# WordPress cookie consent plugin: choosing one that really blocks scripts

> A WordPress cookie consent plugin only protects you if it stops analytics, pixels and embeds from loading until the visitor agrees. What to look for, how to set it up with caching and other plugins, and how to prove it works.

Updated 2026-09-26 · WordPress & WooCommerce · HTML version: https://getreport.app/guides/wordpress-cookie-consent-plugin

A WordPress cookie consent plugin has one job that matters: keep Google Analytics, advertising pixels, embedded videos and other trackers from loading until the visitor clicks "Accept", and keep them off after "Reject". Many sites install one, see a banner appear and stop there, while the theme or another plugin keeps printing tracking code for everyone. This guide shows how to choose a plugin that really blocks scripts, how to set it up alongside caching and optimisation plugins, and how to prove it works with a first-visit scan. It is part of our guide to [cookie consent and what the law requires](https://getreport.app/guides/cookie-consent).

> **Note:**
> This guide is about the technical side of consent on WordPress. It is not legal advice; which categories need consent, and whether a US-style opt-out is enough, depends on where your visitors are.

## Quick answer

- **Pick a plugin that blocks, not one that only shows a notice.** Look for automatic script blocking by category, or tight integration with the tools you use.
- **It must offer "Reject all" on the first layer,** equal to "Accept all", and a link to reopen the choice on every page.
- **It should support Google Consent Mode v2** and the WP Consent API, so Google tags and consent-aware plugins such as Site Kit and WooCommerce follow the choice.
- **Route every tracker through it.** Remove tracking code pasted into the theme header or a "header scripts" plugin, and add it back through the consent plugin or Tag Manager.
- **Tell your caching and optimisation plugins about it:** exclude its script from JavaScript delay, deferral and combining.
- **Prove it:** run the free [cookie scanner](https://getreport.app/tools/cookie-scanner) in a fresh browser. No tracker should load before the click.

## What a WordPress consent plugin has to do

A WordPress page is assembled from the theme and every active plugin, and any of them can print a `<script>` tag. A consent plugin sits in the middle of that and has to do four things:

1. **Show the choice:** a banner with accept, reject and settings, per category (statistics, marketing, preferences).
2. **Block until consent:** stop scripts, iframes and pixels in non-necessary categories from running before the visitor agrees.
3. **Release on consent:** load the blocked items once the visitor accepts, without a page reload if possible.
4. **Remember and prove:** store the choice in a strictly necessary cookie, log it, and let the visitor change it.

Showing the banner is the easy part; every plugin does it. The differences, and the audit findings, are in step 2.

## How consent plugins block scripts

There are three ways a plugin can hold a tracker back. Most good plugins combine them.

| Method | How it works | Strength | Weak spot |
| --- | --- | --- | --- |
| Automatic blocking | Scans the page output and changes known tracker scripts to `type="text/plain"` with a category, then restores them after consent | Catches code the theme or other plugins print | Only knows trackers in its database; unknown scripts run |
| Built-in integrations | The plugin adds Google Analytics, Tag Manager or a pixel itself, only after consent | Clean and reliable | Only for the services it integrates |
| Consent signals | Passes the choice to Google Consent Mode, the WP Consent API or Tag Manager, and the tools respect it | Tools keep working in a limited, consent-aware mode | Only works if each tool reads the signal |

Blocking by rewriting the script tag happens in PHP, before the page is sent, so it must run on every request. With a page cache, the blocked version is what gets cached, which is fine as long as the plugin releases scripts in the browser with JavaScript after consent. Plugins designed for WordPress do this; generic banner scripts pasted into a header box usually do not block anything at all.

## What to look for when choosing

Popular options in the wordpress.org directory include Complianz, CookieYes, Cookiebot by Usercentrics, Real Cookie Banner and Cookie Notice & Compliance, and there are premium plugins such as Borlabs Cookie. Rather than recommend one, here is a checklist to hold any of them against:

- **Script blocking before consent,** automatic or by integration, for the trackers you actually use. Test it; don't trust the feature list.
- **A first-layer "Reject all" button** that can be styled the same as "Accept all". Some free tiers hide it by default.
- **Per-category consent** (statistics, marketing, preferences) with no pre-ticked boxes.
- **Google Consent Mode v2** with all four signals, and a choice between basic and advanced mode. Our guide to [Google Consent Mode v2](https://getreport.app/guides/google-consent-mode-v2) explains the difference.
- **WP Consent API support.** The WP Consent API is a small plugin that gives WordPress a shared way to store and read consent. Site Kit by Google, WooCommerce and several analytics plugins read it, so one choice in the banner reaches them all.
- **Blocking iframes and embeds:** YouTube, Vimeo, Google Maps and social posts, with a placeholder the visitor can click to load one.
- **Consent records** you can export, and a cookie policy table generated from a scan, which our guide to [writing a cookie policy](https://getreport.app/guides/cookie-policy) explains how to check.
- **Geolocation, if you need it:** opt-in for EU, UK and Swiss visitors, opt-out with Global Privacy Control for US visitors. Our guide to [CCPA cookie banner requirements](https://getreport.app/guides/ccpa-cookie-banner) covers the US side.
- **Google certification, if you run AdSense or Ad Manager.** Google requires publishers serving ads to visitors in the EEA, the UK and Switzerland to use a Google-certified consent management platform; check Google's list before choosing.
- **Weight.** A banner loads on every page for every visitor. Compare its JavaScript and CSS with the [WordPress plugin detector](https://getreport.app/tools/wordpress-plugin-checker) before and after installing.

Cloud-based platforms keep the scanner and consent log on the vendor's servers and usually charge by traffic or number of pages; plugins that run entirely inside WordPress store everything in your database. Both work; the cloud option adds a third-party script and a data processor to your privacy notice.

## Setting it up step by step

Do this on a staging copy first if your site has a lot of tracking.

### 1. Take an inventory

Run a first-visit scan and list every cookie and tracker the site sets today, with the plugin or code that adds each one. The plugin detector shows which plugins load files on the page; the cookie scanner shows which trackers make requests.

> **Free tool:** [Cookie scanner: GDPR consent check](https://getreport.app/tools/cookie-scanner): Free cookie scanner: see every cookie and tracker your site sets before and after the visitor clicks Accept, and whether your banner offers a reject option.

### 2. Remove tracking code from the theme

Search for tracking code outside the consent plugin: the theme's `header.php` or `functions.php`, "Insert Headers and Footers"-style plugins, the theme customiser's "custom scripts" box, and page builder custom code settings. Every Google Analytics snippet, Meta Pixel, Hotjar or TikTok code found there runs regardless of the banner. Move each one into the consent plugin's integrations or into Tag Manager with consent triggers.

### 3. Configure categories

Map every service to a category. Only the login session, cart, security, load balancing and the consent cookie itself are strictly necessary. Analytics goes in statistics, pixels and remarketing in marketing, chat widgets and embeds wherever the plugin's scan puts them, after you check. Nothing optional should be in "necessary".

### 4. Turn on Consent Mode and the WP Consent API

Enable Google Consent Mode v2 in the consent plugin, map statistics to `analytics_storage` and marketing to `ad_storage`, `ad_user_data` and `ad_personalization`, and install the WP Consent API if the plugin asks for it. If you use Site Kit, check that its consent mode setting is on and that it is not also adding a second Google tag outside the consent plugin.

### 5. Design the banner

- "Accept all" and "Reject all" side by side, same size and weight.
- A settings link for per-category choices.
- A floating icon or footer link, "Cookie settings", that reopens the banner on every page.
- A position that does not cover the whole screen on phones.

Our guide to [a cookie banner that passes](https://getreport.app/guides/cookie-banner-that-passes-reject-button-lifetime-consent-mode) covers the first layer, lifetimes and wording in detail.

### 6. Make caching and optimisation plugins cooperate

Most consent failures on otherwise well-configured WordPress sites come from optimisation plugins:

- **Exclude the consent plugin's script** from "delay JavaScript execution", "defer JavaScript" and "combine JavaScript" in WP Rocket, LiteSpeed Cache, Perfmatters and similar plugins. If the banner script is delayed until interaction, the banner appears late or not at all; if trackers are combined into one file, they can no longer be blocked individually.
- **Purge all caches** after changing consent settings, including the host's cache and a CDN such as Cloudflare.
- **Geolocated banners** need a cache that varies by country, or a plugin that decides in the browser. Otherwise the first visitor's version is served to everyone.

Our guide to [two caching plugins and which to keep](https://getreport.app/guides/two-caching-plugins-why-it-breaks-and-which-to-keep) is worth reading if you are unsure which layer caches what.

### 7. Test before the click and after reject

In a private window: load the page, don't click anything, and check DevTools → Network for requests to `google-analytics.com`, `facebook.net`, `hotjar.com` and similar, and Application → Cookies for `_ga`, `_fbp` and `_gcl_au`. Then click "Reject all", browse two pages and check again. Then accept and confirm the tools start working.

## How to verify with getReport

The cookie scanner loads your page in a fresh browser from Frankfurt, records every cookie and tracker, clicks the accept button it finds (it knows the selectors of 18 consent platforms and visible accept buttons in 20 languages), and records what appears afterwards. On a WordPress site the full report shows these findings together with the plugin table:

> **Check: No trackers load before consent.** Analytics, ad pixels and session-recording scripts that run before the visitor answers the cookie banner set identifiers without permission. Under GDPR and ePrivacy that needs prior consent; regulators fine for it, and the banner is worthless if the tags do not wait for it.
>
> 1. Load tracking tags through your consent platform (Cookiebot, OneTrust, Complianz, CookieYes, Google Tag Manager with consent triggers) so they run only after "Accept". Test in a fresh incognito window: no tracker request until you click.
> 2. If you use Google tags, add Consent Mode v2 with the defaults set to denied; the tags then send cookieless pings until consent.

> **Check: Only necessary cookies are set before consent.** Analytics and advertising cookies (_ga, _fbp, _gcl_au, _hjid…) written before the visitor agrees are the most common finding of data-protection audits. Session, security and consent cookies are fine; tracking cookies need a yes first.
>
> 1. Block the scripts that set these cookies until consent (your consent platform's script blocking, or GTM consent triggers), then check again in a fresh browser: the tracking cookies should appear only after "Accept".
> 2. If a plugin or theme sets them directly, look for its "load after consent" option or replace it.

> **Check: Cookie banner reject option.** EU regulators (CNIL, the Datatilsynet, the EDPB guidance) expect refusing to be as easy as accepting: a "Reject all" or "Only necessary" control on the first layer, not hidden behind "Settings". A banner without it is a dark pattern and, in several countries, a finable one.
>
> 1. Enable the first-layer reject button in your consent platform (your consent platform: usually a "Show reject all" or "Decline" setting) with the same size and colour weight as accept.

> **Check: No cookie banner detected.** A consent banner is required in the EU when the site sets non-essential cookies. It also covers part of the screen and adds scripts, so it is worth knowing which one runs.
>
> 1. Make sure the banner blocks tracking scripts until the visitor agrees, and that "Reject" is as easy as "Accept".

> **Check: Analytics run with Google Consent Mode.** Consent Mode tells Google tags what the visitor agreed to, so analytics keep working (in aggregate) after a "Reject" click instead of going dark. Without it, EU sites lose a large share of their measurement.
>
> 1. Enable Consent Mode v2 in your consent banner's settings and connect it to Google Tag Manager or the GA4 tag.

The scanner clicks Accept, not Reject, so test the refusal path by hand as in step 7. Scan more than the home page: a contact page with a map embed or a product page with a reviews widget often loads trackers the home page does not.

The banner itself has a cost too. The plugin detector shows each plugin's kilobytes on the page, so you can see whether your consent plugin is one of the heavier ones:

> **Free tool:** [WordPress theme and plugin detector](https://getreport.app/tools/wordpress-plugin-checker): Free WordPress theme and plugin detector: see the theme, page builder and plugins a site uses, what each plugin costs in kilobytes and which are abandoned.

> **Check: WordPress plugin weight.** Every active plugin can add scripts and styles to every page, whether the page uses them or not. A slider or a form builder can weigh more than the rest of the site together.
>
> 1. Deactivate plugins the site does not use; for the heavy ones in the table, check whether a lighter alternative exists.
> 2. Load plugin assets only where needed with a performance plugin (Perfmatters, Asset CleanUp) or the plugin's own "load on demand" setting.

## Common mistakes

- **A notice-only plugin** that shows "We use cookies" with an OK button and blocks nothing.
- **Tracking code in the theme header** that bypasses the consent plugin entirely.
- **Two consent plugins,** or a consent plugin plus a cloud banner script, fighting over the same choice.
- **Google Analytics added twice:** once by Site Kit or an analytics plugin and once by the consent plugin's integration, with only one of them blocked.
- **The consent script delayed by an optimisation plugin,** so trackers load before the banner exists.
- **Analytics placed in "necessary"** because the plugin's scan guessed wrong.
- **Never re-scanning** after installing a new plugin, which may bring its own tracking.

## Questions people ask

### Which WordPress cookie consent plugin is best?

The best one is the one that demonstrably blocks the trackers your site uses before consent. Several established plugins do this, including Complianz, CookieYes, Cookiebot and Real Cookie Banner. Choose by script blocking for your tools, a first-layer reject button, Consent Mode v2 and WP Consent API support, then verify with a first-visit scan. A plugin with a nice banner but no blocking does not protect you.

### Does a free WordPress cookie plugin block scripts before consent?

Some do, some only show a notice. Several free plugins include automatic blocking of common trackers and Google Consent Mode, while others reserve blocking, geolocation or consent logs for paid plans. Read what the free tier includes, then test: load the site in a private window without clicking, and check that no analytics or pixel requests appear in the Network panel.

### What is the WP Consent API?

The WP Consent API is a free wordpress.org plugin that gives WordPress one shared place to store and read a visitor's consent by category. A consent plugin writes the choice once, and consent-aware plugins such as Site Kit by Google and WooCommerce read it before setting cookies. It does not show a banner itself; it connects the banner to the other plugins.

### Why do trackers still load after installing a cookie consent plugin?

Usually because the tracking code does not go through the plugin. Snippets pasted into the theme header, a header-scripts plugin or a page builder run for everyone, and optimisation plugins that delay or combine JavaScript can load trackers before the banner. Find the source with a first-visit scan, move each tracker into the consent plugin or Tag Manager, and exclude the consent script from JavaScript delay.