Description
Cookie Consent Hub is a WordPress plugin that connects your site to the
CookieConsentHub service. It provides:
- Cookie consent banner — Customizable from your CookieConsentHub dashboard
- Server-side script blocking — Rewrites third-party scripts before they reach the browser
- Cache compatible — Works with WP Rocket, W3 Total Cache, LiteSpeed Cache, and WP Super Cache
- Regional targeting — Show banners only to EU, US, EEA+UK, or Brazil visitors, or globally
- Google Consent Mode v2 — Supported via the CDN script and GTM integration
Requirements
This plugin is a client for a third-party service and does nothing on its own. It
requires:
- A CookieConsentHub account with an active subscription
- An API key generated from your CookieConsentHub dashboard
See External services below for exactly what data is sent where.
How It Works
- Install and activate the plugin — activation opens a short setup flow
- Paste the API key from your CookieConsentHub dashboard
- Choose who sees the banner, where it sits, and whether trackers are blocked
- The plugin loads your own home page and confirms the banner is actually live
You can re-run those settings any time from Settings > Cookie Consent Hub, which
also has a “Check my banner is live” button for when something looks wrong.
External services
This plugin relies on the third-party service CookieConsentHub
(https://cookieconsenthub.com) and does not function without it. Nothing is sent
anywhere until you enter an API key and click Connect.
Service terms: https://cookieconsenthub.com/terms-and-conditions
Privacy policy: https://cookieconsenthub.com/privacy
1. Connecting your site — POST https://cookieconsenthub.com/api/wp/validate
Fires once, when an administrator clicks “Connect” on the settings screen. Sends the
API key you pasted. Receives your site’s banner configuration, script URL, and
subscription status. No visitor data is involved.
2. Syncing settings — PATCH https://cookieconsenthub.com/api/wp/settings
Fires when an administrator finishes the setup wizard or clicks “Sync to Dashboard”.
Sends the API key and the banner settings shown on the settings screen (enabled, region,
position). No visitor data is involved.
3. The consent banner script — loaded from https://cdn.cookieconsenthub.com
Once connected, the plugin adds a <script> tag to the front end of your site. This
script runs in each visitor’s browser and contacts CookieConsentHub directly. It
affects your visitors, so it is described in full:
GET https://cookieconsenthub.com/api/customization/{site-id}— fetches the banner
text, colors, and behavior you configured. Sends your site identifier only.GET https://cookieconsenthub.com/api/geo-country— resolves the visitor’s country
so that region-restricted banners are shown to the right people. The visitor’s IP
address reaches CookieConsentHub as part of this request and is used to derive the
country. If your banner region is set to “Global”, this lookup is not needed.POST https://cookieconsenthub.com/api/consentlog/{site-id}— records the consent
choice so you have an auditable log, as GDPR requires. Sent only after a visitor
interacts with the banner. Includes: the accept/reject action, which categories were
granted, the page URL the choice was made on, an expiry timestamp, a generated event
identifier, and the browser language, platform, and user agent string.
If you deactivate the plugin, the script tag is removed and none of the above occurs.
CookieConsentHub is the only service this plugin contacts. The tracker blocker holds a
list of third-party domain names — connect.facebook.net, googletagmanager.com/gtag,
intercom.io and so on — and the settings screen prints that same list under “What gets
blocked”. Those are patterns matched against script tags your site is already serving, so
they can be switched off until a visitor agrees. They are not destinations: the plugin
sends no request to any of them, and adding one to the list is what stops it loading.
Screenshots
Installation
- Upload the
cookie-consent-hubfolder to/wp-content/plugins/, or install through the Plugins screen - Activate through the ‘Plugins’ menu in WordPress
- Navigate to Settings > Cookie Consent Hub and enter your API key
FAQ
-
Yes. The plugin connects to the CookieConsentHub service to load your consent banner
configuration and customizations, and to handle consent logging. See the External
services section above for what that entails. -
Does it work with caching plugins?
-
Yes. The plugin is designed to work with WP Rocket, W3 Total Cache, LiteSpeed Cache,
and WP Super Cache. Scripts are blocked server-side so the cached HTML already has
scripts in a blocked state. -
What scripts are blocked?
-
Google Analytics (including the GA4 gtag loader), Facebook Pixel, TikTok Pixel,
LinkedIn Insight Tag, Hotjar, Mixpanel, Intercom, Zendesk, HubSpot, and other common
tracking scripts. Scripts are categorized as analytics, marketing, or personalization.
The full list is shown on the plugin’s settings screen. -
Is the Google Tag Manager container blocked?
-
No, and deliberately. Consent Mode v2 works by letting the GTM container load and then
signalling the visitor’s consent state to it, so that GTM itself withholds the tags
that need consent. Blockinggtm.jsoutright would stop those signals from ever being
delivered. Tags loaded directly rather than through GTM are still blocked as listed
above. -
Does server-side blocking slow down my site?
-
Scripts added through the normal WordPress queue are rewritten as WordPress prints each
one, which costs almost nothing. On WordPress 6.9 and later there is additionally one
pass over the finished page; responses with no script tag at all are skipped entirely,
and on a cached site that pass runs once per cache build rather than once per visitor.
If you would rather not have it, turn the option off — the banner script still blocks
trackers in the browser. -
What is not blocked server-side?
-
Only scripts registered through WordPress’s own script queue can be rewritten as they
are printed. These cannot, and are left to the banner to hold back in the browser:- Tracking code pasted directly into a theme file or a theme “header scripts” setting
- Tags another plugin prints into the page instead of queueing them
- Tags inside post or page content, such as a Custom HTML block
- Tags a script loads after the page has already reached the browser
On WordPress 6.9 and later, WordPress can also hand the plugin the finished page, which
covers the first three of those before anything is sent. Some page builders and
performance plugins switch that off for the whole site — Elementor is one — and on
earlier WordPress versions it does not exist at all. In those cases the tags are held in
the browser by the banner instead. Either way, running any of the four supported caching
plugins also hands the plugin the whole page while the cache is being built. -
In the CookieConsentHub dashboard. The settings screen in WordPress covers the few
options that need to be available locally; everything else lives in the dashboard.
Reviews
There are no reviews for this plugin.
Contributors & Developers
“Cookie Consent Hub” is open source software. The following people have contributed to this plugin.
Contributors
Translate “Cookie Consent Hub” into your language.
Interested in development?
Browse the code, check out the SVN repository, or subscribe to the development log by RSS.
Changelog
1.0.1
- Tracker blocking no longer opens an output buffer of its own. Queued scripts are
rewritten as WordPress prints them, and on WordPress 6.9 and later the finished page
is read through the output buffer WordPress provides for the purpose - Documented what server-side blocking cannot reach, on the settings screen and here
- Uninstall now also removes the stored subscription end date
- Removed an unused API call
1.0.0
- Initial wordpress.org release
- Guided setup on activation: connect, configure, and verify in three steps
- “Check my banner is live” — the plugin loads your own home page and reports
whether the consent script is really there - API key authentication with CookieConsentHub
- CDN script injection
- Server-side script blocking
- Cache plugin compatibility (WP Rocket, W3TC, LiteSpeed, WP Super Cache)
- Admin settings page with connection, banner, and blocking sections