To be compliant on WordPress you need a banner that truly blocks non-essential scripts until consent, not just one that paints a message over trackers that already fired. Many free plugins only do the second. The simplest robust path is a single banner script that holds Analytics, pixels and other trackers until acceptance and sends the Google Consent Mode v2 signals — then you verify the result with a free scan.
Why do most free plugins not make you compliant?
Most "cookie notice" plugins in the WordPress directory do one thing: paint a message. The banner appears, you click, the message disappears — but the trackers already fired on page load.
That breaks the core rule of Law 506/2004: consent must be obtained before the non-essential cookie is set. A banner that only informs, without blocking, is legally decorative.
The check is simple: open the browser's Network tab before touching the banner. If you see requests to google-analytics.com, facebook.net or ad networks before any click, your plugin paints, it does not block. A free scan runs the same test automatically.
What does "real blocking" mean?
Real blocking means non-essential scripts do not execute at all until the visitor accepts that category. The difference, in short:
| Behaviour | Only shows a message | Real blocking |
|---|---|---|
| When Analytics fires | On page load, before the click | Only after acceptance |
| Marketing pixel | Fires anyway | Held until consent |
| Consent Mode v2 signals | Usually absent | All four, updated on choice |
| Legal status | Non-compliant | Compliant |
A serious CMP blocks everything non-essential by default and unblocks by category based on the banner choice — while also sending ad_storage, analytics_storage, ad_user_data, ad_personalization to Google.
The one-script approach (works with any theme)
You do not need a dedicated plugin for every builder. The most portable method is a single banner script added to the <head>, which works the same regardless of theme, Elementor, Divi or Gutenberg:
- Get the banner script from your chosen CMP (a single
<script>line carrying your site key). - Add it to the
<head>— via an "insert headers and footers" plugin or directly in your child theme'sheader.php. - Let the CMP manage the trackers: move Analytics, pixels and GTM under its control so they stay blocked until consent.
- Publish the cookie policy generated from what the site actually sets, in Romanian and English if your audience is mixed.
FewCookies works exactly this way: one script line, real blocking, all four Consent Mode v2 signals and hosted bilingual policies, at €6/month tax included and a 7-day trial without a card.
What gotchas come up on WordPress?
Even with real blocking, a few WordPress quirks can sabotage your result:
- Caching plugins (WP Rocket, LiteSpeed, W3 Total Cache): clear the cache after installing the banner, otherwise visitors get the old page without it.
- Google Tag Manager: if GTM loads your tags, it must be placed under consent control — otherwise it injects the trackers regardless of the banner.
- Embedded YouTube and maps: a YouTube
<iframe>sets cookies on render. Use "privacy-enhanced" mode or let the CMP block the embed until acceptance. - Chat, heatmaps, external fonts: all can set cookies or send data; treat them as non-essential until you prove otherwise.
After configuring, always test with a free scan: if nothing non-essential fires before the click any more, you are compliant. If you want to compare other tools too, see the honest list of CMP platforms for 2026.
Frequently asked questions
Can I use a free cookie plugin on WordPress?
You can, if that plugin actually blocks non-essential scripts until consent and makes rejecting as easy as accepting. Many free plugins only show a message and let trackers fire, which does not make you compliant. Test with a scan, not by looks.
Why does the caching plugin matter for the cookie banner?
Caching plugins serve a saved version of the page, so a page generated before you installed the banner will be delivered without it. Clear the cache after any banner change and verify in a private window that it appears correctly.
Does embedded YouTube need consent?
Yes, a standard YouTube iframe sets cookies on render, so it falls into the non-essential category. Use "privacy-enhanced" mode (youtube-nocookie.com) or let the CMP block the embed from loading until the visitor accepts.
Want to see which cookies and trackers fire on your site before consent? The scan is free and needs no account. Check your site for free →