Tracking Scripts Not being blocked

Hi. I will investigate and get back to you asap.

Version 1.7.0 will be released to sites in about 24 hours. WordPress.org currently delays plugin updates by 24 hours so moderators and security scanners can review changes before they reach users.

Bricks → Settings → Custom Code → Header Scripts was not covered in 1.6.2. That’s fixed in 1.7.0, which is now available on WordPress.org.

What was going on in 1.6.2

The plugin only blocked scripts loaded through WordPress’s script API (wp_enqueue_script). Anything pasted as raw HTML in Bricks Custom Code bypassed that, which is why you still saw _ga / _gid, g/collect requests, and Clarity activity before consent — even though the Script Blocking tab listed Google Analytics.

What changed in 1.7.0

There’s a new Custom Code blocking option on Settings → Cookie Consent → Script Blocking (on by default). It scans the final page HTML and blocks known tracking scripts — including GA4/gtag and Microsoft Clarity — when they’re added via Bricks, Elementor, or similar Custom Code fields.

GA and Clarity should no longer run until the visitor accepts the matching category.

Optional: Google Site Kit is still a good way to add GA4 if you prefer a plugin-based setup, but it’s no longer required for Bricks Custom Code to work with consent blocking.

If anything still slips through after updating, let me know which snippet you’re using and I’ll take another look.

Hi. Sorry for the delay.

Thanks the video helped a lot. I’ve also checked your website. I see you changed the banner to CookieYes but it still loads the analytics even when everything is denied.

It seems like you have a second Google Analytics tag in the code:

Blocked correctly (GA4):

<script async data-cookieyes="cookieyes-analytics" src="https://www.googletagmanager.com/gtag/js?id=G-XGFR5PZK4E"></script>

<script data-cookieyes="cookieyes-analytics">

gtag('config', 'G-XGFR5PZK4E');

</script>

This GA4 tag has the data-cookieyes="cookieyes-analytics" attribute, so CookieYes does hold it until consent. That part is working.

NOT blocked (legacy Universal Analytics):

<script async src="https://www.google-analytics.com/analytics.js"></script>

<script async src="https://www.googletagmanager.com/gtag/js?id=UA-43454331-3&cx=c&gtm=4e6711h1"></script>

I’m not sure where the Universal Analytics code is in the WordPress but that seems to be the problem. I suggest you check :

• Bricks → theme settings / custom code (header scripts) — very common on Bricks sites
• A header/footer injector plugin (“Insert Headers and Footers,” “WPCode,” “GA Google Analytics,” etc.)
• The child theme’s functions.php
• A Google Tag Manager container that still fires a Universal Analytics tag