your site</li>
<li>Review detected cookies</li>
<li>Confirm categories</li>
<li>Activate enforcement</li>
</ol>
<p>That is it.</p>
<p>Setup should feel good, not overwhelming.</p>
<h3>No Visitor-Based Limits</h3>
<p>Whether a site has 1,000 visitors or 1,000,000 visitors, SureCookie works the same way.</p>
<p>No caps.<br />
No surprises.<br />
No usage-based pricing tiers.</p>
<h3>Built for the WordPress Ecosystem</h3>
<p>SureCookie works with:</p>
<ul>
<li>SureCart</li>
<li>WooCommerce</li>
<li>Easy Digital Downloads</li>
<li>Page builders</li>
<li>Analytics tools</li>
<li>Marketing integrations</li>
<li>Multisite setups</li>
</ul>
<p>Consent logic applies across your site.</p>
<h3>Who This Is For</h3>
<ul>
<li>Site owners who want real enforcement, not just a banner</li>
<li>eCommerce stores handling customer data</li>
<li>Agencies managing multiple client sites</li>
<li>Developers who care about clean implementation</li>
<li>Businesses operating in regulated regions</li>
</ul>
<p>If the goal is just the simplest possible banner without caring about detection accuracy, SureCookie is probably not the right fit.</p>
<p>If the goal is modern, accurate, performance-conscious consent management, it is.</p>
<h3>Important Note</h3>
<p>SureCookie provides the technical infrastructure for consent management. Legal compliance depends on your policies and jurisdiction. Always consult a qualified legal professional when needed.</p>
<h3>External Services</h3>
<p><strong>Cookie Scanning:</strong> SureCookie connects to <a href="https://library.surecookie.com/" rel="nofollow ugc">https://library.surecookie.com/</a> to provide real browser-based cookie scanning and smart categorization.</p>
<p>When you run a cookie scan, SureCookie sends the URLs of your selected pages to the scanner. A real Playwright-powered browser visits those pages, just like an actual user would, and detects every cookie, tracking script, and third-party service running on your site. Detected cookies are then automatically categorized using a continuously improving detection database.</p>
<p><strong>Scanner Registration & Authentication:</strong> Before your first scan, SureCookie performs a one-time registration handshake with <code>library.surecookie.com/api/register</code>. The request includes your site URL, the WordPress administrator email, and the SureCookie plugin version so the SaaS can associate scan results with your site. The SaaS issues a per-site credential which is stored locally in your WordPress database (the <code>surecookie_site_credentials</code> option) and used to sign every subsequent scan request with HMAC-SHA256. To prove that the registration is initiated by an admin who actually controls the domain, the SaaS makes a single follow-up GET request to <code>https://yoursite.example/wp-json/surecookie/v1/site-verify/{token}</code> and confirms the token matches before issuing the credential. No user content or personal data is sent during this handshake — only the site URL, the administrator email, and the plugin version. Credentials are automatically invalidated and re-issued if the site moves to a new domain.</p>
<p><strong>Consent IP Logs:</strong> For region-aware consent, visitor IP addresses are processed through MaxMind integration to determine country-level location, so the correct Country gets into the consent log.</p>
<p><strong>PDF Export (PDFObject):</strong> SureCookie allows administrators to download consent logs as PDF files. This feature uses the <a href="https://pdfobject.com/" rel="nofollow ugc">PDFObject</a> library, loaded from the cdnjs Cloudflare CDN: <code>https://cdnjs.cloudflare.com/ajax/libs/pdfobject/2.1.1/pdfobject.min.js</code>. PDFObject is used solely to render the consent log data as a PDF in the browser. No user data is sent to the CDN — the library file itself is fetched and executed locally in the browser. PDFObject is MIT-licensed and GPL-compatible.</p>
<h3>Data Stored Locally</h3>
<p>All consent data is stored inside your WordPress database:</p>
<ul>
<li>User consent choices (categories accepted or rejected)</li>
<li>Timestamps of consent actions</li>
<li>Masked IP address, country and user session ID</li>
<li>Cookie scan results</li>
<li>Plugin configuration settings</li>
</ul>
<h3>Privacy Policy</h3>
<p>SureCookie processes data through its API service at library.surecookie.com to empower cookie scanning and region-aware consent. Here is exactly what happens and why.</p>
<p><strong>What we send to surecookie.com:</strong></p>
<p>When your site is connected to the billing portal, the plugin sends only:</p>
<ul>
<li>An opaque account identifier (UUID) — never your email address.</li>
<li>The site URL, plugin version, and the URLs you’re scanning.</li>
<li>For Pro users: an HMAC signature derived from your license key (the license key itself never crosses the wire after activation).</li>
</ul>
<p>Your admin email is never transmitted on scan requests, scan polling, or any other recurring call after authentication completes.</p>
<p><strong>What Is Processed and Why:</strong></p>
<ul>
<li><strong>Cookie Scanning:</strong> When you run a scan, page URLs are sent to the scanning service where a real browser detects cookies and scripts. Detected cookie information (names, domains, durations) is used to categorize cookies and improve detection accuracy across all SureCookie installations.</li>
<li><strong>Region Detection:</strong> Visitor IP addresses are processed through MaxMind to determine country-level location for applying the correct Country into logs. IP addresses are masked before being stored in your database.</li>
<li><strong>Consent Records:</strong> Consent choices, timestamps, and user session ID details are logged locally in your WordPress database for compliance documentation.</li>
</ul>
<p><strong>Where Data Lives:</strong></p>
<ul>
<li>All consent logs, scan results, and settings are stored in your WordPress database</li>
<li>Data sent to library.surecookie.com for scanning and geolocation may be temporarily stored for processing</li>
<li>Nothing is sold, shared with third parties, or used for advertising</li>
</ul>
<p>Since visitor data is processed through SureCookie’s services, this should be mentioned in your site’s privacy policy. Full details: <a href="https://surecookie.com/privacy-policy/" rel="nofollow ugc">https://surecookie.com/privacy-policy/</a></p>
<p><strong>Data Retention and Control:</strong></p>
<ul>
<li>Consent logs and scan results can be viewed, exported, or deleted anytime from your WordPress admin</li>
<li>Retention periods are configurable in plugin settings</li>
</ul>
<p><strong>Security:</strong></p>
<ul>
<li>All data transmission uses HTTPS encryption</li>
<li>API communications are secured with authentication tokens</li>
</ul>
<p>For questions about data processing, visit <a href="https://surecookie.com/support/" rel="nofollow ugc">https://surecookie.com/support/</a></p>
<h3>About Brainstorm Force</h3>
<p>SureCookie is built by Brainstorm Force, the team behind Astra and other widely used WordPress products.</p>
<h3>Support</h3>
<ul>
<li><a href="https://wordpress.org/support/plugin/surecookie/" rel="ugc">Support Forum</a></li>
<li><a href="https://surecookie.com/docs/" rel="nofollow ugc">Documentation</a></li>
</ul>


SureCookie – Smarter Cookie Consent solution

Real cookie consent for WordPress. Browser-based scanning, smart categorization, strict script blocking, and consent logs stored in your database.

Aslam Hasib

Zenaul Islam

DevItems

Madhusudan

<p>CookieRay is a cookie consent and privacy tooling plugin for WordPress. It stores data on your hosting account and runs in your environment. There is no external SaaS dashboard for site operation.</p>
<p>CookieRay helps website owners manage cookie consent settings for GDPR, CCPA, ePrivacy, and other privacy-related requirements. Legal compliance depends on your website setup, third-party tools, region, and how the plugin is configured.</p>
<p>CookieRay provides a visitor-facing consent experience, configurable script blocking, cookie discovery from your site, detailed consent records, and a setup dashboard to help you manage cookie consent records and support privacy-related workflows.</p>
<h4>Cookie consent banner</h4>
<p>A customizable consent surface with card and bar layouts, live preview in the admin, and nine placement positions. Visitors can Accept All, Decline All, or open a Preferences modal to choose which categories to allow (Necessary, Analytical, Functional, and Marketing). Banner text, colors, buttons, and fonts are editable without writing code.</p>
<h4>Script blocking</h4>
<p>Choose Log Only recording or Strict blocking in Settings. In Strict mode, CookieRay delays known tracking scripts until the visitor agrees to categories that match those trackers. Common patterns for services such as Google Analytics, Meta Pixel, Hotjar, HubSpot, TikTok Pixel, and many others are included out of the box.</p>
<h4>Google Consent Mode v2</h4>
<p>When enabled, CookieRay outputs consent state in the visitor’s browser for Google tags (such as GA4, Google Ads, or Google Tag Manager) that <strong>you have already placed on your site</strong>. Google Consent Mode v2 lets Google tags adjust their behavior based on visitor consent choices while supporting privacy-conscious measurement modes when consent is withheld.</p>
<p>CookieRay itself does not open separate server-side uploads of visitor payloads to Google; instead it surfaces JavaScript so tags you load can read consent signaling. Behavior of those downstream tags depends on how you configured Google products.</p>
<p>Further reading: Google’s Consent Mode documentation (linked under External Services).</p>
<h4>Cookie scanner</h4>
<p>Run a cookie scan from the WordPress admin to detect cookies surfaced on responses from your own site.</p>
<p>When an administrator starts a scan, CookieRay queues work on your server and uses the WordPress HTTP API to request public URLs belonging to <strong>your site domain</strong> (for example the homepage, published content URLs, WooCommerce storefront pages where applicable, and related routes depending on plugins). Cookie names surfaced in responses can be merged with your inventory for categorization alongside the plugin’s bundled tracking-cookie reference data.</p>
<p>CookieRay also runs deeper script-discovery passes that analyze HTML fetched from a bounded set of URLs (the embeddable deep scan inspects up to 50 URLs on the same domain, chosen from the XML sitemap when available or from the home page plus recent posts and pages). Scan coverage still depends on plugins, caches, authenticated-only flows, and what responses your site serves to CookieRay’s unauthenticated crawler.</p>
<p>There is <strong>no recurring unattended scan timetable built into CookieRay</strong>. You start scans from CookieRay screens (background processing completes those runs without another manual click).</p>
<h4>Cookie inventory</h4>
<p>View, edit, and categorize cookies discovered on your site. Assign cookies to Necessary, Analytical, Functional, or Marketing categories. Bulk-categorize or delete entries. Custom cookies can be added manually, with regex pattern support where appropriate.</p>
<h4>Consent logs</h4>
<p>Consent events can be logged with identifiers, statuses, granted categories, page URL, banner version, and timestamp fields available for review. Entries are searchable and filterable in the admin. You can export records as CSV, and export individual receipts as PDF for your record-keeping process.</p>
<h4>Dashboard</h4>
<p>See a summarized score guided by configurable checks (blocking mode, categorized cookies, policy link usage, consent expiry and scan recency reminders, whether Google Consent Mode output is enabled, and related items). Use it as onboarding guidance alongside your legal or compliance review.</p>
<h4>Scan history</h4>
<p>Review past scans: timing, URLs covered, counts, and summaries of results to track changes over time.</p>
<h4>Settings</h4>
<p>Configure consent behavior (Log Only vs Strict blocking), consent expiry, consent log retention, Google Consent Mode v2 toggle, optional data portability export flows, and related options. Banner and behavior settings are stored through WordPress options alongside plugin metadata.</p>
<h4>Privacy and data handling</h4>
<p>CookieRay does not send usage data, telemetry, or visitor payloads to CookieRay-operated servers. Consent logs and inventories stay in your site’s database unless you export them elsewhere.</p>
<p>Third-party trackers you integrate yourself (such as Google Analytics, Google Ads, Google Tag Manager, Meta Pixel, marketing pixels, embedded chat widgets, and similar vendors) may still collect information according to their own tags, configurations, vendor accounts, regions, and published policies, even when CookieRay delays or respects categories for scripts it recognizes.</p>
<p>A WordPress Cron task deletes consent records older than the retention period configured in Settings, whenever WordPress Cron runs normally on your host.</p>
<h3>Pro Features</h3>
<ul>
<li>Scheduled automatic cookie scans</li>
<li>Geo targeting – show or hide the banner by country</li>
<li>Integration with Google Tag Manager, Meta Pixel, Adobe Experience Platform</li>
<li>Trust Badge – “Privacy Protected” badge displayed in the site footer</li>
<li>Premium support and priority updates</li>
</ul>
<p><a href="https://wp.cookieray.com/#pricing" rel="nofollow ugc">Upgrade to CookieRay Pro</a></p>
<h3>Support</h3>
<p>For questions, bug reports, or help with configuration, visit the <a href="https://wp.cookieray.com/contact" rel="nofollow ugc">CookieRay support page</a>.</p>
<h3>External Services</h3>
<p>CookieRay does not send analytics, telemetry, or visitor data to CookieRay-operated servers.</p>
<h4>1. Same-site cookie scanner</h4>
<p>When an administrator runs a cookie scan, CookieRay uses the WordPress HTTP API (wp_remote_get) to fetch public URLs belonging to the same WordPress site — for example the homepage, published post URLs, WooCommerce storefront pages, and sitemap entries.</p>
<p>What is sent: Standard HTTP GET requests to your own site’s public URLs.<br />
When: Only when an administrator triggers a scan from CookieRay admin screens.<br />
Who receives the requests: Your own web server. No data is sent to CookieRay or any third party.<br />
Source file: includes/class-scanner.php</p>
<h4>2. Google Consent Mode v2 (optional, admin-enabled)</h4>
<p>When enabled in Settings, CookieRay outputs JavaScript on visitor pages that signals consent state to Google tags you have independently installed (e.g. GA4, Google Ads, Google Tag Manager). CookieRay does not make server-side HTTP calls to Google.</p>
<p>What is sent: Browser-side consent signals read by locally loaded Google tags you control.<br />
When: When Consent Mode is enabled in CookieRay Settings and visitors load pages that include your Google tags.<br />
Who receives downstream data: Google, per your Google account and tag configuration.</p>
<p>Google Privacy Policy: https://policies.google.com/privacy<br />
Google Terms of Service: https://policies.google.com/terms<br />
Google Consent Mode documentation: https://support.google.com/analytics/answer/9976101</p>


CookieRay – Cookie Banner for Cookie Consent (GDPR/CCPA Compliant)

Cookie consent banner, script blocking, Google Consent Mode v2, cookie scanner, and consent logs for WordPress.

SureCookie – Smarter Cookie Consent solution vs CookieRay – Cookie Banner for Cookie Consent (GDPR/CCPA Compliant)