What Borlabs Cookie does on your site
Borlabs Cookie displays the consent dialog and only activates services that need consent once the visitor has explicitly agreed, service by service or by group. Three mechanisms do the work: content blockers replace a YouTube video or a Google Maps map with a placeholder, the script blocker holds back JavaScript, inline scripts included, and the style blocker holds back external stylesheets such as Google Fonts.
Setup revolves around a scanner and a library. The scanner finds cookies, external resources and features that require consent, then suggests matching packages from more than 370 service and blocker templates, according to the vendor. A setup assistant offers three paths (quick, custom or guided), and a consent log records every consent and its changes. According to Borlabs, no visitor data is sent to it: everything is processed on your own server.
The vendor is Borlabs GmbH, a company based in Hamburg, Germany. The plugin is paid, with no free version, and is not on wordpress.org: you download it from the customer portal with an annual license. Every license includes the same features (Google Consent Mode v2, IAB TCF 2.4, Microsoft UET Consent Mode); only the number of sites changes. It requires at least WordPress 4.6, PHP 7.4 and MySQL 5.6, and its interface is translated into eight languages.
Which sites Borlabs Cookie is a good fit for
Borlabs Cookie makes sense when you want a complete consent banner, largely configured for you, without a hosted consent platform:
- European sites with third-party content: videos, maps, fonts and analytics tools are held back until consent, and geo restriction tells visitors from the European Union apart.
- Sites that rely on Google ads: Consent Mode v2 and the IAB TCF 2.4 framework come with the entry-level license.
- Multilingual sites: the plugin works with WPML, Polylang, TranslatePress and Weglot, and can automatically translate your custom services.
- Agencies: WP-CLI, Composer, settings import and export, and consent shared across domains.
It is the wrong pick if you need a free solution or want to try before you buy: there is no free version and no trial. Real Cookie Banner and Complianz both offer a free version that also runs from your own server.
Borlabs Cookie strengths and limitations
Strengths
- Every feature in every license. Consent Mode v2, TCF 2.4, statistics and the consent log are not locked behind pricier tiers.
- Setup that is close to automatic. The scanner detects the services on your site and installs the suggested library packages in one click.
- Thorough blocking. Embedded content, inline scripts and external stylesheets stay blocked until consent.
- Consents stay with you. Choices and the log live in your WordPress database, and no visitor data goes to Borlabs.
Limitations
- No free version, no trial. You have to buy a license to test it, backed by a 30-day money-back guarantee.
- Tied to Borlabs services. Once the license expires, updates and support stop, and the scanner and library no longer work.
- Staging counts as a site. A test or development site also needs a license key.
- Scripts you must not optimize. Combining or minifying its JavaScript files causes errors, so you have to exclude them in your caching plugin.
The Borlabs Cookie settings we recommend
Paths use the plugin's English labels, under the Borlabs Cookie menu.
| Setting | Recommended value | Why |
|---|---|---|
| Setup Assistant Borlabs Cookie menu, on first launch | "Guided Setup" for a first install, "Quick Setup" if you already know the plugin | The guided path installs the same packages and explains each step. |
| "Display of Settings Mode" Settings > Admin & Plugin Settings | "Simplified" for a non-technical client, "Standard" for yourself | Simplified mode hides advanced options and cuts down on configuration mistakes. |
| "Consent log retention period in months" Settings > Admin & Plugin Settings, "Consent settings" card | 24 (default), or the period stated in your privacy policy | Proof of consent is kept for this period, then deleted. |
| "IAB TCF Status" Consent Management > IAB TCF > Settings | On only if you serve ads through TCF (Google AdSense, for example) | Without ads, TCF needlessly weighs down the dialog. |
| Google Analytics or Google Ads package Library & Scanner > Library | Installed from the library, with Consent Mode turned on in the package | According to Borlabs, the package is enough unless you need Google Tag Manager, and basic Consent Mode is active as soon as it is installed. |
| Exclude Borlabs Cookie files In your caching or optimization plugin | Every JavaScript file whose URL contains /borlabs-cookie/ excluded from combining and minification | The official documentation reports errors with WP Rocket, LiteSpeed Cache, Autoptimize or W3 Total Cache when these files are altered. |
- Configure and test in Setup Mode: visitors see nothing until you are done.
- Run the scanner's audit: it checks that no cookie or external content loads before consent.
- Open the Debug Console on a page of your site: "Config is loaded" and "Config is placed correctly" should pass, otherwise an optimization plugin is altering the files.
- With WP Rocket, run the "Remove cache for used CSS" action after installing the WP Rocket package from the library.
Borlabs Cookie security: an XSS flaw fixed in 3.4.2.2
At the time of writing, the WPScan database lists no vulnerability for Borlabs Cookie, and we found no published CVE. The vendor's changelog does report two fixes:
- Version 3.4.2.2 (August 2026): fix for an XSS flaw in the consent log. Attackers were limited to 35 characters of code, which only ran when an administrator opened that log.
- Version 3.4.5 (September 2026): hardened security of the REST API endpoint used by the cloud scan.
Updates show up in the WordPress dashboard as long as the license is active: keep it current and run at least 3.4.2.2. The consent log holds personal data, which also makes it a compliance matter (see our article on GDPR, logs and retention periods). WP Masquerade Pro removes the plugin's file addresses and those of its cache folder from your pages, along with its script and style IDs; the borlabsCookieConfig variable, the #BorlabsCookieBox ID and the borlabs-cookie cookie stay visible, and this masking does not replace updating.
What WP Masquerade hides for Borlabs Cookie
Pro Handled by WP Masquerade Pro only
The free version does not know the traces specific to Borlabs Cookie: without Pro, only generator tags are removed, as for any plugin.
Free version
Handled by WP Masquerade Pro only
With Pro
- folder name
- tag IDs
- generated-file folders
Still visible
- JavaScript variables
borlabsCookieConfig - tag IDs
#BorlabsCookieBox - cookies
borlabs-cookie
These traces stay because the plugin needs them to work (scripts, styles, cookies) or because they come from the server.
Borlabs Cookie FAQ
Is there a free version or a trial of Borlabs Cookie?
No. Borlabs suggests starting with the Personal license at €49 per year excluding VAT, backed by a 30-day money-back guarantee, then upgrading and paying only the difference. Nonprofits and NGOs working for people, nature or animals can get a free license.
What happens when the license expires?
The plugin keeps working with limitations: no more updates or support, and features that rely on Borlabs services, such as the scanner and the library, are no longer available. You also can no longer download the plugin.
Do I need a license for my staging site?
Yes: the library, geo restriction, TCF, the scanner and automatic translation all go through Borlabs services, so every test or development environment needs a key.