Converta Cookie Banner

GDPR/ePrivacy cookie consent banner for WordPress with Google Consent Mode v2, a built-in cookie scanner, consent statistics dashboard, full design customizer, and translations in 6 languages.

Version: 1.9.0 · License: GPL v2 or later · Author: Converta

Features

• Google Consent Mode v2 — pushes consent default (all denied except security_storage) and, for returning visitors, consent update before Google Tag Manager loads, no matter how GTM is installed (theme header.php, another plugin, wp_head, hardcoded snippet). The script is injected as the very first script after <head> via output buffering, with an early wp_head fallback.
• Consent categories — Necessary (always on), Analytics/Statistics, Marketing — with per-category cookie tables in the preferences panel.
• Cookie scanner — crawls up to 100 pages of your site, detects cookies and known tracking scripts, plus a one-click "Quick Add" library for common platforms. Fully editable cookie list.
• Statistics dashboard — accept/reject/custom rates, unique visitors, daily trend charts (Chart.js), selectable period (7/30/90/365 days). Consent actions are logged with a salted SHA-256 visitor hash (no raw IPs stored).
• Design customizer — every color, corner radius, and font size, with live preview.
• Translations — English, French, German, Italian, Romanian, Spanish. Language detection via URL subfolder (/fr/, /de/…) or the <html lang> attribute (WPML, Polylang, TranslatePress compatible), with a configurable fallback.
• Reopen consent (GDPR requirement) — choose how visitors change their mind later:
  • Floating icon — small round button fixed bottom-left (default)
  • Footer link — a discreet translated text link ("Cookie Settings" / "Paramètres des cookies" / "Cookie-Einstellungen" / …) at the bottom of every page
  • Both
  • Plus a shortcode [pcc_consent_link] (optional text="…" attribute) and support for adding the CSS class pcc-plink to any link or menu item (the old pcc-consent-link class keeps working) — these work with every option above.
• dataLayer events — fires cookie_necessary, cookie_analytics, cookie_marketing, cookie_functional events for GTM triggers based on the granted categories, on every page load for returning visitors.

Installation

1. Download this repository as a ZIP (or grab a release ZIP).
2. In WordPress admin go to Plugins → Add New → Upload Plugin and upload the ZIP.
3. Activate. The banner appears immediately for visitors without a consent cookie.
4. Configure under the Cookie Consent admin menu:
   • Statistics — consent analytics dashboard
   • Cookie Scanner — scan your site and manage the cookie list
   • Banner Design — colors, sizes, and the Reopen Consent method
   • Translations — language detection and all banner texts

Updates — no more zip uploads

Once installed, the plugin updates itself directly from this GitHub repository (main branch) using WordPress's native update mechanism: when a newer version is pushed here, a standard "Update available" notice appears on the site's Plugins page. While the repository is private, paste a GitHub personal access token (read access to this repo) in Banner Design → Plugin Updates from GitHub; a public repository needs no token.

Google Tag Manager setup

The plugin handles the consent side; in GTM you can use these dataLayer events as triggers for tags that must wait for consent:

Consent Mode mapping: Marketing → ad_storage, ad_user_data, ad_personalization, personalization_storage; Statistics → analytics_storage; security_storage is always granted.

Verify with Google Tag Assistant: Consent Default must appear before GTM's Consent Initialization event.

Data & privacy

• Consent choices are stored in a first-party cookie procab_cookie_consent (365 days, SameSite=Lax; Secure).
• Consent actions are logged to a custom table (wp_pcc_consent_log) with a salted hash — no raw IP addresses.
• Uninstalling the plugin drops the log table and deletes all plugin options.

Changelog

1.9.0

• Self-updates from GitHub: the plugin now uses WordPress's native Update URI mechanism to check this repository's main branch for new versions and offers them as normal one-click updates on the Plugins page — no manual zip uploads. New "Plugin Updates from GitHub" section on the Banner Design page shows the update status and accepts an optional GitHub token for private-repo access.

1.8.0

• New Google Tag Manager blocking mode option (Banner Design page):
  • Advanced Consent Mode (default) — GTM loads immediately on every page; Consent Mode signals keep Google tags cookieless until consent (best data quality, enables GA4 behavioral modeling). This is the plugin's existing behavior, now explicit.
  • Basic Consent Mode (hard block) — every script referencing googletagmanager.com is neutralized (type="text/plain") server-side and only executed after the visitor grants Statistics or Marketing consent (immediately on later visits for visitors who already granted).

1.7.0

• Ad-blocker hardening (Brave, uBlock Origin, AdGuard): the banner was invisible for visitors with cookie-notice-blocking filters enabled, because (a) the plugin's asset URLs contain "cookie-banner" and were blocked by network filters, and (b) its element ids/classes (pcc-cookie-banner, pcc-consent-link, …) matched cosmetic hiding filters. Fixes:
  • Frontend CSS and JS are now inlined into the page — no external plugin asset URLs to block
  • All frontend ids/classes renamed to neutral names with no "cookie"/"consent"/"banner" words (pcc-ui-card, pcc-ui-overlay, pcc-plink, …)
  • AJAX action renamed pcc_get_banner → pcc_load_ui (old name kept as alias)
  • Neutral aria-label/title attributes
  • Manually placed links with the old pcc-consent-link class are automatically migrated to pcc-plink at runtime — existing menu items keep working

1.6.1

• Corrected plugin/author URLs to converta.ro

1.6.0

• SEO: zero banner markup in the page HTML. The banner's texts (headings, category descriptions, buttons) are no longer rendered server-side on every page — they were appearing as duplicate content in the source of every URL. The markup is now fetched via AJAX (pcc_get_banner) and injected client-side by banner.js. Language detection still works: the page's path and <html lang> are passed along with the request.
• All banner containers carry data-nosnippet, so search engines never use banner text in snippets.
• Consent Mode default/update in <head> and the dataLayer events are unchanged — GTM behavior is identical.

1.5.4

• Universal footer detection for custom/hand-coded footers: when no WordPress footer menu or copyright row is found, the consent link is inserted right after the last link inside the page's <footer> element, inheriting its styling — works with any theme or custom-built page

1.5.3

• If a consent link is placed manually (menu item with the pcc-consent-link class, shortcode, or widget), the automatic footer link steps aside — no duplicates

1.5.2

• Footer link is now theme-aware: it automatically inserts itself into the theme's own footer links area — the footer menu (last menu in the footer, e.g. next to "Contact · Blog") or, failing that, the copyright/site-info row — inheriting the theme's link styling. The standalone bottom bar remains only as a fallback for themes with no footer links area.

1.5.1

• Floating icon now shows a cookie symbol and is hardened against theme button styles (!important on size, padding, and border-radius: 50%), so it stays perfectly round in any theme
• Footer consent link now has a solid background bar (banner background color), so it is legible over theme background images and no longer exposes a strip of the body background below the footer

1.5.0

• New Reopen Consent option (Banner Design page): floating icon, translated footer link, or both
• New [pcc_consent_link] shortcode and pcc-consent-link CSS class for placing a consent link anywhere (footer menu, widget, privacy page)
• New translatable string "Consent Reopen Link Text" in all 6 languages

1.4.0

• Consent Mode default + update now injected as the first script in <head> via output buffering, guaranteeing it runs before GTM regardless of how the container snippet is installed
• JS guard against double injection; skips feeds, REST, AJAX, embeds, and non-HTML output

1.3.1

• Cookie scanner, statistics dashboard, design customizer, 6-language translations, Consent Mode v2 baseline