Home › Guides › WordPress cookie consent

WordPress cookie consent: block pixels until visitors accept

By the WaitForYes team · Updated November 15, 2026 · 6 min read

In short: on WordPress, trackers come from many places — plugins, theme settings, header code and Google Tag Manager. A consent plugin only protects you if it actually blocks each of them until the visitor accepts, and if U.S. visitors see the banner.

Step 1 — List what loads before consent

Start with a free scan of your home page. Then find the source of each tool:

Plugins: pixel plugins, "Site Kit by Google", MonsterInsights, WooCommerce marketing extensions, chat and heatmap plugins.
Theme or header code: Appearance → Theme File Editor, or "Header & Footer scripts" plugins.
Google Tag Manager: one GTM container can load Meta, TikTok, Clarity and more.

Step 2 — Use a consent plugin that blocks scripts

Popular options include CookieYes and Complianz. Whichever you choose, check these settings:

Script blocking is on (automatic or manual).
The banner is shown to U.S. visitors, with opt-in (Accept / Decline) for marketing and analytics.
Google Consent Mode v2 is enabled if you use Google tags.
Each detected script is assigned to a category (marketing, analytics, functional).

Step 3 — If you use Google Tag Manager

Make sure the consent plugin sets Consent Mode defaults to denied before GTM loads.
In GTM, open each tag → Advanced settings → Consent settings and require ad_storage / analytics_storage as appropriate.
For non-Google tags (Meta, TikTok, Clarity), require additional consent or fire them on a "consent granted" trigger.

Step 4 — Don't forget chat and session replay

Chat and recording tools carry the highest wiretapping risk. Load them only after consent, or load chat only when a visitor clicks the chat button. Why these tools matter.

Step 5 — Purge caches and re-scan

Caching plugins and CDNs can keep serving the old page. Purge them, then scan again in a private window. Re-scan after every plugin update or new install.

Want it done for you?

We fix WordPress and WooCommerce sites for $149, with a before/after re-scan and 6 months of weekly checks.

Scan my site free See what's included

Common questions

Does a free consent plugin work?

Often, yes — the free tiers of several plugins include script blocking. The important part is configuration: U.S. visitors, opt-in, and every tracker assigned to a category.

Site Kit by Google added GA4. Is it covered?

Site Kit supports Consent Mode when paired with a compatible consent plugin. Turn that integration on and confirm with a scan that Google tags respect the default.

Why do trackers still load after I installed the plugin?

Usually caching, a tag inside Google Tag Manager, or code hard-coded in the theme. Purge caches and check GTM consent settings.