Works with your stack
Cookie consent and popular WordPress themes
most themes are quiet
Most popular themes set no tracking cookie of their own. What matters is around them: Google Fonts, video backgrounds, widgets, and sometimes an Analytics field or a small cookie notice. Each theme below, and what to check.
WordPress themes, one by one
Theme by theme
- Astra
- No cookie on visitor pages. Google Fonts load from Google once chosen: switch on its local fonts option.
- Blocksy
- An Analytics field that prints the tag on every page, and a small notice that holds only that tag. With a consent plugin, leave both off.
- Hello Elementor
- A bare theme: no cookie, no outside request. Look at Elementor instead.
- Kadence
- YouTube background videos in Kadence Blocks, held by Cookie Rocks until consent. Google Fonts to host locally.
- Neve
- No cookie of its own. Its dashboard offers an extra cookie notice through Orbit Fox: skip it with a consent plugin.
- OceanWP
- Google Fonts on by default, and Ocean Extra widgets that load YouTube, Facebook and X on arrival.
What matters for consent with WordPress themes
Fonts are the common point
Every theme here loads a chosen Google font from Google’s servers unless you switch on its local fonts option. That option is off by default. See Fonts.
One notice, not two
Some themes offer a cookie notice of their own that holds little or nothing. Next to a consent plugin, visitors see two bars. Leave the theme’s notice off.
Videos and widgets
Video backgrounds and social widgets can load YouTube or Facebook as the page opens. These are what the visitor’s choice has to cover.
No consent signal from themes
None of these themes sends a consent signal of its own. Your consent plugin handles the choice for the whole site.
What our tests found on WordPress themes
Good to knowYouTube and Vimeo background videos wait for consent
- Held without a box: the section shows its fallback image or colour.
- After consent: muted, looped, no reload.
- A video hosted on the site (MP4, WebM) plays for everyone.
Read in its code, 4 November 2026.
Full detail
A YouTube or Vimeo background video of a section or container (Elementor, Kadence, Beaver Builder) is held without any box until consent: the section shows the builder's fallback image, or its background colour. After consent it starts muted and looped, without a reload; visitors who refuse never see it. A background video hosted on the site (MP4 or WebM) is never held and plays for everyone, so it is the better choice for a hero section, with a fallback image set in any case.
Good to know · Cookie RocksThe audit names the local fonts setting of your theme
When the home page loads Google Fonts, the Cookie Rocks 2.9.5 audit names the setting of the active theme or plugin that serves them from the site: Elementor, WP Rocket, Spectra, Kadence Blocks, OMGF, Local Google Fonts, Astra, Kadence, OceanWP or Neve. Otherwise it suggests a plugin such as OMGF. Divi, Bricks, Oxygen and Beaver Builder have no such setting. With Cookie Rocks Pro, it points to « Serve Google Fonts from this site » instead.
Read in its code, 1 November 2026, Cookie Rocks.
Depends on a setting · AstraAstra loads Google Fonts from Google once a Google font is chosen
setting “Load Google Fonts Locally” · by default: off
No Google font loads by default. Once one is chosen, Astra adds a Google stylesheet on every page. Load Google Fonts Locally serves them from the site and is off by default.
Read in its code, 16 October 2026, Astra 4.14.1.
Full detail
Astra's body font defaults to inherit, so no Google font loads until one is chosen. Once a Google font is chosen, Astra enqueues a stylesheet from fonts.googleapis.com on every page and, since 4.12.6, preconnects to fonts.googleapis.com and fonts.gstatic.com. Load Google Fonts Locally (self_hosted_gfonts) serves them from the site and is off by default.
Good to know · AstraThe free Astra theme sets no cookie on visitor pages
Its storage is used only in the admin and editors. It has no banner and no consent signals, and keeps embeds as normal frames, with no lazy loading of its own.
Read in its code, 16 October 2026, Astra 4.14.1.
Full detail
The free Astra theme reads and writes no cookie or browser storage on visitor pages; its storage keys and the astraPricingVisited cookie are used only in the Customizer, block editor or admin. It has no banner, no WP Consent API and no gtag('consent') call; vendor usage tracking is opt-in and server-side from the admin. Astra keeps embeds as normal iframes with src, only wrapped in ast-oembed-container (classic content), with no lazy loading of its own. A dark palette adds astra-dark-mode-enable to <html> and <body>.
Good to know · BlocksyBlocksy loads Google fonts from Google and inserts image videos on demand
A Google font loads from Google unless the paid Local Google Fonts extension is used. Videos attached to images are inserted on click, hover or, with autoplay, the first scroll.
Read in its code, 16 October 2026, Blocksy 2.1.60.
Full detail
Blocksy uses System Default fonts; a Google font picked in the Customizer loads from Google's servers unless the paid Local Google Fonts extension is used (filter blocksy:typography:google:use-remote). Videos attached to Blocksy images (featured image, product gallery) are fetched from admin-ajax and inserted by JavaScript on click or hover, or with autoplay on the first scroll or mouse move, with a plain src; the preview is the site's own image. Blocksy has no iframe lazy loading of its own.
Depends on a setting · BlocksyBlocksy's Google Analytics field can load the tag on every page
setting “Google Analytics v4 (analytics_v4_id)” · by default: empty
With Blocksy's own consent notice off, gtag.js is printed on every page with no consent default. With it on, a page cache can serve the first visitor's state to others.
What to do: With a consent plugin, leave Blocksy's GA4 field empty and switch off Blocksy's Cookies Consent extension.
Read in its code, 16 October 2026, Blocksy 2.1.60.
Full detail
If a Google Analytics 4 ID is entered in Blocksy (Customizer, Visitor Engagement) and Blocksy Companion's Cookies Consent extension is off, gtag.js is printed on every page with no condition and no gtag('consent') default. With that extension on, it is printed only when the server reads blocksy_cookies_consent_accepted=true, or loaded through admin-ajax after Accept; behind a page cache the first visitor's state can be served to others.
See the 10 other findings
Good to know · BlocksyBlocksy's own consent notice only releases Blocksy's Google Analytics
The free Cookies Consent extension shows Accept or Decline and keeps blocksy_cookies_consent_accepted for about 10,000 days by default. It does not use WP Consent API.
Read in its code, 16 October 2026, Blocksy 2.1.60.
Full detail
Blocksy Companion's free Cookies Consent extension shows an Accept or Decline notice built in JavaScript from a template in each page, and stores blocksy_cookies_consent_accepted (true, or no after Decline; forever by default, about 10,000 days; SameSite=Lax). It only releases scripts registered on the filter blocksy:cookies-consent:scripts-to-load, which only Blocksy's GA4 uses. Neither the theme nor the companion uses WP Consent API.
Good to know · Hello ElementorHello Elementor sets no cookie and contacts no other site for visitors
Its only front script is a local mobile menu. It has no consent setting and no WP Consent API support. Only in the admin does the server check my.elementor.com for notices.
Read in its code, 16 October 2026, Hello Elementor 3.5.1.
Full detail
Hello Elementor 3.5.1 sets no cookie, stores nothing in the browser, declares no remote font and contacts no other site on visitor pages; its only front script is the local hello-frontend.js mobile menu, loaded in the footer. It has no consent setting and no WP Consent API support. In the admin only, the server polls my.elementor.com for theme notifications.
Good to know · Kadence BlocksCookie Rocks holds a Kadence Blocks YouTube background video
Before the choice nothing reaches YouTube. After Accept all, without a reload, the video loads from youtube-nocookie.com.
Seen in our tests, 16 October 2026, Kadence Blocks 3.8.0.
Full detail
Tested: a Kadence Blocks row with a YouTube background video is held by Cookie Rocks. Before the choice the iframe carries data-cr-src and nothing reaches YouTube; after Accept all, without reload, its src becomes youtube-nocookie.com/embed.
Set before the choice · Kadence BlocksKadence Blocks background videos are written as YouTube or Vimeo frames
- Row background video: autoplay frame from www.youtube.com (not youtube-nocookie) or player.vimeo.com.
- Video Popup: frame created on click, from youtube-nocookie.com or Vimeo with do not track.
- Video Popup: Plyr keeps a plyr key in localStorage.
- Google Maps block: a lazy-loaded frame or maps.googleapis.com.
Read in its code, 16 October 2026, Kadence Blocks 3.8.0.
Full detail
A Kadence Blocks row with a YouTube or Vimeo background video writes an autoplay iframe with src www.youtube.com/embed (not youtube-nocookie) or player.vimeo.com in the HTML. The Video Popup block writes no iframe: GLightbox and Plyr create it on click, using youtube-nocookie.com and Vimeo dnt by default (attribute youtubeCookies), and Plyr keeps a localStorage key plyr. The Google Maps block uses a native loading=lazy iframe or maps.googleapis.com; no iframe src is moved to data-src.
Good to know · KadenceKadence sets first-party cookies for countdowns and the shop layout
- Evergreen countdown: <site name slug>-<campaign id>, 30 days, from the first page.
- Shop grid or list toggle: <site name slug>-shopLayout, 30 days, only after a click.
- No WP Consent API or Google consent code in the theme or Kadence Blocks.
Read in its code, 16 October 2026, Kadence theme 1.5.2, Kadence Blocks 3.8.0.
Full detail
Kadence Blocks' evergreen countdown sets a first-party cookie named <site name slug>-<campaign id> for 30 days on the first page to keep each visitor's deadline. The theme's grid or list toggle sets <site name slug>-shopLayout for 30 days only after a click. Neither the theme nor Kadence Blocks has WP Consent API or gtag('consent') code. Form captchas (reCAPTCHA, Turnstile, hCaptcha) are required to submit.
Depends on a setting · KadenceKadence loads Google Fonts directly unless local fonts are turned on
setting “Load Google Fonts Locally” · by default: off
The theme's Load Google Fonts Locally setting is off by default. Kadence Blocks follows it, and without the theme has its own local setting, also off by default.
Read in its code, 16 October 2026, Kadence theme 1.5.2, Kadence Blocks 3.8.0.
Full detail
The Kadence theme loads fonts.googleapis.com (with a preconnect to fonts.gstatic.com) as soon as a Google font is chosen; Load Google Fonts Locally (Customizer > General > Performance) is off by default. Kadence Blocks prints its Google Fonts as direct link tags in wp_head (priority 85) and wp_footer without a style handle, follows the theme's setting, and without the theme has its own local setting, also off by default.
Depends on a setting · NeveNeve loads a chosen Google font from Google unless local hosting is on
setting “Enable Local Fonts Hosting” · by default: off
Neve uses Arial by default and sets no cookie. Enable Local Fonts Hosting is off by default and free. The light or dark switch is kept in local storage (neve_user_theme).
Read in its code, 16 October 2026, Neve 4.2.16.
Full detail
Neve 4.2.16 uses Arial by default and sets no cookie of its own; it has no WP Consent API or gtag code and does not move iframe src. When a Google font is chosen it loads fonts.googleapis.com unless Enable Local Fonts Hosting is on (off by default, free); that setting also serves locally Google Fonts and Typekit stylesheets enqueued by other plugins, except in the Elementor editor. The palette switch stores light or dark in localStorage neve_user_theme on click and sets data-neve-theme on html.
Good to know · Orbit FoxNeve's cookie notice installs Orbit Fox, an Accept-only bar that blocks nothing
- Only Accept and a close button; no script is blocked.
- Accept sets obfx-policy-consent=accepted for 365 days.
- Behind a page cache, a page without the bar can be served to others.
- Next to a consent plugin, visitors see two bars.
Read in its code, 16 October 2026, Orbit Fox 3.0.10.
Full detail
The cookie notice module in Neve's dashboard installs Orbit Fox, whose Policy Notice bar has only Accept and a close button, blocks no script, and sets obfx-policy-consent=accepted for 365 days on Accept. The server stops printing the bar when that cookie is present, so behind a page cache a page without the bar can be served to others. Next to a consent plugin, visitors see two bars.
Depends on a setting · OceanWPOceanWP loads Google Fonts from Google by default
setting “Enable Google Fonts” · by default: on
Enable Google Fonts is on by default on a new install. Enable Local Google Fonts (needs Ocean Extra, off by default) serves them from the site. Neither plugin has WP Consent API or Google tag code.
Read in its code, 16 October 2026, OceanWP 4.2.7 (Ocean Extra 2.6.3).
Full detail
OceanWP 4.2.7 loads a chosen Google font from fonts.googleapis.com because Enable Google Fonts is on by default on a new install; Enable Local Google Fonts (needs Ocean Extra, off by default) has the server download them from fonts.gstatic.com on the first request and serve them from wp-content/uploads. Apply on Elementor (off) does the same for Elementor fonts. Neither OceanWP nor Ocean Extra has WP Consent API or gtag code, and neither moves iframe src.
Set before the choice · OceanWPOceanWP sets one cookie; Ocean Extra widgets contact other sites on load
- gridcookie (session) is set on click of the WooCommerce grid or list switch.
- Video widget: YouTube or Vimeo iframe. Facebook widget: facebook.com iframe.
- Twitter widget: platform.twitter.com script. Flickr widget: request to www.flickr.com.
- An Adobe Fonts project ID loads use.typekit.net on every page.
Read in its code, 16 October 2026, OceanWP 4.2.7 (Ocean Extra 2.6.3).
Full detail
OceanWP's only own cookie is gridcookie (session, set on click of the WooCommerce grid or list switch). Ocean Extra widgets contact third parties on page load: Video writes an oEmbed iframe (YouTube, Vimeo), Facebook an iframe facebook.com/plugins/likebox.php, Twitter a platform.twitter.com/widgets.js tag, Flickr a JSONP request to www.flickr.com. An Adobe Fonts project ID loads use.typekit.net on every page.
Page builders and themes
Other plugins of the same kind.
Questions
I use Divi. Where is it?
Divi has its own page: Divi.
What happens after the 30-day trial?
The banner, your visitors’ choices and your proofs of consent keep working. Without a key, most settings lock, updates and support stop. Take a key at any time and everything opens again.
For WordPress themes
Keep your theme, add consent.
most themes are quiet
Every feature of the complete plugin for 30 days, no card. Your theme keeps working as it does today.
- During the trial: everything, including the full settings and the scans
- After 30 days without a key: the banner, your visitors’ choices and your proofs of consent keep working
- What waits for a key: most settings, updates and support
Get your trial key
Your e-mail and your site. Your key arrives as soon as you confirm your e-mail.