Cookie Consent → What is held back. The plugin already knows about:

Measurement — Google Analytics, Google Tag Manager, Hotjar, Microsoft Clarity, Matomo, Yandex Metrica
Advertising — Meta's pixel, Google Ads, TikTok, LinkedIn Insight, X, Pinterest, HubSpot, Microsoft Advertising (UET), Reddit, Snapchat, Quora, Criteo, Taboola, Outbrain, Klaviyo, WooCommerce order attribution
Preferences — Google Maps, Intercom, Crisp, Tawk.to
Embeds — YouTube, Vimeo

Each is recognised two ways: by part of its address, and by a phrase from its own snippet — because half of them are pasted inline rather than loaded from a file.

Advertising pixels pasted into a page. Microsoft Advertising, Reddit, Snapchat and Quora pixels, and Criteo, Taboola, Outbrain and Klaviyo, are usually pasted in as a few lines of code that fetch the real script afterwards. Each is recognised by the address its own published code loads, and, for Microsoft, Reddit, Snapchat, Quora and Outbrain, by the call a later snippet makes on its own, such as a purchase on the order page, which then waits with it and runs after it. They are held back until the visitor agrees to Advertising, on every site, including sites that had this plugin before they were added. On such a site the banner may not ask about Advertising yet: until you press Read my site, or Add what was found on the monthly reading's note, nobody can agree to Advertising and those pixels wait for everybody. When your last reading already listed one of them as an address from another site, the Dashboard names it under Worth doing next. Klaviyo's sign-up forms come from the same script as its tracking, so they appear only for visitors who agree to Advertising. Any of them can be switched off under What is held back if you would rather it ran for everybody.

Only the pixels. Taboola's recommendations and Criteo's ads on a publisher's own pages come from other files on the same sites, and are left as they were.

A choice you made before stands. If you had already dealt with one of these sites' addresses on the list of sites this plugin did not recognise:

held back with Hold back as…, it stays the kind of cookie you chose, and the pixel's own calls wait for that kind too. The switch says so;
left loading with Leave it, it goes on loading for everybody. Its switch starts off, with the reason beside it, and the Dashboard says it is not being held back until you switch it on. Switching it on takes its address off the Left alone list.

A settings file from an earlier version brings those choices with it.

WooCommerce order attribution is WooCommerce's own record of where a shopper came from (a search, an advert, another site), shown as the Origin of each order. It writes sbjs_* cookies that follow the visitor from page to page, so it waits for Advertising like any other tracker. Orders from visitors who refuse Advertising show the origin Unknown. For visitors who agree, it starts on the page where they agree: a shopper who agrees on the page they arrived at is recorded as before, but one who arrives from an advert and answers on a later page is recorded as coming from your own site, which WooCommerce shows as Direct. It is held back on every site, including sites that had this plugin before, and you can switch it off under What is held back if you would rather it ran for everybody. If your last reading was made before this version, the banner may not ask about Advertising yet, and then the Dashboard's Worth doing next asks you to read your site again: until you do, nobody can agree to it and every new order shows Unknown. Once you have, visitors who answered before are asked once more, about Advertising (see Asking again).

Plausible and Fathom are switched off by default. They set no cookie and hold no identifier, so on most readings they need no consent at all, and holding them back would cost you your only honest traffic number for nothing. Switch them on if you would rather.

Something the plugin does not know#

Add a rule at the bottom of that screen: part of the script's address (cdn.example.com) or a word from inside it (trackerInit(), and which kind of cookie it sets. Anything matching is held back with the rest.

What you type is kept as you typed it: a <, a per cent code such as %23, an entity such as &, a tab and a run of spaces included. Only control characters other than the tab are taken out, and spaces or tabs at either end, and a rule keeps its first 190 characters. The box shows each rule exactly as it is kept, so pressing Save on that screen leaves it as it is.

A rule is looked for in a snippet's text exactly as the page's source writes it, such as if(w<768)trackerInit( or p?a=1&b=2. In a script's or an embed's address it is looked for as a browser reads the address, per cent codes and all, so there write & where the page's source has & or &. The name you give a rule is what the [cookie_list] table shows visitors, and it is cleaned as words are. Left empty, the rule is named after what it matches.

Before this version a rule was cleaned as if it were words. A < was kept as <, per cent codes were taken out and runs of spaces were run together, so such a rule matched nothing while the screen listed it. A rule saved that way is kept as it was saved, and its box shows what it holds: where you typed a <, it shows <. Type the < in its place and press Save. An address whose per cent codes are missing has to be typed again. Before this version, too, each rule's box on that screen was drawn empty, so pressing Save there removed every rule of your own, the ones Hold back made included. If a site you had held back is listed again under On your pages, from sites this plugin does not recognise, hold it back again.

Scripts and embeds from sites the plugin does not recognise#

Reading your site also lists every other site the pages load a script or an embed from, in the panel On your pages, from sites this plugin does not recognise under the list of services it found. Each row shows the address (the site's host name), the page it was seen on, and an example of the file, with anything after a ? taken off.

A row found inside a snippet pasted into a page, rather than as a tag's own address, says Loaded by a snippet on and the page, because nothing in the page's source names it as a script.

Each row asks one question, and nothing is chosen for you:

Hold back as… Preferences, Measurement or Advertising, then Hold back. This adds a rule of your own named after the host, the same kind of rule you could type at the bottom of the screen, and empties your page cache. The rule is the host between slashes, such as //example.com/, so it catches that host's addresses (with a port, with no path, or with a name and @ before the host too) and an inline snippet that loads from it. That includes a snippet that writes the address with nothing after the host, with a port, with only a ? or # after it, or with a name and @ before the host, such as 'https://example.com', and adds the file's name later. Any inline script that writes the address one of those ways waits too, so if a script of your theme's names "https://example.com", it waits with the host. An e-mail address at the host, such as info@example.com, is not an address it loads from and does not count. A rule you type in that shape yourself, or bring in with a settings file, works the same way. It does not catch shop.example.com, or example.com.au, or any other host whose name only begins or ends the same way, so holding back your company's example.com on a shop at example.com.au leaves the shop's own files alone. From then on the script or embed waits until a visitor agrees to that kind of cookie.
Leave it keeps it loading and stops asking about it. It moves to the Left alone list under the table, where Look at it again takes it off that list. It shows in the table again straight away if the last reading found it, and otherwise after the next reading, if your pages still load it.

Payment forms, spam checks and code libraries (Stripe, PayPal, reCAPTCHA, hCaptcha, Cloudflare Turnstile, jsDelivr, cdnjs and the like) carry a Usually needed label, and so do Jetpack's copies of WordPress files and addresses on your own domain that are not your site itself, such as a cdn. or media. subdomain. Holding one of those back usually breaks the page it is on, such as the checkout, so hold back only what tracks visitors. A tag manager or a statistics tool can run from a subdomain too, which is why those are listed at all.

Until every row has been dealt with, the Dashboard says how many addresses have not been looked at, names the first four and says how many more there are, instead of Asking, and nothing is getting past. Holding a host back or leaving it alone clears it straight away, without reading the site again. The list holds 50 hosts at most. When a reading found more, the ones it had no room for count as not looked at until you read your site again, even once every listed row is dealt with, so the Dashboard, the panel and the command line say how many more were found rather than that nothing is waiting. A first reading that could not read any page cannot say either way, and nor can one made by an earlier version of the plugin that looked for less than a reading does now, such as one made before readings looked inside pasted snippets. The Dashboard then says Asking, and holding things back and asks you to read your site again, and What is held back says so above its lists, which still show whatever that reading found.

What it reads: the address of each <script> and <iframe> in the page as it leaves your server, and the inside of each snippet pasted into the page (an inline <script>). In a snippet it takes each address written whole in quotes that ends in .js. In a snippet that builds a <script> tag itself (createElement('script')), which is how a chat tool or an advertising pixel usually arrives, it takes every address written whole in quotes, a picture's or a plain web address's included, since such a snippet can send what it collects to any of them. Your own site's addresses are never listed, and neither are the settings WordPress prints for other plugins' scripts, whose addresses are written with \/. Nor is an address that no browser can load, such as one with a letter in its port (https://example.com:80a/), whether in a snippet or as a tag's own address. Hold back on any row holds back what loads from that host, a row that an earlier reading found and a later one kept included. It takes at most 20 addresses from one snippet and 200 from one page.

What it does not do: it reads the same pages as the rest of the reading (the home page, the posts page, the latest post and, on a shop, the shop page, the newest product, the cart and the checkout), so a script that appears only on other pages is not listed. A script that another script adds while the page runs is still not listed when its address is not written in a snippet on the page: a tag that Google Tag Manager adds, or an address a snippet puts together from pieces. Nor is an image or a pixel, or anything inside <noscript>, which loads only in a browser that runs no scripts (such as Google Tag Manager's frame for those browsers). A host written in letters outside the Latin alphabet, or as an IPv6 number in square brackets, is not listed. It keeps at most 50 hosts, and says how many more there were. A rule you write by hand that matches only what comes after the ? in an address clears its row at the next reading, since the reading keeps addresses without that part. Your choices here are kept with the rest of what is held back, and the settings file under Settings → Import / Export carries them to another site (see Moving your set-up to another site).