Cookie consent that fits the WordPress you already have
Your theme, your page builder, your cache, your shop, your forms: find yours and see what it adds to the browser and what Cookie Rocks does with it.
Not on our pages yet. It very likely works anyway: the free Audit tells you in a minute. Ask us to test it
150 plugins and themes tested · latest test 7 November 2026 · WordPress 7.1.3
Online shops
A shop has cookies that keep the cart, and cookies that track where orders come from. Only the second kind needs consent.
- WooCommerceOrder attribution cookies, and a checkout that must keep working.
- WooPaymentsStripe’s script on product, cart and checkout pages.
- WooCommerce PayPal PaymentsPayPal’s script and fraud check where buttons show.
- WooCommerce Stripe Payment GatewayStripe’s script on product, cart and checkout pages.
- YITH WooCommerce WishlistWishlist cookies that keep what the visitor saved.
- Cart Abandonment RecoveryAbandoned cart reminders, and a cookie that stops the follow-up.
Page builders and themes
Builders put videos, maps and forms in your pages. Each one can load an outside tool.
- ElementorThe Video widget loads YouTube with a script.
- Essential AddonsSticky videos held, a few widgets that call other sites.
- SpectrareCAPTCHA in forms and Google Maps, both held.
- Happy Addons for ElementorElementor widgets, and an age gate that remembers.
- Beaver BuilderYouTube backgrounds held, Google Fonts to host yourself.
- AstraNo cookie of its own, Google Fonts once you choose one.
See all 17
- BlocksyIts own Analytics field and notice: leave both off with a consent plugin.
- Hello ElementorA bare theme: no cookie, no outside request.
- KadenceBackground videos held, Google Fonts to host yourself.
- NeveNo cookie of its own, an extra notice to avoid.
- OceanWPGoogle Fonts on by default, widgets that load other sites.
- WordPress themesFonts, videos, widgets and extra notices, theme by theme.
- Builders and add-onsVideo backgrounds, sticky videos, maps and reCAPTCHA, held.
- Elementor ProPop-up counters and countdowns kept in the browser.
- Divi EnginePlugins for Divi that remember the grid or list view.
- WordPressHeader videos, video shortcodes, embeds and avatars, with no plugin at all.
- DiviContact forms with reCAPTCHA, videos and maps in modules.
Multilingual sites
The banner and your policies should speak the language of the page.
- GTranslateTranslation on request, never held by Cookie Rocks.
- PolylangEach page in one language, policies translated page by page.
- TranslatePressNo cookie of its own, and the right language for the banner.
- WeglotTranslated on your server, quiet in the browser by default.
- MultilingualPressOne site per language, one choice per site.
- Translation pluginsWhere the text is translated, and in which language the banner shows.
Google’s tags, Consent Mode and Tag Manager.
- Site KitGoogle’s tag on every page, and a consent setting of its own.
- MonsterInsightsThe Google Analytics tag from MonsterInsights, held until consent.
- Google for WooCommerceThe Google Ads tag of your shop and its own consent defaults.
- GTM4WPYour Tag Manager container, held until the visitor agrees.
- GA Google AnalyticsThe Google Analytics tag, held until the visitor agrees.
- ExactMetricsThe Google Analytics tag from ExactMetrics, held until consent.
See all 11
- Google Analytics for WooCommerceThe Google tag of your shop, held until consent.
- GTM KitThe Tag Manager container from GTM Kit, held until consent.
- Google Tag Manager pluginThe container from the Google Tag Manager plugin, held until consent.
- Google tag pluginsPlugins that add Google’s tag or a Tag Manager container.
- Google Tag ManagerCookie Rocks reads your public Tag Manager container, lists the tools it loads and adds them to your cookie policy.
Analytics and ad pixels
Plugins that count your visitors or add Meta, Google and other tags to your pages, often with cookies of their own.
- JetpackStats, comments, videos and images from WordPress.com.
- WP StatisticsVisitor counts on your own server, without cookies.
- Meta Pixel for WordPressThe Meta pixel, plus Meta cookies sent from your server.
- Meta for WooCommercePixel and server events, with a hold switch for consent.
- PixelYourSiteMeta and Google tags, plus first-party cookies of its own.
- TikTok for BusinessThe TikTok pixel held, server events to decide.
See all 20
- Microsoft ClarityClarity on every page, with no consent signal.
- HubSpotHubSpot’s loader on every page, consent only in HubSpot.
- Burst StatisticsWaits for statistics consent when WP Consent API is there.
- MatomoStatistics from your own site, consent through Matomo’s API.
- Independent AnalyticsNo cookie, but returning visitors are still recognised.
- Koko AnalyticsStatistics on your own site, with a cookie by default.
- SlimStat AnalyticsNo consent check by default; one setting changes that.
- HotjarHotjar held until the visitor agrees.
- Pixel ManagerUp to ten shop pixels from one script, held until the visitor agrees.
- Plausible AnalyticsStatistics with no cookie, from plausible.io or your own site.
- Pixel CaffeineThe Meta pixel on every page, with no consent setting.
- Ad pixel pluginsMeta and TikTok pixels, and what your server sends.
- Statistics on your own siteStatistics plugins that count on your own server.
- Fathom AnalyticsStatistics with no cookie, from cdn.usefathom.com.
Ads
Ad plugins place ad code on your pages. Ads from an ad network need consent first.
Consent for other plugins
How other plugins learn the visitor’s choice.
Forms and captchas
A captcha that needs consent can stop a form from sending.
- Contact Form 7reCAPTCHA on every page, and messages that must not be lost.
- WPFormsOne captcha per form, and answers that survive the wait.
- Fluent FormsNo cookie with default settings.
- ForminatorCaptchas per form, and one AJAX option to watch.
- Ninja FormsNo cookie with default settings.
- Gravity FormsreCAPTCHA scores every entry, and the score needs consent.
Newsletters and popups
Sign-up forms, popups and email marketing. Some add a tracker of their own.
- MC4WP: Mailchimp for WordPressSign-up forms with no cookie, an optional tracker on top.
- OptinMonsterCampaigns from OptinMonster’s servers, built by an inline script.
- Popup MakerIts own cookie is harmless, its content is not always.
- MailPoetLight forms, but server cookies for known subscribers.
- Mailchimp for WooCommerceA Mailchimp script, server cookies and cart tracking by default.
- KlaviyoA script on every page, and a checkout that sends data by itself.
Chat and messaging
Chat buttons and widgets. A link waits for the click, a hosted widget may need consent.
- JoinchatA WhatsApp button, plus click events for Google and Meta.
- Click to ChatA WhatsApp button that contacts no one before the click.
- ChatyChat buttons that stay, and remember their state in the browser.
- tawk.to Live Chattawk.to’s chat held until consent.
- WP WhatsAppA WhatsApp button with a cookie only after its own box is ticked.
- TidioTidio held until consent, started without a reload.
Bookings, events and courses
Booking calendars, event pages and online courses, often with payments and maps inside.
- The Events CalendarNo cookie of its own, a Google map on every event by default.
- Tutor LMSA Google font on learning pages, videos from YouTube and Vimeo.
- AmeliaA booking form that loads payments, maps and tags by itself.
- BooklyNo cookie by default, outside scripts added while the form runs.
- Simply Schedule AppointmentsA booking iframe that a page rewrite never sees.
- EventinEvents with one item of local storage and no cookie.
Galleries, feeds and maps
Galleries, sliders, social feeds and maps. Some load from your site, some from another company’s servers.
- Smash Balloon Instagram FeedFeed images come from Meta unless GDPR mode is on.
- Widgets for Google ReviewsReviews wait for Trustindex, images load anyway.
- Smart Slider 3Google Fonts by default, video players built by script.
- NextGEN GalleryImage galleries stay at home, video players call their provider.
- WP Go MapsMap code and tiles from other servers, before the choice.
- Envira Gallery LiteYour own images, nothing loaded from elsewhere.
See all 11
- FooGalleryImages from your site, frames only on request.
- Smash Balloon Custom Facebook FeedMeta pictures and Like Box, unless GDPR mode is on.
- Embed Plus for YouTubeIts own script loads YouTube, so it waits with YouTube.
- Galleries and slidersImages stay at home, videos and fonts call out.
- Feeds and embedsContent from Meta, YouTube, Google or Trustindex, before the choice.
Social sharing
Share buttons and social icons. A plain link waits for the click, a button from another server may not.
- AddToAny Share ButtonsAddToAny’s script and frame on every page, before the choice.
- Simple Social IconsProfile links and icons from your site, nothing else.
- Ultimate Social Media IconsLocal links, except the YouTube and LinkedIn buttons.
- Social WarfarePlain share links, counts fetched by your server.
- Shared CountsPlain links, counts fetched by your server.
- Social sharingPlain links wait for the click, scripts call out at once.
Page cache
One cached page for everyone: the choice has to be read in the browser.
- LiteSpeed CacheDefers, combines and serves a guest version of every page.
- WP Fastest CacheOne cached file for everyone, held trackers kept out of the merge.
- WP-OptimizeA shared page cache, plus preload and delay options to handle.
- SiteGround OptimizerMinifies, combines and loads scripts asynchronously.
- WP Super CacheServes the same static file to every visitor.
- W3 Total CacheMinifies and caches nearly everything on a page.
See all 13
- BreezeA shared page cache, script delay, and lazy videos to watch.
- CloudflareNothing on visitor pages, but a cache to clear by hand.
- Jetpack BoostMerge, defer, image CDN and a page cache that reads cookies.
- NitroPackOptimized pages built after the banner, and a cookie of its own.
- HummingbirdNo cookie of its own, but combining and delaying need care.
- Swift Performance LiteMerged scripts, and an analytics option no banner can fully hold.
- WP RocketCan delay every script until the visitor interacts.
Optimisation
Scripts get delayed, deferred and combined. The consent script has to run first.
SEO plugins
SEO plugins add tags and verification codes to your pages.
Fonts
Fonts served by Google send each visitor’s address to Google.
Anti-spam
Spam protection that does not need a captcha.
- AkismetNo cookie in the browser, a check on your server.
- WP ArmourSpam protection with no cookie and no question.
- CleanTalkA bot detector on every page, before the visitor chooses.
- Advanced Google reCAPTCHAGoogle on every protected form, or a captcha from your own site.
- Simple Cloudflare TurnstileTurnstile classed as necessary, so forms keep working.
- Spam protectionServer checks, captchas and bot detectors, each in its place.
Security
Firewalls and login protection set cookies of their own.
Code in the header
Plugins that paste your snippets into every page. What they paste decides what needs consent.
Kinds of sites
What changes with the kind of site you run.
- Online shopsCart and payment first, attribution and pixels after a yes.
- Business websitesStatistics, forms, maps, reviews and chat: what each one asks.
- Personal sites and blogsA free Community key for a non-commercial site.
- News and ad-funded sitesPersonalised ads in Europe need a TCF certified tool. Cookie Rocks is not one.
- Courses and membershipsAccounts work, lesson videos and social logins wait.
- Sites for childrenNo statistics, no marketing, an adult before any video.
See all 12
- Sites for US visitorsDo Not Sell or Share, Global Privacy Control, state by state.
- Non-profit websitesA free Community key for associations that sell nothing.
- Multisite networksEach site of the network with its own banner, rules and proofs.
- Sites for European visitorsConsent first, an equal Reject button, proof of each choice.
- Sites for UK visitorsConsent first, five exceptions, advertising always asks.
- SaaS websitesNo visitor quota, Google Ads signals, customers from everywhere.
Hosting and CDN
What your host or CDN changes for the banner: the visitor’s country for rules by country, the page cache, and the headers it adds.
- Hosting and CDNWhere the visitor’s country comes from, and when Cookie Rocks trusts it.
- Bunny CDNSends the visitor’s country to your site, and replaces a forged one.
- LiteSpeed serverThe server looks up the country and gives it to PHP.
- KinstaRules by country read from Kinsta’s server variable.
- PantheonThe country read from the Pantheon-Geo header, after a check.
- WP EngineRules by country from WP Engine GeoTarget.
Plugins that add trackers of their own
Here is what each one loaded in our tests, with links to the trackers’ pages.
Every plugin and theme, A to Z
- Ad Inserter 2.8.20
- AddToAny Share Buttons 1.8.18
- Advanced Ads 2.0.29
- Advanced Custom Fields 6.8.11
- Advanced Google reCAPTCHA 5.42
- Akismet 5.7.2
- All 404 Redirect to Homepage 5.8
- All in One SEO 5.0.5
- Amelia 2.4.14
- Anti-Spam by CleanTalk 6.91
- Astra 4.14.2
- Autoptimize 3.1.17
- bbPress 2.6.21
- Beaver Builder 2.11.1.2
- Better Search Replace 1.4.11
- Blocksy 2.1.61
- Bookly 28.7
- Breeze 2.6.4
- BuddyPress 14.5.4
- Burst Statistics 3.7.4
- Buttonizer (Facebook Page Like Widget) 7.0.2
- Cart Abandonment Recovery for WooCommerce 2.2.2
- CartFlows 3.3.2
- Chaty 3.6.5
- Child Theme Configurator 2.6.7
- Classic Editor 1.7.0
- Click to Chat 4.46
- Cloudflare 4.14.5
- Contact Form 7 6.2.4.1
- Crisp 0.49
- Custom Post Type UI 1.19.3
- Debloat 1.4.0
- Divi 5.15.0
- Elementor 4.3.6
- Elementor Pro
- Embed Plus for YouTube 14.2.6.1
- Envira Gallery 1.16.3
- Essential Addons for Elementor 6.8.8
- Eventin 4.1.30
- ExactMetrics 10.3.0
- Find and Replace All 1.3
- Fluent Forms 6.2.17
- Flying Scripts 1.2.5
- FooGallery 3.3.17
- Forminator 1.58.4
- GA Google Analytics 20260810
- Google Analytics for WooCommerce 2.4.4
- Google for WooCommerce 3.10.0
- Google Tag Manager (plugin) 1.0.4
- Gravity Forms
- GTM Kit 2.23.1
- GTM4WP 2.1.1
- GTranslate 5.0.2
- Happy Elementor Addons 3.51.0
- Header Footer Code Manager 1.1.46
- Hello Elementor 3.5.2
- Hotjar 1.0.16
- HubSpot 11.3.75
- Hummingbird 4.0.0
- Independent Analytics 2.16.2
- Internal Link Juicer 2.26.1
- Jetpack 16.4
- Jetpack Boost 4.8.2
- Joinchat 6.4.2
- Kadence 1.5.2
- Klaviyo 3.9.0
- Koko Analytics 2.5.3
- LiteSpeed Cache 7.9.3
- Mailchimp for WooCommerce 6.3
- MailPoet 5.45.1
- Maintenance 4.33
- Matomo 5.13.1
- MC4WP: Mailchimp for WordPress 4.15.0
- Members 3.3.1
- Meta for WooCommerce 3.7.8
- Meta pixel for WordPress 5.2.2
- Microsoft Clarity 0.10.37
- MonsterInsights 11.3.0
- MultiLingualPress
- myCred 4.0.3
- Neve 4.2.17
- NextGEN Gallery 4.5.5
- Ninja Forms 3.16.0
- NitroPack 1.20.4
- OceanWP 4.2.8
- OMGF 6.4.1
- OptinMonster 2.17.1
- Perfmatters
- Pixel Caffeine 2.3.3
- Pixel Manager for WooCommerce 1.72.0
- PixelYourSite 11.4.5
- Plausible Analytics 2.6.4
- Polylang 3.9.1
- Popup Maker 1.25.0
- PW WooCommerce Gift Cards 2.55
- Query Monitor 4.1.1
- Rank Math SEO 1.0.281
- Really Simple Security 9.8.4
- Shared Counts 1.5.0
- Simple CAPTCHA with Cloudflare Turnstile 1.44.5
- Simple Social Icons 4.1.0
- Simply Schedule Appointments 1.6.13.0
- Site Kit by Google 1.191.0
- SiteGround Optimizer 7.8.6
- SlimStat Analytics 6.0.0
- Smart Slider 3 3.5.1.40
- Smash Balloon Facebook Feed 4.15.1
- Smash Balloon Instagram Feed 6.15.1
- Smush 4.3.6
- Social Media and Share Icons (Ultimate Social Media) 3.0.2
- Social Warfare 4.5.6
- Spectra Legacy 2.20.6
- SVG Support 2.6.3
- Swift Performance Lite 2.3.7.5
- tawk.to Live Chat 0.9.3
- The Events Calendar 6.18.3.1
- Tidio Chat 8.0.1
- TikTok 1.4.3
- TranslatePress 3.3.9
- Tutor LMS 4.2.0
- UpdraftPlus 1.26.14
- User Role Editor 4.67
- W3 Total Cache 2.11.0
- Weglot 6.4.3
- Widgets for Google Reviews 14.3
- WooCommerce 11.2.2
- WooCommerce Legacy REST API 1.0.6
- WooCommerce PayPal Payments 4.2.0
- WooCommerce Stripe Gateway 11.1.1
- WooPayments 11.2.1
- Wordfence Security 9.0.2
- WordPress Importer 0.9.7
- WP Activity Log 5.7.0
- WP Armour 2.4.02
- WP Chat App 3.8.2
- WP Consent API 2.1.0
- WP Fastest Cache 1.5.5
- WP Go Maps 10.1.10
- WP Headers And Footers 3.2.0
- WP Mail SMTP 4.10.3
- WP Rocket
- WP Statistics 14.16.18
- WP Super Cache 3.1.5
- WP-Optimize - Clean, Compress, Cache 4.7.0
- WPCode 2.4.1
- WPForms 2.0.4
- WPML 5.2.0
- YITH WooCommerce Wishlist 4.20.0
- Yoast Duplicate Post 4.7
- Yoast SEO 28.8
How we test
On live sites
Some plugins are tried on real WordPress sites, with their real settings, before a release.
Version after version
Around each version of Cookie Rocks, a fresh WordPress installs each plugin in its latest version from WordPress.org and checks that the banner shows, trackers wait and nothing breaks.
Trackers, one by one
Plugins that add trackers are set up with test IDs. We check that their tags do not load before the choice, and do load after it.
Not on this list? It very likely works anyway
Cookie Rocks does not need to know your theme or your plugins: it reads what your pages actually load, whatever made them. The free Audit tells you in a minute how your own stack behaves.
Want yours tested by name? Tell us, and we add it to the tests.
Whatever your stack
Try the complete plugin on your own site.
30 days, every feature
Every feature, every update and support, for 30 days. Nothing breaks when the trial ends.
- During the trial: everything, including the full settings and the scans
- After 30 days without a key: the banner, your visitors’ choices and your proofs of consent keep working
- What waits for a key: most settings, updates and support
Get your trial key
Your e-mail and your site. Your key arrives as soon as you confirm your e-mail.