Works with your stack
Cookie consent for the Cloudflare plugin
purge by hand
The Cloudflare plugin adds nothing to visitor pages: no script, no style, no cookie. It tells Cloudflare’s APO which pages may be cached and clears them when your content changes. It does not clear them when another plugin changes its settings.
By Cloudflare, Inc. · cloudflare.com · WordPress.org
Is this your product? Tell us if anything here is out of date. Write to us
Cloudflare
WordPress plugin
- Tested version
- 4.14.5
- How
- Tested automatically around each Cookie Rocks version
- Last test
- 7 November 2026
- Latest version
- 4.14.5 tested
- Active installs
- 200,000+
What Cloudflare adds to your visitors’ browser
No trackers In our test of Cloudflare 4.14.5 on 7 November 2026, the plugin itself added no tracker and no cookie. What you place in your pages with it, such as a video or a map, still counts.
What matters for consent with Cloudflare
Nothing to hold
The plugin itself puts nothing in the visitor’s browser. Cookie Rocks holds known trackers until consent, whether the page comes from Cloudflare’s cache or from your site.
Clear APO after changing the banner
APO is cleared when you publish or edit content, not when a consent plugin saves its settings. After changing the banner, purge the cache in Cloudflare so visitors see the new one.
A cache in front of WordPress
Pages served by Cloudflare never reach WordPress, so the choice has to be read in the browser. See caching plugins.
The visitor’s country for rules by country
Cloudflare sends CF-IPCountry with each request. Even on the Free plan, the Managed Transform ‘Add visitor location headers’ also adds cf-region-code, so a US visitor’s state is known. Cookie Rocks Pro uses them only when the request carries Cloudflare’s marks. See hosting and CDN.
What our tests found on Cloudflare
Good to know · CloudflareCloudflare and the country database can disagree on one address
Cloudflare and the DB-IP country database can give different countries for the same address. A mismatch can only make the rules stricter for a US visitor seen in Europe.
Seen in our tests, 23 October 2026, Cloudflare DB-IP lite country, edition 2026-10-20.
Full detail
For the same visitor address, Cloudflare's CF-IPCountry said IT while the DB-IP lite country database (edition 2026-10-20) said NO. Both gave the strict profile here, but two sources can disagree on the country of one address: a US visitor seen in Europe by one source would get the strict rules rather than the US profile.
Depends on a setting · CloudflareCloudflare Free can send the visitor's US state to the site
Turn on 'Add visitor location headers' in Cloudflare so that rules by country can read a US visitor's state (CF-Region-Code). It is off by default.
What to do: Enable 'Add visitor location headers' so that country rules can read the US state (CF-Region-Code).
Seen in our tests, 23 October 2026, Cloudflare. Source
Full detail
On a Cloudflare Free zone, the Managed Transform 'Add visitor location headers' (Rules, Settings, Managed Transforms) is available, off by default. Turned on, it adds cf-ipcountry, cf-region-code, cf-ipcity and coordinates to requests sent to the site. Without it, only CF-IPCountry is sent (IP Geolocation setting), so a US visitor's state is unknown.
Good to know · Cookie RocksThe country database works end to end on a real site
On a real site behind Cloudflare, the country database downloaded, verified and answered correctly, never cached, and forged Cloudflare headers got the strict rules.
Seen in our tests, 23 October 2026, Cookie Rocks country database edition 2026-10-20.
Full detail
On a real site behind Cloudflare, the 'country database on this server' source of Cookie Rocks 2.7.0 worked end to end: signed manifest and signature read, 8,300,093-byte file downloaded in 0.5 s, checksum verified, source trusted. Test addresses got the right country and a private address got the strict rules. geo.php and the REST route answered with Cache-Control private, no-store and were never cached by Cloudflare (cf-cache-status DYNAMIC). A direct request to the site with forged Cloudflare headers got the strict rules.
Depends on a setting · Cookie RocksBehind Cloudflare on some hosts, choose the country database
If your host rewrites the visitor's address behind Cloudflare (mod_cloudflare, mod_remoteip), choose 'country database on this server' as the source in Rules by country.
What to do: In Rules by country, choose 'country database on this server' as the source, then Update now.
Seen in our tests, 23 October 2026, Cookie Rocks.
Full detail
Some hosts rewrite REMOTE_ADDR with the visitor's address behind Cloudflare (mod_cloudflare or mod_remoteip). There, Cookie Rocks 2.7.0 with the Cloudflare source gives every visitor the strict rules, because the request no longer seems to come from Cloudflare. The 'country database on this server' source reads that visitor address and gives the right profile.
Good to know · CloudflareThe Cloudflare plugin adds nothing to visitor pages
It adds no script, style or cookie and does not use WP Consent API. It clears the APO cache on content changes, not when another plugin saves its settings.
Read in its code, 16 October 2026, Cloudflare 4.14.5.
Full detail
The Cloudflare plugin adds no script, style or cookie to visitor pages and does not use WP Consent API; it only sends a cf-edge-cache header telling APO whether the page may be cached. It purges APO on content publication or change, comments, theme switch and Customizer save, not when another plugin saves its settings. Its purge filters (cloudflare_purge_everything_actions, cloudflare_purge_url_actions) are read when the plugin loads; a public method, Hooks::purgeCacheEverything(), purges the whole zone.
How we test it
Around each version, with its latest release
Around each Cookie Rocks version, a fresh WordPress installs its latest version from WordPress.org next to Cookie Rocks and runs the same checks. A new version joins the next run on its own.
- Cloudflare 4.14.5, tested on 7 November 2026.
- The banner shows, the trackers of the test page wait for consent and load after it, and Cookie Rocks raises no PHP error.
- Settings of the test: Default settings after activation.
- Last run: Cloudflare 4.14.5 on 7 November 2026, with WordPress 7.1.3.
Light as a pebble
11.43 kB once, 1.00 kB per page. Measured, not promised.
lighter than the font on this page*
Every kilobyte costs your visitors time and costs you Core Web Vitals. Cookie Rocks adds 11.43 kB to the first page a visitor opens, then 1.00 kB to each page after that, because its files stay in the browser cache. It calls no outside server and never shifts your layout.
11.43 kB First visit, in total
1.00 kB Each next page
7.74 kB JavaScript, first visit
3.48 kB Stylesheet, first visit
0 Requests to other servers
0 Layout shift caused
* The font on this page is Inter, compressed and cut down to the Latin alphabet. It still weighs 26.23 kB.
Page cache
Other plugins of the same kind.
Questions
What happens after the 30-day trial?
The banner, your visitors’ choices and your proofs of consent keep working. Without a key, most settings lock, updates and support stop. Take a key at any time and everything opens again.
For sites behind Cloudflare
Cached at the edge, consent in the browser.
cloudflare stays on
Every feature of the complete plugin for 30 days, no card. Cloudflare keeps working as it does today.
- During the trial: everything, including the full settings and the scans
- After 30 days without a key: the banner, your visitors’ choices and your proofs of consent keep working
- What waits for a key: most settings, updates and support
Get your trial key
Your e-mail and your site. Your key arrives as soon as you confirm your e-mail.