WordPress.org
Get WordPress
WordPress.org

Plugin Directory

Nymbl Cookie Sentinel

Nymbl Cookie Sentinel

By sminec
Download

Description

Nymbl Cookie Sentinel is a lightweight plugin (no jQuery, no external assets of its own) for managing visitor consent to cookie usage. The plugin itself sends nothing to the plugin developer: the only external services that can be contacted are the counters and analytics you connect yourself in the “Integrations” tab, and only after the visitor has given consent. See the “External services” section for the exact list of services, the data they receive and links to their terms and privacy policies.

The plugin is a tool for collecting, storing and re-requesting visitor consent. It does not by itself guarantee legal compliance: review your cookie list, policy pages and processing rules with your legal advisor.

Features

  • Consent banner: “Accept all” / “Reject all” / “Customize”
  • Policy links integrated into the banner text: use the {policy} and {privacy} placeholders in the description and the plugin turns them into real links right inside the sentence (if a placeholder is missing, links are appended after the text; if a URL is not set, the placeholder renders as plain text)
  • Granular settings for 4 categories: necessary (non-disableable), functional, statistical, marketing
  • Script blocking until consent: type="text/plain" + data-cookiecategory, dynamic activation after choice without page reload
  • Cookie table with descriptions, storage durations, domains, and third-party info; templates for WordPress, WooCommerce, Yandex.Metrika, GA4, Matomo, Facebook Pixel; CSV import
  • Integrations tab (form-based, no code pasting): connect Yandex.Metrika, Google Analytics 4, Google Tag Manager, VK Pixel, Top.Mail.ru, Facebook Pixel or Matomo by entering the service ID only — the plugin generates the official counter snippet itself and keeps it blocked until consent; each integration has a category, placement (head / body / footer), load priority and an on/off toggle; every supported service is documented with links to its terms and privacy policy in the “External services” section
  • Re-open settings widget
  • Consent versioning: banner reappears when the cookie list or policy changes
  • Accent color (Color Picker) applies to all UI elements
  • Light / dark / auto theme, banner position top/bottom
  • WCAG 2.1 AA: keyboard, Escape, ARIA, focus trap, contrast >= 4.5:1
  • API hooks: filters nymcs_is_category_allowed and nymcs_register_cookie, actions nymcs_after_consent_updated and nymcs_clear_cache, JS event nymcs:consent-updated. The action and the JS event fire on every frontend request that carries valid consent, not only when the choice changes — if you need one-time side effects, record the fact of processing yourself.
  • Integrations: WooCommerce, Fluent Forms (CSRF = necessary, abandonment = statistics), Rank Math, Yoast SEO, Polylang/WPML
  • Multisite: network activation creates the cookie table on every site, and new sites in the network are set up automatically

Consent storage: localStorage (nymcs_consent) + fallback cookie for 12 months.

Security note: the plugin never accepts, stores or outputs arbitrary CSS/JS/PHP entered by users. The Integrations tab is a form: you pick a supported service and enter its ID (counter number, Measurement ID, Pixel ID…), every value is validated against a strict whitelist format, and the counter snippet is generated by the plugin programmatically.

External services

This plugin has no server of its own. It does not phone home and sends nothing to the plugin developer: all settings and the cookie registry live in your WordPress database, and the visitor’s consent is stored in the visitor’s browser (localStorage plus a fallback cookie).

The plugin can, however, connect counters and analytics that you enable in the “Integrations” tab. Every integration is off by default, and the plugin works fully without any external service. For an enabled integration the plugin generates the official snippet of that service and prints it blocked (type="text/plain"). The snippet is executed and starts contacting the service only after the visitor has given consent to the category the integration is assigned to (Statistics by default). If the visitor rejects that category, or has not chosen yet, no request is ever made to the service’s domain.

When a snippet does load, the plugin only supplies the service ID you entered (counter number, Measurement ID, Container ID, Pixel ID or Matomo URL). After that the service collects the data it normally collects: the visitor’s IP address, user agent, the page URL and referrer, plus its own browser identifiers and cookies (_ga, _ym_uid, _fbp and alike). The plugin never proxies, logs or stores this data.

  • Yandex.Metrika (mc.yandex.ru) – web analytics. Loaded only after consent to the category you assigned (Statistics by default). Data sent on load: page URL, referrer, browser, screen and device parameters, IP address, and the counter number you entered. Yandex.Metrika terms of use, Yandex privacy policy.
  • Google Analytics 4 (www.googletagmanager.com, google-analytics.com) – web analytics. Loaded only after consent. Data sent on load: page URL, referrer, browser and device parameters, IP address, and the Measurement ID you entered. Google Terms of Service, Google Privacy Policy.
  • Google Tag Manager (www.googletagmanager.com) – tag manager. Loaded only after consent. Data sent on load: page URL, referrer, browser and device parameters, IP address, and the Container ID you entered. Note: a GTM container can load any other tags you have configured inside it – those tags send data to their own providers according to your container setup, so review the container as well. Google Terms of Service, Google Privacy Policy.
  • VK Pixel / VK Ads (vk.com) – advertising pixel. Loaded only after consent to the category you assigned (Marketing by default). Data sent on load: page URL, referrer, browser and device parameters, IP address, and the Pixel ID you entered. VK terms of use, VK privacy policy.
  • Top.Mail.ru counter (top-fwz1.mail.ru, top.mail.ru) – web analytics. Loaded only after consent. Data sent on load: page URL, referrer, browser and device parameters, IP address, and the counter ID you entered. Top.Mail.ru license agreement, Top.Mail.ru privacy policy.
  • Facebook Pixel (connect.facebook.net, facebook.com) – advertising pixel. Loaded only after consent to the category you assigned (Marketing by default). Data sent on load: page URL, referrer, browser and device parameters, IP address, the Pixel ID you entered and the PageView event. Meta Terms of Service, Meta Privacy Policy, Meta Business Tools Terms.
  • Matomo – self-hosted analytics. Nothing is sent to matomo.org or to the plugin developer: the tracker sends data only to the Matomo URL you enter in the plugin settings, that is, to your own server or to the host you trust. Data sent on load: page URL, referrer, browser and device parameters, IP address, and the Site ID you entered. Matomo software: terms, privacy policy.

These are the only external services this plugin can contact. If you change the Matomo URL, data is sent to the host you specify there. You are responsible for having a lawful basis for the services you enable.

Installation

  1. Upload the nymbl-cookie-sentinel folder to /wp-content/plugins/.
  2. Activate the plugin in the “Plugins” section.
  3. Go to “Cookie Consent > General Settings” and set the cookie policy and privacy policy page URLs.
  4. In the “Cookie” tab, apply templates for services used by the site.
  5. Connect analytics in the “Integrations” tab: pick the service, enter its ID (no code needed). Custom scripts can be wrapped manually in your theme:

FAQ

Does the plugin send any data to third-party services?

Not by itself. The plugin has no cloud service, no telemetry and no update server: it does not contact the plugin developer or anyone else. Only the counters and analytics that you enable yourself in the “Integrations” tab contact their services, and only after the visitor has consented to the category assigned to that integration. Before consent the snippet is printed blocked (type="text/plain") and never executed, so no request is made to the service’s domain. The exact services, the data they receive and links to their terms and privacy policies are listed in the “External services” section.

Does the plugin work with caching plugins?

Yes. The markup is rendered hidden, and visibility is managed by client-side JavaScript, so page caching does not break the consent logic. In addition, the plugin automatically purges the page cache whenever settings, the cookie registry, integrations or the consent version change. Supported out of the box: LiteSpeed Cache, WP Rocket, W3 Total Cache, WP Super Cache, WP Fastest Cache, Autoptimize, Hummingbird, Breeze, SiteGround Optimizer and Cache Enabler. For any other caching layer (CDN, server-side Varnish/nginx, Cloudflare) hook into the nymcs_clear_cache action or purge it on the hosting side.

How to connect a Yandex.Metrika counter?

Open the “Integrations” tab, select “Yandex.Metrika” and enter the counter number from your Metrika account settings (e.g. 12345678). The plugin generates the official counter code itself, prints it blocked (type="text/plain") and activates it after the visitor consents to the Statistics category. Alternatively, replace type="text/javascript" with type="text/plain" in your theme code and add the data-cookiecategory="statistics" attribute.

Can I paste custom JavaScript/CSS into the plugin?

No. Following the WordPress.org plugin guidelines, the plugin does not accept, store or output arbitrary user code. The “Integrations” tab is a form: choose a supported service (Yandex.Metrika, GA4, GTM, VK Pixel, Top.Mail.ru, Facebook Pixel, Matomo) and enter its ID — the counter snippet is generated programmatically from validated values. For scripts outside this list, wrap them in your own theme/plugin code with type="text/plain" and data-cookiecategory="..."; the plugin activates such tags after consent as well.

Which services are supported in the Integrations tab?

Yandex.Metrika (with optional Webvisor), Google Analytics 4 (gtag.js), Google Tag Manager, VK Pixel (VK Ads), Top.Mail.ru, Facebook Pixel and self-hosted Matomo. Each integration accepts only the service ID, validated by a strict format (regex / integer / URL whitelist).

How to put the policy link inside the banner text?

Use placeholders in the banner description (General Settings): {policy} is replaced with the cookie policy link and {privacy} with the privacy policy link — right inside the sentence, e.g. “Learn more: {policy}.” If a page URL is not set, the placeholder is shown as plain text so the sentence stays readable. If the description contains no placeholders, the links are appended after the text automatically.

Reviews

There are no reviews for this plugin.

Contributors & Developers

“Nymbl Cookie Sentinel” is open source software. The following people have contributed to this plugin.

Contributors

Translate “Nymbl Cookie Sentinel” into your language.

Interested in development?

Browse the code, check out the SVN repository, or subscribe to the development log by RSS.

Changelog

1.0.1

  • Documentation update requested by the WordPress.org plugin review team: added the “External services” section that lists every service which can be connected through the “Integrations” tab, what data it receives and when, and links to its terms of use and privacy policy (Yandex.Metrika, Google Analytics 4, Google Tag Manager, VK Pixel, Top.Mail.ru, Facebook Pixel, Matomo).
  • Clarified that the plugin itself has no server, no telemetry, no phone-home and no external assets of its own, and that connected counter snippets are printed blocked (type="text/plain") until the visitor consents to the matching category.
  • The same disclosure (domains, data sent, terms and privacy links) is now shown in the admin, on the “Integrations” tab next to the fields of each service.
  • Version bump only: no functional changes to the consent logic, no changes to stored data.

1.0.0

  • Initial release: consent banner with “Accept all” / “Reject all” / “Customize”, granular settings for 4 categories, script blocking until consent with dynamic activation, admin panel, cookie table with templates, CSV import, consent versioning, compliance checklist, re-open widget, integrations (WooCommerce, Fluent Forms, Rank Math, Yoast SEO, Polylang/WPML).
  • Policy links are integrated into the banner text via {policy} / {privacy} placeholders in the description; without placeholders the links are appended after the text, and with an empty URL a placeholder renders as plain text. Link URLs are validated server-side (esc_url_raw) and re-checked client-side (http/https/relative only) before they reach the DOM.
  • The per-category cookie list in the settings modal is collapsible (“Show cookies (N)” with aria-expanded), keeping the dialog compact while staying transparent.
  • Automatic cache purging: every frontend-affecting change (settings, cookie registry, integrations, consent version, activation) purges the page cache of supported caching plugins (LiteSpeed Cache, WP Rocket, W3 Total Cache, WP Super Cache, WP Fastest Cache, Autoptimize, Hummingbird, Breeze, SiteGround Optimizer, Cache Enabler) and fires the nymcs_clear_cache action for other caching layers; each purge call is guarded and cannot break saving.
  • The “Integrations” tab is form-based and does not accept arbitrary code: the admin picks a supported service (Yandex.Metrika, GA4, GTM, VK Pixel, Top.Mail.ru, Facebook Pixel, Matomo) and enters only its ID; the official counter snippet is generated by the plugin programmatically at render time and never stored in the database.
  • Every integration ID is validated against a strict whitelist format (regex / absint / esc_url_raw) on save and again on every read, so altered or legacy option records cannot reach the frontend.
  • Blocked integrations can be placed in head, body or footer, and each entry has a category, a load priority and an on/off toggle.
  • Multisite: network activation sets up every site in the network, and sites created later are set up through the wp_insert_site hook.
  • The nymcs_consent cookie is read in a single place, NYMCS_Plugin::get_cookie_consent(), with size and JSON depth limits: categories are checked against a whitelist, version and timestamp are cast to integers, and consent stored for an older consent version is not accepted server-side.
  • CSV import validates the upload (UPLOAD_ERR_*, is_uploaded_file(), 512 KB limit, .csv/.txt only) and parses it row by row with fgetcsv(); every cell is sanitized before it is stored.
  • Cookie names keep their original case, spaces, dots, slashes and wildcard * (for example PHPSESSID / wordpress_logged_in_*, _ga_*, _pk_id.*).
  • Settings, cookie records and integration entries are validated against whitelists on both save and read; all admin output is escaped; WP_List_Table is loaded only on the plugin’s own admin screen.

Meta

Ratings

No reviews have been submitted yet.

Your review

See all reviews

Contributors

Support

Got something to say? Need help?

View support forum