Cookie banner for a business website

Widgets for Google Reviews (Trustindex) sets ti-success = connected or disconnected for 60 seconds in its Advanced settings tab, after the editor connects or disconnects the review source, reads it once on the next admin page and deletes it. Editors only, never for visitors. The Audit 2.9.11 lists it as unknown.

Cookie Rocks lists the site cookies of Wordfence (wfCBLBypass, wf_loginalerted_*, wfls-remembered-*), Forminator (poll-cookie-*, forminator_stripe_payment_owner), WP WhatsApp (nta-wa-gdpr) and WPForms Pro (_wpfuuid) in the cookie list it writes, with their purpose.

With Site Kit's Google tag gateway on, the Google tag is served by the site itself: a script with the id google_gtagjs-<tag ID>-js loads /wp-content/plugins/google-site-kit/gtg/measurement.php?id=<tag ID>. That file forwards each request to <tag ID>.fps.goog with the visitor's IP address and request headers. The browser never contacts a Google address directly, so a banner that only knows Google's addresses does not see the tag.

Cookie Rocks recognises the Google tag that Site Kit serves from the site through its tag gateway (gtg/measurement.php?id=G-, GT- or AW-) and holds it until consent, like the tag served by Google. Site Kit's short inline script that only fills the dataLayer still runs before the choice, after the default consent set by Cookie Rocks.

On a fresh WordPress home page with default settings, Contact Form 7, WPForms Lite, Forminator, Fluent Forms and Ninja Forms set no cookie, keep nothing in the browser's storage and load no known third-party tool, before or after Accept all (no form or captcha placed on the page).

On a fresh WordPress home page with default settings (no account, key or content set up), TranslatePress, Weglot, Smash Balloon Instagram Feed, WP Go Maps, MailPoet and Matomo for WordPress set no cookie, keep nothing in the browser's storage and load no known third-party tool, after Accept all.

WhatsApp button plugins keep their state on the site only: Click to Chat stores ht_ctc_storage, Joinchat stores joinchat_views (a page-view counter updated on every page) and joinchat_hashes, and WP WhatsApp (NinjaTeam) sets nta-wa-gdpr for 30 days only when the visitor ticks its consent box. None of them contacts Meta before the click.

With Site Kit's Sign in with Google module, Cookie Rocks holds both Google's script (accounts.google.com/gsi/client) and Site Kit's own sign-in script until consent: before the choice there is no g_state or googlesitekit_auth_nonce cookie. After Accept all, without a reload, the button and One Tap appear. On wp-login.php, where no banner is shown, the button works as usual. If accounts.google.com does not answer, the button does not appear, as without Cookie Rocks. Before 2.5.2 both scripts ran before the choice.

Once reCAPTCHA keys are saved, Contact Form 7 enqueues google-recaptcha (api.js?render=) and wpcf7-recaptcha on every page, not only pages with a form, and calls grecaptcha.execute on each page load. Turnstile (challenges.cloudflare.com/turnstile/v0/api.js) also loads on every page once its keys are saved, and js.stripe.com/v3/ wherever CF7 scripts load when Stripe is set up. The filter wpcf7_use_recaptcha_net switches reCAPTCHA to www.recaptcha.net.

On Contact Form 7 forms protected by reCAPTCHA, Cookie Rocks shows a permission request above the form, holds the send until reCAPTCHA is allowed, reloads without losing what was typed, and loads reCAPTCHA from recaptcha.net. A setting can treat reCAPTCHA as necessary.

Contact Form 7 reads and sets no cookie and sends nothing to other sites unless reCAPTCHA, Turnstile, Akismet, Stripe or a mailing tool is turned on. A submission records timestamp, IP address, port, user agent and page URL. The nonce is added only for logged-in users, so a cached form page stays valid for visitors. It does not use WP Consent API.

If grecaptcha is missing, Contact Form 7's wpcf7-recaptcha script stops with an error before it wraps the submit, so the form is sent without a token and CF7 files it as spam ('reCAPTCHA response token is empty.') and sends no email. An empty Turnstile token is also treated as spam.

WPForms loads its captcha only on pages that show a form using it, in the footer: reCAPTCHA (www.google.com/recaptcha/api.js), hCaptcha (hcaptcha.com/1/api.js) or Turnstile (challenges.cloudflare.com); the address can be changed with the wpforms_frontend_captcha_api filter. Its No-Conflict mode dequeues other scripts from google.com/recaptcha, gstatic.com/recaptcha and hcaptcha.com/1, but not recaptcha.net. It sends a Permissions-Policy header for private state tokens on every request.

WPForms Lite sets no cookie for visitors: its front script writes _wpfuuid (random ID, 3,999 days, SameSite=Strict) only if uuid_cookie is true, which Lite hardcodes to false, or if a wpforms.hasRequiredConsent JavaScript function exists and returns true. Form analytics (2.0) send form-view data to the site's own admin-ajax.php by sendBeacon, with an in-memory session ID, no cookie or storage, and skip authors, editors and administrators. It does not use WP Consent API.

WP Go Maps loads its map libraries without any consent condition: the Leaflet engines, including the zero-cost engine of new installs, from unpkg.com (leaflet, maplibre-gl); the newer OpenLayers engine from cdn.jsdelivr.net; the classic OpenLayers engine from the site (lib/ol.js). These load even when its own consent notice is on. With OpenStreetMap-type engines the map and its tiles (tile.openstreetmap.org, tiles.openfreemap.org and others) are requested by JavaScript, so a consent plugin reading the page HTML does not see them. The Google engine adds a maps.googleapis.com script tag with a callback.

The review widget of Widgets for Google Reviews is written into the page by the server but hidden (opacity 0, height 0) until cdn.trustindex.io/loader.js formats it; if that script is held, visitors see no reviews until they accept. Its star icons and platform logos (cdn.trustindex.io) and reviewer photos are plain <img> tags with the skip-lazy class, so they load before any choice even when loader.js waits. Widgets with an ID also add a stylesheet from cdn.trustindex.io.

Widgets for Google Reviews removes consent markers that consent tools add through WordPress' script_loader_tag filter (attributes consent-required, consent-by, consent-id, and consent-original-src or type put back), at priority 9999999, and adds one consent plugin's ignore attribute to loader.js. It also excludes trustindex.io from the delay, minify and combine features of three performance plugins. An inline fallback recreates loader.js on DOMContentLoaded only if no script tag with its address is in the page, so a tag kept with its src as type="text/plain" is not bypassed. It has no consent setting and does not use WP Consent API.

On click, Joinchat sends a generate_lead event through gtag to each G- or GT- tag found, a Google Ads conversion if set, a dataLayer push and fbq('trackCustom') if fbq exists, then opens wa.me or web.whatsapp.com; if those tags are held, nothing reaches Google or Meta. Its click counter (on by default) posts to the site's /wp-json/joinchat/v1/track-click, and the server keeps a hash of IP, user agent, channel and number for 60 seconds. No WP Consent API or Consent Mode default; events joinchat:event and joinchat:track can be cancelled.

Joinchat writes joinchat_views to localStorage on page load when automatic opening is on (default: after 10 seconds and 2 page views). The cookieless setting (filter joinchat_get_settings) moves its keys to sessionStorage, and a negative automatic-opening delay removes all storage. The JavaScript event joinchat:starting can pause its start until joinchat_obj.resume().

With Site Kit's conversion tracking for WooCommerce and the gtagUserData flag (since 1.161.0), the purchase event carries user_data with the billing email, phone and name for Google's enhanced conversions. Its Reader Revenue Manager module loads news.google.com/swg/js/v1/swg-basic.js on the pages where its snippet is set.

Cookie Rocks lists the Google tag as Google Analytics (gtag.js), statistics only, without the Google Ads cookie _gcl_au and storage key _gcl_ls, when nothing shows Google Ads (no Google Ads tag seen on the pages or declared in GTM, no Site Kit Ads module) and one sign says there is none (the answer No Google Ads, or Site Kit active without its Ads module). Otherwise a GT- tag stays in statistics and marketing. A Google Ads ID (AW-) in the gtag.js address or in gtag('config', 'AW-...') counts as Google Ads.

With Site Kit's Ads module (a test AW- conversion ID), the Google tag counts as statistics and marketing. After Accept all, Google Ads sets _gcl_au and calls doubleclick.net. With consent to statistics only, no Google Ads cookie is set, but the loaded tag still sends Google a cookieless request with advertising consent denied (pagead2.googlesyndication.com/ccm/collect).

Site Kit prints its Google tag (gtag.js) in the page head. Cookie Rocks holds it there in basic mode: before any choice, no request goes to Google. After Accept all, Google Analytics sets _ga and _ga_<ID>; with statistics only, the same happens and advertising stays denied; after Reject all, gtag.js is never loaded. With a GT- test ID Google returned no configuration and set no cookie; the cookies were seen with a G- test ID.

With its Consent Mode setting on, Site Kit sets Google's default consent a second time, after the banner's, and only for a fixed list of 32 countries (EU, IS, LI, NO, GB, CH): the regions saved in Site Kit are not read. With WP Consent API present, it also sends its own consent updates after each choice; they grant functionality_storage as soon as the page opens (the functional category of WP Consent API), while statistics and advertising follow the visitor's choice.

With Site Kit, Cookie Rocks pushes its 'denied' consent default first in the dataLayer and asks Google to wait 500 ms; on Accept all it records 'granted' before releasing Site Kit's tag, so the tag reads denied, Site Kit's settings and events, then granted, and everything is sent as granted. After a refusal the tag never loads. In a browser test: no request and no cookie before the choice, Analytics and its cookies after Accept all.

When a banner holds Site Kit's Google tag (gtag/js), two other Site Kit scripts still run before the choice: the inline tag settings (google_gtagjs-js-after: linker, js, developer_id, config) and its content events provider. They only fill the dataLayer and send nothing to Google. Site Kit also replaces window.gtag with an equivalent function writing to the same dataLayer. After consent, events pushed before the choice are processed by the tag.

With Site Kit's Tag Manager module, the container (gtm.js) is held in the page head and loads only after consent. With its AdSense module, the Auto ads script (adsbygoogle.js) is held as marketing: it loads after Accept all, not with statistics only or after Reject all.

Site Kit declares itself compatible with WP Consent API, but its code reads WP Consent API only when its own Consent Mode setting is on. With that setting off, Site Kit pushes no consent command at all, and the visitor's choice reaches Google only through the banner's own Consent Mode signals.

WP Consent API keeps its wp_consent_* cookies for 30 days by default. A banner that writes them only at the click leaves Site Kit reading no consent after 30 days, while the banner's own choice is still valid. Cookie Rocks writes the visitor's choice to WP Consent API on every page: in a test, the wp_consent_* cookies were deleted and the page reloaded; they were set again to allow, and Site Kit and Google read granted.