| 开发者 |
riptight
danjed |
|---|---|
| 更新时间 | 2026年9月18日 13:49 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 7.1 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
window.cookrConsent)WP_HTML_Tag_Processor before delivery to the browser. Matching script and iframe tags are neutralised server-side and restored only after the visitor grants consent.
There is no client-side race condition because blocking happens before the browser receives the page.
Reliability
Your consent choices are applied precisely — analytics, marketing, and external media are gated independently, with no mixups between categories. You can withdraw consent at any time; it takes effect starting with your next page load.
COOKR is safe to use with page caching. The server-rendered HTML is always consent-neutral — a cached page never carries one visitor's consent-based content into another visitor's response.
If COOKR encounters an internal enforcement failure, it fails closed rather than silently serving unblocked trackers.
Scope of Enforcement
COOKR blocks known trackers that are present in the server-rendered HTML as standard external <script src> or <iframe> elements, before the visitor's browser ever receives them.
It does not intercept arbitrary JavaScript behaviour at runtime. This includes: scripts and iframes created dynamically after page load, document.write()-based script injection, and tracker requests proxied through a first-party URL — COOKR matches known third-party hostnames, so a same-origin proxy path is invisible to that classification regardless of what it forwards to server-side.
One consequence worth knowing specifically: once a tag manager such as Google Tag Manager is itself permitted to run (its own <script src> was consented to and restored), whatever tags that container subsequently injects at runtime are outside COOKR's enforcement scope. Configuring consent-aware tag firing inside the tag manager itself remains the site owner's responsibility.
These are architectural limits of a server-side, markup-level blocker, not partial results. If your site loads trackers through any of the paths above, COOKR will not enforce consent on them — migrate them to standard external <script src>/<iframe> markup to bring them into scope.
Auto-Blocker
Enable in Settings. Off by default.
When enabled, COOKR rewrites matching script tags and iframe tags server-side — setting type="text/plain" and preserving original attributes in data-cookr-* attributes for restoration after consent.
Test after enabling when using WP Rocket, LiteSpeed Cache, NitroPack, or Cloudflare Rocket Loader.
Runtime Inspector
The Runtime Inspector exposes third-party runtime activity directly in the browser — blocked scripts, restored services, iframe activity, detected domains.
Enable in Settings. Append ?cookr_debug=1 to any frontend URL while logged in as administrator.
Compatibility
COOKR is verified compatible with WP Rocket and Autoptimize. It is partially verified with LiteSpeed Cache — see the Compatibility Center for exactly which parts are confirmed. For other caching and optimization plugins, check your own site's Compatibility Center before assuming full compatibility.
CSP-aware
COOKR never sends its own Content-Security-Policy header. It supports strict Content-Security-Policy setups without requiring unsafe-inline, provided your CSP layer supplies a nonce through the cookr_csp_nonce filter.
If your site runs a nonce-based script-src policy, hook the cookr_csp_nonce filter once with the nonce your CSP layer already generates for the response:
add_filter( 'cookr_csp_nonce', function () { return my_csp_plugin_get_nonce(); } );
COOKR then applies that single nonce consistently to its own scripts and to every dynamically-restored, consented tracker script. Without a hooked cookr_csp_nonce provider, COOKR's own scripts and any restored tracker scripts will be blocked by a strict script-src policy with no 'unsafe-inline' — the Diagnostics self-test reports this explicitly (CSP nonce: pass/warn) rather than silently assuming it works.
Developer JS API
cookrConsent.has('analytics')
cookrConsent.require('marketing', callback)
cookrConsent.whenConsented('analytics').then(fn)
cookrConsent.on('consent' | 'change' | 'decline' | 'reset', handler)
cookrConsent.off(event, handler)
cookrConsent.getConsent()
cookrConsent.getExpiry()
cookrConsent.categories()
cookrConsent.reset()
Consent Categories
<script src> or <iframe> element. Examples: Google Tag Manager, Meta Pixel, YouTube embeds, TikTok Analytics.
What about tags Google Tag Manager loads on its own?
COOKR gates GTM's own <script src> load — GTM itself will not run before consent. Once a visitor consents and GTM is restored, tags that GTM subsequently injects at runtime are outside COOKR's enforcement scope; that's a tag manager configuration question, not something a markup-level blocker can see. See "Scope of Enforcement" above for the full picture.
Does COOKR support Google Consent Mode v2?
Yes. Enable in settings when using GTM or GA4.
How do I inspect runtime activity?
Enable the Runtime Inspector in settings and append ?cookr_debug=1 to any frontend URL while logged in as administrator.
Does COOKR store personal data?
The consent log stores a hashed IP (not the raw IP address), consent choices, and a timestamp. The raw IP address is never stored.
Is COOKR compatible with strict CSP?
Yes, if your site's CSP layer supplies a nonce. COOKR does not generate or send its own CSP, and it cannot see a nonce your CSP-generating plugin creates unless you connect the two: hook the cookr_csp_nonce filter once to return that nonce. COOKR then applies it consistently to its own scripts and to every dynamically-restored, consented tracker script. Without that filter hooked, a strict script-src policy with no 'unsafe-inline' will block COOKR's own scripts as well as any restored trackers — check Settings → Diagnostics, which reports the CSP nonce check explicitly rather than assuming success.
Will COOKR work with caching plugins such as LiteSpeed Cache, WP Rocket, or Cloudflare?
Yes, but always test after enabling script optimization features such as JavaScript combine, defer, delay, or Rocket Loader. COOKR performs script blocking server-side, but aggressive optimization plugins may alter script delivery and should be verified on your site.
COOKR automatically excludes itself and the tracker scripts it blocks from LiteSpeed Cache, WP Rocket, Autoptimize, and FlyingPress's JavaScript optimization pipelines — no configuration required. Check the Compatibility Center (COOKR → Compatibility) for the current tested/verified status of your specific stack.
Does COOKR require HTTPS?
Yes. COOKR requires HTTPS for consent state to persist correctly across page loads. Modern browsers restrict cookie behaviour on HTTP origins — on HTTP, the consent cookie may not persist, causing the banner to reappear on every page load. HTTPS is also a legal recommendation under GDPR for any site collecting consent.
What WordPress version is required?
WordPress 6.2 or higher. COOKR uses WP_HTML_Tag_Processor for safe, attribute-aware script rewriting, introduced in WP 6.2.
cookr_csp_nonce requirement up front rather than reading as automatic. No functional changes — every claim added here already has a corresponding live Compatibility Center status, per this week's trust-testing program.cookr_fallback_events (enforcement fail-closed fallback history, introduced in 1.9.30) was missing from the uninstall cleanup list — an orphaned option left behind on a full uninstall with "preserve data" off. Found during upgrade-safety testing.WP_DEBUG_LOG (off by default in production). Found via a controlled failure test, confirmed live. Replaced with a three-stage chain: the normal rewrite, an independent emergency fallback that conservatively neutralises every cross-origin <script>/<iframe> (deliberately not reusing the classifier or parser that may have just failed), and — if even that fails — a minimal privacy-safe response with zero third-party resources instead of the original page. The Runtime Inspector's own scanning is now strictly best-effort and can never affect enforcement. A persistent, WP_DEBUG-independent admin notice and a new Diagnostics check surface if this fallback is ever triggered.script-src policy. Replaced with an explicit cookr_csp_nonce filter: site owners hook it once with the nonce their CSP layer already generates, and COOKR applies that single value consistently to its own scripts and to every restored tracker script. The Diagnostics self-test now reports pass/warn honestly instead of a permanent placeholder warning, and the CSP documentation no longer claims "no manual configuration required."aria-labelledby) with the explanatory sentence as a proper description (aria-describedby), instead of a short aria-label that silently hid it from screen readers. Fixed insufficient text contrast on the "Customise"/preferences-toggle control and the category-description text (light and dark mode). The banner dialog now carries a lang attribute matching COOKR's configured banner language (independent of the site's own <html lang>), and its title is a real heading (<h2>, referenced via aria-labelledby) instead of a plain paragraph.rocket_excluded_strings, does not exist anywhere in WP Rocket's codebase — confirmed by cloning and grepping WP Rocket's actual public source, since it has no free WP.org listing or trial to install and test against directly. Replaced with the real filters (rocket_exclude_js, rocket_exclude_defer_js, rocket_delay_js_exclusions), verified against WP Rocket's own source and its official Termly integration. Code-verified, not yet live-tested; compatibility matrix status stays UNKNOWN pending a real test/wp-content/plugins/cookr/...) — a string that only matches if the plugin folder happens to be named exactly "cookr". Every real CORE install (the actual WP.org-distributed folder name, cookr-cookie-consent-script-blocking) never matched, so these three optimizers' exclusions were silently no-ops on CORE the whole time. Now resolved dynamically via COOKR_PLUGIN_URL at runtime insteadlitespeed_optm_js_defer_exc filtergoogletagmanager.com as "analytics" regardless of which Google product it actually loaded, so a Google Ads conversion tag (gtag/js?id=AW-...) was silently gated behind Analytics consent instead of Marketing consent. The blocker now reads the tag's id parameter — AW-* is classified as marketing, G-* (GA4) remains analytics, GTM containers (GTM-*) are unchanged pending a separate design decision, since a single container can load both marketing and analytics tagsassets/cookr-debug.js (the Debug Inspector script) from CORE builds, despite Debug Inspector being a documented, default-on feature in both CORE and RADR. CORE builds now correctly include this file. No functional change to this codebase itself — RADR was never affected, since it has always included the file directly from source#cookr-banner had no explicit box-sizing, so the mobile layout's width: 100% plus the banner's existing border was rendered as 100vw + border-width, causing the banner to extend ~2px past the right edge of the screen. Added box-sizing: border-box to the shared #cookr-banner, #cookr-reopen rule so the banner's total rendered width exactly matches the viewport on mobile. No visual change on desktop (320px fixed-width banner)cookr-accent--disabled class and an "Overridden by Scoped Banner Styling" message to the Theme Sync field — matching the existing accent-colour picker behaviour — but admin.css only styled this disabled state for the accent field, not the Theme Sync field. The font pills remained fully clickable and visually normal with no indication that font sync was inactive. The disabled-state styling (38% opacity, disabled pointer events, override message) now applies to both fields--cookr-accent, so cookr.css's defaults for #cookr-reopen and .cookr-switch input:checked + .cookr-slider (both driven by var(--cookr-accent)) fell through to the global accent_color setting#cookr-banner, #cookr-reopen { --cookr-accent: #00ff88; } and #cookr-reopen svg rect { fill: #000000; stroke: #00ff88; } to the preset — toggle switches and the reopen pill/dot now render in the preset's black/green theme regardless of the global accent colour setting@keyframes cookr-spin only animates transform: rotate(), but the spinner's centering also used transform: translate(-50%, -50%) — animating transform between an implicit translate(...) start and a rotate(360deg) end produced a visible jump/skip instead of a clean spin. Centering now uses top/left + negative margin, leaving transform free for rotation onlypointer-events: none). The preview is a visual reference only, not an interactive democookr_scope_css): every settings save re-sanitises the currently saved value (the textarea is repopulated with the previously-scoped output), but the selector-mirroring logic was not idempotent — an already-mirrored selector like #cookr-banner .cookr-inner would itself pass the #cookr-/.cookr- prefix check and get re-added on each save, and the .cookr-title svg icon-colour helper would re-fire for both a selector and its mirror, with both copies persisting forward. On real-world installs this had compounded over repeated saves into 150+ duplicate copies of some rules and a single selector list repeated 18 times, ballooning the saved CSS to 220KB. Selectors within each rule and the full set of emitted rules are now deduplicated (exact-string, order-preserving), making the sanitiser idempotent — re-saving now reproduces the same output instead of growing it. Existing bloated saved CSS will collapse back to its correct minimal form on the next savecookr_scope_css): a CSS comment placed directly above a rule (e.g. /* Buttons */ followed by .cookr-btn { ... }) caused the comment text to be parsed as part of the selector, failing the #cookr-/.cookr-/:root prefix check and silently dropping the entire rule with no error shown to the admin:root accent overrides and any commented/sectioned custom CSSUpdate URI header (added in 1.9.9) correctly prevents WordPress.org from offering false update notices on RADR installs