Description
Cookie Rocket is a WordPress cookie consent banner that blocks Google Analytics, Meta Pixel, Hotjar and other third-party tracking scripts until the visitor consents, with Google Consent Mode v2, a cookie scanner and a consent log included in the free version. It is for any site that has to comply with GDPR, CCPA / CPRA, LGPD (Brazil) or LFPDPPP (Mexico), each with its own banner wording and consent rules, selectable per site.
It is a fully self-hosted alternative to cloud cookie-consent services: no account, no monthly SaaS fee, and your visitors’ browsers never call an outside server. Real script blocking, Google Consent Mode v2 and on-demand cookie scanning are free here — features that comparable consent tools typically gate behind a paid plan or a remote service.
- Automatic script blocking: common third-party trackers (Google Analytics, Meta Pixel, Hotjar, Microsoft Clarity, LinkedIn, TikTok and more) are blocked until consent, with Google Consent Mode v2 built in.
- Built-in cookie scanner: detect on demand which known tracking services are present on your site and the cookies they set.
- Automatic cookie policy / cookie declaration: a single shortcode (or one-click page) publishes a table of every cookie your site uses — provider, purpose and duration — grouped by category and updated from your scans.
- Consent audit log with an admin viewer: every consent decision is recorded and browsable for compliance.
- Editable cookie categories: rename, re-describe and reorder the categories shown on the banner.
- Unified Cookie Banner editor: layout, content (text and labels) and colors, all in one place.
- Zero external scripts and zero CDN dependencies — everything is served from your own site.
- Framework selector: GDPR, CCPA / CPRA, LGPD (Brazil) and LFPDPPP (Mexico), each with its own banner wording and consent behavior.
- 100% local — no consent data is sent to third-party servers.
- WooCommerce aware: respects shop pages and checkout.
- Fully customizable colors, fonts sizes, copy and banner position.
- WCAG 2.1 AA accessible: keyboard navigation, focus states, ARIA labels.
- Multisite compatible.
- Five banner layouts: bottom bar, top bar, floating card, modal and drawer.
Shortcodes
[cookie-rocket-preferences]— renders a button that re-opens the cookie preferences modal.[cookie-rocket-withdraw]— renders a link that withdraws consent and clears stored preferences.[cookie_rocket_policy]— renders the automatic cookie declaration table (provider, purpose and duration per cookie, grouped by category).
External services
This plugin connects to one outside service, and only from your admin, never from your visitors’ browsers:
- Deactivation feedback (Templates Rocket). When you deactivate the plugin you are offered a short, optional form asking why. Only if you choose a reason and press “Submit & deactivate” does the plugin send it to
https://templatesrocket.com/cr-feedback/: the reason, the text you typed (if any), and the Cookie Rocket, WordPress and PHP versions and the site language. No site address, no visitor data and no consent records are sent. Pressing “Skip & deactivate” sends nothing. Provided by Templates Rocket: terms of service, privacy policy.
Cookie Rocket Pro
Cookie Rocket Pro is a commercial extension built on top of the free plugin. It adds:
- A catalog of 76 recognized services covering 340 cookies. Every cookie comes with its purpose and duration already written, so the cookie declaration table fills itself in from a scan. The free version recognizes 34 services; anything else is described by hand under Your own services.
- Rules per region. Each visitor gets the law of their country, also behind page caching: GDPR in Europe, CCPA / CPRA in the United States, LFPDPPP in Mexico and LGPD in Brazil, each with its own consent model, Reject button, consent duration and banner text. Global Privacy Control is honored.
- Google Consent Mode advanced and Google Tag Manager. Google Ads and GA4 keep modeling conversions while consent is denied, and the Tag Manager container is added with consent already wired.
- A tamper-evident consent ledger. Every record is sealed and chained to the previous one, with CSV export and a one-click evidence report.
- A deeper scan, every month. The crawl goes beyond the key pages, and a monthly re-scan emails you when a new tracker appears.
- Premium styles and finishes. Glass, Branded, Frosted and Frosted Dark styles, a blurred backdrop, border color and thickness, shadow intensity, button text size and weight, spacing, and a reopen button made your way (text, icon or both, icon, side, distance, colors, shape, size and shadow).
- Latin America pack. A generated privacy notice for Mexico and Brazil and a self-hosted ARCO / DSAR rights request channel.
Cookie Rocket Pro is available at templatesrocket.com. The free version published here is fully functional and does not require the Pro plugin to work.
Screenshots
Installation
- Upload the
cookie-rocketfolder to the/wp-content/plugins/directory, or install the plugin through the WordPress plugins screen directly. - Activate the plugin through the Plugins screen in WordPress.
- Go to Cookie Rocket in the admin menu and answer one question: where your visitors come from. Nothing changes on your site until you answer; then the banner, the blocking and your cookie policy start in one click.
- Optionally, place the
[cookie-rocket-preferences]shortcode in your privacy policy page to let visitors update their choices at any time.
FAQ
-
Does this plugin send any data to external services?
-
Not about your visitors. Cookie Rocket stores consent in the visitor’s browser (cookie + localStorage) and logs events to your own WordPress database; your visitors never generate a request to an outside server. The one exception is in your admin and only if you choose it: the optional feedback form shown when you deactivate the plugin. See “External services” below.
-
Because a banner that really blocks keeps Google Analytics off until the visitor’s law allows it: where visitors must be asked first, those who do not answer or say no are not counted. They are still on your site; Analytics just cannot see them. Cookie Rocket tells you before it starts, in the answer you choose, and Status Reach Google Analytics shows how many of every 100 page views reach Analytics, why the rest does not, how to measure more where the law allows it, and the date of every change to your rules, so a drop can be matched to its cause. That figure comes from an anonymous daily count on your own site: no cookie, no IP address and no identifier is stored.
-
Is it compatible with caching plugins?
-
Yes. The banner state is read from a first-party cookie, so caching (page cache, object cache, CDN) does not interfere with consent storage or display.
-
Does it block third-party scripts automatically?
-
Yes. The free version automatically blocks the most common third-party tracking scripts — Google Analytics, Meta (Facebook) Pixel, Hotjar, Microsoft Clarity, LinkedIn, TikTok, Google Ads and more — until the visitor accepts the matching cookie category, and it ships Google Consent Mode v2 (default denied) out of the box. Enqueued scripts are blocked by default; an optional setting also blocks scripts pasted directly into your theme or header. Cookie Rocket Pro adds scheduled monthly re-scans that email you when a new tracker appears, plus Google Consent Mode advanced, so Google can model the visits and conversions it loses to non-consent.
-
Is it translation-ready?
-
Yes. The text domain is
cookie-rocketand a complete.potfile is included under/languages/. All banner and modal strings are wrapped for translation. The plugin ships in English by default with Spanish (es_ES) and Brazilian Portuguese (pt_BR) translations bundled, applied automatically on matching locales. WordPress also loads community translations for plugins hosted on WordPress.org, and you can translate the banner yourself with Loco Translate or Poedit, or via WPML/Polylang. -
Yes. Add the
[cookie_rocket_policy]shortcode to any page, or go to Cookie Rocket Cookie Policy and create the page in one click. It publishes a cookie declaration table — each cookie with its provider, purpose and duration, grouped by category — built from your latest scan plus a built-in catalog of the most common third-party cookies. Strictly-necessary cookies are always listed, and the table updates automatically as you re-scan. -
Does it work on WordPress Multisite?
-
Yes. Each site stores its own settings. Activate per-site or network-activate from the network admin.
Reviews
There are no reviews for this plugin.
Contributors & Developers
“Cookie Rocket, Cookie Consent Banner and Script Blocker for GDPR, CCPA and LGPD” is open source software. The following people have contributed to this plugin.
Contributors
“Cookie Rocket, Cookie Consent Banner and Script Blocker for GDPR, CCPA and LGPD” has been translated into 3 locales. Thank you to the translators for their contributions.
Interested in development?
Browse the code, check out the SVN repository, or subscribe to the development log by RSS.
Changelog
2.16.7
Rules that fit where your visitors are. A new install asks “Where do your visitors come from?”. From several countries, the recommended answer, visitors in the EU, the EEA, the UK, Switzerland and Brazil are asked first under their own law, and everyone else is measured from their first visit with Reject on screen. The country comes from the visitor’s time zone, in their browser, so it works behind a page cache.
* Mexico: the LFPDPPP (2025) takes tacit consent for data that is neither sensitive nor financial, so a Mexican site can measure until the visitor rejects. The banner then says so and points to your privacy notice.
* Under opt-out, the banner text says the cookies are active until the visitor rejects them.
* A site that runs opt-out never applies it to visitors from the EU, the EEA, the UK, Switzerland or Brazil.
* Status offers the recommended rules to sites set up before, and changes nothing until you apply them.
* New optional “Statistics only” button, with the same look as Reject and Accept: accepts measurement and nothing else. Off unless you turn it on.
* The time-zone map now covers every US time zone and their older names.
* Nothing changes on a new site until you answer. The banner and the blocking start when you say where your visitors come from, and each answer tells you what it does to Google Analytics.
* Status Reach Google Analytics: the share of page views Analytics can count, and a screen with why the rest does not, how to measure more, and the date of every change to your rules. An anonymous daily count on your own site, with no cookie, IP address or identifier.
* Sites already running Cookie Rocket keep working exactly as before after the update.
2.16.6
Older release notes are available in the plugin’s development history on WordPress.org.