Cookie consent that works with your page cache

On a Cloudflare Free zone, the Managed Transform 'Add visitor location headers' (Rules, Settings, Managed Transforms) is available, off by default. Turned on, it adds cf-ipcountry, cf-region-code, cf-ipcity and coordinates to requests sent to the site. Without it, only CF-IPCountry is sent (IP Geolocation setting), so a US visitor's state is unknown.

On a real site behind Cloudflare, the 'country database on this server' source of Cookie Rocks 2.7.0 worked end to end: signed manifest and signature read, 8,300,093-byte file downloaded in 0.5 s, checksum verified, source trusted. Test addresses got the right country and a private address got the strict rules. geo.php and the REST route answered with Cache-Control private, no-store and were never cached by Cloudflare (cf-cache-status DYNAMIC). A direct request to the site with forged Cloudflare headers got the strict rules.

Some hosts rewrite REMOTE_ADDR with the visitor's address behind Cloudflare (mod_cloudflare or mod_remoteip). There, Cookie Rocks 2.7.0 with the Cloudflare source gives every visitor the strict rules, because the request no longer seems to come from Cloudflare. The 'country database on this server' source reads that visitor address and gives the right profile.

With Combine JS on, WP Fastest Cache merges the site's own scripts in the page head into one file, whatever their type, so a tracker held by a banner can run from the merged file before the choice. Cookie Rocks 2.5.1 keeps held scripts out of the merged file.

With Delay JS on, WP-Optimize delays every script until the first interaction, consent banners included, unless they carry its exclusion attribute: a banner without it may not be shown or clickable. Cookie Rocks 2.5.1 marks its scripts so they are never delayed.

With Preload JavaScript files on, WP-Optimize adds a preload link for every script, so the browser downloads a held tracker (for example Google's gtag.js) before the choice, without running it. Cookie Rocks 2.5.1 hides the address of held scripts from it.

With the page cache of W3 Total Cache (Disk: Enhanced), WP Super Cache (Simple mode), WP Fastest Cache or Breeze turned on, the page served from the cache keeps the Cookie Rocks banner, and each visitor gets their own banner: a choice made by one visitor is never served to another from the cache.

With its default settings, Autoptimize does not aggregate scripts: it defers them ('Do not aggregate but defer' and 'Also defer inline JS' on), turning inline scripts into <script defer src="data:text/javascript;base64,...">. Only scripts with no type or a JavaScript type are aggregated or deferred, so a script held as text/plain by a consent plugin is left as it is. Tags carrying data-noptimize, data-cfasync or data-pagespeed-no-defer, or listed through autoptimize_filter_js_exclude, are not moved.

Breeze's page cache wraps the whole page from advanced-cache.php, so it stores the page after a consent plugin has rewritten it, the same for every visitor who is not logged in; no consent cookie creates a variant or bypasses the cache. Breeze sets cookies only for logged-in users (breeze_folder_name) and after a comment (breeze_commented_posts, 7 days). It has no WP Consent API or Consent Mode code.

In a test with Breeze's Delay All JavaScript (Expert preset) and Cookie Rocks 2.5.0, the held tracker stayed held, the banner appeared and the tracker ran after Accept all. The Delay JS inline scripts variant was not tested. Since 2.5.1 Cookie Rocks also adds its own scripts to Breeze's never-delay list (filter default_scripts_gnore_from_delay).

Breeze minifies, groups and delays only scripts with no type or a JavaScript type: a script held as text/plain is left untouched. Delay All JavaScript recreates delayed scripts at DOMContentLoaded and never delays scripts containing gtag(, ga( or googletagmanager.com. Breeze reads no no-optimize attribute, and the default list of 'Delay JS inline scripts' (off by default) contains data-noptimize and gtag.

Debloat's Defer JS, Delay JS and Delay All Scripts are off by default. It reads no standard no-optimize attribute: exclusions match the tag text (or id:, url:) in its Exclude Scripts lists and the filters debloat/delay_js_excludes and debloat/defer_js_excludes. Delayed scripts run on mousemove, mousedown, keydown, touchstart or wheel, or after the maximum delay; Defer Inline JS turns inline scripts into data: scripts with defer.

Debloat's output buffer starts on template_redirect at priority -999, outside a consent plugin's buffer at a higher priority, so it receives the rewritten page; it delays or defers only scripts with no type or a type containing javascript, so a script held as text/plain stays held. It does not merge scripts, has no iframe lazy loading in 1.4.0, and sets no cookie or browser storage on visitor pages.

Jetpack Boost's Defer Non-Essential JavaScript moves every script tag without data-jetpack-boost="ignore" to just before </body>, whatever its type, but does not change type or attributes and does not wait for a user gesture. Its output buffer opens at template_redirect priority -999999, outside the consent plugin's buffer, so scripts held as text/plain stay held.

Jetpack Boost's page cache key includes the URL, GET parameters and all visitor cookies except a fixed list (Cloudflare, sbjs_*, _ga*, tk_ai, tk_qs...). A consent cookie with a per-visitor value therefore creates one cache file per visitor and page after the choice. The cookie filter jetpack_boost_ignore_cookies must be added in wp-content/boost-cache-extra.php, because the cache is served before plugins load. The first view without a cookie stays cached.

LiteSpeed Cache's built-in exclusion list for combining (data/js_excludes.txt) contains gtag, gtm and dataLayer, but its list for deferred and delayed loading (js_defer_excludes.txt) does not. An inline gtag('consent','default',...) added by another plugin is therefore turned into type=litespeed/javascript under Load JS Delayed and runs only at the first gesture unless excluded. Only scripts with no type or text/javascript are processed, so trackers held as text/plain stay untouched.

LiteSpeed Cache's iframe lazy load skips an iframe with no src, or with data-src, data-no-lazy, data-skip-lazy or data-lazyloaded, and adds a noscript copy to the others. Under Load JS Delayed, iframes it processes get data-litespeed-src until the first gesture. Load Google Fonts Asynchronously only changes when Google Fonts load: the browser still contacts fonts.googleapis.com.

NitroPack builds its optimized page from a normal WordPress request made by its optimizer (X-Nitropack-Request header, Nitro-Optimizer-Agent), so the consent plugin's output buffer has already rewritten the HTML; with alwaysBuffer, NitroPack's buffer opens in advanced-cache.php and is outer. The cached page carries nobody's choice. Cache is bypassed by default only for logged-in users, comment_author, wp-postpass_ and woocommerce_items_in_cart. NitroPack has no WP Consent API or gtag('consent') code.

SiteGround Optimizer's Defer Render-blocking JavaScript adds defer, not async, to enqueued scripts, except handles excluded with sgo_js_async_exclude. Its page rewriting (combination, minification, fonts) and deferral are skipped for logged-in users. Its file cache skips requests carrying a fixed cookie list (sgo_bypass_cookies: logged-in, carts, comment author, wpSGCacheBypass) and never stores a response with Set-Cookie; a consent cookie set in the browser is not on the list, so cached pages stay the same for everyone.

In Swift Performance Lite, the setting that keeps third-party scripts out of Merge Scripts is saved as merge-scripts-exlude-3rd-party but read as merge-scripts-exclude-3rd-party, so it has no effect: external scripts are downloaded by the server and served from the site's merged file, and a tracker a banner does not recognise loses its original address in the page. Its page cache key ignores cookies and Set-Cookie headers are not cached.

Swift Performance Lite opens its output buffer when plugins load, before a banner's template_redirect buffer, so it receives the page already rewritten. Merge Scripts only merges scripts with no type or a JavaScript type, so scripts held as text/plain stay in place; the only exclusion it reads is data-dont-merge. Without it, a banner's own scripts are merged into the footer file and, with Delay Async Scripts, run only at the first gesture. Cookie Rocks 2.5.1 puts data-dont-merge on its tags and clears Swift's cache when its settings are saved.

WP Fastest Cache opens its output buffer when the plugin loads, outside a consent plugin's buffer opened at template_redirect, so it stores the page already rewritten by the consent plugin and serves the same file to every anonymous visitor (via .htaccess or PHP). No consent cookie bypasses its cache by default; a $consent_cookie variable in its rules is always empty. The free version sets no cookie and adds no third-party request on visitor pages, and it does not use WP Consent API or Consent Mode. It refuses to enable its cache while one specific consent plugin is active.

With a CDN set in WP Fastest Cache, its cdn_rewrite looks for src= without a word boundary, so a local address kept in data-src or in a consent plugin's data attribute (such as data-cr-src) is rewritten to the CDN host too. External embeds such as YouTube or Vimeo are not affected.

WP-Optimize's Delay JS releases scripts only on the first scroll, mousemove, mouseover, resize, touchstart or touchmove, with no timeout and not on click or keydown; it moves each src to data-src, runs scripts one by one in document order, then dispatches fake DOMContentLoaded and load events. Its exclusion list compares src only, so an inline script can be kept out only with the data-no-delay-js attribute.

WP-Optimize serves one cached file to every visitor; a consent cookie does not create a separate version unless a developer adds it with the wpo_cache_cookies filter. Its only cookie is wpo_commented_post (1 week, path of the post) after a visitor posts a comment, to skip the cache there. The free version adds no request to another site and has no WP Consent API or Consent Mode code. Cookie Rocks 2.5.1 empties WP-Optimize's page cache when its settings are saved.

With Image CDN on (off by default), Jetpack Boost rewrites img tags to i0.wp.com (and i1, i2), so visitors' browsers load images from Automattic's servers on every page. Iframes are not touched. Boost itself sets no visitor cookie; the Tracks script is loaded only for logged-in administrators (Image Guide).

NitroPack's footer script sets the session cookie nitroCachedPage (1 or 0, SameSite=Lax) on every page before any choice. With the impact test on it sets nitroImpactGroup (24 hours); with the 304 option, np_cache_variation (session). If cjevent is in its ignored parameters, it copies it into a 395-day affiliate cookie cje on cached pages. Its footer also sends a sendBeacon and a periodic heartbeat to the site itself.

Hummingbird's free Asset Optimization works on WordPress script handles (print_scripts_array, priority 5) before any output buffer: a locally enqueued tracker can be combined into a Hummingbird file, whose address a banner does not recognise, and a banner's own handle can be combined, deferred or moved to the footer. Filters such as wphb_dont_combine_handles exclude a handle. With the WPMU DEV CDN, files come from hb.wpmucdn.com.

Hummingbird's Delay JavaScript (off by default, WPMU DEV members) rewrites each script to type="wphb-delay-type" in a buffer opened at template_redirect priority 2, so it runs after a banner's later buffer and leaves held type="text/plain" scripts untouched. It reads no common no-delay attribute, so a banner's own scripts wait for the first key, mouse, wheel or touch event or 20 seconds unless excluded (wphb_delay_js_exclusions, wphb_should_delay_js, WPHBDONOTDELAYJS).

Hummingbird sets no cookie and stores nothing in the browser on visitor pages. Its page cache serves the same page to every anonymous visitor, written after the banner's processing; only wp-postpass_, comment_author_, wordpress_logged_in_ and wphb_cache_* cookies create variants, so a consent cookie does not. It has no iframe lazy loading (only comments).

The keyword "gtag" suggested in Flying Scripts' FAQ also matches any inline script containing that word, such as a consent plugin's head script that sets Google's default consent: it would wait for the first interaction, and delayed scripts run with no guaranteed order. Flying Scripts has no exclusion attribute or filter.

Flying Scripts only delays scripts whose tag matches one of its keywords (empty list by default, so nothing is delayed), and only scripts with no type or type text/javascript: a script held by a consent plugin as type="text/plain" is never touched. Its output buffer opens at plugin load, so it rewrites the page after a banner's later buffer. Delayed scripts run on the first click, mouse move, key, touch or wheel, or after 5 seconds. It sets no cookie and adds no third-party request.

The Cloudflare plugin adds no script, style or cookie to visitor pages and does not use WP Consent API; it only sends a cf-edge-cache header telling APO whether the page may be cached. It purges APO on content publication or change, comments, theme switch and Customizer save, not when another plugin saves its settings. Its purge filters (cloudflare_purge_everything_actions, cloudflare_purge_url_actions) are read when the plugin loads; a public method, Hooks::purgeCacheEverything(), purges the whole zone.

When an update of Cookie Rocks Pro changes or removes a value it sends to visitors (for example the default accent colour), Pro clears the known page caches (WP Rocket, LiteSpeed Cache, W3 Total Cache, WP Super Cache, SiteGround Optimizer, WP Fastest Cache, Breeze) at the first request after the update, with no extra database query and nothing more for visitors. An added value clears nothing. Host and CDN caches are not cleared and keep the old pages until they expire.

Cookie Rocks Pro clears the page caches of WP Fastest Cache (wpfc_clear_all_cache, pages only) and Breeze (action breeze_clear_all_cache) when its settings are saved and when an update changes a default sent to visitors. Breeze's purge also clears its minified files and its object cache; it purges Varnish and Cloudflare only if they are set up in Breeze, with no extra network request otherwise.

With JavaScript combined, minified or delayed (LiteSpeed Cache including Guest Mode and Load JS Delayed, W3 Total Cache minify in auto mode, SiteGround Optimizer combine and async, Autoptimize aggregate including inline JS), the Cookie Rocks head script stays first and untouched, its engine stays a separate file, and trackers are held until Accept all. Without a LiteSpeed web server, LiteSpeed Cache sets no cookie.

By default, WP Super Cache does not serve a cached page when the address carries ad or campaign parameters (gclid, fbclid, utm_...): WordPress builds the page again on every such visit (its rewrite rules require an empty query string). Its option to ignore tracking parameters makes these visits get the cached page; its list can be extended with gad_source, gbraid, wbraid, msclkid and srsltid. A form field filled on the server with the page address then loses these parameters, while values read in the browser (a cookie set by a tag, a field filled by script) keep them.