Melon Consent – Cookie Banner & Content Blocker

Description

Melon Consent is a lightweight, self-contained consent banner with real script and content blocking for WordPress. It does not just display a cookie notice — it technically blocks non-essential scripts, iframes, embeds and external connections until the visitor has given consent.

No cloud. No account. No monthly fees. No telemetry. Everything runs on your own WordPress installation.

Features

• Consent banner with four layouts: compact card, center modal, top/bottom bar, side drawer
• Five design presets (Clean Light, Soft Neutral, Dark Contrast, Minimal Bar, Brand Accent) with custom colors and live preview
• Category- and service-level consent (Necessary, Statistics, Marketing, External Media)
• Real blocking: enqueued scripts, inline scripts (conservative signatures), iframes, oEmbeds, Gutenberg embeds, resource hints
• Cache-safe architecture: identical HTML for all visitors, activation happens client-side — works with page caching and CDNs
• Accessible placeholders with “load once” and “always allow” actions
• Google Consent Mode v2 (strict basic mode by default, advanced mode as explicit opt-in)
• Managed Google Analytics 4 and Google Tag Manager integration
• Custom services with safe matching rules (hosts, wildcards, URL substrings, script handles, inline signatures — no regex)
• Manual consent wrapper shortcode for custom embeds and Leaflet maps
• Consent revocation via floating button, shortcode, JavaScript API, or data attribute
• Diagnostics for conflicting consent plugins and duplicate Google integrations
• Import/export of settings as JSON, full reset, clean uninstall
• English and German included; WPML and Polylang compatible (string translation via wpml-config.xml)
• Fully keyboard-operable, focus trap, WCAG-oriented markup, prefers-reduced-motion support
• No external requests, fonts, or CDNs — all assets are local

Supported services

• Google Analytics 4 (managed or existing integration)
• Google Tag Manager (managed or existing integration)
• Google Consent Mode v2
• YouTube (Gutenberg, oEmbed, classic iframes, Shorts, playlists — privacy-enhanced youtube-nocookie.com player after consent)
• Google Maps (embed iframes, JavaScript API, static maps where safely detectable)
• OpenStreetMap embeds and configurable tile domains
• Custom scripts, iframes and external content via your own rules

Google Search Console is intentionally not a blockable service: verification via DNS, HTML file or meta tag normally requires no consent management.

Developer API

• JavaScript: window.MelonConsent (getConsent, hasCategoryConsent, hasServiceConsent, acceptAll, rejectOptional, savePreferences, openSettings, resetConsent, loadService, loadElement) and CustomEvents such as melonConsentChanged
• PHP filters: melon_consent_services, melon_consent_should_block_url, melon_consent_frontend_config, melon_consent_placeholder_markup and more
• Shortcodes: [melon_consent_settings], [melon_consent_content service="youtube"]…[/melon_consent_content]

External services

Melon Consent itself performs no external requests, loads no remote assets for its own operation, and sends no data to the plugin author. The domain lists contained in the plugin code (for example googletagmanager.com or youtube.com) are blocklist matching rules: they are used to detect and BLOCK requests to those hosts until the visitor consents — not to perform requests.

External requests only occur for third-party services that (a) the site owner has explicitly enabled in the plugin settings and (b) the visitor has consented to — or, for embedded content, that the visitor actively triggers by clicking “load once” on a placeholder. The following services can be involved:

Google Analytics 4 (disabled by default)

Used for web analytics when the site owner enables the managed integration. After the visitor consents to the “Statistics” category (or, only if the site owner explicitly enables the Advanced Consent Mode, before consent with all consent signals denied), the plugin loads the gtag.js script from googletagmanager.com and Google Analytics collects usage data (page URL, referrer, browser/device information, approximate location derived from the IP address, events). This data is sent to Google LLC / Google Ireland Ltd.
Terms: https://marketingplatform.google.com/about/analytics/terms/us/ — Privacy: https://policies.google.com/privacy

Google Tag Manager (disabled by default)

Used for tag management when the site owner enables the managed integration. After the visitor consents (or in the explicit Advanced Consent Mode, with denied consent signals), the plugin loads the gtm.js container script from googletagmanager.com. Which further data is collected depends on the tags configured inside the site owner’s container. Provider: Google LLC / Google Ireland Ltd.
Terms: https://marketingplatform.google.com/about/analytics/tag-manager/use-policy/ — Privacy: https://policies.google.com/privacy

Google Consent Mode v2

When Google Analytics or Google Tag Manager is enabled, the plugin sets the Google consent signals (analytics_storage, ad_storage, ad_user_data, ad_personalization) — all “denied” by default — and sends updates after the visitor’s decision. In the default strict mode no request to Google happens before consent; the signals only take effect once Google tags are loaded.

YouTube (blocking enabled by default)

YouTube videos embedded by the site owner are blocked and replaced with a local placeholder. Only when the visitor consents to YouTube (permanently or one-time per embed) is the video iframe loaded from youtube-nocookie.com (privacy-enhanced mode) or youtube.com, which transmits the visitor’s IP address and browser information to Google and may set cookies/use local storage. Provider: Google LLC / Google Ireland Ltd.
Terms: https://www.youtube.com/t/terms — Privacy: https://policies.google.com/privacy

Google Maps (blocking enabled by default)

Google Maps embeds are blocked and replaced with a local placeholder. Only after the visitor’s consent is the map loaded from google.com/maps, maps.googleapis.com or related Google hosts, which transmits the visitor’s IP address and browser information to Google. Provider: Google LLC / Google Ireland Ltd.
Terms: https://cloud.google.com/maps-platform/terms — Privacy: https://policies.google.com/privacy

OpenStreetMap (blocking enabled by default)

OpenStreetMap embed iframes are blocked and replaced with a local placeholder. Only after the visitor’s consent is the map loaded from openstreetmap.org, which transmits the visitor’s IP address and browser information to the OpenStreetMap Foundation (or to the configured third-party/self-hosted tile server).
Terms: https://osmfoundation.org/wiki/Terms_of_Use — Privacy: https://osmfoundation.org/wiki/Privacy_Policy

Custom services

Site owners can define additional third-party services with their own blocking rules. For those, the request behaviour and the applicable terms depend entirely on the service configured by the site owner; the plugin only blocks and (after consent) releases the site owner’s own embed code.

Privacy

Melon Consent stores the visitor’s consent decision exclusively in a strictly necessary first-party cookie (melon_consent) in the visitor’s browser: consent version, timestamp and the choices per category and service. It stores no personal data, no IP addresses and no consent logs, and it sends no data to the plugin author. A suggested privacy policy text is provided via the WordPress Privacy API. Third-party services enabled by the site owner process data under their own privacy policies once the visitor consents.

Legal Disclaimer

Melon Consent supports site owners in technically implementing consent and blocking optional services. A consent banner alone does not automatically make a website legally compliant. This plugin does not constitute legal advice.