WpAgencyKit Cookies — GDPR Consent, 100% on your server.

It ships inside the WpAgencyKit Agency Bundle together with four other premium plugins. The bundle is a one-time payment from €199 — no per-plugin purchase path, no recurring fee. You get every plugin in the bundle plus lifetime OTA updates for each.

One-time payment for lifetime access, including every future update delivered over-the-air. There is no yearly renewal, no per-seat billing, no "unlock pro features" paywall inside the admin.

No per-domain fees. Your licence covers unlimited production sites plus unlimited staging copies. Agencies can deploy WpAgencyKit Cookies on every client project without extra cost — a deliberate contrast with Iubenda / CookieYes, where each production domain is billed separately.

Iubenda and CookieYes host consent data on their own SaaS — the plugin is just a front-end to their cloud. Complianz is self-hosted but doesn't offer a built-in site scanner and its preset coverage is less curated. WpAgencyKit Cookies is fully self-hosted, ships a 20-tracker preset library, includes a one-click site scanner, and costs zero per additional site. See the comparison table above for the per-feature breakdown.

Yes. The Bundle licence is site-unlimited, the top-level admin menu keeps the plugin discoverable for your clients, and the Cookie Declaration shortcode auto-maintains the Cookie Policy page so you don't re-edit static content every time a client enables a new tracker.

Always. Staging sites don't consume any per-domain slot because the licence is site-unlimited by design. You can clone production to a staging URL, run the scanner there, and keep both in sync without touching the licence.

Twenty curated presets: Google Analytics 4, Google Tag Manager, Microsoft Clarity, Hotjar, Matomo, Mixpanel, Amplitude, Plausible, Meta (Facebook) Pixel, Google Ads, DoubleClick, LinkedIn Insight, TikTok Pixel, Pinterest Tag, X (Twitter) Pixel, Snapchat, Reddit, YouTube embed, Google reCAPTCHA and Vimeo. Each preset carries script URL patterns, inline signatures for the scanner, and declarative cookie metadata for the Cookie Policy shortcode.

Open Trackers & Cookies → Custom Trackers, fill in name, provider, consent category and one script URL substring per line. Optionally add the cookies it sets (name, duration, purpose) so they appear in the Cookie Policy. No PHP required. The server-side blocker treats custom trackers identically to the built-in presets.

The scanner fetches your homepage, up to two recent posts, one recent page and (if present) the WooCommerce shop, then parses the HTML for <script src>, <iframe src> and known inline signatures (fbq(, gtag(, _paq.push, GTM-, and similar). It detects every tracker rendered in the initial HTML. It cannot see scripts injected at runtime by GTM or by SPA routers — those are still handled by the manual preset toggle. Results are cached for one hour; "Rescan" forces a refresh.

Yes. GTM is in the preset library. When visitors have not consented to Analytics, the GTM <script> is rewritten to type="text/plain" before the browser sees it, so no child tag fires. When consent is granted, the runtime re-activates GTM and every tag it manages. No race conditions, no "tracker slipping through" bug.

Drop [wpak_cookies_declaration] on any page. It renders a category-grouped table of every cookie set by the trackers you've enabled, with name, provider, duration and purpose. The table auto-updates whenever you toggle a tracker. Optional attributes: category="analytics,marketing" to limit the output, show_empty="1" to keep empty categories visible.

Yes. Every visible string — banner title, subtitle, message, three action buttons, "Required" badge, close label, save success message, plus the four category titles and descriptions — is editable from the Banner → Texts subpage via a single text field. Leave a field empty to keep the translated default. Full multilingual support via wpak-translate is on the roadmap.

No — with one exception. Banner rendering, consent log, script blocking and cookie declaration all run on your WordPress server with zero external requests. The only outbound request is the periodic licence check against WpAgencyKit's activation server, identical to every other plugin in the bundle.

In a dedicated table inside your own WordPress database. Each record contains UTC timestamp, IP, user-agent and the list of categories the visitor granted. Export as CSV or JSON from Consent Logs at any time. Retention is configurable from 1 to 3,650 days (default 30); the cleanup runs via a daily cron job.

Both. The default is opt-in (required for EU / UK GDPR — cookies are blocked until the visitor explicitly accepts). Switch to opt-out from Settings → Consent Mode if your jurisdiction allows implied consent.

WpAgencyKit Cookies implements prior-consent blocking (art. 7), granular per-category opt-in, machine-readable consent records with timestamp and IP (art. 7.1 — demonstrable consent), and the Cookie Declaration shortcode covers art. 13 transparency on the Cookie Policy page. The plugin handles the technical side of GDPR. It does not replace legal counsel for your Privacy Policy copy or your specific legal basis.

Yes. Script blocking happens server-side at WordPress render time — the blocked <script type="text/plain"> tags are baked into the HTML before the cache layer stores the page. Visitors always receive consent-safe markup regardless of cache status. For the frontend runtime, cache-bust on plugin version bump; automatic via WPAK_COOKIES_VERSION enqueue parameter.

WordPress 5.8 or later and PHP 7.4 or later. Tested up to WordPress 6.9. The plugin follows WordPress coding standards and does not use any deprecated API.