Cookie consent for a non-profit website

Cookie Rocks lists the site cookies of Wordfence (wfCBLBypass, wf_loginalerted_*, wfls-remembered-*), Forminator (poll-cookie-*, forminator_stripe_payment_owner), WP WhatsApp (nta-wa-gdpr) and WPForms Pro (_wpfuuid) in the cookie list it writes, with their purpose.

On a fresh WordPress home page with default settings, Contact Form 7, WPForms Lite, Forminator, Fluent Forms and Ninja Forms set no cookie, keep nothing in the browser's storage and load no known third-party tool, before or after Accept all (no form or captcha placed on the page).

On a fresh WordPress home page with default settings (no account, key or content set up), TranslatePress, Weglot, Smash Balloon Instagram Feed, WP Go Maps, MailPoet and Matomo for WordPress set no cookie, keep nothing in the browser's storage and load no known third-party tool, after Accept all.

Once reCAPTCHA keys are saved, Contact Form 7 enqueues google-recaptcha (api.js?render=) and wpcf7-recaptcha on every page, not only pages with a form, and calls grecaptcha.execute on each page load. Turnstile (challenges.cloudflare.com/turnstile/v0/api.js) also loads on every page once its keys are saved, and js.stripe.com/v3/ wherever CF7 scripts load when Stripe is set up. The filter wpcf7_use_recaptcha_net switches reCAPTCHA to www.recaptcha.net.

On Contact Form 7 forms protected by reCAPTCHA, Cookie Rocks shows a permission request above the form, holds the send until reCAPTCHA is allowed, reloads without losing what was typed, and loads reCAPTCHA from recaptcha.net. A setting can treat reCAPTCHA as necessary.

Contact Form 7 reads and sets no cookie and sends nothing to other sites unless reCAPTCHA, Turnstile, Akismet, Stripe or a mailing tool is turned on. A submission records timestamp, IP address, port, user agent and page URL. The nonce is added only for logged-in users, so a cached form page stays valid for visitors. It does not use WP Consent API.

If grecaptcha is missing, Contact Form 7's wpcf7-recaptcha script stops with an error before it wraps the submit, so the form is sent without a token and CF7 files it as spam ('reCAPTCHA response token is empty.') and sends no email. An empty Turnstile token is also treated as spam.

WPForms loads its captcha only on pages that show a form using it, in the footer: reCAPTCHA (www.google.com/recaptcha/api.js), hCaptcha (hcaptcha.com/1/api.js) or Turnstile (challenges.cloudflare.com); the address can be changed with the wpforms_frontend_captcha_api filter. Its No-Conflict mode dequeues other scripts from google.com/recaptcha, gstatic.com/recaptcha and hcaptcha.com/1, but not recaptcha.net. It sends a Permissions-Policy header for private state tokens on every request.

WPForms Lite sets no cookie for visitors: its front script writes _wpfuuid (random ID, 3,999 days, SameSite=Strict) only if uuid_cookie is true, which Lite hardcodes to false, or if a wpforms.hasRequiredConsent JavaScript function exists and returns true. Form analytics (2.0) send form-view data to the site's own admin-ajax.php by sendBeacon, with an in-memory session ID, no cookie or storage, and skip authors, editors and administrators. It does not use WP Consent API.

MC4WP: Mailchimp for WordPress 4.14.1 contains no setcookie, document.cookie, localStorage, sessionStorage, IndexedDB, WP Consent API or gtag('consent') code (outside minified and vendor files). Forms use a timestamp field accepted for 90 days instead of a nonce, so they work on cached pages. Form data is sent to Mailchimp by the server on submission.

MC4WP's Site Tracking Pixel (off by default) enqueues Mailchimp's script chimpstatic.com/mcjs-connected/js/users/<id>.js (handle mc4wp-mailchimp-site-tracking-pixel, defer) on every public page, with no setting to wait for consent. After a sign-up, an inline footer script calls $mcSite.pixel.api.identify with the subscriber's email only if the pixel is already loaded, so it is lost if the pixel is held and accepted later on the same page.

MailPoet's subscriber tracking consent (track_all by default, ask_new, ask_all) covers email opens and clicks only; it does not read a cookie banner and does not cover cookies set at login or order. MailPoet has no WP Consent API code. For anonymous visitors, its forms set only popup_form_dismissed_<id>, by JavaScript, after closing a pop-up form or subscribing (182 days).

MailPoet forms load www.google.com/recaptcha/api.js or challenges.cloudflare.com/turnstile only when that captcha is chosen; the built-in captcha uses a hidden field and no cookie. Google Fonts in forms load from fonts.googleapis.com only when Load 3rd-party libraries is on (off by default). If the captcha script is held, public.js retries 20 times every 400 ms then gives up, so the form cannot be sent before consent.

With the default Engagement analytics tracking level (Full), MailPoet sets from PHP mailpoet_subscriber (10 years) when a known subscriber logs in, confirms, registers or places a WooCommerce order, then mailpoet_page_view (10 years) on public pages at most once a minute; a click in a newsletter sets mailpoet_revenue_tracking (14 days) and mailpoet_subscriber before redirecting. A consent plugin cannot hold them. Partial or Basic, or the mailpoet_is_cookie_tracking_enabled filter, stops them.

The Events Calendar shows a Google map on events with an address by default (maps enabled, Show Google Map ticked for new events). With the key built into the plugin, the map is an iframe to www.google.com/maps/embed/v1/place in the HTML; with the site's own key, it loads maps.googleapis.com/maps/api/js and embedded-map.js draws the map on page load. The plugin sets no cookie and uses no browser storage on visitor pages, and its calendar export links load nothing until clicked. Its suggested privacy policy text says no data leaves the site by default.

WP Go Maps loads its map libraries without any consent condition: the Leaflet engines, including the zero-cost engine of new installs, from unpkg.com (leaflet, maplibre-gl); the newer OpenLayers engine from cdn.jsdelivr.net; the classic OpenLayers engine from the site (lib/ol.js). These load even when its own consent notice is on. With OpenStreetMap-type engines the map and its tiles (tile.openstreetmap.org, tiles.openfreemap.org and others) are requested by JavaScript, so a consent plugin reading the page HTML does not see them. The Google engine adds a maps.googleapis.com script tag with a callback.