{ "title": "CookieYes", "seo_title": "CookieYes: review, recommended settings and limits", "h1": "CookieYes", "description": "CookieYes standalone or connected: strengths, free plan limits, per-domain pricing, recommended GDPR settings and patched vulnerabilities.", "lead": "CookieYes shows a cookie consent banner on activation and blocks non-essential scripts until the visitor decides. Our take on standalone use and the connected plans, their limits, the settings worth checking and the vulnerabilities already fixed.", "language": "en", "locale": "en-US", "type": "plugin-sheet", "url": "https://www.wp-masquerade.com/features/camouflaged-plugins/cookieyes/", "canonical": "https://www.wp-masquerade.com/features/camouflaged-plugins/cookieyes/", "markdown": "https://www.wp-masquerade.com/features/camouflaged-plugins/cookieyes/index.md", "json": "https://www.wp-masquerade.com/features/camouflaged-plugins/cookieyes/index.json", "published": "2026-11-04T08:00:00+00:00", "modified": "2026-11-05T21:04:07+00:00", "site": { "name": "WP Masquerade", "url": "https://www.wp-masquerade.com/" }, "translations": [ { "language": "en", "hreflang": "en-US", "title": "CookieYes", "url": "https://www.wp-masquerade.com/features/camouflaged-plugins/cookieyes/", "markdown": "https://www.wp-masquerade.com/features/camouflaged-plugins/cookieyes/index.md", "json": "https://www.wp-masquerade.com/features/camouflaged-plugins/cookieyes/index.json" }, { "language": "fr", "hreflang": "fr-FR", "title": "CookieYes", "url": "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/cookieyes/", "markdown": "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/cookieyes/index.md", "json": "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/cookieyes/index.json" }, { "language": "es", "hreflang": "es-ES", "title": "CookieYes", "url": "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/cookieyes/", "markdown": "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/cookieyes/index.md", "json": "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/cookieyes/index.json" }, { "language": "de", "hreflang": "de-DE", "title": "CookieYes", "url": "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/cookieyes/", "markdown": "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/cookieyes/index.md", "json": "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/cookieyes/index.json" }, { "language": "it", "hreflang": "it-IT", "title": "CookieYes", "url": "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/cookieyes/", "markdown": "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/cookieyes/index.md", "json": "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/cookieyes/index.json" }, { "language": "pt", "hreflang": "pt-BR", "title": "CookieYes", "url": "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/cookieyes/", "markdown": "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/cookieyes/index.md", "json": "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/cookieyes/index.json" }, { "language": "nl", "hreflang": "nl-NL", "title": "CookieYes", "url": "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/cookieyes/", "markdown": "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/cookieyes/index.md", "json": "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/cookieyes/index.json" } ], "headings": [ { "level": 1, "text": "CookieYes" }, { "level": 2, "text": "What CookieYes does on your site" }, { "level": 2, "text": "Which sites CookieYes is a good fit for" }, { "level": 2, "text": "CookieYes strengths and limitations" }, { "level": 3, "text": "Strengths" }, { "level": 3, "text": "Limitations" }, { "level": 2, "text": "The CookieYes settings we recommend" }, { "level": 2, "text": "CookieYes security: few vulnerabilities, one fixed in 3.5.8" }, { "level": 2, "text": "CookieYes FAQ", "id": "faq" } ], "body": "## The essentials\n\n- Best for small sites that want a GDPR banner working on activation, with Google Consent Mode v2.\n- Main caveat: no scan or consent log without an account; the free plan stops at 5,000 pageviews.\n- Free; Basic costs €9 a month or €90 a year per domain, plus taxes.\n\n## What CookieYes does on your site\n\nCookieYes shows a cookie consent banner the moment you activate it, with no setup: a GDPR opt-in template, five categories (necessary, functional, analytics, performance, advertisement) denied by default, a preference center and a floating button that lets visitors change their mind. Until a visitor accepts a category, the plugin blocks the scripts and iframes of the services it recognizes, then releases them as soon as they click “Accept,” without a page reload. It also passes the visitor’s choice to Google Consent Mode v2 (basic and advanced), Microsoft UET Consent Mode and the WP Consent API.\n\nThe plugin runs in two modes, and almost everything depends on which one you pick. **Standalone**, with no account, it keeps its settings in WordPress: you declare your cookies yourself, nothing is scanned and no consent is recorded. **Connected** to the CookieYes web app, it hands the banner, cookie scanning, the consent log and cookie policy generation over to the vendor’s servers, and the banner then loads from the CookieYes CDN.\n\nThe vendor is CookieYes Limited, a UK company; the plugin used to be called GDPR Cookie Consent. Pricing is a per-domain subscription: the web app’s free plan covers one site per account and 5,000 pageviews a month, while the Basic, Pro and Ultimate plans raise the limits and unlock customization, geo-targeting and the IAB TCF framework.\n\n![Diagram: CookieYes works on visitors and bots, wordpress, database and files. Public traces: folder name (hidden with Pro); tag IDs (hidden with Pro); JavaScript variables (still visible); CSS classes (still visible); cookies (still visible); files served by the vendor (still visible).](https://www.wp-masquerade.com/media/wpm-sheets/cookieyes/diagram-en.svg?v=875a393f)\n\n## Which sites CookieYes is a good fit for\n\nCookieYes makes sense when you want a decent banner up and running in a few minutes:\n\n- **Small business sites and low-traffic blogs**: the connected free plan is enough as long as the site stays under 5,000 pageviews a month.\n- **Sites running Google ads**: Consent Mode v2 is included in every plan, standalone use included.\n- **Sites with few cookies that want to stay inside WordPress**: standalone mode avoids any outside account, as long as you list your cookies by hand.\n- **Agencies**: the web app manages several sites from one place, but every additional domain needs a paid plan.\n\nIt is not the best pick for a high-traffic site that wants to stay free, for a publisher that needs IAB TCF without paying for the Pro plan, or for a site that wants to keep proof of consent without relying on an outside service. In those cases, compare it with [Complianz](https://www.wp-masquerade.com/features/camouflaged-plugins/complianz/).\n\n## CookieYes strengths and limitations\n\n### Strengths\n\n- **Working banner on activation.** The GDPR template applies right away, with non-necessary categories denied by default.\n- **Auto-blocking with release on click.** Recognized scripts, including ones added later, wait for consent and start the moment the visitor accepts.\n- **Consent Mode v2 in every plan.** Signals reach Google Analytics, Google Ads and Tag Manager before the tags fire.\n- **Light on the database.** Only three tables; in connected mode, scanning and logging run on the vendor’s servers, which store consent data in the EU.\n\n### Limitations\n\n- **No account, no scan and no proof.** In standalone mode no consent is recorded, the cookie list has to be filled in by hand and no cookie policy is generated.\n- **A tight free plan.** 5,000 pageviews a month, 100 pages per scan, 5 scans a month and only one free site per account.\n- **Multilingual banner and colors cost extra.** In the web app they need at least the Basic plan; geo-targeting and IAB TCF need Pro.\n- **Blocking covers recognized services only.** A self-hosted or proxied script is blocked only if you tag it yourself.\n\n## The CookieYes settings we recommend\n\nThese settings exist in standalone mode, under the CookieYes menu. In connected mode, most of them are managed in the web app instead.\n\n| Setting | Recommended value | Why |\n| --- | --- | --- |\n| **Consent Template** CookieYes > Cookie Banner > General | GDPR (default) for a European audience | The GDPR template blocks before consent; which law applies depends on your audience, not on taste. |\n| **Consent expiration (days)** Same tab | 180 | The plugin itself notes that the French regulator CNIL recommends keeping choices for six months, while the default is 365 days. |\n| **Load cookies prior to consent** and **Hide categories from banner** Same tab | No category checked | The plugin warns that loading or hiding a category that holds cookies makes the site non-compliant with GDPR. |\n| **“Reject All” button** CookieYes > Cookie Banner > Content | On | Rejecting should be as easy as accepting, on the first layer of the banner. |\n| **Close [X] button** Same tab | On if you have Italian visitors | The plugin states that the Italian data protection authority requires this close-without-tracking button. |\n| **Revisit Consent button** Same tab, Revisit Consent Button section | On | Visitors must be able to withdraw consent as easily as they gave it. |\n| **Enable Google Consent Mode (GCM)** CookieYes > Google Consent Mode (GCM) | On if you use Google tags; off if another plugin already handles Consent Mode | CookieYes asks you to remove any hand-added Consent Mode script, and its docs say to leave it off when [Site Kit](https://www.wp-masquerade.com/features/camouflaged-plugins/site-kit-by-google/) handles it. |\n| **Reload page on consent action** CookieYes > Cookie Banner > General | Off, unless a script only starts on page load | Blocked scripts already start on click; reloading slows the visit for no gain. |\n\n- Clear every cache, then open the site in a private window: the banner should appear.\n- Before any choice, the Network tab of your browser’s developer tools should show no analytics or advertising requests.\n- Click “Accept” without reloading: the blocked requests should fire right away. In another private window, reject: the `cookieyes-consent` cookie should contain `analytics:no`.\n- In standalone mode, declare each cookie under CookieYes > Cookie Manager, with its Script URL Pattern so that it gets blocked.\n- With Google tags, check in Tag Assistant that the default consent state arrives before the first tag.\n\n## CookieYes security: few vulnerabilities, one fixed in 3.5.8\n\nTwo published vulnerabilities are worth knowing about:\n\n- **CVE-2020-20633, versions 1.8.2 and earlier**: in the old GDPR Cookie Consent, the policy generator let a logged-in user perform [stored XSS](https://www.wp-masquerade.com/glossary/xss/) and privilege escalation. WPScan lists it as fixed in 1.8.3.\n- **Stored XSS fixed in 3.5.8**: published by WPScan in early November 2026, with no CVE ID so far, it went through cookie category scripts and required at least a contributor account.\n\nWhat to do: turn on automatic updates for CookieYes (see our guide to automatic plugin updates) and give contributor accounts only to people who need them. With WP Masquerade Pro, the plugin folder and the IDs of its tags are renamed; the `cookieyes-consent` cookie, the banner’s `cky-*` classes and, in connected mode, the script served from `cdn-cookieyes.com` stay visible, and none of this replaces updating.\n\n## CookieYes FAQ\n\n**Do I need a CookieYes account to use the plugin?**\n\nNo. Connecting to the web app is optional and the banner works without it. Automatic cookie scanning, the consent log and the generated cookie policy, however, are only available in connected mode.\n\n**Does CookieYes make my site GDPR compliant?**\n\nNot on its own, and the vendor says so itself. You still need to declare every cookie correctly, check that nothing loads before the banner and write your privacy policy. For logs and retention periods on the security side, see our article on GDPR and WordPress security.\n\n**How much does CookieYes cost for several sites?**\n\nPricing is per domain, and each account gets only one free site. Basic costs €9 a month or €90 a year per domain, Pro €23 or €230, and Ultimate €50 or €500, plus local taxes. The pricing page also lists the same plans in US dollars.\n\n**What is left after deleting the plugin?**\n\nBy default, its tables and settings stay in the database. For a clean removal, set the `CKY_REMOVE_ALL_DATA` constant to `true` in `wp-config.php` before deleting the plugin.\n\n## Key facts\n\n- Category: Cookies and GDPR\n- Vendor: CookieYes Limited\n- Price: Free; paid plans from €9 a month or €90 a year per domain, plus taxes\n- Active installations (wordpress.org): 1 000 000+\n- Version: 3.5.8\n- Official page: https://wordpress.org/plugins/cookie-law-info/\n\n## What WP Masquerade hides\n\n- Handled by the free version of WP Masquerade\n- With Pro: folder name, tag IDs\n- Still visible: JavaScript variables, CSS classes, cookies, files served by the vendor", "catalog": "cookieyes", "essentials": [ "Best for small sites that want a GDPR banner working on activation, with Google Consent Mode v2.", "Main caveat: no scan or consent log without an account; the free plan stops at 5,000 pageviews.", "Free; Basic costs €9 a month or €90 a year per domain, plus taxes." ], "format": "application/json" }