Description
Most cookie banners ask for permission after the tracking has already started. The visitor sees a box, the pixels have long since fired, and the consent record describes something that never happened.
This one runs before them. It prints its script at the earliest point WordPress allows in the page head, ahead of Google Analytics, Meta Pixel, Google Tag Manager, Hotjar, Clarity and the tag managers that load them, so those scripts are held rather than caught. Nothing third party runs until somebody chooses.
Anything it does not recognise is held too. A new pixel added by a marketing agency next month is blocked on the day it appears, without anyone updating a list.
Setup
- Install and activate.
- Attesso, in the sidebar.
- Click Protect this site.
That is the whole setup. No account to create first, no key to copy: the plugin verifies the site with our servers and sets everything up, then emails you a link to claim the account whenever you like.
If you already use Attesso, Connect your account signs you in and attaches this site, or you can paste a pairing code from your dashboard. There is also a plain site-key field for hosts that block incoming requests.
What gets held
Trackers do not always arrive as a script tag, so a blocker that only looks for those misses the rest. This one also holds:
- Tracking pixels, including invisible ones created in the background
- Data sent as a visitor leaves the page, which is how some analytics tools report
- Background requests to other companies’ servers
- Embedded video, maps and players, replaced by a placeholder that loads on click
Embeds are stopped in the page itself, before your visitor’s browser ever sees them. Most tools cannot do this: a browser starts fetching an embedded video while it is still reading the page, before any blocking code has had a chance to run.
What you get in WordPress
The whole thing lives in your admin. There is no second dashboard to keep open.
- Overview: how many people answered, and what they chose
- Banner: wording, colours, position, with a live preview
- Trackers: everything found on your site, with a plain-English explanation of each and a dropdown to recategorise it
- Consent log: every choice, with CSV export
- Cookie policy: written from what the scan actually found, publishable as a real WordPress page in one click
- Scans: history, a live view while one runs, and control over how often they happen
- Alerts: anything new that turned up
Caching and optimisation plugins
Read this if you use one. A consent blocker that gets delayed is worse than no blocker: the analytics tags it was holding run first, so tracking happens before consent while the banner still claims otherwise.
The plugin ships with the documented opt-out attributes for WP Rocket, LiteSpeed Cache and Cloudflare Rocket Loader, so those leave it alone automatically.
W3 Total Cache and Autoptimize have no attribute-based opt-out. If you use either, exclude a.js from JavaScript minify, combine and defer in its settings. One line in an exclusion box.
External services
This plugin connects to Attesso, a consent management service operated by Attesso. Using it requires an Attesso account, which the plugin can create for you during setup. Before setup, the plugin makes no external connections at all and adds nothing to your pages.
The short version: your visitors load one small script from our servers, and when somebody answers the banner their choice is saved with us as the record that proves consent was given. We never receive your WordPress login, your customers’ names or email addresses, or the pages anyone visited. Everything below is the same thing said precisely, because a consent tool that is vague about its own data handling has not understood the problem.
On every page of your site
Once a site is connected, every page view loads one script from https://cdn.getattesso.com/a.js. That request carries your site key and the normal information any browser sends when fetching a file, including the visitor’s IP address and user agent.
When a visitor answers the banner
Their choice, the categories they allowed, a timestamp, the version of your policy they saw and their coarse region are sent to https://getattesso.com/api/consent and stored as a consent record. This is the record that demonstrates consent was given, and it is the reason the plugin exists.
When the script holds a third-party host that Attesso has not seen on your site before, that hostname is sent to https://getattesso.com/api/observed so your cookie policy can describe it. The page URL is not sent, and no visitor identifier is sent.
During setup
https://getattesso.com/api/plugin/provision: creates your account. Sends this site’s address and name, your WordPress administrator email address, and a one-time secret.https://your-site.com/wp-json/attesso/v1/challenge(or?rest_route=on plain permalinks): this is a route on your own site, not ours. Our server fetches it once during setup to confirm you control the domain, the way a TLS certificate is validated. Nothing is sent to it; a one-time random value is read back and discarded.https://getattesso.com/connect: opened in your browser if you connect an existing account.https://getattesso.com/api/plugin/pair: exchanges a pairing code from your dashboard for this site’s credentials.
From the admin screens, when you open them
These carry an access token issued to this site, and no visitor data.
/api/plugin/dashboard: the figures and settings shown on the screens/api/plugin/version: a small check for whether anything changed, so the screens stay current without refetching everything/api/plugin/scan-status: live progress while a scan runs/api/plugin/scan: one scan in detail/api/plugin/banner: saves banner changes/api/plugin/action: saves a tracker category, resolves an alert, requests a scan, changes the scan schedule, or builds a CSV export/api/plugin/checkout: asks Stripe for a checkout link when you start a plan. Card details are entered on Stripe’s own pages and never touch WordPress.
No WordPress login, password or user data is sent at any point.
Service terms: https://getattesso.com/legal/terms
Privacy policy: https://getattesso.com/legal/privacy
Screenshots
FAQ
Do I need an account before I install this?
No. Click Protect this site and the plugin creates one, using your WordPress administrator email. You get a link to claim it whenever suits you; the banner works in the meantime.
Do I need a paid account?
There is a free trial, and pricing starts at $10 a month for one site, less per site as you add more. The plugin behaves the same either way; the banner stops serving when a trial ends without a plan.
Will this slow my site down?
It adds one script, around 10KB compressed, served from a CDN. It is deliberately a plain blocking script rather than a deferred one, because a consent blocker that loads late has already lost: the trackers it was meant to hold have run.
Does it work with Google Analytics and Meta Pixel?
Yes, and with Google Tag Manager, Hotjar, Clarity, LinkedIn, TikTok, Pinterest and the rest. It does not need to know about them individually. Anything third party is held unless a rule says otherwise, so new tools are covered from the moment they appear.
Does it support Google Consent Mode v2?
Yes. Consent state is pushed to Google’s consent API before their tags run, which is the order Google requires. A stricter default is set for the EEA, the UK and Switzerland.
Will it break my page builder or my embeds?
Embedded video and maps are held until consent and show a small placeholder that loads them on click. Elementor, Divi, Beaver Builder and the block editor are unaffected, since the plugin touches nothing but the head and third-party iframes.
How often is my site re-scanned?
Weekly by default. You can change it to daily or monthly on the Scans screen, and scan on demand at any time. A tracker found by a re-scan is blocked from the moment it appears.
Can visitors change their mind?
Yes, and they must be able to: consent has to be as easy to withdraw as it was to give. A small tab sits at the edge of the page after somebody answers, and reopens the choices.
I use a caching plugin. Anything to do?
WP Rocket, LiteSpeed and Cloudflare Rocket Loader are handled automatically. For W3 Total Cache or Autoptimize, exclude
a.jsfrom JavaScript delay and combine. See the Description above.What happens if I deactivate the plugin?
The banner stops appearing and nothing is held any more. Your consent records stay in your Attesso account. Deleting the plugin removes its settings from your WordPress database and nothing else.
Setup did not work. What now?
Some hosts block the incoming request we use to confirm you own the site. Open the Site key section on the Settings screen, copy your key from the Install screen of your dashboard, and paste it there. The result is identical.
Reviews
There are no reviews for this plugin.
Contributors & Developers
“Attesso Cookie Consent” is open source software. The following people have contributed to this plugin.
Contributors
Translate “Attesso Cookie Consent” into your language.
Interested in development?
Browse the code, check out the SVN repository, or subscribe to the development log by RSS.
Changelog
1.0.0
- First release.