Search plugins, docs and guides… Buy · from $19/yr Buy

Sell more

Protect and comply

Speed and delivery

Content and SEO

Launch and support

All 15 plugins Every plugin from $19 a year, or pay once from $49. Pricing Not sure which one? Search plugins, docs and answers

Cookie Consent changelog

Every version, newest first, with the date it was released. Updates install from your Plugins screen.

Latest version 1.6.023 Oct 2026first released 14 Sep 2026

1.6.0

  • New Taking an answer back removes the cookies it had allowed. When a visitor switches off a kind of cookie they had agreed to, the cookies its services leave on your site are removed from their browser, and the page reloads once so the tags already running stop. Each service's cookie names come from its maker's documentation, and the cookie list now shows them. Cookies a company keeps on its own website, and cookies your server marks HttpOnly, cannot be removed by any website; the list tells visitors so. On by default under Settings.
  • Fixed Deleting sites from a large network during the pass after an update no longer makes it miss others. Each wp-admin screen went on from a place in the list of sites, so sites deleted in between moved the rest forward and as many were never reached, though the network was marked done. It now goes on from the next site by its number.

1.5.0

  • New Microsoft Advertising and Clarity follow each visitor's answer. On pages that carry them, UET's consent mode starts at denied and Clarity's consent API is told each answer, as Microsoft asks for visitors in Europe. On by default under Settings.
  • New A browser's privacy signal is shown as honoured. A visitor whose browser sends Global Privacy Control or Do Not Track and opens the choices is told the signal was honoured and nothing optional is on.
  • Improved Your pages are drawn without waiting for the banner's stylesheet. It used to hold up every page until it arrived. Now the page appears first, and the banner and the Cookie choices button show once it has arrived, already in place, so nothing on the page moves.
  • Improved The plugin's screens no longer load the media library. No screen here uses it, and it cost every screen about half a megabyte and a slow query on sites with many images. WordPress's colour picker now loads only on The banner.
  • Improved Faster pages on sites in Spanish or French. The translations now also ship as PHP files, which WordPress 6.5 and later reads from PHP's code cache instead of reading the translation file again on every page. Measured on a French site with all fifteen of our plugins: 6.3 ms and 0.8 MB of memory less on every request. Older WordPress reads the translations as before.
  • Improved Opening the plugin's screens asks less of your server. To make switching tabs instant, the plugin loads its other screens in the background while you read the first one. It now loads at most four, the plugin's own tabs first, and none while the browser tab is in the background; a tab past the fourth loads as your pointer reaches it.
  • Fixed Switching the plugin on for a whole network no longer runs out of time. It set up every site and emptied every one of its page caches before WordPress could note it as on, so on a network of a few hundred sites the host stopped it part of the way and the plugin was never switched on. It now takes a few seconds. A site it has no time for is set up, and its caches emptied, the first time WordPress runs on it.
  • Fixed After an update, every site of a large network has its page cache emptied. The first wp-admin screen marked the network done and then emptied every site in one go, so on a few hundred sites the host stopped it and the sites it had not reached kept pages from before the update. It now works a few seconds at a time, each wp-admin screen or daily check going on from where the last one stopped, and the network is marked done only once every site has been reached.
  • Fixed The banner's colours are colour pickers when you reach the screen from another tab. Opened from the Dashboard without a page load, they were left as plain text boxes.
  • Fixed No "deprecated" notice from Cloudflare's plugin when you save. With WP_DEBUG on and a current version of Cloudflare's plugin, emptying its cache printed a deprecation notice, which could stop a save from returning to its screen. Cloudflare is now asked under its current name, and the old one only on older copies.
  • Fixed Notes that should be hidden stay hidden. A hint or note a screen had hidden could still show, because the style that lays hints out outranked the browser's own rule for hidden things. Hidden things on the plugin's screens now always stay hidden.

1.4.2

  • Fixed Switching the plugin off for a whole network no longer runs out of time. It emptied every site's page cache one after another before WordPress could note it as off, so on a network of a few hundred sites the plugin stayed on. It now takes a few seconds; on a large network, empty your page cache afterwards so cached pages run your tags again.
  • Fixed Page caches are emptied only as far as a change needs. With LiteSpeed Cache, saving a change visitors see, and deactivating the plugin, pressed its Purge All, which also deletes its combined CSS and JS files, empties the object cache and PHP's code cache, clears Cloudflare where LiteSpeed is set to, and leaves "Purged all caches successfully." on your next screen. It now empties LiteSpeed's cached pages only. On a network, WP Super Cache is emptied for this site alone, where it emptied every site's (except a save on the main site of a network in subfolders, whose cached pages hold the other sites', and WP Super Cache's legacy copies, which it always clears for every site).

Earlier versions

September 2026 37 versions

1.4.1

  • Fixed Saving What is held back no longer removes your own rules. Each rule's address box was drawn empty, so pressing Save on that screen removed every rule of your own, and the scripts they held back ran before visitors agreed. If a site you held back is listed again among the sites this plugin does not recognise, hold it back again.
  • Fixed A rule of your own keeps a <, a per cent code such as %23, an entity and a tab as you type them. A < was stored as < and per cent codes were dropped, so the rule matched nothing while the screen listed it. Type again any rule saved that way.
  • Fixed The hint under a rule's name now says visitors see it, since the [cookie_list] table shows it.
  • Fixed After updating from 1.2 or earlier, a page that turns the reading away no longer brings the Dashboard's all-clear back. A page a security rule answers with 403, or a busy host with 429 or 503, keeps what the earlier reading saw until it can be read, and the Dashboard names it.
  • Fixed A Read my site that cannot read any page keeps what the last reading found, instead of replacing it with an empty one that made the banner ask returning visitors again.

1.4.0

  • New Every word on the banner and in its choices can be your own. The banner > Words has a box for each button, the Cookie choices button, the privacy policy link, each kind of cookie's name and description, the always on and New tags, and a held-back video's button and sentence. An empty box keeps the plugin's own words, and WPML and Polylang can translate what you type. The Dashboard tells you when a language's buttons are still in English. Accept all and Reject all cannot be saved with the same words.
  • New Google Tag Manager hears each answer. Each time a visitor answers, the banner adds a trcc_consent event to the data layer saying which kinds of cookie they agreed to, so the tags in your container can wait for their own kind. Where a reading finds Google Tag Manager, a Dashboard panel shows two ways to make advertising tags wait. On for new sites; sites that had the plugin before are offered it once.
  • Changed Reject all is now always exactly as wide and as tall as Accept all, in every design and whatever their words. On most sites it is a little wider than before, and on a phone the Slim design's buttons now fill the banner's width.
  • Fixed With Google Consent Mode on, Google's tags the banner puts back after an answer now receive the answer before they start, Google Tag Manager's container included. Before, they received it a moment after.
  • Fixed On a network of sites in sub-directories with translations in language folders, each site keeps one answer for all its languages. A visitor who still has separate answers from 1.3.2 has them joined into the one they gave last.
  • Fixed After updating from 1.2 or earlier, the Dashboard's all-clear comes back on a site where one page always answers with an error, such as a cart page in the Trash. What is held back and wp cookie-consent scan now name every page that answered with an error.
  • Fixed On a network of sites in sub-directories, a page cache switched on for one site only is now emptied after an update.
  • Changed The Dashboard's offer of the Cookie choices button stays until you switch the button on or save The banner, where its switch is.

1.3.2

  • Fixed Empty it and Ask everybody again do nothing until you confirm. Both were links, so opening one in a new tab or with the middle mouse button emptied the record, or asked everybody again, without asking you first. They are buttons now, and an old link or bookmark to either does nothing.
  • Fixed On a small phone every answer and choice on the banner can be reached. With the choices open on a small phone, a phone held sideways or a page zoomed to 200%, Reject all and Save my choices could sit below the foot of the screen, leaving Accept all as the only answer. The banner is now never taller than the window: its words and choices scroll inside it, and the three answers stay in view along its foot in every design.
  • Changed On a network of sites in sub-directories, each site asks for itself. The sites of such a network share one address, so an answer given on one counted on all of them, and another site's trackers ran on an answer its banner never asked for. Each site now keeps its own answer, in a cookie named for it and sent to that site only, and WP Consent API's cookies are named per site too, so visitors on such a network are asked once more on each site. Single sites and networks of sub-domains are unchanged.
  • Improved Your page cache is emptied after an update even if you do not open wp-admin. The plugin empties your page cache once after each update; with automatic updates this now happens at the next daily check if nobody has opened wp-admin. On a network of sub-directories, 1.3.2 emptied only caches switched on for the whole network; from 1.4.0 a cache switched on for one site is emptied too.
  • Fixed After an update that reads more of your site, the Dashboard no longer gives the all-clear until your site has been read again. A reading made before 1.3.0 could not see pasted snippets such as a Reddit or Microsoft Advertising pixel. The Dashboard now says the last reading was made by an earlier version, and with the monthly reading on, your site is read again at the next daily check rather than a month later.

1.3.1

  • Fixed Hold back holds back every way a script writes its address. A Hold back rule such as //example.com/ now also holds back a script that writes that address with nothing after the host (as PostHog's snippet does), with a port, with only a ? or # after it, or with a name and @ before the host. Until now such a script kept running while the list said it was held back.

1.3.0

  • New A Cookie choices button on every page. A small button in a bottom corner lets a visitor who has answered change that answer, and Escape puts the reopened choices away unchanged. It is on for new sites. Sites that had the plugin before keep it off and are offered it once on the Dashboard, unless a reading finds a Cookie choices link of their own.
  • Changed More advertising pixels wait for consent. The pixels of Microsoft Advertising, Reddit, Snapchat, Quora, Criteo, Taboola, Outbrain and Klaviyo, pasted into a page or loaded as a script, now wait for a visitor to agree to Advertising on existing sites too, and Klaviyo sign-up forms wait with them. Where your banner does not ask about Advertising yet, they wait for everybody until you press Read my site. Taboola recommendations and Criteo publisher ads are not held back, and an address you had already held back or left alone keeps your choice.
  • Improved Read my site lists what pasted snippets load. Other sites whose address a pasted snippet writes out in full are listed too, and wp cookie-consent scan --not-recognised gains a via column.

1.2.1

  • Fixed Hold back no longer lets WooCommerce order attribution run before visitors agree. On a shop that had saved What is held back before 1.2.0, pressing Hold back for a site the plugin does not recognise switched order attribution off, so its tracking cookies were set before anybody agreed. It stays held back now. The Dashboard and What is held back show each service's switch as it is now, so if you pressed Hold back after updating to 1.2.0, the Dashboard tells you to switch order attribution back on.
  • Fixed With Treat scrolling as agreement on, scrolling never overrules an answer. A visitor who pressed Reject all or Save and then scrolled was recorded as agreeing to everything. Scrolling now counts only while nobody has answered, and when the banner asks again about a newly added kind of cookie, scrolling agrees to that kind only.
  • Fixed Read my site answers on a slow site, and a reading that stops part way keeps what was found before. Read my site waits at most 45 seconds for your pages, reads the shop's product, cart and checkout first, and says how many pages it did not read; nothing found before is taken off the list until a reading reads every page. The monthly reading and wp cookie-consent scan still read every page.
  • Changed Scripts written with an older JavaScript type now wait for consent. A tag written as type="application/x-javascript", "text/javascript1.2", language="JavaScript" or similar ran before anybody agreed, and Read my site did not list the site it came from. These are now held back and listed like any other, and each is put back with the type it was written with once a visitor agrees.
  • Improved Settings, The banner and What is held back ask before unsaved changes are lost. Pressing Ask everybody again, moving to another of the plugin's screens, or sending another form such as Import with changes you have not saved now asks whether to go on without saving them.
  • Fixed French counts zero in the singular. French writes "0 message", not "0 messages", and the plugin's French now counts the way WordPress's own French does.

1.2.0

  • New Your site is read again every month. It starts on its own a month after your last reading, and when something new turns up the Dashboard says what it found; one press of Add what was found puts it on the banner and the cookie list. The banner never changes by itself, and if your last reading had found nothing, the Dashboard first names the kinds of cookie the banner will stop asking about. Read the site again every month under Settings → What it does switches it off.
  • New Other plugins can follow each visitor's answer. With the free WP Consent API plugin installed, WooCommerce, Site Kit and other plugins that read it follow what each visitor chose, and are told nothing is agreed once that answer runs out. There is nothing to set up here, and your cookie list names the cookies WP Consent API keeps the answer in.
  • New An Ask everybody again button in Settings. Under How it asks, it shows the banner again, with nothing ticked, to everyone who has answered, on their next visit. It asks you to confirm first when you click it (until 1.3.2, opening it in a new tab or with the middle mouse button asked everybody again without the question), and shows when you last used it. Save any other changes on that screen before you press it, because it does not save them.
  • Improved Reading your site now also reads your newest product, the cart and the checkout. Those are where shop tracking tags are usually printed. If your host stops your site reaching its own pages, the reading now stops after two pages and tells you why, instead of running on.
  • Improved Settings → Import / Export now also carries What is held back. The file takes the switch for each service, your own rules and the addresses you left alone. A file made before this update leaves What is held back on the site you import it into as it is.
  • Changed WooCommerce order attribution now waits until a visitor agrees to Advertising. It is held back on every shop, including shops that had this plugin before, so orders from visitors who refuse show the origin Unknown, and a shopper who arrives from an advert but agrees on a later page shows as Direct. If your banner does not ask about Advertising yet, every new order shows Unknown until you press Read my site on the Dashboard, and visitors who answered before are then asked once more, about Advertising. Switch it off under What is held back if you would rather it ran for everybody.
  • Changed Visitors who have already answered see the banner again when it starts asking about a new kind of cookie. Their earlier choices are still ticked, and the new kind is unticked and marked New. Nothing of that kind runs for them until they answer.
  • Changed Plugins that read WP Consent API now wait for the visitor's answer. If WP Consent API was already installed, it told them that a visitor who had not answered had agreed to everything. Now a visitor the banner asks counts as not having agreed until they answer.
  • Changed On some servers, visitors outside the countries you ask in stop seeing the banner. With Only where a banner is the law or Only in the countries I list under Who is asked, on a server that writes IPv4 addresses the IPv6 way behind a proxy of its own and sends no country header, the country lookup through WooCommerce saw the proxy, placed nobody and asked every visitor. Visitors it places elsewhere are now not asked, as the setting says.
  • Changed The privacy policy text the plugin suggests says more about its cookie. It now adds that the cookie notes which kinds of cookie the visitor was asked about, and when the site last asked everyone again. If you copied the earlier text into your privacy policy, add that sentence.
  • Fixed On servers that write addresses the IPv6 way, each visitor's answers count against their own limit. Some servers write a visitor's IPv4 address as ::ffff:203.0.113.7, and it is now read as 203.0.113.7 however it is written. On such a server behind Cloudflare or a proxy of your own, every visitor was taken for the proxy, so they all shared one hourly limit and, on a busy site, answers past it were not added to the Record; each visitor now has their own. Consent records still hold no address.

1.1.0

  • New Read my site lists scripts and embeds from sites the plugin does not recognise. Each one appears under What is held back with the page it was seen on, and you choose: hold it back until visitors agree to Preferences, Measurement or Advertising, or leave it loading and stop being asked. Nothing is chosen for you, and payment forms, spam checks and code libraries carry a Usually needed label. It lists what is written into the pages it reads, so a tag that Google Tag Manager adds later is not among them.
  • Changed Scripts and embeds written with single quotes or no quotes now wait for consent. A script or video from a service you hold back used to load before the visitor agreed when its address was written in single quotes, or with no quotes as some page optimisers print it, and so did some embeds that load only once scrolled into view. They are now held back like any other, so some sites will see one more script or video wait for consent after this update.
  • Changed The Dashboard no longer says nothing is getting past while unrecognised scripts are waiting. Until each one found has been held back or left alone, it says how many addresses have not been looked at and names up to four of them. Straight after this update it asks you to read your site again, because the last reading did not look for them.
  • Changed wp cookie-consent scan lists unrecognised sites in its JSON, CSV and YAML output. After the services, each site nobody has looked at yet is a row of its own, with Not recognised as its kind and NO under held back, so a script that reads this output will see more rows. The new --not-recognised option lists only those sites with an example address, and status has a new row, Addresses not looked at.
  • Fixed Held-back scripts and embeds come back as written once a visitor agrees. A script with an integrity check and a bare crossorigin, as some code library sites give you to paste, was refused by the browser even after the visitor agreed, and it now runs. An embed limited with a bare sandbox also came back with none of its limits, and now keeps them.

1.0.28

  • Fixed The Middle of the screen design no longer blocks clicks on your page when Dim the page behind it is off. The banner covered the whole window to centre its box, so nothing on the page could be clicked until the visitor answered, even with dimming switched off. Now only Dim the page behind it holds clicks back, and a link reached with the Tab key is moved out from behind the box when the window has room to show it clear.
  • Fixed On wider screens, the Side panel design no longer pushes floating corner buttons off the top of the screen. That includes a prize wheel's floating tab. On phones, where the panel shows as a sheet along the bottom, links reached with Tab are no longer left under it in current browsers. On wider screens, links behind the panel are still not moved out from under it.
  • Fixed Keyboard visitors no longer land on links hidden behind a banner along the bottom, along the top or in a corner. In current browsers, a link reached with Tab is brought clear of the banner, and a banner along the bottom or in a corner leaves room at the end of the page so footer links can be scrolled clear of it. A banner along the top still covers the first lines of the page until it is answered.
  • Fixed Pressing Choose from the keyboard takes focus to the first choice. Choose hides itself as the choices open, and focus used to fall out of the banner with it.
  • Fixed After changing cookie choices from a Cookie choices link or button, keyboard focus goes back to it. Focus used to fall to the page itself as the banner closed, so a visitor who had opened it from the foot of a page lost their place.
  • Fixed Pressing Load this content on a held-back video or other embed takes keyboard focus into it. The button goes as the embed loads, and focus used to fall to the page itself with it.
  • Fixed With several of our plugins on one site, licensing and updates for all of them run on the newest licence code any of them carries. The order WordPress loads them in no longer decides it, with one exception: while the first of our plugins that WordPress loads, usually the alphabetically first, is on a release from before this one, its older code still serves them all until that plugin is updated. An older plugin of ours can also no longer stop this plugin's admin screens loading.
  • Fixed wp cookie-consent export no longer builds the whole file in memory. It writes the record a thousand rows at a time, as the download on the Record screen does. An empty record now gets a warning that there is nothing in it, instead of a file holding only the header row.
  • Fixed The documentation no longer tells you to put [cookie_choices] in a menu. A menu shows a shortcode as plain text. It now explains the way that works: add a Custom Link with # as its address and give it the CSS class trcc-open.

1.0.27

  • Fixed A record table that could not be created no longer fails in silence. On a host whose database user may not create tables, every answer visitors gave was dropped, the Record screen looked like a quiet week, and the plugin had written down that its database work was done, so it never tried again. The screen now says the table could not be created and what to ask your host, and the plugin keeps trying, at most once an hour.
  • Fixed The reply the banner gets says whether the answer was really recorded. It reported the answer as kept whatever had happened: the table missing, the record full, the write refused, or a visitor changing their mind whose new answer could not be written over the old one. Anything you have watching that reply, a monitor or an integration, can now tell. The visitor's own choice is honoured either way, by the cookie in their browser.
  • Fixed On a network, creating one site's record table no longer confuses the rest of that request. Switching the plugin on across a network, or adding a site to one, left the remainder of that request holding another site's answer about whether its record table exists, and that is what decides whether a visitor's consent is written down at all.
  • Fixed A failed activation no longer wipes the licence key you had typed. When the licence server could not be reached, or sent back something we could not read, the screen threw away the key and the list of sites using it, and asked you to go and find the key again. It hit hardest where it mattered most: freeing a site on a full licence and pressing Activate. What is stored now stands until the licence server itself says otherwise.
  • Fixed A key the licence server does not recognise leaves the key box open. When a key is reissued, or deleted while a site still holds it, the box was greyed out and the only button on offer was "Deactivate this site", on the very screen the notice had just sent you to with "enter it again". You can now paste the right key straight in.
  • Fixed "Check again", "Deactivate this site" and "Free" work with the key box empty. None of the three reads what is in the box, but all three answered "Enter your licence key first." and sent nothing to the licence server.
  • New A "Check again" button on the licence screen. Renew your licence, or have it put right, and one press picks it up instead of waiting hours for the next automatic check. If the check cannot be made, the screen says why and nothing here is changed.
  • Improved Searching the Record screen no longer makes a wasted trip to the server first. Pressing Search sent the filter one way, got back something the screen could not use, and left the browser to send the form again the ordinary way. The filtered page is now fetched once.

1.0.26

  • Fixed "Read my site" reads your pages with the plugin's own blocking switched off, as it says it does. Every reading was taken from the held-back copy of the site instead, so a site with no Google tag of its own could be listed as running Google Analytics, and what a reading finds is what decides which kinds of cookie the banner asks visitors about. Every page of a reading is taken with the blocking off now, however slow the site is to answer. That copy is also marked as one no page cache may keep, so it can never be stored and served to a visitor with the tags live in it.
  • New Your own banner wording, in each visitor's language. Heading and What it says, under Words on The banner screen, can now be translated with WPML or Polylang: they are offered in WPML's String Translation under admin texts, and in Polylang's string translations. Each visitor reads the banner in their own language, while your settings screen goes on showing the words exactly as you typed them.
  • Fixed Pressing "Check again" on the Updates screen looks for a new version straight away. One failed connection to us left a note on the site that stopped every one of our plugins asking again for fifteen minutes, and "Check again" cleared this plugin's own wait but not that note. It clears both now.
  • Fixed Deleting the plugin clears away tables left behind by network sites that are gone. WordPress asks each plugin which tables are its own as it deletes a site from a network, but it does not load the plugins of the site it is deleting, so a site running this plugin on its own left its record of what visitors answered in the database with nothing to say whose it was. Deleting the plugin now finds those tables by name and drops them, once it has checked that the site really has gone.

1.0.25

  • Fixed Saving the Settings screen no longer resets your banner. Its design, colours, wording and privacy policy link were put back to the defaults on every save of that screen.
  • Fixed Reopening cookie choices shows what the visitor chose. The boxes are now ticked as they last answered, so pressing Save no longer withdraws their consent by accident.
  • Fixed Visitors whose browser sends Global Privacy Control can use the buttons when they reopen their cookie choices.
  • Fixed Country detection for shops never contacts an outside service. Working out a visitor's country no longer calls another website or writes to the database, and a visitor who cannot be placed is always asked.
  • Fixed Pages with a very large inline script are no longer sent as blank pages.
  • Improved Recording an answer is quicker, and the Record screen says when the record is full. Each answer used to count the whole record first. When the record reaches its limit, the screen now tells you that new answers are not being kept.
  • Fixed Activating from WP-CLI or a site-management tool no longer stops with a fatal error.
  • Fixed Deactivating the plugin across a network now tidies every site. Its daily task is removed and the page cache emptied on every site, except sites that still run the plugin on their own.

1.0.24

  • Improved Fewer database queries on every admin page. Each of our plugins checks its licence on every admin screen, to know whether to show the licence notice, and read its saved licence and its "Remind me later" flag with a query each. With the whole range installed that was thirty separate lookups on every admin page, most of them for rows that do not exist yet. They are now read together in one query (on WordPress 6.4 or later). Measured on a test site with all fifteen plugins: the WordPress Dashboard went from 41 queries of ours to 12.

1.0.23

  • Improved A download is made once, not twice. Pressing Download as a spreadsheet on the Record and Export settings built the file twice: the admin's no-reload navigation fetched it first, found a file rather than a screen it could show, and then asked for it again the ordinary way. On a long list that was twice the wait, and twice the work for the server. Each download is now a single request. Measured in a browser: two requests per click before, one after.

1.0.22

  • Improved Two database queries fewer on every page not served from a cache. Every public page reads the list of services held back and the last reading of your site. Before you first saved one or read the other, each was looked up in the database and not found, on every page view; and a reading, once made, was stored so that it was never loaded with the rest of the settings. Both are now made once and loaded with the settings. Measured on a shop's product page: the plugin's own queries went from two to none.

1.0.21

  • New A cookie list for your policy page. Put [cookie_list] on your cookie or privacy policy page and it lists each kind of cookie the banner asks about, what it is for, the services behind it, who runs each one and a link to that company's privacy policy. Under Necessary it lists the site's own cookies and how long they last: the visitor's answer, signing in, and the basket where WooCommerce is installed. It is built from exactly what the banner uses, so the list and the banner cannot disagree, and it says when the site was last read. On a phone each row becomes a short labelled block. The shortcode is on The banner screen, ready to copy.
  • Fixed Reading the site did not empty the page cache. What a reading finds decides which kinds of cookie the banner asks about, and cached pages kept asking about the old ones. The caches are now emptied after each reading, as they already were after changing what is held back.

1.0.20

  • Fixed Switches that start on could not be switched off. Under Settings, "Ask visitors about cookies", "Hold scripts back until somebody agrees", "Tell Google's own tags what they may do", "Let people choose category by category", "Take a browser's own refusal as an answer" and "Keep a record of what people answered" came back on after every save. A browser sends nothing for a switch that is off, and the plugin read that as "use the default", which for these is on. On The banner screen, "Dim the page behind it" could be switched on and then never off. Each now saves the way you left it. Tried in a browser: switched off, saved, reloaded, and it stayed off.

1.0.19

  • Improved Pages with the banner download less. The script and stylesheet visitors are sent are now minified: 8.7 KB became 4.4 KB compressed, 49% less, on every page that shows the banner. The readable files stay in the plugin, and a minified copy is only ever sent while it was built from the file as it is now, so an update can never be hidden behind an old copy. With SCRIPT_DEBUG on, the readable files are sent, as WordPress does for its own. Checked by photographing the same pages both ways at two screen sizes: identical, pixel for pixel.

1.0.18

  • Fixed One visitor's "do not track me" could be served to everybody. A browser sending Global Privacy Control or Do Not Track is not shown the banner and is recorded as refusing. That was decided on the server, from the request's headers, and written into the page, and your pages are cached. So a copy stored while such a browser was visiting refused every visitor after it (no banner, nothing optional ever running, and a record full of refusals nobody gave), and a copy stored for anybody else showed the banner to browsers that had already said no. The page now carries only whether the setting is on, and each visitor's own browser reads its own signal. Measured: the page is the same with and without the header, a browser sending GPC is refused without a banner, and an ordinary browser sees the banner.

1.0.17

  • Fixed Answers given on a page a cache had kept for more than a day never reached the record. The banner sent a WordPress security code with each answer, and that code expires within a day. A page cache serves the same copy for longer than that, and WordPress refuses any request carrying an expired code, so from then on every visitor's answer was turned away (HTTP 403, measured) and the record of consent quietly stopped growing. The banner no longer sends one: the record already checks its own page token, which does not expire. Measured again: an answer is kept.

1.0.16

  • Fixed A script that needs a library ran before the library had loaded. When a visitor agreed, the scripts that had been held back were put back all at once, and a script loaded that way arrives in the background. So a snippet written under the library it uses, like <script src="library.js"> followed by a line that calls it, ran first and found nothing. They are now put back one at a time in page order, and a script written without async or defer is waited for, the way the page itself would have run them. Measured with a library and the snippet that uses it: before, the snippet found no library; after, it did, on the first answer and on every visit after.
  • Fixed A held-back module script stopped with an error. A <script type="module"> was put back as an ordinary script, so its first import failed ("Cannot use import statement outside a module"). The plugin now remembers the script was a module and puts it back as one.

1.0.15

  • Fixed A held-back video left an empty gap and then made the page jump. In WordPress's own video block (every YouTube or Vimeo link pasted into the editor), the "Load this content" box sat under an empty 16:9 space the size of the video, and when the video loaded the article below jumped up by the height of the box: 238px on a desktop, measured. The box now takes the video's exact place, so nothing moves when it loads (0px, measured on a desktop and a phone). A frame pasted in with its own width and height, like a Google Map, keeps that size too.
  • Fixed A video loaded from its box lost its name and permissions. It came back with only its address and size, without its title (what a screen reader announces), what it is allowed to do (full screen, picture-in-picture) or the referrer setting YouTube checks. It now comes back with those, and never with anything that runs a script.

1.0.14

  • Fixed Import settings stopped with an error instead of importing. Choosing a settings file on the Settings screen and pressing Import ended on WordPress's critical error page, because the button never handed the file over. It now imports the file and says so: "Settings imported.", or which part of the file could not be used and why. Found by a static check of every plugin's code, and tried end to end on a test site: export a file, import it back, read the message.

1.0.13

  • New Ask only where the law asks. Under How it asks, choose who sees the banner: everyone (as before), only where a banner is the law — the EU, the EEA, the UK, Switzerland and Brazil — or only the countries you list. Where a visitor is comes from Cloudflare, if your site is behind it, or from WooCommerce's own geolocation; anyone who cannot be placed is still asked, because the safe mistake is a banner somebody did not need, never a tag somebody did not agree to. It works behind a page cache: the banner asks a tiny, never-cached question of your own site before it shows, and remembers the answer for the visit.

1.0.12

  • Improved One update check for all of our plugins on a site, instead of one each. Every plugin of ours used to ask our server about updates separately — fifteen requests in a row on a site with the whole range, twice a day and every time you press "Check again". The first plugin asked now asks for all of them at once, and the rest read the answer. Measured on a site with all fifteen: fifteen requests became one, and the whole check took a third of a second. If our server refuses or cannot be reached, every plugin waits the same fifteen minutes before trying again, rather than each trying in turn.

1.0.11

  • Fixed A banner at the top of the window now stands clear of the other things up there. It sits under WordPress's own admin bar for anyone signed in, and under a shipping bar pinned to the top, instead of covering them; and it tells a prize-wheel launcher or a dark-mode switch in a top corner how tall it is, so they stand below it rather than underneath it — the same rule the bottom of the window already follows.

1.0.10

  • Fixed The banner sat on top of the page's corner buttons. While the banner was showing, a prize-wheel launcher or a dark-mode switch in a bottom corner was underneath it and could not be pressed — on a phone, both were under the "Choose" button. The banner now says how much of the foot of the window it takes, so those buttons stand above it; and it stands above a shipping bar or a share bar rather than over their buttons. Found by a new check that reads every widget we put on a page the way a screen reader and a keyboard do, and hit-tests every floating control at its own centre.

1.0.9

  • Fixed A busy site could not download its own consent record. The whole record was read into memory before the file was written, so the bigger the record the more it cost — and measured on 200,000 rows, which a site with real traffic reaches inside a year, it needed 284 MB against the 256 MB WordPress allows. The file a regulator would ask for was the one file a busy site could not produce, and what you got instead was a blank page. It is now written out as it is read, a thousand rows at a time: the same 200,000 rows come out in under a second, and the size of the record no longer matters.

1.0.8

  • Fixed A wp-admin that would not load when our licence server could not be reached. Each of our plugins checked for its own updates, and if the server was unreachable each one waited out its own fifteen-second timeout — so a site with several of them could spend minutes on a single admin page, twice a day, for something entirely outside its control. The first one to find the server unreachable now says so for the whole site, and the others stand down until it is worth trying again. Measured on a site with fifteen installed: fifteen waits became one.

1.0.7

  • Fixed "Delete everything on removal" was leaving three rows behind. The licence records are stored under names the licence part of the plugin chooses, and the removal list had drifted from them — it named two rows nothing has ever written, and looked for a third in the wrong place. So it read as thorough while the real rows stayed. Tested by putting all four rows in place and removing the plugin: nothing is left now.

1.0.6

  • Fixed "Delete every row?" keeps asking on sites with a strict security policy. The question before emptying the consent record — the proof that people were asked, which cannot be got back — was written into the page in a way that some sites block for safety, which quietly removed it altogether. It is now asked in a way no security policy switches off.

1.0.5

  • Fixed A setting that is waiting on another one is readable again. A field held back until you switch something else on is dimmed, so it does not look identical to one you simply have not used — but it was dimmed so far that its label and explanation fell below the contrast a person with ordinary eyesight needs. Measured on the rendered screen at 2.55:1 against the 4.5:1 minimum, and now 4.75:1 and 5.02:1. The greying, the sunken background and the blocked cursor carry the rest of the signal.
  • Fixed The answer filter on the Record screen now says what it is. It had no label at all, so a screen reader announced a dropdown with no purpose.

1.0.4

  • Fixed It stopped asking the database whether its own table exists, over and over. Every part of the plugin checks before reading, which is right, but a single screen was asking six separate times to establish something that cannot change while a page is loading. It now asks once.

1.0.3

  • Fixed The daily tidy-up no longer holds the table while it runs. Clearing old rows from the record of answers was a single statement, however many rows matched. Measured on 300,000 of them: 6.63 seconds, and for all of it nothing else could write to the table. Worse, a host that cuts long queries off rolled the whole thing back — so nothing was deleted, there was more to delete the next day, and it quietly never caught up. It now goes a thousand rows at a time and stops after five seconds, leaving the rest for the next run.
  • Fixed Emptying the record of answers is no longer a wait. The button ran one delete over every row, which on a large table left the screen looking like it had hung for several seconds. It now empties the table outright: 161,000 rows in under a third of a second.

1.0.2

  • Fixed A site deleted from a network no longer leaves its tables behind. WordPress asks every plugin for the tables it owns when a site is removed, and this one never answered, so its record of answers stayed in the database for ever with nothing left to say which site it had belonged to. On a network that creates and removes sites regularly that is thousands of orphan tables and a database that stops fitting in its backup window. Deleting a site now takes its record of answers with it.

1.0.1

  • Fixed The page cache is emptied when it needs to be. A page cached before this plugin was installed still had the tracking tags live in it, and a cache would go on serving that page for days with the banner sitting on top changing nothing. Caches are now emptied when the plugin is activated, when you change what is held back, when you change the settings, and when you deactivate it.
  • Fixed The endpoint that records an answer could be used to fill your database. Anyone could post to it with made-up references and add a row each time. It now checks a word only a page of your site carries, limits how many rows one address can add in an hour, and stops writing entirely beyond a hard ceiling.

1.0.0

  • New The scripts really are held back. Every script and embed belonging to a service nobody has agreed to is rewritten so the browser will not run it and will not even fetch it. Measured on a site with Google Analytics, Tag Manager and Meta's pixel installed: nothing reaches a third party before the visitor answers.
  • New It reads your own site and tells you what is on it. A few of your pages, fetched as a visitor sees them, and a list of the third parties actually there — with a note beside anything that is not being held back yet.
  • New Twenty-odd services recognised out of the box. Google Analytics and Tag Manager, Meta, TikTok, LinkedIn, X, Pinterest, HubSpot, Hotjar, Clarity, Matomo, Yandex, YouTube and Vimeo embeds, Google Maps, Intercom, Crisp and Tawk. Anything else takes one line to add.
  • New Accept and Reject are the same size, in every design. Same row, same weight, one click each. Nothing is pre-ticked, scrolling is not treated as agreement, and a browser sending Global Privacy Control is not asked again.
  • New A record you can show somebody. A random reference the visitor's own browser also holds, the date, what was agreed to and the page. No address and no browser details. Downloads as a spreadsheet.
  • New Six shapes and your own colours. A bar, a corner box, a middle-of-the-screen panel, a slim line, a side panel, or a plain one with no card. Held-back embeds keep their space, so nothing jumps when a video loads.
  • New Google Consent Mode, WP-CLI, multisite, Spanish and French. Consent signals before any Google tag; wp cookie-consent scan, status and export; network activation sets up every site (on a large network, the rest on each site's first request, from 1.5.0).

Pricing

Every plan includes every feature. Choose how many domains, and whether to pay yearly or once.

Pay yearly renews until you cancel

1 domain One year of updates and support
$19a year
5 domains One year of updates and support
$29a year
Unlimited domains One year of updates and support
$39a year

Pay once (lifetime) no renewals

5 domains Updates and support for as long as we publish it
$49once
Unlimited domains Updates and support for as long as we publish it
$69once
  • Every plan includes every feature. You choose only the number of domains.
  • 30-day refund, no reason needed. Refund policy
  • Licence key and download straight after payment, by Stripe.
  • A lapsed licence stops updates and support. It never switches a feature off.
  • Local, development and staging copies are free and do not count against your domains.
  • Yearly plans renew at the then-current price until you cancel. Cancel any time from your account.
  • Where tax applies it is calculated at checkout and shown before you pay.

Licence questions