{"id":300422,"date":"2026-10-26T15:28:52","date_gmt":"2026-10-26T15:28:52","guid":{"rendered":"https:\/\/en-gb.wordpress.org\/plugins\/cookieflame\/"},"modified":"2026-10-30T23:10:45","modified_gmt":"2026-10-30T23:10:45","slug":"cookieflame","status":"publish","type":"plugin","link":"https:\/\/wordpress.org\/plugins\/cookieflame\/","author":23489478,"comment_status":"closed","ping_status":"closed","template":"","meta":{"version":"5.4.1","stable_tag":"5.4.1","tested":"7.1.4","requires":"6.0","requires_php":"8.0","requires_plugins":null,"header_name":"CookieFlame","header_author":"Zoobu Limited","header_description":"A lightweight, self-hosted cookie consent manager with Google Consent Mode v2, IAB TCF v2.2, automatic script blocking, multi-region compliance (GDPR\/CCPA\/LGPD\/POPIA), passive cookie monitoring, and server-side geo detection via Cloudflare.","assets_banners_color":"715a49","last_updated":"2026-10-30 23:10:45","external_support_url":"","external_repository_url":"","donate_link":"","header_plugin_uri":"https:\/\/cookieflame.com","header_author_uri":"https:\/\/zoobu.com","rating":5,"author_block_rating":0,"active_installs":0,"downloads":238,"num_ratings":1,"support_threads":1,"support_threads_resolved":1,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":{"5.1.1":{"tag":"5.1.1","author":"zoobu","date":"2026-10-26 15:28:30","revision":3766806},"5.2.0":{"tag":"5.2.0","author":"zoobu","date":"2026-10-27 10:36:27","revision":3768250},"5.3.0":{"tag":"5.3.0","author":"zoobu","date":"2026-10-27 21:16:23","revision":3769546},"5.4.0":{"tag":"5.4.0","author":"zoobu","date":"2026-10-28 20:11:59","revision":3771537},"5.4.1":{"tag":"5.4.1","author":"zoobu","date":"2026-10-30 23:10:45","revision":3776170}},"upgrade_notice":{"5.4.1":"<p>Fixes rules that could break pages, and tracking scripts that never loaded after consent. Your page cache is cleared once after updating. Please clear any other cache, such as a CDN.<\/p>"},"ratings":{"1":0,"2":0,"3":0,"4":0,"5":1},"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3766824,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3766824,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3766824,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3766824,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["5.1.1","5.2.0","5.3.0","5.4.0","5.4.1"],"block_files":[],"assets_screenshots":{"screenshot-1.png":{"filename":"screenshot-1.png","revision":3771537,"resolution":"1","location":"assets","locale":"","width":1440,"height":900},"screenshot-2.png":{"filename":"screenshot-2.png","revision":3771537,"resolution":"2","location":"assets","locale":"","width":1440,"height":900},"screenshot-3.png":{"filename":"screenshot-3.png","revision":3771537,"resolution":"3","location":"assets","locale":"","width":1459,"height":1996},"screenshot-4.png":{"filename":"screenshot-4.png","revision":3771537,"resolution":"4","location":"assets","locale":"","width":1440,"height":860},"screenshot-5.png":{"filename":"screenshot-5.png","revision":3771537,"resolution":"5","location":"assets","locale":"","width":1459,"height":1831},"screenshot-6.png":{"filename":"screenshot-6.png","revision":3771537,"resolution":"6","location":"assets","locale":"","width":1459,"height":1432},"screenshot-7.png":{"filename":"screenshot-7.png","revision":3771537,"resolution":"7","location":"assets","locale":"","width":1459,"height":1036}},"screenshots":{"1":"Opt-in banner with category toggles","2":"US notice with the \"Do Not Sell or Share\" link","3":"Cookie Manager listing your site's cookies","4":"Cookie Discovery in progress","5":"Settings tab","6":"Geo Detection tab","7":"Tag Managers tab"}},"plugin_section":[],"plugin_tags":[166295,20011,388,131785,396],"plugin_category":[54],"plugin_contributors":[288742],"plugin_business_model":[],"class_list":["post-300422","plugin","type-plugin","status-publish","hentry","plugin_tags-ccpa","plugin_tags-consent","plugin_tags-cookie","plugin_tags-gdpr","plugin_tags-privacy","plugin_category-security-and-spam-protection","plugin_contributors-zoobu","plugin_committers-zoobu"],"banners":{"banner":"https:\/\/ps.w.org\/cookieflame\/assets\/banner-772x250.png?rev=3766824","banner_2x":"https:\/\/ps.w.org\/cookieflame\/assets\/banner-1544x500.png?rev=3766824","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/cookieflame\/assets\/icon-128x128.png?rev=3766824","icon_2x":"https:\/\/ps.w.org\/cookieflame\/assets\/icon-256x256.png?rev=3766824","generated":false},"screenshots":[{"src":"https:\/\/ps.w.org\/cookieflame\/assets\/screenshot-1.png?rev=3771537","caption":"Opt-in banner with category toggles"},{"src":"https:\/\/ps.w.org\/cookieflame\/assets\/screenshot-2.png?rev=3771537","caption":"US notice with the \"Do Not Sell or Share\" link"},{"src":"https:\/\/ps.w.org\/cookieflame\/assets\/screenshot-3.png?rev=3771537","caption":"Cookie Manager listing your site's cookies"},{"src":"https:\/\/ps.w.org\/cookieflame\/assets\/screenshot-4.png?rev=3771537","caption":"Cookie Discovery in progress"},{"src":"https:\/\/ps.w.org\/cookieflame\/assets\/screenshot-5.png?rev=3771537","caption":"Settings tab"},{"src":"https:\/\/ps.w.org\/cookieflame\/assets\/screenshot-6.png?rev=3771537","caption":"Geo Detection tab"},{"src":"https:\/\/ps.w.org\/cookieflame\/assets\/screenshot-7.png?rev=3771537","caption":"Tag Managers tab"}],"raw_content":"<!--section=description-->\n<p>CookieFlame is a cookie consent plugin that finds your site's cookies for you, runs on your own server, and shows each visitor the banner their region requires. Full details are at <a href=\"https:\/\/cookieflame.com\">cookieflame.com<\/a>.<\/p>\n\n<h4>Finds cookies for you<\/h4>\n\n<ul>\n<li><strong>Watch for new cookies:<\/strong> your visitors' browsers report cookies as they browse, so a new plugin's or tag's cookies appear in the Cookie Manager without you scanning. Get an email about changes weekly, daily, or not at all.<\/li>\n<li><strong>Cookie Discovery:<\/strong> for a full list now, browse your own site with every cookie allowed for your browser only. It uses your own browser.<\/li>\n<\/ul>\n\n<h4>The right banner for each region<\/h4>\n\n<ul>\n<li>UK, EU\/EEA, Switzerland, Brazil and South Africa: an opt-in banner with Accept All and Manage preferences. You can also show Decline All on the first screen (off by default).<\/li>\n<li>United States: a short notice with a \"Do Not Sell or Share My Personal Information\" link that opens a real opt-out choice.<\/li>\n<li>Everywhere else: no banner.<\/li>\n<\/ul>\n\n<p>Country comes from CDN headers such as Cloudflare's, or a free MaxMind database you upload, with the time zone as a fallback. If none works, the opt-in banner is shown.<\/p>\n\n<h4>Global Privacy Control<\/h4>\n\n<p>A browser that sends Global Privacy Control (GPC) is opted out of selling and sharing straight away: marketing cookies stay off and Google's ad signals are denied. US visitors see that the signal was honoured, and OK only closes the notice. The opt-out is saved, so a later visit without GPC keeps it. A visitor can opt back in only through a separate, clear choice.<\/p>\n\n<h4>Blocks trackers before consent<\/h4>\n\n<p>Tracking scripts are rewritten on your server before the page is sent, so blocking works with WP Rocket, LiteSpeed, Cloudflare APO and other caches. Built-in patterns cover Google Analytics, Google Ads, Google Tag Manager, Microsoft Ads, Meta, X (Twitter), LinkedIn, Pinterest, Reddit and TikTok. Cookies you classify get matching rules automatically.<\/p>\n\n<p>YouTube, Vimeo, Google Maps, Spotify, SoundCloud, Dailymotion and Elementor videos show a click-to-load placeholder until the visitor consents.<\/p>\n\n<h4>Google Consent Mode v2<\/h4>\n\n<p>All Google consent signals start as denied before any tag runs and update the moment a visitor chooses. Returning visitors' choices are restored before Google Tag Manager loads.<\/p>\n\n<h4>For developers<\/h4>\n\n<ul>\n<li>Events: cc:ready, cc:update, cc:accept-all, cc:decline-all, cc:save and cc:banner-rendered.<\/li>\n<li>JavaScript API: CookieConsent.getState(), show(), showSettings() and more.<\/li>\n<li>[cookieflame_settings_link] shortcode, or the class cc-open-settings on any link, to reopen a visitor's choices.<\/li>\n<li>CSS custom properties (--cc-accent, --cc-bg, --cc-radius, --cc-font and others) to restyle the banner.<\/li>\n<li>Filters cookieflame_frontend_config, cookieflame_digest_email and cookieflame_unsafe_block_hosts, and the action cookieflame_settings_sections.<\/li>\n<li>An optional consent log endpoint for your own audit trail.<\/li>\n<\/ul>\n\n<h4>CookieFlame Pro<\/h4>\n\n<p>Pro identifies and classifies cookies automatically, creates the blocking rules, and adds instant emails. See <a href=\"https:\/\/cookieflame.com\">cookieflame.com<\/a>.<\/p>\n\n<h4>Compliance note<\/h4>\n\n<p>CookieFlame helps with GDPR, CCPA, LGPD, POPIA and similar laws; how you set it up is your responsibility. For legal advice, ask a qualified professional.<\/p>\n\n<h3>External services<\/h3>\n\n<p>CookieFlame does not phone home. These requests happen only in the cases described.<\/p>\n\n<p><strong>Google Tag Manager (optional).<\/strong> If you enter a container ID on the Tag Managers tab, Google's script (https:\/\/www.googletagmanager.com\/gtm.js) loads on every page, except for visitors you exclude from tracking. Tags inside it follow the visitor's Consent Mode choices. Sent: the container ID and the browser's standard request data (IP address, user agent, page URL). <a href=\"https:\/\/marketingplatform.google.com\/about\/analytics\/tag-manager\/use-policy\/\">Terms<\/a>, <a href=\"https:\/\/policies.google.com\/privacy\">privacy policy<\/a>.<\/p>\n\n<p><strong>Microsoft UET (optional).<\/strong> If you enter a UET tag ID, Microsoft's loader (https:\/\/bat.bing.com\/bat.js) loads on every page, except for visitors you exclude from tracking. It records nothing until the visitor allows Marketing. Sent: the tag ID and the browser's standard request data. <a href=\"https:\/\/about.ads.microsoft.com\/en\/resources\/policies\/microsoft-advertising-agreement\">Microsoft Advertising agreement<\/a>, <a href=\"https:\/\/privacy.microsoft.com\/en-gb\/privacystatement\">privacy statement<\/a>.<\/p>\n\n<p><strong>YouTube thumbnails.<\/strong> When a page has a YouTube embed that is waiting for consent, its placeholder shows the video's thumbnail from img.youtube.com. Sent: the video ID and the browser's standard request data. <a href=\"https:\/\/www.youtube.com\/t\/terms\">YouTube terms<\/a>, <a href=\"https:\/\/policies.google.com\/privacy\">Google privacy policy<\/a>.<\/p>\n\n<p><strong>Consent log endpoint (optional).<\/strong> If you enter a URL in the Consent Log Endpoint setting, each consent choice is sent there from the visitor's browser as JSON: an anonymous ID, time, action, the choice per category, region, country code, page URL, user agent, the GPC flag, consent version and plugin version. No cookie values or IP address are in it. You choose the destination and are responsible for it.<\/p>\n\n<p>Third-party domain names in the code (such as connect.facebook.net) are only used to recognise and block scripts; they are never contacted.<\/p>\n\n<!--section=installation-->\n<ol>\n<li>Install from Plugins &gt; Add New, or upload the <code>cookieflame<\/code> folder to <code>\/wp-content\/plugins\/<\/code>.<\/li>\n<li>Activate the plugin.<\/li>\n<li>Open <strong>CookieFlame<\/strong> in the admin menu to check the settings.<\/li>\n<\/ol>\n\n<p>It works straight away. For the best country detection, use Cloudflare or upload a free MaxMind database on the Geo Detection tab.<\/p>\n\n<!--section=faq-->\n<dl>\n<dt id=\"do%20i%20need%20to%20know%20which%20cookies%20my%20site%20sets%3F\"><h3>Do I need to know which cookies my site sets?<\/h3><\/dt>\n<dd><p>No. Watch for new cookies lists them as your visitors' browsers report them, and Cookie Discovery finds them on demand. You classify them when you are ready.<\/p><\/dd>\n<dt id=\"does%20it%20work%20with%20google%20tag%20manager%20and%20caching%20plugins%3F\"><h3>Does it work with Google Tag Manager and caching plugins?<\/h3><\/dt>\n<dd><p>Yes. Blocking happens in the HTML before it is cached. Turn off Cloudflare Rocket Loader; the plugin warns you if it is on.<\/p><\/dd>\n<dt id=\"what%20do%20us%20visitors%20see%3F\"><h3>What do US visitors see?<\/h3><\/dt>\n<dd><p>A short notice. Cookies are allowed by default because US laws use an opt-out model. The \"Do Not Sell or Share My Personal Information\" link opens a choice to opt out. Put [cookieflame_settings_link] in your footer so visitors can reach it again later.<\/p><\/dd>\n<dt id=\"can%20i%20show%20%22decline%20all%22%20on%20the%20first%20screen%3F\"><h3>Can I show \"Decline all\" on the first screen?<\/h3><\/dt>\n<dd><p>Yes. Turn on \"Show 'Decline all' on the first screen\" on the Settings tab. It appears only on the opt-in banner, never on the US notice.<\/p><\/dd>\n<dt id=\"can%20i%20change%20the%20banner%20text%3F\"><h3>Can I change the banner text?<\/h3><\/dt>\n<dd><p>Not yet from the settings. The banner is in English, with light and dark themes. Developers can change the text and colours with the cookieflame_frontend_config filter and the --cc-* CSS properties.<\/p><\/dd>\n<dt id=\"is%20my%20visitors%27%20data%20safe%3F\"><h3>Is my visitors' data safe?<\/h3><\/dt>\n<dd><p>CookieFlame collects no visitor data. Cookie values are never sent, only names. IP addresses are hashed for rate limiting and never stored. Choices are kept in a first-party cookie in the visitor's browser.<\/p><\/dd>\n\n<\/dl>\n\n<!--section=changelog-->\n<h4>5.4.1<\/h4>\n\n<ul>\n<li>Fixed: a short blocking rule such as \"t.co\" also matched ordinary code, which could hold back scripts your pages need, leaving sections hidden or images blank even after a visitor accepted. A rule for a domain now matches only scripts that really come from that domain or its subdomains.<\/li>\n<li>Fixed: tracking scripts delayed by a speed or caching plugin lost their address when blocked, so they never loaded, even after a visitor accepted. This also fixes pages already saved in a cache.<\/li>\n<li>Link shorteners and hosts that many services share, such as t.co, google.com and public script libraries, are no longer used as automatic blocking rules, because that can break pages. Rules you add yourself never change.<\/li>\n<li>An automatic rule can no longer move a built-in tracker to a less strict category. Rules you add yourself still win.<\/li>\n<li>After this update, CookieFlame clears your page cache once and reminds you to clear any other cache, such as a CDN.<\/li>\n<li>Older changes: changelog.txt.<\/li>\n<\/ul>","raw_excerpt":"Cookie consent for WordPress that finds cookies automatically. Self-hosted, with the right banner for GDPR, CCPA, LGPD and POPIA visitors.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/300422","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=300422"}],"author":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/zoobu"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=300422"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=300422"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=300422"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=300422"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=300422"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=300422"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}