Description

ONiDEA Consenso Cookie Conforme Italia is a free, self-hosted alternative to subscription services like CookieYes or Cookiebot, covering the essential cookie consent features for WordPress sites:

Consent banner with “Accept all” / “Reject all” buttons of equal visual prominence (as required by the Italian Data Protection Authority’s — Garante Privacy — guidelines) plus a “Customize” option.
Preferences panel with categories: Necessary (always on), Statistics, Marketing, Functional — enabled individually per site.
Automatic blocking of scripts marked as non-essential until the user gives consent.
Google Consent Mode v2: sets consent signals for Google Analytics 4 / Google Ads / AdSense before their scripts load, so they automatically honor the user’s choice (only needs enabling where relevant).
Server-side consent log (date, chosen categories, page, hashed IP — never stored in the clear) for the accountability record required by the GDPR, with CSV export.
Engine built on the open-source “CookieConsent” library by Orest Bida (MIT license), served from your own site: no third-party calls, no subscription fee.

What it does NOT do (unlike paid services)

No automatic recurring scan of the site’s cookies: categories and the scripts to block are configured manually (see GUIDA-RAPIDA.md, in Italian, in the plugin folder).
Not IAB TCF certified: suited to Google AdSense/Ads/GA4 (via Consent Mode) and to the general run of editorial/business/e-commerce sites, not to publishers selling ad inventory through multiple ad exchanges/SSPs that require IAB certification.
Does not provide legal privacy/cookie policy text: that remains your responsibility or your legal counsel’s.

Included features

Every feature of the plugin — banner, categories, script blocking, Google Consent Mode v2, proof-of-consent log with CSV export, and the Dashboard with consent reporting/trends (accepted/rejected/partial breakdown, last-7-days chart) — is included and active for anyone who installs the plugin, with no distinctions. The “Powered by ONiDEA adv” credit at the bottom of the banner is disabled by default and can be turned on by anyone from Settings.

Any future premium extensions (if and when they arrive) will be a separate, independently distributed add-on — never functionality hidden inside this same package.

Credits and licenses

The banner engine is the open-source CookieConsent library by Orest Bida (https://github.com/orestbida/cookieconsent), released under the MIT license — fully compatible with this plugin’s GPLv2+ license. The library’s code is bundled unmodified in assets/js/cookieconsent.umd.js and assets/css/cookieconsent*.css; the original MIT license text is available at the repository above.

Plugin developed and maintained by ONiDEA adv, a web agency based in Milan, Italy.

Screenshots

The banner on the frontend, with "Accept all" and "Reject all" buttons of equal visual prominence, as required by the Italian Data Protection Authority's guidelines. — The banner on the frontend, with “Accept all” and “Reject all” buttons of equal visual prominence, as required by the Italian Data Protection Authority’s guidelines.

The "Customize" panel, with cookie categories (Necessary, Statistics, Marketing, Functional) toggled individually. — The banner on the frontend, with “Accept all” and “Reject all” buttons of equal visual prominence, as required by the Italian Data Protection Authority’s guidelines.

Installation

Upload the onidea-cookie-consent folder to /wp-content/plugins/.
Activate the plugin from the WordPress Plugins screen.
In the admin sidebar, open “Consenso Cookie” and configure categories, banner text, and links to your privacy/cookie policy (under the “Settings” entry of the new menu).
If the site uses AdSense/Google Ads/GA4, enable “Google Consent Mode”.
See GUIDA-RAPIDA.md (Italian-language guide, included in the plugin folder) for how to tag third-party scripts that need blocking.

FAQ

Why doesn’t the REST endpoint that logs consent use a nonce?

Deliberate choice, not an oversight. A WordPress nonce is generated when the page is rendered: on a site with page caching (practically all of them, in production) it ends up baked into the cached HTML and is replayed identically by every visitor for as long as that cache lives — often longer than the nonce’s own lifetime. The practical result, observed during development: consents silently rejected by the endpoint (a 200 response with {"logged":false}, no visible error) for the entire lifetime of the cache.

A nonce, in this specific case, does not protect anything worth protecting: the route is public by design (permission_callback is __return_true, deliberately — it must be callable by an anonymous visitor who has no account yet), it doesn’t write anything privileged (only a row in an accountability-only log), and for a logged-out visitor the token is identical for everyone anyway. In its place: strict per-argument validation (type, length, and a category whitelist, so only well-formed rows can ever be written), a same-origin check on the request, and a 20-calls-per-hour-per-IP limit against abuse — computed from REMOTE_ADDR only by default, since request headers like X-Forwarded-For are attacker-controllable and are not trusted unless a site explicitly opts in via the occit_trust_proxy_ip_headers filter (for sites that know they sit behind a proxy/CDN they control). None of this is a substitute for authentication; it bounds the worst case to “some extra rows in a low-sensitivity accountability log,” which is the actual risk on this endpoint. Details in the code, in class-occ-frontend.php and the REST handler.

Does the plugin send data to external services?

No. The banner engine (the “CookieConsent” library by Orest Bida) is downloaded once during development and distributed inside the plugin itself: it runs entirely on your own site, with no call to any third-party service either at runtime or during configuration. The consent log is a table in your own database.

Reviews

There are no reviews for this plugin.

Contributors & Developers

“ONiDEA Consenso Cookie Conforme Italia” is open source software. The following people have contributed to this plugin.

onideaadv

Translate “ONiDEA Consenso Cookie Conforme Italia” into your language.

Interested in development?

Browse the code, check out the SVN repository, or subscribe to the development log by RSS.

Changelog

1.6.2

Second round of wordpress.org review fixes. The tools/ folder (developer-only scripts, .py/.mjs, not needed at runtime) is no longer included in the distributed package — it stays in the source repository for internal use. Hardened the unauthenticated consent-log REST endpoint: added strict per-argument validation (type, length, a whitelist of the four known category keys) so the log table can only ever receive well-formed rows, and the per-IP rate limit now reads only REMOTE_ADDR by default instead of also trusting the attacker-controllable X-Forwarded-For/CF-Connecting-IP headers (opt-in via the new occit_trust_proxy_ip_headers filter for sites that know they sit behind a trusted proxy/CDN). The endpoint remains intentionally public (no user account exists to authenticate against) — see the FAQ below for the full rationale. No visible change for site visitors.

1.6.1

Updated the “Tested up to” header to 7.1, per wordpress.org’s automated submission scan (the previous 7.0 value was flagged as outdated). No functional change.

1.6.0

Renamed the plugin to “ONiDEA Consenso Cookie Conforme Italia” (previously “Consenso Cookie Conforme Italia”), per wordpress.org directory guideline 17 (distinctive naming) — the previous name was too close to the generic pattern used by many other cookie-consent plugins. Internal function/class/option/hook names were also renamed from the “occ_” prefix (3 characters) to “occit_”, meeting the directory’s minimum prefix length; existing settings and the consent-log table are migrated automatically and transparently on upgrade, no data is lost. The Dashboard page’s CSS moved from an inline <style> block to a properly enqueued stylesheet. No visible change for site visitors; wp-admin menu URLs change (occ-dashboard occit-dashboard, etc.) and any old bookmarks to them will need updating.

1.5.5

Text Domain header updated to match the wordpress.org-assigned slug (consenso-cookie-conforme-italia), fixing a textdomain_mismatch warning raised by the automated submission scan. No functional change.

1.5.4

Removed the Plugin URI header (it was identical to the Author URI, which wordpress.org’s submission form does not allow — the two must point to different pages). Kept the Author URI pointing to the agency site, since there is no dedicated page for this specific plugin yet. No functional change.

1.5.3

Translated readme.txt into English, per wordpress.org’s directory-listing language policy (July 2025): the readme is now the base language for community translations via translate.wordpress.org. The plugin itself — admin screens, banner text, settings, GUIDA-RAPIDA.md — remains entirely in Italian, as intended for its target audience. No functional change.

1.5.2

Fixed the findings from wordpress.org’s official Plugin Check: prepared direct database queries are now documented with the matching phpcs exemption instead of being left unannotated; the CSV export’s write to php://output (the HTTP response stream, not a real file — WP_Filesystem doesn’t apply here) is documented the same way; removed GUIDA-RAPIDA.md from the distributed package (an internal guide for the agency, not required for the plugin to work — still available in the source repository). No functional change for site visitors.

1.5.1

Added a reference to the agency’s site (ONiDEA adv, web agency in Milan) in the plugin header (Plugin URI/Author URI) and in the readme’s Credits section. No functional change for site visitors.

1.5.0

Removed the Free/Pro distinction: the Dashboard with consent reporting and trends, previously reserved for the Pro tier, is now included and active for everyone. The wordpress.org directory guidelines (guideline 5, “trialware”) do not allow functionality that already exists in the code but is disabled behind a license flag — this removal brings the plugin in line with that requirement ahead of submission. Any future premium extensions will be a separate add-on, never a hidden switch inside this same package.

1.4.1

Renamed the plugin to “Consenso Cookie Conforme Italia” (previously “Cookie Consent – by ONiDEA”), ahead of a future submission to the official wordpress.org repository — the previous name remains as the author/agency name, no longer as the plugin name. No change to how the plugin behaves for site visitors. Internal cleanup: code brought in line with the WordPress Coding Standards (complete docblocks, style conventions), added an FAQ section (justification for the log endpoint’s nonce-free design, confirmation of no calls to external services), a Credits and licenses section for the bundled CookieConsent library, and a Screenshots section.

1.4.0

The “Powered by ONiDEA adv” credit is now disabled by default at every tier (previously always on in Free, only removable in Pro) and is a free-standing Settings option independent of tier. Also fixed the “|” divider between the banner footer links, which stayed stuck to the first link when only two remained (e.g. Privacy Policy and Cookie Policy with the credit off): spacing is now symmetric regardless of how many links are present.

1.3.2

The “Manage cookie preferences” button now works even where wp_kses_post() strips its inline onclick — i.e. in widgets, filtered content, and many theme templates, where it used to stay visible but inert. The click is now captured via delegation in occ-init.js, so the button no longer depends on an inline attribute (also useful under a Content-Security-Policy).

1.3.1

The banner’s two JavaScript files now load with defer. Without it, they blocked the parser and the browser fetched them at high priority, taking bandwidth away from the render-blocking CSS: the banner can never appear before the page itself, so that priority bought nothing and cost something.

1.3.0

The preferences-panel stylesheet (roughly 41% of the library’s CSS) is no longer loaded with the page: it’s only fetched by visitors who actually open the panel. Everyone else never downloads it. The split is regenerated with tools/split-modal-css.py after a library update.

1.2.0

Banner settings now travel in a <script type="application/json"> block instead of via wp_localize_script: optimization plugins that combine JavaScript also swallow inline scripts, so excluding the banner script from the bundle (to make it appear earlier) left it without its settings and the banner failed to appear at all.
The consent log no longer requires a nonce: it used to get baked into the HTML when the page cache was written and expired before that cache did, silently losing consents on every cached site. In its place: a same-origin check and a per-IP hourly limit.

1.1.0

Added the “Powered by ONiDEA adv” credit to the banner (removable in the Pro version) and a Free/Pro distinction (dashboard reporting reserved for the Pro version).

1.0.0

First release.