Nymbl Cookie Sentinel
| 开发者 | sminec |
|---|---|
| 更新时间 | 2026年9月22日 21:35 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 7.1 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
- Consent banner: "Accept all" / "Reject all" / "Customize"
- Policy links integrated into the banner text: use the
{policy}and{privacy}placeholders in the description and the plugin turns them into real links right inside the sentence (if a placeholder is missing, links are appended after the text; if a URL is not set, the placeholder renders as plain text) - Granular settings for 4 categories: necessary (non-disableable), functional, statistical, marketing
- Script blocking until consent:
type="text/plain"+data-cookiecategory, dynamic activation after choice without page reload - Cookie table with descriptions, storage durations, domains, and third-party info; templates for WordPress, WooCommerce, Yandex.Metrika, GA4, Matomo, Facebook Pixel; CSV import
- Integrations tab (form-based, no code pasting): connect Yandex.Metrika, Google Analytics 4, Google Tag Manager, VK Pixel, Top.Mail.ru, Facebook Pixel or Matomo by entering the service ID only — the plugin generates the official counter snippet itself and keeps it blocked until consent; each integration has a category, placement (head / body / footer), load priority and an on/off toggle; every supported service is documented with links to its terms and privacy policy in the "External services" section
- Re-open settings widget
- Consent versioning: banner reappears when the cookie list or policy changes
- Accent color (Color Picker) applies to all UI elements
- Light / dark / auto theme, banner position top/bottom
- WCAG 2.1 AA: keyboard, Escape, ARIA, focus trap, contrast >= 4.5:1
- API hooks: filters
nymcs_is_category_allowedandnymcs_register_cookie, actionsnymcs_after_consent_updatedandnymcs_clear_cache, JS eventnymcs:consent-updated. The action and the JS event fire on every frontend request that carries valid consent, not only when the choice changes — if you need one-time side effects, record the fact of processing yourself. - Integrations: WooCommerce, Fluent Forms (CSRF = necessary, abandonment = statistics), Rank Math, Yoast SEO, Polylang/WPML
- Multisite: network activation creates the cookie table on every site, and new sites in the network are set up automatically
nymcs_consent) + fallback cookie for 12 months.
Security note: the plugin never accepts, stores or outputs arbitrary CSS/JS/PHP entered by users. The Integrations tab is a form: you pick a supported service and enter its ID (counter number, Measurement ID, Pixel ID…), every value is validated against a strict whitelist format, and the counter snippet is generated by the plugin programmatically.
安装:
- Upload the
nymbl-cookie-sentinelfolder to/wp-content/plugins/. - Activate the plugin in the "Plugins" section.
- Go to "Cookie Consent > General Settings" and set the cookie policy and privacy policy page URLs.
- In the "Cookie" tab, apply templates for services used by the site.
- Connect analytics in the "Integrations" tab: pick the service, enter its ID (no code needed). Custom scripts can be wrapped manually in your theme:
<script type="text/plain" data-cookiecategory="statistics" src="..."></script>
常见问题:
Does the plugin send any data to third-party services?
Not by itself. The plugin has no cloud service, no telemetry and no update server: it does not contact the plugin developer or anyone else. Only the counters and analytics that you enable yourself in the "Integrations" tab contact their services, and only after the visitor has consented to the category assigned to that integration. Before consent the snippet is printed blocked (type="text/plain") and never executed, so no request is made to the service's domain. The exact services, the data they receive and links to their terms and privacy policies are listed in the "External services" section.
Does the plugin work with caching plugins?
Yes. The markup is rendered hidden, and visibility is managed by client-side JavaScript, so page caching does not break the consent logic. In addition, the plugin automatically purges the page cache whenever settings, the cookie registry, integrations or the consent version change. Supported out of the box: LiteSpeed Cache, WP Rocket, W3 Total Cache, WP Super Cache, WP Fastest Cache, Autoptimize, Hummingbird, Breeze, SiteGround Optimizer and Cache Enabler. For any other caching layer (CDN, server-side Varnish/nginx, Cloudflare) hook into the nymcs_clear_cache action or purge it on the hosting side.
How to connect a Yandex.Metrika counter?
Open the "Integrations" tab, select "Yandex.Metrika" and enter the counter number from your Metrika account settings (e.g. 12345678). The plugin generates the official counter code itself, prints it blocked (type="text/plain") and activates it after the visitor consents to the Statistics category. Alternatively, replace type="text/javascript" with type="text/plain" in your theme code and add the data-cookiecategory="statistics" attribute.
Can I paste custom JavaScript/CSS into the plugin?
No. Following the WordPress.org plugin guidelines, the plugin does not accept, store or output arbitrary user code. The "Integrations" tab is a form: choose a supported service (Yandex.Metrika, GA4, GTM, VK Pixel, Top.Mail.ru, Facebook Pixel, Matomo) and enter its ID — the counter snippet is generated programmatically from validated values. For scripts outside this list, wrap them in your own theme/plugin code with type="text/plain" and data-cookiecategory="..."; the plugin activates such tags after consent as well.
Which services are supported in the Integrations tab?
Yandex.Metrika (with optional Webvisor), Google Analytics 4 (gtag.js), Google Tag Manager, VK Pixel (VK Ads), Top.Mail.ru, Facebook Pixel and self-hosted Matomo. Each integration accepts only the service ID, validated by a strict format (regex / integer / URL whitelist).
How to put the policy link inside the banner text?
Use placeholders in the banner description (General Settings): {policy} is replaced with the cookie policy link and {privacy} with the privacy policy link — right inside the sentence, e.g. "Learn more: {policy}." If a page URL is not set, the placeholder is shown as plain text so the sentence stays readable. If the description contains no placeholders, the links are appended after the text automatically.
更新日志:
- Documentation update requested by the WordPress.org plugin review team: added the "External services" section that lists every service which can be connected through the "Integrations" tab, what data it receives and when, and links to its terms of use and privacy policy (Yandex.Metrika, Google Analytics 4, Google Tag Manager, VK Pixel, Top.Mail.ru, Facebook Pixel, Matomo).
- Clarified that the plugin itself has no server, no telemetry, no phone-home and no external assets of its own, and that connected counter snippets are printed blocked (
type="text/plain") until the visitor consents to the matching category. - The same disclosure (domains, data sent, terms and privacy links) is now shown in the admin, on the "Integrations" tab next to the fields of each service.
- Version bump only: no functional changes to the consent logic, no changes to stored data.
- Initial release: consent banner with "Accept all" / "Reject all" / "Customize", granular settings for 4 categories, script blocking until consent with dynamic activation, admin panel, cookie table with templates, CSV import, consent versioning, compliance checklist, re-open widget, integrations (WooCommerce, Fluent Forms, Rank Math, Yoast SEO, Polylang/WPML).
- Policy links are integrated into the banner text via
{policy}/{privacy}placeholders in the description; without placeholders the links are appended after the text, and with an empty URL a placeholder renders as plain text. Link URLs are validated server-side (esc_url_raw) and re-checked client-side (http/https/relative only) before they reach the DOM. - The per-category cookie list in the settings modal is collapsible ("Show cookies (N)" with
aria-expanded), keeping the dialog compact while staying transparent. - Automatic cache purging: every frontend-affecting change (settings, cookie registry, integrations, consent version, activation) purges the page cache of supported caching plugins (LiteSpeed Cache, WP Rocket, W3 Total Cache, WP Super Cache, WP Fastest Cache, Autoptimize, Hummingbird, Breeze, SiteGround Optimizer, Cache Enabler) and fires the
nymcs_clear_cacheaction for other caching layers; each purge call is guarded and cannot break saving. - The "Integrations" tab is form-based and does not accept arbitrary code: the admin picks a supported service (Yandex.Metrika, GA4, GTM, VK Pixel, Top.Mail.ru, Facebook Pixel, Matomo) and enters only its ID; the official counter snippet is generated by the plugin programmatically at render time and never stored in the database.
- Every integration ID is validated against a strict whitelist format (regex / absint / esc_url_raw) on save and again on every read, so altered or legacy option records cannot reach the frontend.
- Blocked integrations can be placed in
head,bodyorfooter, and each entry has a category, a load priority and an on/off toggle. - Multisite: network activation sets up every site in the network, and sites created later are set up through the
wp_insert_sitehook. - The
nymcs_consentcookie is read in a single place,NYMCS_Plugin::get_cookie_consent(), with size and JSON depth limits: categories are checked against a whitelist, version and timestamp are cast to integers, and consent stored for an older consent version is not accepted server-side. - CSV import validates the upload (
UPLOAD_ERR_*,is_uploaded_file(), 512 KB limit,.csv/.txtonly) and parses it row by row withfgetcsv(); every cell is sanitized before it is stored. - Cookie names keep their original case, spaces, dots, slashes and wildcard
*(for examplePHPSESSID / wordpress_logged_in_*,_ga_*,_pk_id.*). - Settings, cookie records and integration entries are validated against whitelists on both save and read; all admin output is escaped;
WP_List_Tableis loaded only on the plugin's own admin screen.