Works with your stack
Cookie consent for WordPress itself
no plugin needed to leak
WordPress can call outside servers by itself, on a plain site with no extra plugin: a YouTube video in the header, a video shortcode, a pasted link that turns into an embed, an avatar next to a comment. Each one reaches another company before the visitor chooses, and some set cookies.
WordPress
The platform itself
- Tested version
- 7.1.3
- Works from
- WordPress 6.5
- PHP
- 7.4 to 8.5
- Last test
- 7 November 2026
What WordPress can load by itself
- YouTube header video
- Set in the Customizer, on themes that support a header video. WordPress starts the YouTube player itself, from its own script, so the address is not in the page. In our test it reached youtube.com and doubleclick.net, and set YSC and VISITOR_INFO1_LIVE.
- The video shortcode
- [video] with a YouTube or Vimeo address does not write a frame in the page. WordPress builds the player with JavaScript when the page loads, and YouTube or Vimeo sets its cookies then.
- Embeds from a pasted link
- Paste a link on its own line and WordPress turns it into an embed. It knows dozens of providers: videos, podcasts, documents, slides, social posts. Each one loads from that provider. A Reddit embed set cookies in our test, and a Scribd embed also called Facebook.
- Gravatar next to comments
- Comment avatars load from secure.gravatar.com, on classic themes, with a hash of the commenter’s e-mail address in the link. The visitor’s browser sends its IP address with each image.
- Emoji images
- When the browser lacks an emoji, WordPress loads the image from s.w.org.
- Images, backgrounds and fonts by address
- An image, a CSS background or a font added by address loads from that server like any other file, with no script and no frame. Some of those servers set a cookie.
What matters for consent with WordPress
A plugin list does not show this
None of this needs an extension. A check of your plugins finds nothing, because the code is WordPress itself.
Often nothing to see in the HTML
The header video and the video shortcode are started by JavaScript. Search your page source for the player and you will not find it, so a banner that only reads the page can miss it.
A provider is not a path
A banner can know YouTube and still miss it. The same service reaches a page by a frame, a script, a shortcode or the header, and each path has to wait for the visitor.
After a refusal too
A tool that is not held does not stop when the visitor refuses. In our test, a header video kept playing after “Reject all”. A refusal must stop it, not only hide the banner.
What our tests found on WordPress
Set before the choice · WordPress sites with a cookie bannerTracking cookies before any choice in three countries
- Sites: WordPress, national domain, same ranking start. Read: France 107, Germany 114, Canada 104 of 120 each.
- Banner: cookie or consent text with a choice button, or a known tool. Doubtful cases set apart: France 3, Germany 9, Canada 6.
- Cookies: home page, 6 seconds, no click. Names of marketing and statistics services in our catalogue, as on our country pages.
- Reject found by button words, so a rare wording can be missed. Small sample: an order of magnitude, not a national rate.
Seen in our tests, 7 November 2026, WordPress sites with a cookie banner.
Full detail
We visited 120 WordPress sites each in France, Germany and Canada on 7 November 2026, from each country, with a new browser and no click. Among sites with a clear cookie banner, a tracking cookie was set before any choice on 36 of 57 in France (63 %), 21 of 53 in Germany (40 %) and 17 of 19 in Canada. A Reject button on the first screen: 42 of 57, 32 of 53 and 12 of 19. This describes what we saw, not a legal finding: Canada does not use the same consent rule as the European Union.
Set before the choice · WordPressWordPress comment avatars load from Gravatar before any choice
setting “show_avatars” · by default: on
Show Avatars is on by default. Each avatar loads from secure.gravatar.com with a hash of the commenter's e-mail. Seen on 19 sites, on 16 before any choice, without any cookie.
What to do: For a site that targets the EU, turn off Show Avatars (Settings > Discussion) or use local avatars, and name Gravatar in the privacy policy.
Seen in our tests, 18 October 2026, WordPress 7.1.3. Source
Full detail
WordPress shows comment avatars from Gravatar by default (Settings > Discussion > Show Avatars). Each avatar is an image loaded from secure.gravatar.com before any choice, with a hash of the commenter's email address in its address. Our harvests saw Gravatar on 19 sites, before any choice on 16, without any cookie.
Page builders and themes
Other plugins of the same kind.
Questions
Do I have this on my site?
Check three places: Appearance, Customize, Header Media, for a YouTube address; your pages, for a [video] shortcode or a pasted link; and Settings, Discussion, for avatars.
Is a self-hosted video in the header a problem?
No. A video file served by your own site stays on your site. The call to another company comes from a YouTube address.
Does Cookie Rocks hold these?
Yes for the YouTube header video, the video shortcode and the video widget, and for the embeds in its list. They wait for the visitor, then start on the same page, without a reload. Avatars and emoji images are not held today: turn avatars off if you do not need them.
Can I turn avatars off?
Yes. Settings, Discussion, Avatars: untick “Show Avatars”. Comments keep working.
Does it work on a WordPress multisite network?
Yes. We have tested it on two multisite networks. Each site of the network has its own settings, banner, cookie policy and proofs of consent, and its own cookie for the visitor’s choice. Turn it on for the whole network or for one site at a time. Each live site needs its own key. See the multisite guide.
What happens after the 30-day trial?
The banner, your visitors’ choices and your proofs of consent keep working. Without a key, most settings lock, updates and support stop. Take a key at any time and everything opens again.
For WordPress
Check what your site loads, before anyone chooses.
even with no plugin
Every feature of the complete plugin for 30 days, no card.
- During the trial: everything, including the full settings and the scans
- After 30 days without a key: the banner, your visitors’ choices and your proofs of consent keep working
- What waits for a key: most settings, updates and support
Get your trial key
Your e-mail and your site. Your key arrives as soon as you confirm your e-mail.