{ "title": "WPConsent", "seo_title": "WPConsent: review, recommended settings and limits", "h1": "WPConsent", "description": "WPConsent free or Pro: script blocking before consent, limits (paid consent logs and multilingual), pricing, recommended settings and a patched flaw.", "lead": "WPConsent shows a cookie banner, blocks tracking scripts before consent and keeps visitor choices in your own WordPress database. Our take on the free version and the Pro plans, the settings to turn on, the limits that matter and the XSS flaw fixed in 1.2.0.", "language": "en", "locale": "en-US", "type": "plugin-sheet", "url": "https://www.wp-masquerade.com/features/camouflaged-plugins/wpconsent/", "canonical": "https://www.wp-masquerade.com/features/camouflaged-plugins/wpconsent/", "markdown": "https://www.wp-masquerade.com/features/camouflaged-plugins/wpconsent/index.md", "json": "https://www.wp-masquerade.com/features/camouflaged-plugins/wpconsent/index.json", "published": "2026-11-04T08:00:00+00:00", "modified": "2026-11-05T21:33:45+00:00", "site": { "name": "WP Masquerade", "url": "https://www.wp-masquerade.com/" }, "translations": [ { "language": "en", "hreflang": "en-US", "title": "WPConsent", "url": "https://www.wp-masquerade.com/features/camouflaged-plugins/wpconsent/", "markdown": "https://www.wp-masquerade.com/features/camouflaged-plugins/wpconsent/index.md", "json": "https://www.wp-masquerade.com/features/camouflaged-plugins/wpconsent/index.json" }, { "language": "fr", "hreflang": "fr-FR", "title": "WPConsent", "url": "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/wpconsent/", "markdown": "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/wpconsent/index.md", "json": "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/wpconsent/index.json" }, { "language": "es", "hreflang": "es-ES", "title": "WPConsent", "url": "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/wpconsent/", "markdown": "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/wpconsent/index.md", "json": "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/wpconsent/index.json" }, { "language": "de", "hreflang": "de-DE", "title": "WPConsent", "url": "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/wpconsent/", "markdown": "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/wpconsent/index.md", "json": "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/wpconsent/index.json" }, { "language": "it", "hreflang": "it-IT", "title": "WPConsent", "url": "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/wpconsent/", "markdown": "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/wpconsent/index.md", "json": "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/wpconsent/index.json" }, { "language": "pt", "hreflang": "pt-BR", "title": "WPConsent", "url": "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/wpconsent/", "markdown": "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/wpconsent/index.md", "json": "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/wpconsent/index.json" }, { "language": "nl", "hreflang": "nl-NL", "title": "WPConsent", "url": "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/wpconsent/", "markdown": "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/wpconsent/index.md", "json": "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/wpconsent/index.json" } ], "headings": [ { "level": 1, "text": "WPConsent" }, { "level": 2, "text": "What WPConsent does on your site" }, { "level": 2, "text": "Which sites WPConsent suits best" }, { "level": 2, "text": "WPConsent strengths and limitations" }, { "level": 3, "text": "Strengths" }, { "level": 3, "text": "Limitations" }, { "level": 2, "text": "The WPConsent settings we recommend" }, { "level": 2, "text": "WPConsent security: an XSS flaw tied to script blocking" }, { "level": 2, "text": "WPConsent FAQ", "id": "faq" } ], "body": "## The essentials\n\n- Best for blogs and business sites that want to block Analytics and Meta Pixel before consent, for free.\n- Main caveat: consent logs and multilingual banners require a paid plan.\n- Free; Pro starts at $99 per year for one site, discounted the first year, then full price.\n\n## What WPConsent does on your site\n\nWPConsent shows a cookie consent banner and holds back tracking scripts until the visitor agrees. Its automatic blocking recognizes the most common services (Google Analytics, Google Ads, Google Tag Manager, Meta Pixel, Microsoft Clarity, the Pinterest tag and more) without you changing how they are installed. YouTube, Vimeo and DailyMotion videos, Google Maps and reCAPTCHA are swapped for a placeholder until consent is given.\n\nA scanner builds an inventory of the services and cookies on your site, and a Cookie Inspector walks your pages as a first-time visitor to show each cookie the moment it is set. The plugin generates a cookie policy page with an up-to-date table, sends Google Consent Mode v2 and Clarity consent signals, can honor the browser’s Global Privacy Control (GPC) signal and shares consent state with other plugins through the WP Consent API. The banner is isolated from your theme in a Shadow DOM.\n\nThe vendor, WPConsent LLC, comes from the team behind WPBeginner, WPForms, All in One SEO, MonsterInsights and [WPCode](https://www.wp-masquerade.com/features/camouflaged-plugins/wpcode/). The plugin is young (listed on wordpress.org in late 2024). Visitor choices stay in your own WordPress database; WPConsent Pro, a yearly subscription, adds consent logs, geolocation, the IAB TCF v2.3 advertising framework and multilingual banners, among other things.\n\n![Diagram: WPConsent works on visitors and bots, wordpress, database and files. Public traces: folder name (hidden with Pro); tag IDs (hidden with Pro); JavaScript variables (still visible); CSS classes (still visible); cookies (still visible).](https://www.wp-masquerade.com/media/wpm-sheets/wpconsent/diagram-en.svg?v=005ca317)\n\n## Which sites WPConsent suits best\n\nWPConsent fits best when you want real prior blocking without a consent service hosted somewhere else:\n\n- **Blogs and business sites running Google Analytics or Meta Pixel**: the free version blocks these scripts before consent and handles Google Consent Mode v2.\n- **Sites heavy on videos and maps**: embedded content is blocked and replaced with placeholders, no code needed.\n- **Agencies**: the paid plans cover 1 to 100 sites, with no pageview or scan limits.\n\nIt is not the best free option if you need proof of every consent (logs are paid), if your banner has to work in several languages (the Languages tab is Pro only) or if you live off programmatic ads, which require IAB TCF, also paid. In those cases, compare it with [Complianz](https://www.wp-masquerade.com/features/camouflaged-plugins/complianz/) or [CookieYes](https://www.wp-masquerade.com/features/camouflaged-plugins/cookieyes/).\n\n## WPConsent strengths and limitations\n\n### Strengths\n\n- **Automatic blocking of common scripts.** Analytics, Google Ads, Tag Manager, Meta Pixel and Clarity wait for consent, without reinstalling your tags.\n- **A capable free version.** The scanner, Cookie Inspector, cookie policy, Google Consent Mode v2, GPC and embed blocking are all free.\n- **Consent stored on your site.** Visitor choices stay in your WordPress database, and the paid plans have no pageview caps.\n- **A light, isolated banner.** Its styles live in a Shadow DOM, and its stylesheet loads only when the banner actually needs to appear.\n\n### Limitations\n\n- **Consent logs cost extra.** Keeping proof of each choice requires at least the Basic plan.\n- **Multilingual is paid.** The Languages tab is locked in the free version; automatic translations and the “Do Not Sell” addon start with the Plus plan.\n- **The scanner goes through the vendor.** Scans call WPConsent’s online service, which receives the addresses of the pages being scanned.\n- **A young plugin.** Released in late 2024, it has a shorter track record than its rivals, and a high-severity XSS flaw was fixed in October 2026.\n\n## The WPConsent settings we recommend\n\nAll of these settings exist in the current free version. Most of them live under WPConsent > Settings, on the “Settings” tab.\n\n| Setting | Recommended value | Why |\n| --- | --- | --- |\n| **Consent Banner** WPConsent > Settings > Settings | On | The banner is off by default; without it, neither script blocking nor Google Consent Mode loads. |\n| **Script Blocking** Same screen | On | Stops known scripts from setting cookies before consent. Run version 1.2.0 or later (see the security section). |\n| **Default Allow** Same screen | Off | When on, scripts are blocked only after a rejection (opt-out mode); GDPR requires prior opt-in consent in the EU and the UK. |\n| **Settings Button** Same screen | On | A floating button lets visitors change their choice after the banner is closed. |\n| **Google Consent Mode** Same screen, Google Consent Mode section | On if you use Google tags | Analytics and Ads tags receive the consent state instead of simply being cut off. |\n| **Content Blocking** and **Content to Block** Same screen | On, with the services you embed | Videos, maps and reCAPTCHA load only after consent; test any forms protected by reCAPTCHA. |\n| **Consent Duration** Same screen | Per your data protection authority’s guidance | How long the visitor’s choice remains valid, in days. |\n| **Respect Global Privacy Controls** WPConsent > Settings > Advanced | On | Off by default; browsers sending the GPC signal get non-essential cookies declined with no banner. |\n\n- Open your site in a private window: the banner should appear, and your browser’s developer tools should show no analytics cookie before you agree.\n- Run WPConsent > Scanner every time you add a tracking plugin, then check the category of each detected service.\n- In the “Cookie Policy” row of the settings, create the policy page with “Generate Cookie Policy Page” and link it from your footer.\n- Load a page with a YouTube video: the placeholder should stay in place until you accept.\n\n## WPConsent security: an XSS flaw tied to script blocking\n\nThe most serious known flaw is **CVE-2026-97640**, published in October 2026 and fixed in version 1.2.0. Up to version 1.1.9, a visitor without an account could post two crafted comments to run a script in the site’s pages (a stored [XSS vulnerability](https://www.wp-masquerade.com/glossary/xss/)), provided script blocking was turned on. Wordfence rated it 7.2 on the CVSS scale, high severity.\n\nWhat to do: check under Plugins that you run at least version 1.2.0 and turn on auto-updates for WPConsent (see our guide to plugin auto-updates). WP Masquerade Pro removes the plugin folder and its file identifiers from your page addresses, which makes it harder for bots hunting this kind of flaw to spot it; the banner’s classes and cookie stay visible, and this is no substitute for the patch.\n\n## WPConsent FAQ\n\n**Is the free version of WPConsent enough?**\n\nFor a single-language site that simply needs to block its scripts before consent, often yes: the banner, blocking, scanner, cookie policy, Google Consent Mode v2 and GPC are free. You need a paid plan for consent logs, geolocation, IAB TCF or a multilingual banner.\n\n**Where does WPConsent store consent?**\n\nIn your WordPress site’s database, not on the vendor’s servers. Only the cookie scanner calls WPConsent’s online service to analyze your pages.\n\n**How much does WPConsent Pro cost?**\n\nThe pricing page lists, in US dollars per year, $99 for one site (Basic), $199 for 5 sites (Plus), $399 for 25 sites (Pro) and $599 for 100 sites (Elite). A discount applies to the first year, renewals are at full price, and the vendor offers refunds within 14 days.\n\n**Can I run WPConsent alongside another cookie plugin?**\n\nWe advise against it: two banners and two blocking systems can contradict each other and muddle the visitor’s choice. Deactivate the old plugin before turning on the WPConsent banner.\n\n**Does WPConsent make my site GDPR compliant?**\n\nNo plugin can guarantee that, and the vendor says so itself. WPConsent provides the tools (prior blocking, per-category choices, a cookie policy); configuring them and meeting the rest of your obligations remain your responsibility.\n\n## Key facts\n\n- Category: Cookies and GDPR\n- Vendor: WPConsent LLC\n- Price: Free; WPConsent Pro from $99 per year for one site (Basic plan)\n- Active installations (wordpress.org): 200 000+\n- Version: 1.2.0\n- Official page: https://wordpress.org/plugins/wpconsent-cookies-banner-privacy-suite/\n\n## What WP Masquerade hides\n\n- Handled by WP Masquerade Pro only\n- With Pro: folder name, tag IDs\n- Still visible: JavaScript variables, CSS classes, cookies", "catalog": "wpconsent", "essentials": [ "Best for blogs and business sites that want to block Analytics and Meta Pixel before consent, for free.", "Main caveat: consent logs and multilingual banners require a paid plan.", "Free; Pro starts at $99 per year for one site, discounted the first year, then full price." ], "format": "application/json" }