Most consent plugins are huge. Wonderful Cookie and Consent Banner does two things: it asks the visitor once and remembers the answer in a first-party cookie, and it holds back your tracking scripts and embedded videos or maps until the visitor accepts their category. Four categories \u2014 essential, statistics, marketing, external media \u2014 and that is all you need for a normal website.<\/p>\n\n
Everything stays on your own server.<\/strong> The plugin contacts no external service, loads no remote fonts or scripts of its own, keeps no consent log, and sends nothing anywhere. The only third-party requests are the ones you<\/em> configure as services, and those run only after consent.<\/p>\n\n A service is a name, a short description, a category and the script exactly as the provider gave it to you. Paste it, save, done. Presets do the snippet for the usual suspects \u2014 you only fill in the account ID, in a field of its own, and the script is rebuilt from it every time you save. So the container ID stays where you can read and change it instead of being buried in minified provider code. \"Detach preset\" hands the script back for free editing whenever you want it:<\/p>\n\n Every service can list the cookies it sets (with Every service has an \"Active\" switch. Switch it off and it keeps all its settings but stops running: no script, no entry in the banner, no blocked embeds \u2014 handy to take a tracker off the site for a while without deleting it and typing it in again later.<\/p>\n\n Embed blocking is folded away under \"Block embedded content\" and only opens by itself where hosts are configured, so a plain script service is not asked about iframes it will never have.<\/p>\n\n Adding a new optional service \u2014 or switching one back on \u2014 automatically raises the consent version, so every visitor is asked again.<\/p>\n\n A service can also block embedded content: give it the hosts it comes from ( It works with whatever put the iframe there: the block editor, the classic editor, oEmbed, Divi, Elementor, widgets. The server only removes the Enter language codes such as Position on a three-by-three grid (top, middle, bottom \u00d7 left, center, right), size (card, wide, or a bar across the full width), an optional backdrop that dims the page, four colors, one corner radius, and the order of the two buttons. Fonts are inherited from your theme. The floating button that lets visitors change their mind later has its own background and icon color (unobtrusive by default), four built-in icons or an image of your own \u2014 or is switched off, if you prefer a link in the footer ( The settings page renders the banner with whatever is currently in the form. Change a color, click \"Preview banner\", look, adjust, save when it is right. The preview writes no cookie and loads no script.<\/p>\n\n The banner offers \"Accept all\" and \"Choose individually\". Under \"choose individually\" nothing optional is preselected, and saving without ticking anything means essential only. Whether that is enough for your jurisdiction is your call \u2014 the plugin does not give legal advice.<\/p>\n\n JavaScript: Every decision gets a consent id ( PHP: The plugin itself contacts no external service: it loads no remote fonts, scripts or images of its own, sends nothing to the plugin author or anyone else, and keeps no consent log. The visitor's decision is stored only in the visitor's own browser, in a first-party cookie named External services are contacted only for services the site owner configures, and only after the visitor has consented to that service's category. A fresh installation has no service configured and therefore contacts nothing at all. Services placed in the \"essential\" category run without consent, so that category should hold only what is strictly necessary.<\/p>\n\n Every service below is an optional template (\"preset\") that a site owner may add. What is sent is in each case the same kind of data: requesting the provider's script or iframe transmits the visitor's IP address, browser and operating system information, the referring page and any cookies that provider has already set in that browser; what is collected from then on is determined by the provider and by the account the site owner configured. When it is sent differs:<\/p>\n\n Website analytics. Loads Tag management. Loads Website analytics. Loads Conversion measurement and remarketing. Loads Conversion measurement and remarketing for Facebook and Instagram advertising. Loads Conversion measurement and remarketing for Bing advertising. Loads Session analytics (heatmaps, session recordings). Loads the Clarity tag from Conversion measurement and remarketing for LinkedIn advertising. Loads Video embeds. This preset loads no script; it holds iframes from Video embeds. Holds iframes from Map embeds. Holds iframes from Map embeds. Holds iframes from The site owner can also paste any other script, and enter any other host whose iframes should be blocked. Such a service is not part of this plugin: which service is contacted, what data it receives and whose terms and privacy policy apply is determined entirely by the site owner who adds it, and must be documented in that site's own privacy policy.<\/p>\n\n\n No plugin can. It gives you the technical part: nothing optional runs before consent, the visitor can choose per category and withdraw later, and the texts are yours to write. Whether your texts, categories and the missing \"only essential\" button meet the rules that apply to you is a legal question.<\/p><\/dd>\n In a first-party cookie called Raise the consent version. This happens automatically when you add a new optional service.<\/p><\/dd>\nScripts that wait for consent<\/h4>\n\n
\n
*<\/code> as wildcard). They are shown to the visitor under \"choose individually\" and deleted when consent is withdrawn.<\/p>\n\nEmbedded content that waits too<\/h4>\n\n
youtube.com, youtube-nocookie.com<\/code>, or with a path such as google.com\/maps<\/code> so the reCAPTCHA iframe is left alone) and every matching iframe in your content stays empty behind a placeholder until the visitor loads it once or allows the category for good. No request reaches the provider before that \u2014 not even for a thumbnail. Presets for YouTube, Vimeo, Google Maps and OpenStreetMap come with the host lists; the placeholder texts are yours to edit per language, and each service can have its own placeholder image.<\/p>\n\nsrc<\/code> attribute from matching iframes in the content; the browser builds the placeholder and puts the source back after consent, and also catches iframes that scripts add later. Players loaded purely through a provider's JavaScript API are not covered.<\/p>\n\nTexts in as many languages as you need<\/h4>\n\n
de, en<\/code> and every text gets one column per language. The banner picks the language of the page \u2014 the site language, WPML and Polylang all work, and a filter lets you override it. English and German defaults are built in. The description and the category descriptions may contain HTML, so a link to your privacy policy is one <a><\/code> away; {privacy}<\/code> and {imprint}<\/code> become the links to the pages you chose.<\/p>\n\nLooks like your site, not like a plugin<\/h4>\n\n
[wonderful_cookie_and_consent_banner_link]<\/code> or any link to #wonderful-cookie-and-consent-banner<\/code>). [wonderful_cookie_and_consent_banner_status]<\/code> on the privacy page shows the current choice per category; the banner stays closed there so the policy can be read before deciding.<\/p>\n\nPreview without saving<\/h4>\n\n
Deliberately no \"only essential\" button<\/h4>\n\n
Built-in safety rails<\/h4>\n\n
\n
aria<\/code> roles and labels are in place, animations respect \"reduce motion\".<\/li>\n<\/ul>\n\nFor developers<\/h4>\n\n
wonderfulCookieAndConsentBanner.has('statistics')<\/code>, .get()<\/code>, .consentId()<\/code>, .open()<\/code>, .acceptAll()<\/code>, .reset()<\/code>. Events on document<\/code>: wonderful-cookie-and-consent-banner-consent<\/code> (on every page load with a stored decision and after every new decision; detail: categories, id, string, source), -changed<\/code> (new decision only) and -loaded<\/code> (a service script ran). The same wonderful_cookie_and_consent_banner_consent<\/code> event is pushed to the dataLayer<\/code> with the same payload, so one Google Tag Manager trigger covers every page.<\/p>\n\n<client>-<timestamp>-<version>-<random><\/code>); the client part stays stable when the visitor changes their mind. Send it along with your analytics events if you want a record of consent \u2014 the plugin itself keeps no log.<\/p>\n\nwonderful_cookie_and_consent_banner_has( 'marketing' )<\/code> reads the request cookie (mind page caching). Filter wonderful_cookie_and_consent_banner_language<\/code> overrides the language.<\/p>\n\nExternal services<\/h3>\n\n
wonderful_cookie_and_consent_banner<\/code>.<\/p>\n\n\n
Matomo (script, self-hosted)<\/h4>\n\n
matomo.js<\/code> from the Matomo installation URL the site owner enters and sends page views to matomo.php<\/code> there, after consent. That URL is usually the site owner's own server, in which case no third party is involved and the site owner's own privacy policy applies. If a hosted Matomo installation is used, its operator's terms apply.\nProvider of the software: InnoCraft Ltd.\nTerms of service: https:\/\/matomo.org\/terms\/\nPrivacy policy: https:\/\/matomo.org\/privacy-policy\/<\/p>\n\nGoogle Tag Manager (script)<\/h4>\n\n
gtm.js<\/code> from www.googletagmanager.com<\/code> on every page view after consent. Which further tags are then loaded, and what they collect, is configured by the site owner in their own Google Tag Manager container.\nProvider: Google Ireland Limited.\nTerms of service: https:\/\/marketingplatform.google.com\/about\/analytics\/tag-manager\/use-policy\/\nPrivacy policy: https:\/\/policies.google.com\/privacy<\/p>\n\nGoogle Analytics 4 (script)<\/h4>\n\n
gtag.js<\/code> from www.googletagmanager.com<\/code> on every page view after consent and sends page views and events to Google's servers, where they are attributed to the measurement ID the site owner entered. Sets the cookies _ga*<\/code> and _gid<\/code>.\nProvider: Google Ireland Limited.\nTerms of service: https:\/\/marketingplatform.google.com\/about\/analytics\/terms\/us\/\nPrivacy policy: https:\/\/policies.google.com\/privacy<\/p>\n\nGoogle Ads (script)<\/h4>\n\n
gtag.js<\/code> from www.googletagmanager.com<\/code> on every page view after consent and reports page views and conversions to the conversion ID the site owner entered. Sets the cookies _gcl_*<\/code>.\nProvider: Google Ireland Limited.\nTerms of service: https:\/\/policies.google.com\/terms \u2014 advertising specifics: https:\/\/business.safety.google\/adsservices\/\nPrivacy policy: https:\/\/policies.google.com\/privacy<\/p>\n\nMeta Pixel (script)<\/h4>\n\n
fbevents.js<\/code> from connect.facebook.net<\/code> on every page view after consent and reports a page view to Meta for the pixel ID the site owner entered. Sets the cookies _fbp<\/code> and _fbc<\/code>.\nProvider: Meta Platforms Ireland Limited.\nTerms of service: https:\/\/www.facebook.com\/legal\/terms\/businesstools\nPrivacy policy: https:\/\/www.facebook.com\/privacy\/policy\/<\/p>\n\nMicrosoft Advertising, UET tag (script)<\/h4>\n\n
bat.js<\/code> from bat.bing.com<\/code> on every page view after consent and reports page views and conversions to Microsoft for the UET tag ID the site owner entered. Sets the cookies _uet*<\/code> and MUID<\/code>.\nProvider: Microsoft Corporation. For the site owner's advertising account the Microsoft Advertising Agreement applies in addition.\nTerms of service: https:\/\/www.microsoft.com\/en-us\/servicesagreement\nPrivacy policy: https:\/\/privacy.microsoft.com\/privacystatement<\/p>\n\nMicrosoft Clarity (script)<\/h4>\n\n
www.clarity.ms<\/code> on every page view after consent; the tag records interactions with the page (mouse movement, clicks, scrolling, page content) and sends them to Microsoft for the project ID the site owner entered. Sets the cookies _clck<\/code>, _clsk<\/code>, CLID<\/code> and MUID<\/code>.\nProvider: Microsoft Corporation.\nTerms of service: https:\/\/clarity.microsoft.com\/terms\nPrivacy policy: https:\/\/privacy.microsoft.com\/privacystatement<\/p>\n\nLinkedIn Insight Tag (script)<\/h4>\n\n
insight.min.js<\/code> from snap.licdn.com<\/code> on every page view after consent and reports the page view to LinkedIn for the partner ID the site owner entered. Sets the cookies li_*<\/code>, lidc<\/code>, bcookie<\/code>, UserMatchHistory<\/code> and AnalyticsSyncHistory<\/code>.\nProvider: LinkedIn Ireland Unlimited Company.\nTerms of service: https:\/\/www.linkedin.com\/legal\/user-agreement\nPrivacy policy: https:\/\/www.linkedin.com\/legal\/privacy-policy<\/p>\n\nYouTube (embed)<\/h4>\n\n
youtube.com<\/code> and youtube-nocookie.com<\/code> back behind a placeholder. Only when the visitor loads the video, or has consented to the category, is the player requested from YouTube, which may set cookies.\nProvider: Google Ireland Limited.\nTerms of service: https:\/\/www.youtube.com\/t\/terms\nPrivacy policy: https:\/\/policies.google.com\/privacy<\/p>\n\nVimeo (embed)<\/h4>\n\n
vimeo.com<\/code> back until the visitor loads the video or has consented to the category; the player is then requested from Vimeo and may set the cookie vuid<\/code>.\nProvider: Vimeo.com, Inc.\nTerms of service: https:\/\/vimeo.com\/terms\nPrivacy policy: https:\/\/vimeo.com\/privacy<\/p>\n\nGoogle Maps (embed)<\/h4>\n\n
google.com\/maps<\/code>, maps.google.com<\/code> and maps.googleapis.com<\/code> back until the visitor loads the map or has consented to the category; the map is then requested from Google and may set cookies.\nProvider: Google Ireland Limited.\nTerms of service: https:\/\/www.google.com\/help\/terms_maps\/\nPrivacy policy: https:\/\/policies.google.com\/privacy<\/p>\n\nOpenStreetMap (embed)<\/h4>\n\n
openstreetmap.org<\/code> back until the visitor loads the map or has consented to the category; the map is then requested from OpenStreetMap.\nProvider: OpenStreetMap Foundation.\nTerms of service: https:\/\/wiki.osmfoundation.org\/wiki\/Terms_of_Use\nPrivacy policy: https:\/\/wiki.osmfoundation.org\/wiki\/Privacy_Policy<\/p>\n\nCustom services<\/h4>\n\n
\n
\/wp-content\/plugins\/<\/code>.<\/li>\n[wonderful_cookie_and_consent_banner_status]<\/code> on your privacy page \u2014 it shows the visitor's current choice per category with a button to change it, and the banner stays closed on that page so the policy can be read first. [wonderful_cookie_and_consent_banner_link]<\/code> renders just a link, for example for the footer.<\/li>\n<\/ol>\n\n\n\n
Does the plugin make my site GDPR compliant?<\/h3><\/dt>\n
Where is the consent stored?<\/h3><\/dt>\n
wonderful_cookie_and_consent_banner<\/code> in the visitor's browser, for the number of days you configure. Nothing is stored on the server, there is no consent log.<\/p><\/dd>\nHow do I ask everyone again?<\/h3><\/dt>\n