Title: ONiDEA Consenso Cookie Conforme Italia
Author: onideaadv
Published: August 29, 2026
Last modified: August 29, 2026
---
Search plugins
# ONiDEA Consenso Cookie Conforme Italia
By [onideaadv](https://profiles.wordpress.org/onideaadv/)
[Download](https://downloads.wordpress.org/plugin/onidea-consenso-cookie-conforme-italia.1.6.2.zip)
* [Details](https://wordpress.org/plugins/onidea-consenso-cookie-conforme-italia/#description)
* [Reviews](https://wordpress.org/plugins/onidea-consenso-cookie-conforme-italia/#reviews)
* [Installation](https://wordpress.org/plugins/onidea-consenso-cookie-conforme-italia/#installation)
* [Development](https://wordpress.org/plugins/onidea-consenso-cookie-conforme-italia/#developers)
[Support](https://wordpress.org/support/plugin/onidea-consenso-cookie-conforme-italia/)
## Description
ONiDEA Consenso Cookie Conforme Italia is a free, self-hosted alternative to subscription
services like CookieYes or Cookiebot, covering the essential cookie consent features
for WordPress sites:
* Consent banner with “Accept all” / “Reject all” buttons of equal visual prominence(
as required by the Italian Data Protection Authority’s — Garante Privacy — guidelines)
plus a “Customize” option.
* Preferences panel with categories: Necessary (always on), Statistics, Marketing,
Functional — enabled individually per site.
* Automatic blocking of scripts marked as non-essential until the user gives consent.
* Google Consent Mode v2: sets consent signals for Google Analytics 4 / Google
Ads / AdSense before their scripts load, so they automatically honor the user’s
choice (only needs enabling where relevant).
* Server-side consent log (date, chosen categories, page, hashed IP — never stored
in the clear) for the accountability record required by the GDPR, with CSV export.
* Engine built on the open-source “CookieConsent” library by Orest Bida (MIT license),
served from your own site: no third-party calls, no subscription fee.
#### What it does NOT do (unlike paid services)
* No automatic recurring scan of the site’s cookies: categories and the scripts
to block are configured manually (see GUIDA-RAPIDA.md, in Italian, in the plugin
folder).
* Not IAB TCF certified: suited to Google AdSense/Ads/GA4 (via Consent Mode) and
to the general run of editorial/business/e-commerce sites, not to publishers
selling ad inventory through multiple ad exchanges/SSPs that require IAB certification.
* Does not provide legal privacy/cookie policy text: that remains your responsibility
or your legal counsel’s.
### Included features
Every feature of the plugin — banner, categories, script blocking, Google Consent
Mode v2, proof-of-consent log with CSV export, and the Dashboard with consent reporting/
trends (accepted/rejected/partial breakdown, last-7-days chart) — is included and
active for anyone who installs the plugin, with no distinctions. The “Powered by
ONiDEA adv” credit at the bottom of the banner is disabled by default and can be
turned on by anyone from Settings.
Any future premium extensions (if and when they arrive) will be a separate, independently
distributed add-on — never functionality hidden inside this same package.
### Credits and licenses
The banner engine is the open-source **CookieConsent** library by Orest Bida (https://
github.com/orestbida/cookieconsent), released under the MIT license — fully compatible
with this plugin’s GPLv2+ license. The library’s code is bundled unmodified in `
assets/js/cookieconsent.umd.js` and `assets/css/cookieconsent*.css`; the original
MIT license text is available at the repository above.
Plugin developed and maintained by [ONiDEA adv](https://onidea.it/agenzia-web-milano/),
a web agency based in Milan, Italy.
## Screenshots
[⌊The banner on the frontend, with "Accept all" and "Reject all" buttons of equal
visual prominence, as required by the Italian Data Protection Authority's guidelines.⌉⌊
The banner on the frontend, with "Accept all" and "Reject all" buttons of equal
visual prominence, as required by the Italian Data Protection Authority's guidelines
.⌉[
The banner on the frontend, with “Accept all” and “Reject all” buttons of equal
visual prominence, as required by the Italian Data Protection Authority’s guidelines.
[⌊The "Customize" panel, with cookie categories (Necessary, Statistics, Marketing,
Functional) toggled individually.⌉⌊The "Customize" panel, with cookie categories(
Necessary, Statistics, Marketing, Functional) toggled individually.⌉[
The “Customize” panel, with cookie categories (Necessary, Statistics, Marketing,
Functional) toggled individually.
[⌊The Settings page: categories active on the site, Google Consent Mode v2, banner
text.⌉⌊The Settings page: categories active on the site, Google Consent Mode v2,
banner text.⌉[
The Settings page: categories active on the site, Google Consent Mode v2, banner
text.
[⌊The Dashboard: banner status, consent breakdown, and the last-7-days trend.⌉⌊The
Dashboard: banner status, consent breakdown, and the last-7-days trend.⌉[
The Dashboard: banner status, consent breakdown, and the last-7-days trend.
## Installation
1. Upload the `onidea-cookie-consent` folder to `/wp-content/plugins/`.
2. Activate the plugin from the WordPress Plugins screen.
3. In the admin sidebar, open “Consenso Cookie” and configure categories, banner text,
and links to your privacy/cookie policy (under the “Settings” entry of the new
menu).
4. If the site uses AdSense/Google Ads/GA4, enable “Google Consent Mode”.
5. See GUIDA-RAPIDA.md (Italian-language guide, included in the plugin folder) for
how to tag third-party scripts that need blocking.
## FAQ
### Why doesn’t the REST endpoint that logs consent use a nonce?
Deliberate choice, not an oversight. A WordPress nonce is generated when the page
is rendered: on a site with page caching (practically all of them, in production)
it ends up baked into the cached HTML and is replayed identically by every visitor
for as long as that cache lives — often longer than the nonce’s own lifetime. The
practical result, observed during development: consents silently rejected by the
endpoint (a `200` response with `{"logged":false}`, no visible error) for the entire
lifetime of the cache.
A nonce, in this specific case, does not protect anything worth protecting: the
route is public by design (`permission_callback` is `__return_true`, deliberately—
it must be callable by an anonymous visitor who has no account yet), it doesn’t
write anything privileged (only a row in an accountability-only log), and for a
logged-out visitor the token is identical for everyone anyway. In its place: strict
per-argument validation (type, length, and a category whitelist, so only well-formed
rows can ever be written), a same-origin check on the request, and a 20-calls-per-
hour-per-IP limit against abuse — computed from `REMOTE_ADDR` only by default, since
request headers like `X-Forwarded-For` are attacker-controllable and are not trusted
unless a site explicitly opts in via the `occit_trust_proxy_ip_headers` filter (
for sites that know they sit behind a proxy/CDN they control). None of this is a
substitute for authentication; it bounds the worst case to “some extra rows in a
low-sensitivity accountability log,” which is the actual risk on this endpoint.
Details in the code, in `class-occ-frontend.php` and the REST handler.
### Does the plugin send data to external services?
No. The banner engine (the “CookieConsent” library by Orest Bida) is downloaded
once during development and distributed inside the plugin itself: it runs entirely
on your own site, with no call to any third-party service either at runtime or during
configuration. The consent log is a table in your own database.
## Reviews
There are no reviews for this plugin.
## Contributors & Developers
“ONiDEA Consenso Cookie Conforme Italia” is open source software. The following
people have contributed to this plugin.
Contributors
* [ onideaadv ](https://profiles.wordpress.org/onideaadv/)
[Translate “ONiDEA Consenso Cookie Conforme Italia” into your language.](https://translate.wordpress.org/projects/wp-plugins/onidea-consenso-cookie-conforme-italia)
### Interested in development?
[Browse the code](https://plugins.trac.wordpress.org/browser/onidea-consenso-cookie-conforme-italia/),
check out the [SVN repository](https://plugins.svn.wordpress.org/onidea-consenso-cookie-conforme-italia/),
or subscribe to the [development log](https://plugins.trac.wordpress.org/log/onidea-consenso-cookie-conforme-italia/)
by [RSS](https://plugins.trac.wordpress.org/log/onidea-consenso-cookie-conforme-italia/?limit=100&mode=stop_on_copy&format=rss).
## Changelog
#### 1.6.2
Second round of wordpress.org review fixes. The `tools/` folder (developer-only
scripts, `.py`/`.mjs`, not needed at runtime) is no longer included in the distributed
package — it stays in the source repository for internal use. Hardened the unauthenticated
consent-log REST endpoint: added strict per-argument validation (type, length, a
whitelist of the four known category keys) so the log table can only ever receive
well-formed rows, and the per-IP rate limit now reads only `REMOTE_ADDR` by default
instead of also trusting the attacker-controllable `X-Forwarded-For`/`CF-Connecting-
IP` headers (opt-in via the new `occit_trust_proxy_ip_headers` filter for sites
that know they sit behind a trusted proxy/CDN). The endpoint remains intentionally
public (no user account exists to authenticate against) — see the FAQ below for
the full rationale. No visible change for site visitors.
#### 1.6.1
Updated the “Tested up to” header to 7.1, per wordpress.org’s automated submission
scan (the previous 7.0 value was flagged as outdated). No functional change.
#### 1.6.0
Renamed the plugin to “ONiDEA Consenso Cookie Conforme Italia” (previously “Consenso
Cookie Conforme Italia”), per wordpress.org directory guideline 17 (distinctive
naming) — the previous name was too close to the generic pattern used by many other
cookie-consent plugins. Internal function/class/option/hook names were also renamed
from the “occ_” prefix (3 characters) to “occit_”, meeting the directory’s minimum
prefix length; existing settings and the consent-log table are migrated automatically
and transparently on upgrade, no data is lost. The Dashboard page’s CSS moved from
an inline `<style>` block to a properly enqueued stylesheet. No visible change
for site visitors; wp-admin menu URLs change (occ-dashboard occit-dashboard, etc.)
and any old bookmarks to them will need updating.
#### 1.5.5
Text Domain header updated to match the wordpress.org-assigned slug (consenso-cookie-
conforme-italia), fixing a textdomain_mismatch warning raised by the automated submission
scan. No functional change.
#### 1.5.4
Removed the Plugin URI header (it was identical to the Author URI, which wordpress.
org’s submission form does not allow — the two must point to different pages). Kept
the Author URI pointing to the agency site, since there is no dedicated page for
this specific plugin yet. No functional change.
#### 1.5.3
Translated readme.txt into English, per wordpress.org’s directory-listing language
policy (July 2025): the readme is now the base language for community translations
via translate.wordpress.org. The plugin itself — admin screens, banner text, settings,
GUIDA-RAPIDA.md — remains entirely in Italian, as intended for its target audience.
No functional change.
#### 1.5.2
Fixed the findings from wordpress.org’s official Plugin Check: prepared direct database
queries are now documented with the matching phpcs exemption instead of being left
unannotated; the CSV export’s write to `php://output` (the HTTP response stream,
not a real file — WP_Filesystem doesn’t apply here) is documented the same way;
removed GUIDA-RAPIDA.md from the distributed package (an internal guide for the
agency, not required for the plugin to work — still available in the source repository).
No functional change for site visitors.
#### 1.5.1
Added a reference to the agency’s site (ONiDEA adv, web agency in Milan) in the
plugin header (Plugin URI/Author URI) and in the readme’s Credits section. No functional
change for site visitors.
#### 1.5.0
Removed the Free/Pro distinction: the Dashboard with consent reporting and trends,
previously reserved for the Pro tier, is now included and active for everyone. The
wordpress.org directory guidelines (guideline 5, “trialware”) do not allow functionality
that already exists in the code but is disabled behind a license flag — this removal
brings the plugin in line with that requirement ahead of submission. Any future
premium extensions will be a separate add-on, never a hidden switch inside this
same package.
#### 1.4.1
Renamed the plugin to “Consenso Cookie Conforme Italia” (previously “Cookie Consent–
by ONiDEA”), ahead of a future submission to the official wordpress.org repository—
the previous name remains as the author/agency name, no longer as the plugin name.
No change to how the plugin behaves for site visitors. Internal cleanup: code brought
in line with the WordPress Coding Standards (complete docblocks, style conventions),
added an FAQ section (justification for the log endpoint’s nonce-free design, confirmation
of no calls to external services), a Credits and licenses section for the bundled
CookieConsent library, and a Screenshots section.
#### 1.4.0
The “Powered by ONiDEA adv” credit is now disabled by default at every tier (previously
always on in Free, only removable in Pro) and is a free-standing Settings option
independent of tier. Also fixed the “|” divider between the banner footer links,
which stayed stuck to the first link when only two remained (e.g. Privacy Policy
and Cookie Policy with the credit off): spacing is now symmetric regardless of how
many links are present.
#### 1.3.2
The “Manage cookie preferences” button now works even where `wp_kses_post()` strips
its inline `onclick` — i.e. in widgets, filtered content, and many theme templates,
where it used to stay visible but inert. The click is now captured via delegation
in occ-init.js, so the button no longer depends on an inline attribute (also useful
under a Content-Security-Policy).
#### 1.3.1
The banner’s two JavaScript files now load with `defer`. Without it, they blocked
the parser and the browser fetched them at high priority, taking bandwidth away
from the render-blocking CSS: the banner can never appear before the page itself,
so that priority bought nothing and cost something.
#### 1.3.0
The preferences-panel stylesheet (roughly 41% of the library’s CSS) is no longer
loaded with the page: it’s only fetched by visitors who actually open the panel.
Everyone else never downloads it. The split is regenerated with `tools/split-modal-
css.py` after a library update.
#### 1.2.0
Banner settings now travel in a `