Works with your stack
Cookie consent for WP Rocket
never delayed
WP Rocket can hold every script until the visitor moves the mouse or scrolls. Good for speed, bad for consent: a consent script has to run first, before anything else.
By WP Media · wp-rocket.me
Cookie Rocks in the WP Rocket exclusion list
Is this your product? Tell us if anything here is out of date. Write to us
WP Rocket
WordPress plugin
- How
- Reproduced in the Cookie Rocks tests
- Last test
- 14 October 2026
What matters for consent with WP Rocket
Delay JavaScript execution
With this option on, scripts wait for a first interaction. A delayed consent script shows the banner late, after the visitor has started reading.
Defer and combine
WP Rocket can also defer and combine scripts. The consent script has to keep its place at the top of the page.
A cache to clear
WP Rocket keeps a copy of each page. A banner change reaches visitors once that copy is cleared.
YouTube preview images
WP Rocket can show a preview image instead of each YouTube video until the click. The image comes from YouTube’s servers: see YouTube.
Preloading
WP Rocket builds cached pages in advance. The page holds no visitor’s choice, so a preloaded page is right for everyone.
Cookie Rocks with WP Rocket
- Adds the banner’s scripts to its exclusions from delay, combining and minifying.
- Marks the consent script so it is neither moved nor delayed.
- Clears its page cache when you change something visitors can see.
- Holds the scripts it delays until the first interaction, runs them at once after consent, then leaves them to it on the next pages.
What our tests found on WP Rocket
Good to know · WP RocketWhat WP Rocket stores in visitors' browsers when it delays JavaScript
WP Rocket: rocketCSPIssue (session storage, necessary) after a CSP block.
Name Kept in Category What it is for rocketCSPIssuesessionStorage Necessary Remembers that the site's security policy blocks delayed scripts Read in its code, 4 November 2026, WP Rocket.
Full detail
When WP Rocket delays JavaScript, it sets rocketCSPIssue = true in session storage after a Content Security Policy blocks one of its data: scripts, and reads it on the next pages. The Audit 2.9.11 lists it without a category.
Good to know · WP RocketWP Rocket never delays Cookie Rocks, from its own list
Cookie Rocks is in WP Rocket's own Delay JavaScript exclusions list, sent to every WP Rocket site.
Read in its code, 4 November 2026, WP Rocket.
Full detail
WP Rocket's dynamic list of Delay JavaScript exclusions, which WP Rocket sends to every site that uses it, has an entry for Cookie Rocks since 04/11/2026: when cookie-rocks-banner/cookie-rocks-banner.php is active, scripts matching cookie-rocks, crHead or cookieRocks are not delayed. Cookie Rocks already adds the same patterns through WP Rocket's filters; the list keeps them out of the delay even if those filters do not run.
Good to know · Cookie RocksThe audit names the local fonts setting of your theme
When the home page loads Google Fonts, the Cookie Rocks 2.9.5 audit names the setting of the active theme or plugin that serves them from the site: Elementor, WP Rocket, Spectra, Kadence Blocks, OMGF, Local Google Fonts, Astra, Kadence, OceanWP or Neve. Otherwise it suggests a plugin such as OMGF. Divi, Bricks, Oxygen and Beaver Builder have no such setting. With Cookie Rocks Pro, it points to « Serve Google Fonts from this site » instead.
Read in its code, 1 November 2026, Cookie Rocks.
Depends on a setting · WP RocketWP Rocket's Combine JavaScript can run a held script before consent
setting “Combine JavaScript files” · by default: off
It does not check script types, so a script held by a consent plugin can be pulled into the combined file. Local files with data-no-minify are spared; external ones only via the exclude list.
Read in its code, 16 October 2026, WP Rocket 3.23.5.1.
Full detail
WP Rocket's Combine JavaScript files (usable only when Delay JavaScript execution is off) does not check the type of a script with a src, so a local or external script held as type="text/plain" by a consent plugin can be pulled into the combined file and run before consent. Local files with data-no-minify are spared; external ones only through the exclude list or the rocket_minify_excluded_external_js filter.
Good to know · WP RocketWP Rocket's Delay JavaScript delays another plugin's consent default
WP Rocket sets one cookie, only for logged-in users with that cache on. Inline Google tag scripts are not excluded from Delay JavaScript, so a consent default there is delayed unless excluded.
Read in its code, 16 October 2026, WP Rocket 3.23.5.1.
Full detail
WP Rocket sets one cookie of its own, wp_rocket_ucc_<hash> (HttpOnly), only for logged-in users when caching for logged-in users is on; its only localStorage use is in admin scripts. It does not use WP Consent API and sets no Consent Mode default. gtag, gtm and dataLayer inline scripts are excluded from inline combining but not from Delay JavaScript execution, so another plugin's inline gtag('consent','default') is delayed unless excluded.
Set before the choice · WP RocketWP Rocket YouTube preview image loads from i.ytimg.com before the choice
setting “Replace YouTube iframe with preview image”
With the preview image option, the image loads from i.ytimg.com when the page shows, and YouTube only on click. Cookie Rocks 2.5.0 holds iframes that WP Rocket lazy loads.
Read in its code, 16 October 2026, WP Rocket 3.23.5.1.
Full detail
WP Rocket's lazy load only rewrites iframes that have a src attribute (data-no-lazy or skip-lazy excludes them). With Replace YouTube iframe with preview image, the preview image loads from i.ytimg.com as soon as the page shows, and YouTube only on click. Cookie Rocks 2.5.0 reads an iframe address waiting in data-lazy-src and holds it.
Good to know · Cookie Rocks ProCookie Rocks Pro clears page caches when an update changes banner values
It clears the caches of seven known plugins, such as WP Rocket and LiteSpeed Cache, at the first request after the update. Host and CDN caches keep the old pages until they expire.
What to do: After an update that changes banner defaults, clear the host or CDN cache by hand.
Read in its code, 15 October 2026, Cookie Rocks Pro.
Full detail
When an update of Cookie Rocks Pro changes or removes a value it sends to visitors (for example the default accent colour), Pro clears the known page caches (WP Rocket, LiteSpeed Cache, W3 Total Cache, WP Super Cache, SiteGround Optimizer, WP Fastest Cache, Breeze) at the first request after the update, with no extra database query and nothing more for visitors. An added value clears nothing. Host and CDN caches are not cleared and keep the old pages until they expire.
Good to know · WP Rocket, PerfmattersWP Rocket and Perfmatters delayed scripts stay held until consent
setting “Delay JavaScript execution”
Tested with an imitated loader, not the paid plugins. Delayed scripts wait for consent, run once the visitor accepts, and never run after Reject all.
Seen in our tests, 15 October 2026, WP Rocket, Perfmatters.
Full detail
Tested with an imitated loader, not with WP Rocket or Perfmatters themselves (paid plugins): scripts delayed as rocketlazyloadscript or pmdelayedscript stay held by Cookie Rocks until consent, even after the first gesture, run as soon as the visitor accepts, and are handed back to the optimiser on the next pages; after Reject all they never run. Cookie Rocks adds its scripts to WP Rocket's delay, defer and combine exclusions and marks its head script nowprocket.
How we test it
Reproduced in our tests
It is sold by its publisher only. Our tests reproduce what it does to the scripts of a page, with its own setting names, and check that the consent script comes through unchanged.
Light as a pebble
11.43 kB once, 1.00 kB per page. Measured, not promised.
lighter than the font on this page*
Every kilobyte costs your visitors time and costs you Core Web Vitals. Cookie Rocks adds 11.43 kB to the first page a visitor opens, then 1.00 kB to each page after that, because its files stay in the browser cache. It calls no outside server and never shifts your layout.
11.43 kB First visit, in total
1.00 kB Each next page
7.74 kB JavaScript, first visit
3.48 kB Stylesheet, first visit
0 Requests to other servers
0 Layout shift caused
* The font on this page is Inter, compressed and cut down to the Latin alphabet. It still weighs 26.23 kB.
Page cache
Other plugins of the same kind.
Questions
Do I need to add Cookie Rocks to WP Rocket’s exclusions?
No. WP Rocket keeps Cookie Rocks out of Delay JavaScript execution by default, on every site, through its own list of exclusions. Cookie Rocks also adds itself through WP Rocket’s settings: nothing to add by hand.
Will visitors see each other’s choices in a cached page?
No. The choice is read in the browser, after the page arrives, so the cached page is the same for everyone.
And Cloudflare APO or my host’s cache?
They sit in front of WP Rocket and keep their own copy. Clear them by hand after changing what visitors see.
What happens after the 30-day trial?
The banner, your visitors’ choices and your proofs of consent keep working. Without a key, most settings lock, updates and support stop. Take a key at any time and everything opens again.
For WP Rocket sites
Keep WP Rocket, add consent.
never delayed
Every feature of the complete plugin on your WP Rocket site for 30 days, no card.
- During the trial: everything, including the full settings and the scans
- After 30 days without a key: the banner, your visitors’ choices and your proofs of consent keep working
- What waits for a key: most settings, updates and support
Get your trial key
Your e-mail and your site. Your key arrives as soon as you confirm your e-mail.