Works with your stack
Cookie consent for CleanTalk
a bot detector on every page
CleanTalk loads a bot detector from its own servers on every public page, before any form is sent. It keeps data in the browser’s storage and sends browsing signals to CleanTalk. Its default cookie setting avoids cookies, but not the detector.
By CleanTalk Inc. · cleantalk.org · WordPress.org
Is this your product? Tell us if anything here is out of date. Write to us
Anti-Spam by CleanTalk
WordPress plugin
- Tested version
- 6.91
- How
- Tested automatically around each Cookie Rocks version
- Last test
- 7 November 2026
- Latest version
- 6.91 tested
- Active installs
- 200,000+
What CleanTalk adds to your visitors’ browser
Trackers it loads
Browser storage
bot_detector_webgl_supportbot_detector_navigator_property_bindct_bot_detector_event_tokenbot_detector_pointer_datact_screen_infobot_detector_send_schedulect_pointer_databot_detector_prev_dtobot_detector_token_ip_versionbot_detector_referrerbot_detector_user_agentbot_detector_mouse_movedct_checkjsbot_detector_page_hitsct_timezonebot_detector_browser_supports_cookiesbot_detector_typo_dataapbct_visible_fieldsapbct_existing_visitorbot_detector_outer_vs_innerct_bot_detector_frontend_data_logct_ps_timestampapbct_headlessct_fkp_timestampbot_detector_referrer_previousct_checked_emails_existbot_detector_headlessbot_detector_screen_infobot_detector_event_tokenbot_detector_log_transport_enabledct_checked_emails
What matters for consent with CleanTalk
Every page, before the choice
With form checks on, the default, CleanTalk’s bot detector loads from CleanTalk on every public page for visitors who are not logged in. It writes to the browser’s storage and sends browsing signals before any form is sent.
Cookies only on request
With its cookie setting on Auto, the default, CleanTalk sets no cookies of its own and keeps visit data on your server instead. Browser cookies appear when you switch that setting on.
Data sent from your server
Each form sent, an email address as soon as it is typed, and the firewall log go from your server to CleanTalk. No banner can hold that: mention CleanTalk in your privacy policy.
No consent setting
CleanTalk has no consent setting of its own and does not use WP Consent API. Decide whether its detector is necessary protection or should wait, and say so in your cookie list.
What our tests found on CleanTalk
Set before the choice · Anti-Spam by CleanTalkCleanTalk's bot detector runs on every page and sends browsing signals
It loads from fd.cleantalk.org for visitors not logged in, even without an API key, stores bot_detector_* keys in localStorage and posts browsing signals before any form is sent.
Read in its code, 16 October 2026, Anti-Spam by CleanTalk 6.90.
Full detail
CleanTalk enqueues fd.cleantalk.org/ct-bot-detector-wrapper.js (async) on every public page for visitors who are not logged in as soon as a form check is on (the default), with no API key check; without a key the bot detector stays enabled. The wrapper creates the real script, fd.cleantalk.org/2.1.9/ct-bot-detector.min.js, which stores bot_detector_* keys in localStorage and posts browsing signals to fd-api.cleantalk.org/frontend_data/v2 before any form is sent. The pixel from moderateN.cleantalk.org is not added while the bot detector is on (Auto).
Sent from your server · Anti-Spam by CleanTalkCleanTalk sends visitor data from the server, with no consent setting
setting “Check email before POST” · by default: on
- Each submitted form, with IP address, e-mail, name, message and browser signals.
- The e-mail typed in a form as soon as the visitor leaves the field (on by default).
- The firewall log every hour, and a request when a visitor reveals a hidden e-mail.
- No consent setting and no WP Consent API.
Read in its code, 16 October 2026, Anti-Spam by CleanTalk 6.90.
Full detail
CleanTalk sends data from the server: each submitted form with IP address, email, name, message, browser signals and visited addresses; the email typed in a form as soon as the visitor leaves the field (on by default); the SpamFireWall log every hour; and a request to moderate.cleantalk.org when a visitor reveals a hidden email. It has no consent setting and does not use WP Consent API, and adds data-cookieconsent="ignore" to its scripts when one consent plugin is active.
Depends on a setting · Anti-Spam by CleanTalkCleanTalk sets no cookies on Auto, but keeps visit data on the site
setting “Set cookies” · by default: Auto
Browser signals go to localStorage and visit data to the site's database. Cookies appear only with Set cookies On, except apbct_fw_bypass (1 hour), set when the firewall lets a visitor through.
Read in its code, 16 October 2026, Anti-Spam by CleanTalk 6.90.
Full detail
With Set cookies on Auto (the default), CleanTalk sets no ct_* or apbct_* cookies: browser signals go to localStorage and are sent in a hidden form field, and visit data (last visited addresses, referrer) is kept in the site's database under a hash of IP address, user agent and Accept-Language. Auto switches to database storage when a server cache is detected. Browser cookies, including ct_sfw_pass_key for 30 days, appear only with Set cookies On; apbct_fw_bypass (1 hour) is set whenever a firewall bypass is granted.
How we test it
Around each version, with its latest release
Around each Cookie Rocks version, a fresh WordPress installs its latest version from WordPress.org next to Cookie Rocks and runs the same checks. A new version joins the next run on its own.
- Anti-Spam by CleanTalk 6.91, tested on 7 November 2026.
- The banner shows, the trackers of the test page wait for consent and load after it, and Cookie Rocks raises no PHP error.
- Settings of the test: Default settings after activation.
- Last run: Anti-Spam by CleanTalk 6.91 on 7 November 2026, with WordPress 7.1.3.
Anti-spam
Other plugins of the same kind.
Questions
What happens after the 30-day trial?
The banner, your visitors’ choices and your proofs of consent keep working. Without a key, most settings lock, updates and support stop. Take a key at any time and everything opens again.
For sites with CleanTalk
Spam protection, said clearly.
know what runs first
Every feature of the complete plugin for 30 days, no card.
- During the trial: everything, including the full settings and the scans
- After 30 days without a key: the banner, your visitors’ choices and your proofs of consent keep working
- What waits for a key: most settings, updates and support
Get your trial key
Your e-mail and your site. Your key arrives as soon as you confirm your e-mail.