<div class="woo-sc-box alert">
TCF v2.3 takes effect on 28 February 2026 — sites that don’t update may have consent rejected, causing ads to switch to limited mode and reduce revenue. This plugin supports the latest IAB TCF v2.3 consent requirements
</div>
WebToffee GDPR Cookie Consent for WooCommerce helps websites comply with privacy laws like GDPR, CCPA, and more by enabling cookie consent management through customizable banners, popups, and widgets.
It blocks non-essential cookies until consent is given, supports granular control by cookie category, integrates with Google Consent Mode v2, IAB TCF v2.3, and Microsoft Clarity Consent Mode, and offers features like Geo-targeting, multilingual support, advanced cookie scanning, consent logs, and a built-in cookie policy generator.
<img class="size-medium wp-image-18734005527500 aligncenter" src="https://woocommerce.com/wp-content/uploads/2025/07/Frame-6637-1.png?w=840" alt="Advanced Features of the GDPR Cookie Consent extension " width="840" height="388" />
<img class="wp-image-18734005526928 alignright" src="https://woocommerce.com/wp-content/uploads/2025/07/GDPR-EU-Cookie-Law-Compliance-1.png?w=800" alt="GDPR and EU cookie law compliance" width="451" height="463" />
GDPR and EU Cookie Law Compliance
Ensure your website meets GDPR and EU Cookie Law requirements with built-in tools for transparent consent management. The extension enables prior consent collection, automatic blocking of non-essential cookies, and clear categorization of cookie types. It also provides users with granular control over their consent preferences and the ability to revoke consent at any time.
Supported EU cookie laws:
<ul>
<li>GDPR (EU and UK)</li>
<li>LGPD (Brazil)</li>
<li>PIPEDA (Canada)</li>
<li>Privacy Act (Australia)</li>
<li>POPIA (South Africa)</li>
<li>nFADP (Switzerland)</li>
<li>PDPL (Argentina)</li>
<li>PDPL (Andorra)</li>
</ul>
<img class="wp-image-18734005526958 alignleft" style="letter-spacing: -0.176px" src="https://woocommerce.com/wp-content/uploads/2025/07/CPRA-and-US-Cookie-Consent-1.png?w=800" alt="CCPA/CPRA and US cookie consent" width="451" height="463" />
 
CCPA/CPRA and US Cookie Consent
Comply with CCPA, CPRA, and other U.S. privacy regulations by enabling clear opt-out mechanisms and transparent cookie usage disclosures. The extension supports “Do Not Sell or Share My Personal Information” links, honors Global Privacy Control (GPC) signals, and allows users to decline non-essential cookies.
Supported US State Laws: CCPA/CPRA (California), VCDPA (Virginia), CTDPA (Connecticut), CPA (Colorado), UCPA (Utah)
<img class="alignright wp-image-18734005527316" src="https://woocommerce.com/wp-content/uploads/2025/07/Deploy-a-Customizable-Cookie-Consent-Banner-2.png?w=800" alt="Deploy a Customizable Cookie Consent Banner " width="451" height="463" />
 
 
 
 
Deploy A Customizable Cookie Consent Banner
Design and display a fully customizable, ADA-compliant, and responsive cookie consent banner that aligns with your brand and complies with privacy laws.
Choose from various layouts like popups, bars, or boxes, and customize colors, text, and buttons to match your site’s look and feel. This extension allows you to add Accept, Reject, and Settings buttons to give users clear and accessible choices for managing their cookie preferences.
 
 
 
<img class="alignleft wp-image-18734005527329" src="https://woocommerce.com/wp-content/uploads/2025/07/Advanced-Cookie-Scanner-with-Automatic-Cookie-Blocker-1.png?w=800" alt="Advanced Cookie Scanner with Automatic Cookie Blocker " width="451" height="463" />
 
Advanced Cookie Scanner With Automatic Cookie Blocker
Effortlessly manage cookies on your website with the built-in advanced cookie scanner and automatic cookie blocker. The extension scans your website to detect all cookies in use and automatically categorizes them into groups like Necessary, Analytics, Advertising, and more. 
Once scanned, it enables you to block non-essential cookies by default until user consent is obtained, ensuring full compliance with GDPR and similar regulations.
<img class="alignright wp-image-18734005527336" style="letter-spacing: -0.176px" src="https://woocommerce.com/wp-content/uploads/2025/07/Deploy-a-Customizable-Cookie-Consent-Banner-3.png?w=800" alt="Certified Google CMP Partner with Google Consent Mode, Microsoft Clarity Consent Mode & UET Support " width="451" height="463" />
 
 
 
Certified Google CMP Partner with  Google Consent Mode, Microsoft Clarity Consent Mode, and UET Support
As a Google-certified Consent Management Platform (CMP), the extension offers seamless integration with Google’s ads and analytical services. It ensures your website stays compliant with the latest standards for data privacy and digital advertising.
Supported Integration:
<ul>
<li style="font-weight: 400">Google Consent Mode</li>
<li style="font-weight: 400">UET Consent Mode</li>
<li style="font-weight: 400">Microsoft Clarity Consent Mode</li>
<li style="font-weight: 400">IAB TCF v2.3</li>
</ul>
<img class="alignleft wp-image-18734005527358" src="https://woocommerce.com/wp-content/uploads/2025/07/Geo-Targeted-Cookie-Banner-1.png?w=800" alt="Geo-Targeted Cookie Banner " width="451" height="463" />
 
 
 
Geo-Targeted Cookie Banner
Display cookie consent banners only where legally required using the extension’s built-in geo-targeting feature.
This allows you to show or hide banners based on a visitor’s location, ensuring compliance with region-specific privacy laws like GDPR (EU), CCPA/CPRA (California), and more, without disrupting the user experience for others.
By targeting users based on their IP addresses, you can minimize banner fatigue for global audiences while maintaining full compliance in applicable regions.
<img class="alignright wp-image-18734005527375" src="https://woocommerce.com/wp-content/uploads/2025/07/Native-WordPress-Cookie-Consent-Solution-1.png?w=800" alt="Native WordPress Cookie Consent Solution" width="438" height="450" />
 
 
 
Native WordPress Cookie Consent Solution
This cookie consent solution integrates seamlessly with your site and supports the WP Consent API for smooth, reliable consent handling.
All consent data is securely stored in your own database—never on external servers—ensuring full control, privacy, and compliance with data storage regulations.
<img class="alignleft wp-image-18734005527391" src="https://woocommerce.com/wp-content/uploads/2025/07/Built-In-Free-Cookie-Policy-Generator-1.png?w=800" alt="Built-In Free Cookie Policy Generator " width="451" height="463" />
 
 
 
 
 
 
Built-In Free Cookie Policy Generator
Easily generate a compliant cookie policy for your website with this extension’s built-in cookie policy generator. It automatically pulls details from your scanned cookies, categorizes them, and creates a clear, user-friendly cookie policy page.
<img class="alignright wp-image-18734005527402" src="https://woocommerce.com/wp-content/uploads/2025/07/Keep-a-Consent-Log-2.png?w=800" alt="Keep a Consent Log " width="451" height="508" />
 
 
 
 
 
 
 
Keep A Consent Log
Maintain a complete, anonymized record of user consent to support compliance and auditing needs. The extension logs each visitor’s cookie preferences along with the date, time, and masked IP address.
You can easily export these consent logs in CSV format for legal reference, reporting, or internal review, ensuring transparency and accountability in your consent management process.
<img class="alignleft wp-image-18734005527420" src="https://woocommerce.com/wp-content/uploads/2025/07/Keep-a-Consent-Log-3.png?w=800" alt="Translation-Ready for WordPress Multilingual Websites" width="451" height="508" />
 
 
 
 
 
 
Translation-Ready for WordPress Multilingual Websites
Seamlessly deliver cookie consent experiences in multiple languages with built-in multilingual support.
The extension is fully compatible with popular translation tools like WPML, qTranslate, and Polylang, ensuring your banner aligns with the language settings of your website.
English is the default language, and the extension comes preloaded with several widely spoken European languages out of the box.

GDPR Cookie Consent

Deploy a cookie banner to comply with GDPR, CCPA, and other privacy laws.

<div style="width: 980px" class="wp-video"><video class="wp-video-shortcode" id="video-0-1" width="980" height="551" preload="metadata" controls="controls"><a href="https://woocommerce.com/wp-content/uploads/2026/02/ShopDefenderPromo.mp4">https://woocommerce.com/wp-content/uploads/2026/02/ShopDefenderPromo.mp4</a></video></div>
 
<hr class="wccom-product-heading__hr" />

<h2>Key Benefits</h2>
<ul class="wccom-tick-list-primary">
<li>Stop Fraud Before Payment – Block fraudulent orders at checkout before any money changes hands</li>
<li>100% Local — No External APIs – All fraud checks run on your server. No data leaves your site, no third-party dependencies, no per-transaction fees</li>
<li>Flexible Response Actions – Block suspicious orders outright, place them on hold for review, or flag them for attention — your rules, your call</li>
<li>Intelligent Risk Scoring – Automatic fraud detection with disposable email detection, IP tracking, country mismatch analysis, and more</li>
</ul>

<h2>Main Features</h2>
<ul class="wccom-tick-list-secondary">
<li>Custom Blocking Rules – Create rules targeting emails, domains, phones, IPs, countries, addresses, names, payment methods, and shipping methods</li>
<li>4 Matching Modes – Exact match, contains, wildcard patterns, and full regex support</li>
<li>Automatic Risk Scoring – 6 configurable risk signals with adjustable weights and thresholds</li>
<li>Classic & Blocks Checkout – Full protection for both WooCommerce checkout experiences</li>
<li>Order Risk Metabox – Color-coded risk badges, scores, and detailed risk factors on every order</li>
<li>Complete Audit Trail – Every fraud check logged with context, action, trigger, score, and metadata</li>
<li>WooCommerce Analytics Integration – Security Logs report directly in the WooCommerce Analytics dashboard</li>
<li>GDPR & Privacy Ready – Built-in privacy policy integration with transparent data handling</li>
</ul>

<div class="">
<div class="">
<h3>Rule-Based Blocking</h3>
Build your own defense with powerful, flexible rules. Target orders by email address, domain, phone number, IP address, country, city, postcode, billing or shipping address, customer name, payment method, or shipping method. Choose from exact match, contains, wildcard, or regex matching. Set rules to block, hold, or flag — and add expiration dates for temporary rules.
</div>
<div class="">
<h3>Intelligent Risk Scoring</h3>
Every order is automatically assessed against six configurable risk signals: disposable email detection, IP reputation tracking, billing/shipping country mismatch, suspicious address keywords, new account age, and high-value order thresholds. Each signal has an adjustable weight, and you set the thresholds that determine whether an order is blocked, held, or flagged.
</div>
<div class="">
<h3>Real-Time Checkout Protection</h3>
Shop Defender intercepts fraudulent orders at the earliest possible moment — before payment is processed. Full support for both the classic WooCommerce checkout and the newer WooCommerce Blocks checkout. When an order is blocked, draft orders are automatically cleaned up and the customer sees your customizable error message.
</div>
<div class="">
<h3>Order Risk Assessment</h3>
Every order gets a detailed risk assessment stored as metadata. A dedicated metabox on the order page shows a color-coded badge (blocked, on hold, flagged, or low risk), a visual risk score bar, and a breakdown of every risk factor that contributed to the score. Optionally display a fraud risk column directly on the orders list.
</div>
</div>

<h2>How It Works</h2>
<ol>
<li>Install & Activate – Upload the plugin and activate it alongside WooCommerce</li>
<li>Enable Protection – Navigate to WooCommerce > Settings > Advanced > Shop Defender and enable the plugin</li>
<li>Configure Risk Thresholds – Adjust signal weights and set your block/hold score thresholds</li>
<li>Create Rules (Optional) – Add custom rules for known bad actors, risky domains, or suspicious patterns</li>
<li>Monitor & Review – Review flagged orders, check risk scores, and refine your rules using the audit log</li>
</ol>

<h2>Comprehensive Rule Types</h2>
Target fraud from every angle:
<ul class="wccom-tick-list-secondary">
<li>Email & Domain – Block specific addresses or entire domains (e.g., *@disposable.com)</li>
<li>Phone Number – Normalized matching strips formatting differences automatically</li>
<li>IP Address – Block known bad IPs with exact or pattern matching</li>
<li>Country, State, City & Postcode – Geographic restrictions for billing and shipping</li>
<li>Billing & Shipping Address – Catch suspicious address patterns like PO boxes</li>
<li>Customer Name – Block known fraudulent names with case-insensitive matching</li>
<li>Payment Method – Restrict specific payment methods for flagged contexts</li>
<li>Shipping Method – Route orders based on chosen shipping options</li>
</ul>

<h2>Configurable Risk Signals</h2>
Fine-tune fraud detection with six adjustable signals:
<ul class="wccom-tick-list-secondary">
<li>Disposable Email Detection – Bundled database of 5,000+ known disposable email domains (default: +30 points)</li>
<li>Failed IP Tracking – Flag IPs with a history of blocked orders in a configurable lookback period (default: +20 points)</li>
<li>Country Mismatch – Detect when billing and shipping countries differ (default: +15 points)</li>
<li>Suspicious Address Keywords – Configurable keyword list for risky address patterns like PO boxes (default: +10 points)</li>
<li>New Account Detection – Flag orders from recently created accounts (default: +10 points, configurable age threshold)</li>
<li>High-Value Order Alerts – Extra scrutiny for orders above a configurable amount (default: +15 points, $300 threshold)</li>
</ul>

<h2>Three Response Actions</h2>
Choose the right response for every situation:
<ul class="wccom-tick-list-secondary">
<li>Block – Hard deny at checkout. Payment is never processed. The customer sees your customizable error message. Draft orders are automatically deleted.</li>
<li>Hold – The order is placed on hold for manual review. An admin note is added with full risk details. You decide whether to approve or cancel.</li>
<li>Flag – The order completes normally but is marked with a warning. A note and risk score are attached for your review when fulfilling.</li>
</ul>

<h2>Complete Audit Trail</h2>
Every fraud check is logged for accountability and analysis:
<ul class="wccom-tick-list-secondary">
<li>Full Context Logging – Context (checkout, order), action taken, trigger type (rule or heuristic), risk score, and metadata</li>
<li>Advanced Filtering – Filter logs by context, action, email, IP address, or order ID</li>
<li>Automatic Retention – Daily WP-Cron task prunes logs older than your configured retention period (default: 90 days)</li>
<li>Analytics Integration – Access a dedicated Security Logs report in WooCommerce > Analytics with date filtering and sorting</li>
<li>Manual Management – Delete specific log entries or prune by age at any time</li>
</ul>

<h2>Powerful Admin Interface</h2>
Everything you need, right inside WooCommerce:
<ul class="wccom-tick-list-secondary">
<li>Modern React UI – Fast, responsive settings interface built with WordPress components</li>
<li>Risk Metabox – Color-coded badges, visual score bars, and risk factor breakdowns on every order</li>
<li>Orders List Column – Optional fraud risk column with risk level badges and scores</li>
<li>Customizable Messages – Edit the customer-facing block message and admin hold note templates</li>
<li>Capability-Based Access – Configure which user role can manage Shop Defender settings</li>
<li>Debug Mode – Enable detailed logging to the WooCommerce debug log for troubleshooting</li>
</ul>

<h2>Privacy & GDPR Compliance</h2>
Transparent data handling built into the core:
<ul class="wccom-tick-list-secondary">
<li>Privacy Policy Integration – Automatic suggested privacy policy text added to WordPress Privacy settings</li>
<li>Local Processing Only – No data sent to external services. All checks run entirely on your server.</li>
<li>Configurable Retention – Set how long logs are kept (1–365 days) with automatic daily cleanup</li>
<li>Data Transparency – Clear documentation of what data is collected, why, and how long it is stored</li>
<li>Clean Uninstall – Optional removal of all plugin data (tables, options, order metadata) on uninstall</li>
</ul>

<h2>Seamless Integration</h2>
Works with your existing WooCommerce setup:
<ul class="wccom-tick-list-secondary">
<li>WooCommerce HPOS – Fully compatible with High-Performance Order Storage</li>
<li>Classic & Blocks Checkout – Full protection for both checkout experiences</li>
<li>Multisite Ready – Per-site rule and log isolation on WordPress multisite networks</li>
<li>WooCommerce Analytics – Dedicated Security Logs report in the Analytics dashboard</li>
<li>REST API – Full CRUD API for rules, logs, and settings for programmatic management</li>
<li>Developer Hooks – Actions and filters to extend fraud decisions, risk signals, and disposable domain lists</li>
<li>Any Theme – Admin-only plugin with no frontend output — works with any theme</li>
</ul>

Shop Defender

Stop losing revenue to fraudulent orders and chargebacks. Shop Defender catches bad actors before payment is processed — using custom rules, intelligent risk scoring, and disposable email detection — all running locally on your server with no third-party fees or data sharing.

GDPR Cookie Consent vs Shop Defender