Works with your stack
Cookie consent for OptinMonster
the tag is built by script
OptinMonster shows popups and sign-up campaigns from its own servers. Once a campaign is synced, the plugin adds a small inline script that builds OptinMonster’s tag in the page. All OptinMonster cookies come from that outside script.
By OptinMonster · optinmonster.com · WordPress.org
Is this your product? Tell us if anything here is out of date. Write to us
OptinMonster
WordPress plugin
- Tested version
- 2.17.1
- How
- Tested automatically around each Cookie Rocks version
- Last test
- 7 November 2026
- Latest version
- 2.17.1 tested
- Active installs
- 1,000,000+
What OptinMonster adds to your visitors’ browser
No trackers In our test of OptinMonster 2.17.1 on 7 November 2026, the plugin itself added no tracker and no cookie. What you place in your pages with it, such as a video or a map, still counts.
What matters for consent with OptinMonster
A tag that is not in the page
The OptinMonster tag is created by JavaScript, not printed in the HTML. A banner that only looks for script addresses can miss it. OptinMonster is marketing, so it should wait for consent; Cookie Rocks holds known trackers until consent.
Nothing from the plugin itself
The plugin’s own code sets no cookie and stores nothing. It has no consent setting either.
Revenue from the server
With Revenue Attribution on, your server reads OptinMonster’s cookie at a WooCommerce or EDD order and sends the revenue to OptinMonster. If that cookie survives a refusal, the sending goes on.
What our tests found on OptinMonster
Set before the choice · OptinMonsterOptinMonster creates its script by JavaScript on every public page
Since 2.17.0, once a campaign is synced, a script in the page creates the a.omappapi.com tag. A banner that reads only script addresses misses it. All its cookies come from that OptinMonster script.
Read in its code, 16 October 2026, OptinMonster 2.17.1.
Full detail
Since 2.17.0, once a campaign is synced, OptinMonster replaces its enqueued a.omappapi.com/app/js/api.min.js tag with an inline script that creates the tag by JavaScript (id omapi-script, appended to the head) on every public page; a custom domain (customApiUrl, apiCname) can replace the address. A banner reading only src misses it; the address stays in the inline script's content. The plugin's own code sets no cookie or storage and has no WP Consent API or Consent Mode code: all cookies come from api.min.js.
Sent from your server · OptinMonsterOptinMonster sends order revenue from the server using the _omra cookie
setting “Revenue Attribution”
With Revenue Attribution on, OptinMonster's server reads the _omra cookie at a WooCommerce or EDD order and sends the revenue to the OptinMonster API (v2/revenue). If _omra survives a refusal, sending continues.
Read in its code, 16 October 2026, OptinMonster 2.17.1.
How we test it
Around each version, with its latest release
Around each Cookie Rocks version, a fresh WordPress installs its latest version from WordPress.org next to Cookie Rocks and runs the same checks. A new version joins the next run on its own.
- OptinMonster 2.17.1, tested on 7 November 2026.
- The banner shows, the trackers of the test page wait for consent and load after it, and Cookie Rocks raises no PHP error.
- Settings of the test: Default settings after activation.
- Last run: OptinMonster 2.17.1 on 7 November 2026, with WordPress 7.1.3.
Newsletters and popups
Other plugins of the same kind.
Questions
What if I use a custom domain?
OptinMonster can load from your own subdomain. Then its address no longer says OptinMonster, so check that it still waits for consent.
What happens after the 30-day trial?
The banner, your visitors’ choices and your proofs of consent keep working. Without a key, most settings lock, updates and support stop. Take a key at any time and everything opens again.
For OptinMonster users
Campaigns for visitors who said yes.
built inline, still a tracker
Every feature of the complete plugin for 30 days, no card.
- During the trial: everything, including the full settings and the scans
- After 30 days without a key: the banner, your visitors’ choices and your proofs of consent keep working
- What waits for a key: most settings, updates and support
Get your trial key
Your e-mail and your site. Your key arrives as soon as you confirm your e-mail.