About this plugin
Most consent plugins are huge. Wonderful Cookie and Consent Banner does two things: it asks the visitor once and remembers the answer in a first-party cookie, and it holds back your tracking scripts and embedded videos or maps until the visitor accepts their category. Four categories — essential, statistics, marketing, external media — and that is all you need for a normal website.
Everything stays on your own server. The plugin contacts no external service, loads no remote fonts or scripts of its own, keeps no consent log, and sends nothing anywhere. The only third-party requests are the ones you configure as services, and those run only after consent.
Scripts that wait for consent
A service is a name, a short description, a category and the script exactly as the provider gave it to you. Paste it, save, done. Presets do the snippet for the usual suspects — you only fill in the account ID, in a field of its own, and the script is rebuilt from it every time you save.
So the container ID stays where you can read and change it instead of being buried in minified provider code. “Detach preset” hands the script back for free editing whenever you want it:
- Matomo (self-hosted)
- Google Tag Manager
- Google Analytics 4
- Google Ads
- Meta Pixel
- Microsoft Advertising (UET)
- LinkedIn Insight Tag
- Microsoft Clarity
Every service can list the cookies it sets (with * as wildcard). They are shown to the visitor under “choose individually” and deleted when consent is withdrawn.
Every service has an “Active” switch. Switch it off and it keeps all its settings but stops running: no script, no entry in the banner, no blocked embeds — handy to take a tracker off the site for a while without deleting it and typing it in again later.
Embed blocking is folded away under “Block embedded content” and only opens by itself where hosts are configured, so a plain script service is not asked about iframes it will never have.
Adding a new optional service — or switching one back on — automatically raises the consent version, so every visitor is asked again.
Embedded content that waits too
com/maps so the reCAPTCHA iframe is left alone) and every matching iframe in your content stays empty behind a placeholder until the visitor loads it once or allows the category for good. No request reaches the provider before that — not even for a thumbnail. Presets for YouTube, Vimeo, Google Maps and OpenStreetMap come with the host lists; the placeholder texts are yours to edit per language, and each service can have its own placeholder image.
It works with whatever put the iframe there: the block editor, the classic editor, oEmbed, Divi, Elementor, widgets. The server only removes the src attribute from matching iframes in the content; the browser builds the placeholder and puts the source back after consent, and also catches iframes that scripts add later. Players loaded purely through a provider’s JavaScript API are not covered.
Texts in as many languages as you need
Enter language codes such as de, en and every text gets one column per language. The banner picks the language of the page — the site language, WPML and Polylang all work, and a filter lets you override it. English and German defaults are built in.
The description and the category descriptions may contain HTML, so a link to your privacy policy is one <a> away; {privacy} and {imprint} become the links to the pages you chose.
Looks like your site, not like a plugin
Position on a three-by-three grid (top, middle, bottom × left, center, right), size (card, wide, or a bar across the full width), an optional backdrop that dims the page, its colors, one corner radius, the order of the two buttons, and whether the links to the privacy policy and imprint sit left, centered or right. Fonts are inherited from your theme.
The floating button that lets visitors change their mind later has its own background and icon color (unobtrusive by default), four built-in icons or an image of your own — or is switched off, if you prefer a link in the footer ( [wonderful_cookie_and_consent_banner_link] or any link to #wonderful-cookie-and-consent-banner ). [wonderful_cookie_and_consent_banner_status] on the privacy page shows the current choice per category; the banner stays closed there so the policy can be read before deciding.
Preview without saving
The settings page renders the banner with whatever is currently in the form. Change a color, click “Preview banner”, look, adjust, save when it is right. The preview writes no cookie and loads no script.
Deliberately no “only essential” button
The banner offers “Accept all” and “Choose individually”. Under “choose individually” nothing optional is preselected, and saving without ticking anything means essential only. Whether that is enough for your jurisdiction is your call — the plugin does not give legal advice.
Built-in safety rails
- Scripts can only be stored by users who may publish unfiltered HTML (administrators); anyone else keeps what is already saved.
- Every text passes through WordPress’ HTML sanitiser, every color, number and choice is validated before it is stored.
- The consent cookie is validated on every read; anything malformed counts as “no consent”.
- The served HTML is identical for every visitor, so page caches and CDNs never serve a wrong consent state.
- Keyboard operable, focus stays inside the dialog, aria roles and labels are in place, animations respect “reduce motion”.
For developers
reset(). Events on document: wonderful-cookie-and-consent-banner-consent (on every page load with a stored decision and after every new decision; detail: categories, id, string, source), -changed (new decision only) and -loaded (a service script ran). The same wonderful_cookie_and_consent_banner_consent event is pushed to the dataLayer with the same payload, so one Google Tag Manager trigger covers every page.
Every decision gets a consent id ( <client>-<timestamp>-<version>-<random> ); the client part stays stable when the visitor changes their mind. Send it along with your analytics events if you want a record of consent — the plugin itself keeps no log.
PHP: wonderful_cookie_and_consent_banner_has( 'marketing' ) reads the request cookie (mind page caching). Filter wonderful_cookie_and_consent_banner_language overrides the language.
External services
The plugin itself contacts no external service: it loads no remote fonts, scripts or images of its own, sends nothing to the plugin author or anyone else, and keeps no consent log. The visitor’s decision is stored only in the visitor’s own browser, in a first-party cookie named wonderful_cookie_and_consent_banner.
External services are contacted only for services the site owner configures, and only after the visitor has consented to that service’s category. A fresh installation has no service configured and therefore contacts nothing at all. Services placed in the “essential” category run without consent, so that category should hold only what is strictly necessary.
Every service below is an optional template (“preset”) that a site owner may add. What is sent is in each case the same kind of data: requesting the provider’s script or iframe transmits the visitor’s IP address, browser and operating system information, the referring page and any cookies that provider has already set in that browser; what is collected from then on is determined by the provider and by the account the site owner configured. When it is sent differs:
- Script services: the provider’s script is requested on every page view, as soon as the visitor has consented to the service’s category, and then runs on its own.
- Embed services (videos, maps): nothing is requested from the provider until the visitor clicks “Load content” on the placeholder, or has consented to the category — not even a preview image.
Matomo (script, self-hosted)
Website analytics. php there, after consent. That URL is usually the site owner’s own server, in which case no third party is involved and the site owner’s own privacy policy applies.
If a hosted Matomo installation is used, its operator’s terms apply.
Provider of the software: InnoCraft Ltd.
org/website-terms/
org/privacy-policy/
Google Tag Manager (script)
Tag management. com on every page view after consent. Which further tags are then loaded, and what they collect, is configured by the site owner in their own Google Tag Manager container.
Provider: Google Ireland Limited.
com/about/analytics/tag-manager/use-policy/
com/privacy
Google Analytics 4 (script)
Website analytics. com on every page view after consent and sends page views and events to Google’s servers, where they are attributed to the measurement ID the site owner entered. Sets the cookies _ga* and _gid.
Provider: Google Ireland Limited.
com/about/analytics/terms/us/
com/privacy
Google Ads (script)
Conversion measurement and remarketing. com on every page view after consent and reports page views and conversions to the conversion ID the site owner entered. Sets the cookies _gcl_*.
Provider: Google Ireland Limited.
google/adsservices/
com/privacy
Meta Pixel (script)
Conversion measurement and remarketing for Facebook and Instagram advertising. net on every page view after consent and reports a page view to Meta for the pixel ID the site owner entered. Sets the cookies _fbp and _fbc.
Provider: Meta Platforms Ireland Limited.
com/legal/terms/businesstools
com/privacy/policy/
Microsoft Advertising, UET tag (script)
Conversion measurement and remarketing for Bing advertising. com on every page view after consent and reports page views and conversions to Microsoft for the UET tag ID the site owner entered. Sets the cookies _uet* and MUID.
Provider: Microsoft Corporation. For the site owner’s advertising account the Microsoft Advertising Agreement applies in addition.
com/en-us/servicesagreement
com/privacystatement
Microsoft Clarity (script)
Session analytics (heatmaps, session recordings). ms on every page view after consent; the tag records interactions with the page (mouse movement, clicks, scrolling, page content) and sends them to Microsoft for the project ID the site owner entered. Sets the cookies _clck, _clsk, CLID and MUID.
Provider: Microsoft Corporation.
com/terms
com/privacystatement
LinkedIn Insight Tag (script)
Conversion measurement and remarketing for LinkedIn advertising. com on every page view after consent and reports the page view to LinkedIn for the partner ID the site owner entered. Sets the cookies li_*, lidc, bcookie, UserMatchHistory and AnalyticsSyncHistory.
Provider: LinkedIn Ireland Unlimited Company.
com/legal/user-agreement
com/legal/privacy-policy
YouTube (embed)
Video embeds. com back behind a placeholder. Only when the visitor loads the video, or has consented to the category, is the player requested from YouTube, which may set cookies.
Provider: Google Ireland Limited.
com/t/terms
com/privacy
Vimeo (embed)
Video embeds. com back until the visitor loads the video or has consented to the category; the player is then requested from Vimeo and may set the cookie vuid.
com, Inc.
com/legal/
com/legal/privacy/policy
Google Maps (embed)
Map embeds. com back until the visitor loads the map or has consented to the category; the map is then requested from Google and may set cookies.
Provider: Google Ireland Limited.
com/help/terms_maps/
com/privacy
OpenStreetMap (embed)
Map embeds. org back until the visitor loads the map or has consented to the category; the map is then requested from OpenStreetMap.
Provider: OpenStreetMap Foundation.
org/wiki/Terms_of_Use
org/wiki/Privacy_Policy
Custom services
The site owner can also paste any other script, and enter any other host whose iframes should be blocked. Such a service is not part of this plugin: which service is contacted, what data it receives and whose terms and privacy policy apply is determined entirely by the site owner who adds it, and must be documented in that site’s own privacy policy.