High6 Cookie Consent

Free, self-contained GDPR cookie consent. Banner, preference center, script auto-blocking, first-party cookies, consent logging — no cloud, no paywall.

Description

High6 Cookie Consent is a complete GDPR/ePrivacy consent solution that runs 100% on your own server. Every feature works out of the box — there is no account to connect, no cloud dashboard, and no premium tier.

Features

• Consent banner + preference center — Accept All / Reject All / Customize with equal prominence (ICO-compliant), 4 banner positions, fully customizable texts and colors.
• Generates its own first-party cookies — no third-party consent domains:
  • h6cc_consent — JSON payload with consent version, timestamp, anonymous ID, and per-category choices.
  • h6cc_consent_{category} — simple yes/no cookies per category (readable by caches, Varnish, or server code).
  • h6cc_consent_id — anonymous UUID v4 identifying the consent record.
• 5 consent categories — Necessary, Preferences, Analytics, Marketing, Embedded Content. Enable/disable and edit each one.
• Automatic script & iframe blocking — known trackers (Google Analytics, GTM, Meta Pixel, TikTok, Hotjar, Clarity…) and embeds (YouTube, Vimeo, Google Maps, Spotify…) are neutralized until consent. Add your own pattern|category rules in the admin.
• Page builder safe — blocking is skipped entirely inside Divi, Elementor, Beaver Builder, WPBakery, Oxygen, Brizy, Thrive, the Customizer and post previews, so editors always load normally.
• Embed placeholders — blocked iframes show an "Accept & show content" placeholder, so visitors can grant just that category inline.
• Google Consent Mode v2 — default-denied signals before gtag/GTM load, updated instantly on user choice.
• Local consent logging — anonymized proof of consent (salted IP hash, consent ID, choices, version) stored in your own database, with CSV export. No data ever leaves your server.
• Consent versioning & expiry — bump the consent version to re-ask every visitor after a policy change; consent auto-expires (default 365 days).
• Shortcodes — [h6cc_cookie_policy], [h6cc_settings_link], [h6cc_consent_status].
• Developer API — PHP: h6cc_has_consent( 'analytics' ). JS: window.h6ccConsent.has('analytics'), .openPreferences(), .withdraw(), plus a h6cc:consent DOM event.

Manual script blocking

Wrap any script yourself to gate it behind a category:

``

Exclude a tag from auto-blocking with data-h6cc-ignore.

How auto-blocking matches

Patterns are plain case-insensitive substrings, matched against the narrowest text that can identify a tracker:

• Tags with a src (external scripts, iframes) — matched against the src URL only.
• Inline scripts — matched against the script body only. Bodies larger than 8 KB and non-JavaScript types (application/json, text/template…) are skipped, since page builders and wp_localize_script emit large data blobs whose contents can coincidentally mention a blocked domain.

Keep custom patterns specific — a bare word like matomo matches any URL containing it.

Filters

h6cc_is_builder_context — force the current request to be treated as a builder/preview, disabling the banner and blocking (useful for a builder this plugin does not detect).

h6cc_inline_scan_limit — byte ceiling for scanning inline script bodies. Default 8192.

h6cc_cache_safe_blocking — return false to skip rewriting for visitors who already consented. Only safe on sites with no page cache.

h6cc_cookie_domain — set the consent cookie domain (e.g. .example.com to share across subdomains).

Conditional PHP loading

if ( h6cc_has_consent( 'marketing' ) ) { /* print pixel */ }

Installation

1. Upload the high6-cookie-consent folder to /wp-content/plugins/.
2. Activate the plugin through the Plugins screen.
3. Go to Cookie Consent in the admin menu to configure the banner, categories, and blocking rules.
4. (Optional) Add [h6cc_cookie_policy] to your cookie policy page and [h6cc_settings_link] to your footer.

Frequently Asked Questions

Does this send data to any external service?

No. Consent is stored in first-party cookies in the visitor's browser and (optionally) logged to a table in your own WordPress database.

How do I force everyone to re-consent?

Bump the "Consent version" in General settings (e.g. 1.0 → 1.1). All stored consents with the old version are invalidated and the banner reappears.

How do I read consent from my theme or another plugin?

PHP: h6cc_has_consent( 'analytics' ). JavaScript: window.h6ccConsent.has( 'analytics' ) or listen for the h6cc:consent event on document.

Where is the consent log?

Cookie Consent → Consent Log tab. You can export it as CSV. IPs are stored only as salted SHA-256 hashes.

Does this work with Divi, Elementor and other page builders?

Yes. Script blocking and the banner are both disabled inside builder, Customizer and preview requests, so editors load untouched. On the public side the plugin only rewrites tags matching a blocking rule; theme and builder assets are left alone.

If a builder is not detected automatically, mark the request with the h6cc_is_builder_context filter.

A script my site needs is being blocked. How do I exclude it?

Add data-h6cc-ignore to the tag, or data-h6cc-category="..." to control which category gates it. Also check the Blocking tab for a custom pattern that is too broad.

Changelog

1.0.2

• Fixed: automatic blocking could stop page builders from loading. Builder, Customizer and preview requests are no longer processed at all, and blocking rules no longer match against the whole script tag — external tags are matched on their src URL and inline scripts on their body, so a builder's inline config data merely mentioning a blocked domain can no longer neutralize it.
• Added: h6cc_is_builder_context and h6cc_inline_scan_limit filters.

1.0.0

• Initial release: banner, preference center, first-party consent cookies, script/iframe auto-blocking, embed placeholders, Google Consent Mode v2, local consent log with CSV export, shortcodes, PHP/JS API.