Description
Legal Box Plus Compliance helps site owners obtain, store, and respect visitor consent before any third-party service is loaded. It blocks cookies, iframes, and tracking scripts in advance, shows a customizable consent banner with granular categories, keeps proof of every decision, and connects with Legal Box Plus to publish always up-to-date legal texts.
Prior blocking
- Blocks third-party iframes and scripts anywhere on the page: post content, widgets, theme templates, headers and footers, page builders, and code written directly in the theme.
- Inline code, styles,
<noscript>content, templates, and HTML comments are never rewritten, so the theme’s own JavaScript keeps working. - Supports lazy-loaded iframes (
data-src) and JavaScript modules. - Blocked embeds are replaced by an accessible placeholder that shows the service and category, with “Allow category and load” and “Load only this time” buttons.
- X/Twitter blockquotes are held back together with their widget script.
- Whole-page processing can be switched off; embeds inside post content are always blocked.
- Page builder editors (Elementor, Divi, Beaver Builder, Bricks, Oxygen, WPBakery, Brizy, Thrive, Breakdance), the Customizer, feeds, REST, and AJAX responses are never processed.
Known services
More than 30 services are recognized by domain, path, and inline code signature, and each one can be switched off individually:
- Video and audio: YouTube, Vimeo, Dailymotion, Twitch, Wistia, Spotify, and SoundCloud.
- Social networks: X/Twitter, Facebook, Instagram, TikTok, LinkedIn, Pinterest, and Bluesky.
- Third-party features: Google Maps, OpenStreetMap, and Calendly.
- Analytics: Google Analytics and Google Tag Manager, Hotjar, Microsoft Clarity, Matomo Cloud, and Yandex Metrica.
- Advertising: Meta Pixel, TikTok Pixel, LinkedIn Insight Tag, Pinterest Tag, X Ads, Microsoft Advertising, Snap Pixel, Criteo, and Google Ads/DoubleClick.
Google tags are not blocked while advanced Google Consent Mode is active, because they adapt to the consent signals themselves.
Your own blocking rules
- Custom rules: block any other domain (subdomains included), optionally limited to a path, and assign it a consent category.
- Exclusions: any iframe or script whose address, ID, or code contains one of the listed texts is never blocked.
- Script manager: delay WordPress script handles, including their inline data and translations, until their category is accepted.
- Code snippets: paste tracking codes (for example a pixel) in the plugin instead of the theme. They are printed blocked and run only after consent, at the head or at the end of the page.
<noscript>fallbacks are discarded because they would load the tracker without consent. Only users allowed to publish unfiltered HTML can edit snippets.
Consent banner
- Granular categories: Essential (always active), Preferences, Analytics, Marketing, Social, and Video.
- “Accept all”, “Reject”, and “Preferences” in the first layer, with a preferences panel to choose categories one by one.
- Five layouts: bottom bar, top bar, floating box on the left or right, and centered window with a backdrop.
- Background, text, and button colors, plus corner radius.
- Option to give “Reject” the same prominence as “Accept all”, enabled by default.
- Editable banner title, message, and button texts.
- Editable name and description for every consent category.
- Links to the mapped privacy policy, cookie policy, and legal notice pages.
- Live preview in the settings screen.
- Accessible dialog markup, keyboard focus handling, and Escape to close once a choice exists.
- Floating preferences button with custom text, left or right position, and a compact icon-only mode.
- Gutenberg blocks: a consent button and a consent area that shows its inner blocks only after a chosen category is accepted.
[rgpd_lb_preferences]shortcode to reopen the preferences panel from any page.
Proof of consent
- Every decision (accept all, reject all, custom selection, or category allowed from an embed) is stored in a table of your own database.
- Each record keeps a random consent ID, the accepted categories, the consent version, the date, the IP address with its last part removed, the browser user agent, and the page path.
- Visitors can see their consent ID in the preferences panel.
- The Consent records screen shows totals for the last 30 days, search by consent ID, pagination, and CSV export.
- Records are deleted automatically after 1, 2, 3, or 5 years.
- Suggested text for the WordPress privacy policy guide.
- Records never leave your site.
Google Consent Mode v2
- Denied-by-default consent state in the page head, before any Google tag runs.
- Consent updates when the visitor decides: ad_storage, ad_user_data, ad_personalization, analytics_storage, functionality_storage, and security_storage.
- Basic and advanced modes, wait_for_update, ads_data_redaction, url_passthrough, and per-region defaults.
- Configurable list of Google script handles that are never blocked in advanced mode.
Cookie scanner
- Loads a real page of your site twice: before consent and with every category accepted.
- Reports the cookies created by the browser, by JavaScript, and by the server (including HttpOnly cookies from the response headers), with a suggested category.
- Highlights non-essential cookies that already appear before consent.
- Lists the external domains requested by the page.
- Cookie values are never stored.
Legal texts with Legal Box Plus
- Step-by-step wizard to connect a Legal Box Plus account and sync the account data automatically.
- Creates or maps the legal notice, privacy policy, and cookie policy pages.
- Generates each legal text from Legal Box Plus, in singular or plural form, and keeps it up to date.
- Cached documents with automatic refresh, and the last good version is kept if the service is unavailable.
- Connection log with configurable retention to diagnose API errors.
Languages
The plugin is written in English and includes Spanish, French, and Italian translations, also for the block editor.
External services
Legal Box Plus API
The legal-document features connect to https://app.legalbox.plus. When an administrator authenticates, the plugin sends the entered email address, password, and remember-session choice so the service can issue an API token. During account synchronization and legal-document generation, it sends that token, Legal Box Plus account identifiers, the selected plan identifier, the configured website URL, and the requested document type. The service returns account/domain information and generated legal-document HTML. These requests occur only when an administrator uses the Legal Box Plus assistant or when a mapped legal page needs refreshing. Cookie-consent management works locally without a Legal Box Plus login, and cookie scanner results are not sent to this service.
Legal Box Plus is provided by Ocean Legaltech, S.L.:
- Terms of service: https://legalbox.plus/condiciones-de-contratacion/
- Privacy policy: https://legalbox.plus/politica-de-privacidad/
Google Consent Mode and Google/YouTube services
The plugin does not install Google Analytics, Google Tag Manager, advertising tags, or YouTube embeds. When the site owner has installed compatible Google tags and enables Consent Mode, the plugin sends consent-state signals to those tags on page load and whenever the visitor changes consent. Those separately configured Google tags or YouTube embeds may then send the visitor’s IP address, browser/device information, page URL, referrer, consent signals, and Google cookie or advertising identifiers according to the site’s tag configuration. YouTube connections are delayed until the visitor grants the Video category or chooses to load an individual embed.
- Google and YouTube terms: https://policies.google.com/terms
- Google and YouTube privacy policy: https://policies.google.com/privacy
Vimeo embeds
The plugin does not create Vimeo embeds. If a page already contains one, the connection is delayed until the visitor grants the Video category or loads that embed once. Loading it can disclose the visitor’s IP address, browser/device information, page URL, referrer, and Vimeo cookies or identifiers to Vimeo.
- Vimeo terms: https://vimeo.com/legal/
- Vimeo privacy policy: https://vimeo.com/legal/privacy
X, Facebook, Instagram, and Bluesky embeds
The plugin does not create social-network embeds. If a page already contains a supported embed, it is replaced with a local placeholder until the visitor grants the Social category or loads that embed once. Loading an embed connects the visitor’s browser to the relevant provider and may disclose the IP address, browser/device information, page URL, referrer, and that provider’s cookies or identifiers.
- X terms: https://x.com/en/tos
- X privacy policy: https://x.com/en/privacy
- Facebook and Instagram terms: https://www.facebook.com/legal/terms
- Meta privacy policy: https://www.facebook.com/privacy/policy/
- Bluesky terms: https://bsky.social/about/support/tos
- Bluesky privacy policy: https://bsky.social/about/support/privacy-policy
Other recognized services
The plugin does not add any of the other services listed under “Known services” to your site, and it never contacts those providers itself. When the site owner has already added one of them, the plugin only delays the connection until the visitor accepts the related category or loads that embed once. From then on the provider receives whatever its own code sends, typically the IP address, browser/device information, page URL, referrer, and its cookies or identifiers, under that provider’s terms and privacy policy. The same applies to code snippets and custom rules configured by the site owner.
Consent records are stored only in the site’s own database and are never sent to Legal Box Plus or any other service.
Installation
- Upload the
legal-box-plus-compliancefolder to/wp-content/plugins/. - Activate the plugin from the WordPress
Pluginsscreen. - Complete the Legalbox wizard to connect your account and map the legal pages.
- In
Legal Box Plus Compliance > Settings, adjust the banner texts and appearance in the Banner tab and the category texts in the Categories tab. - Review the services in the Blocking tab, add your own rules or exclusions if needed, and paste any tracking code in the Scripts tab.
- Optionally run the cookie scanner to check which cookies appear before consent.
- Optionally insert the consent button block or keep the floating preferences button enabled.
FAQ
-
How do I block specific scripts?
-
Scripts from known services are blocked automatically, even when they are written directly in the theme. For other scripts you can add a domain rule in the Blocking tab, add the registered WordPress script handle in the Scripts tab, or paste the tracking code as a code snippet so it only runs after consent.
-
Which third-party services are blocked automatically?
-
The services listed under “Known services” in the description. Google tags are blocked as well unless advanced Google Consent Mode is active, in which case they receive the consent signals instead. Each service can be switched off in the Blocking tab.
-
Can something stop working because it is blocked?
-
Blocked content loads as soon as the visitor accepts its category. If a script that your site needs is matched by mistake, add a fragment of its address, ID, or code to the “Never block” list. Whole-page processing can also be switched off; embeds inside post content are still blocked. Content inserted later by JavaScript (for example a video created by a page builder script) is not covered: block the script that creates it instead.
-
Does it work with caching plugins?
-
Yes. Pages are cached with third-party content already blocked, and consent is applied in the visitor’s browser, so the same cached page is valid for every visitor. Clear the cache after changing the blocking settings.
-
Can I customize the texts and styles?
-
Yes. The Banner tab lets you edit every banner text, choose the layout (bottom bar, top bar, floating box, or centered window), and set the colors and corner radius with a live preview. The Categories tab customizes the name and description of each consent category. You can still override styles with your own CSS.
-
How are consents recorded?
-
Each decision taken in the banner is stored in a database table of your site with a random consent ID, the accepted categories, the consent version, the date, the IP address with its last part removed, the browser user agent, and the page path. Visitors can see their consent ID in the preferences panel. Records can be searched and exported as CSV from
Legal Box Plus Compliance > Consent recordsand are deleted automatically after the configured retention period. No record is sent to any external service. -
Do I need a Legal Box Plus account?
-
Only for the legal texts. Consent management, blocking, consent records, and the cookie scanner work locally without an account.
-
What is removed when I delete the plugin?
-
Deleting the plugin from the Plugins screen removes its settings, the API token, logs, scan results, cached legal documents, the scheduled clean-up task, and the consent records table. Deactivating it keeps all data.
-
Can developers extend it?
-
Yes. These filters are available:
rgpd_legalbox_plus_service_rules: add, change, or remove blocking rules.rgpd_legalbox_plus_page_blocking: turn whole-page processing on or off for a request.rgpd_legalbox_plus_google_consent_payload: adjust the Consent Mode signals.rgpd_legalbox_plus_google_exempt_handles: Google script handles that are never blocked.rgpd_legalbox_plus_consent_config: consent version, lifetime, and storage keys.rgpd_legalbox_plus_consent_client_ip: read the visitor IP from a trusted proxy header before it is anonymized.rgpd_legalbox_plus_consent_rate_limit: consent records accepted per IP address and hour.rgpd_legalbox_plus_document_refresh_intervalandrgpd_legalbox_plus_document_retry_delay: legal document cache timing.
The
rgpd:consent-updatedbrowser event is dispatched onwindowwhenever the visitor saves a choice.
Reviews
There are no reviews for this plugin.
Contributors & Developers
“Legal Box Plus Compliance” is open source software. The following people have contributed to this plugin.
Contributors
Translate “Legal Box Plus Compliance” into your language.
Interested in development?
Browse the code, check out the SVN repository, or subscribe to the development log by RSS.
Changelog
1.1.0
- Added banner appearance settings: layout, colors, corner radius, equal-prominence reject button, legal page links, and a live preview.
- Added editable category names and descriptions, and floating button text, position, and compact mode.
- Added proof-of-consent records with anonymized IP addresses, search, CSV export, retention period, and suggested privacy policy text.
- Added whole-page prior blocking that covers widgets, theme templates, page builders, and scripts hardcoded in the theme, while leaving inline code, styles, and noscript content untouched.
- Added more than 30 known services with per-service switches, custom domain rules, exclusions, and code snippets that run only after consent.
- Reorganized the settings screen into tabs and split the plugin into focused classes.
- Source strings are now in English, with Spanish, French, and Italian translations included.
- Fixed the “Create page” buttons on the settings screen and the admin assets on the wizard screen.
1.0.5
- Corrected WordPress.org author, contributor, and text-domain metadata.
- Documented all external services and the data sent to them.
- Moved frontend inline JavaScript to the WordPress script enqueue API.
- Updated Gutenberg blocks to Block API v3 and tightened scanner input validation.
1.0.4
- Added a real frontend cookie scanner launched from WordPress administration.
- Added separate before-consent and all-accepted scans, direct Set-Cookie inspection, external-service detection, and secure metadata-only reports.
1.0.3
- Added automatic and manual planSkuId handling with a fallback value of 73.
- Added persistent legal-document caching with stale fallback when the SaaS is unavailable.
- Separated the API credential into a non-autoloaded option and removed unused handlers and scanner code.
- Tightened legacy document detection and reduced sensitive API logging.
- Fixed legal-page creation, inline-script blocking, script execution order, settings fallbacks, and translation catalogs.
1.0.2
- Consolidated the plugin into a single bootstrap and granular consent engine.
- Added consent version and expiry validation, safer remote document fetching, and early Google Consent Mode defaults.
- Added a Preferences category and preserved blocked embed and script attributes.
1.0.0
- Initial release with prior blocking, script manager, Consent Mode v2, Legalbox assistant, and Gutenberg blocks.