Replai – Cookie Consent Banner for GDPR, CCPA & Google Consent Mode (self-hosted)
| 开发者 | replai |
|---|---|
| 更新时间 | 2026年7月27日 01:09 |
| PHP版本: | 7.2 及以上 |
| WordPress版本: | 7.0 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
Replai - Cookie Consent is a privacy-first cookie consent plugin — a self-hosted alternative to subscription-based consent services. The banner, the consent log and the prior blocking all run on your own WordPress by default: no external calls are made unless you explicitly connect the optional REPLAI service (see "External services").
- Prior blocking (before consent): the most common third-party scripts (Google Analytics, Google Tag Manager, Meta Pixel, Google Ads, LinkedIn, TikTok, Hotjar, Microsoft Clarity, Matomo, YouTube, Vimeo, Google Maps...) are automatically neutralized until the visitor consents. Add extra domains with one line each.
- Google Consent Mode v2 (Basic or Advanced): consent state is set to "denied" by default and updated automatically when the visitor chooses, so Google Analytics 4 and Google Ads receive the correct signals. In Advanced mode (recommended) Google tags are allowed to load and send cookieless pings (with
url_passthroughandads_data_redaction), recovering anonymous data and modeling conversions even before consent, while every other tracker stays blocked. - Region-based consent: ask for prior consent everywhere, or opt-in only in the EU/EEA/UK/Switzerland and opt-out where the law allows it (more conversions outside the EU). Visitor country is detected from a hosting/CDN header (Cloudflare and others) with a filter to plug in your own GeoIP; if there is no signal, prior consent is applied for safety.
- Granular categories: Necessary (always on), Preferences, Statistics and Marketing, with an "Accept all", "Reject all" and "Customize" flow.
- Consent log (GDPR proof): every consent is stored locally (date, policy version, choices, hashed IP, page) and can be exported to CSV. IP addresses are never stored in plain text (hashed with a plugin-specific salt).
- Fully customizable banner: bottom bar or corner box, light/dark theme, accent color, custom title and message, links to your privacy and cookie policies.
- Embeddable cookie declaration: the
[replai_cookie_declaration]shortcode renders a ready-to-paste page for your cookie policy — a table per category with provider, purpose, duration and type for every declared cookie, plus the visitor's current consent (per-category status, consent ID and date).[replai_cookie_settings]reopens the preferences panel. - Global Privacy Control (GPC): the US GPC browser signal is honored automatically — non-essential categories are rejected and logged without an intrusive banner.
- Automatic banner language: the banner follows the visitor's browser language across 7 languages, independently of the site language.
- Optional REPLAI monitoring: if you are a REPLAI customer, you can add a REPLAI token to monitor this installation from your REPLAI dashboard. This is off by default; nothing is sent unless you add a token.
安装:
- Upload the plugin to
/wp-content/plugins/or install it from the Plugins screen. - Activate it.
- Go to Replai Cookies → Settings and configure the banner, categories and policy links.
- If you were using another cookie banner service, deactivate it and remove its header script — your third-party scripts will be blocked automatically until consent.
屏幕截图:
常见问题:
Does it send data to any external service?
By default, no — the plugin is fully self-hosted and consents are stored in your own database. It only connects to the optional REPLAI service if you explicitly add a REPLAI token (see "External services"). With no token, no data leaves your site.
Does it work with Google Analytics 4 / Google Ads?
Yes. Keep Google Consent Mode v2 enabled and the plugin will signal consent automatically.
How do I add scripts that are not blocked by default?
Settings → Scripts, add a line domain|category (category = preferences, statistics or marketing).
更新日志:
A full changelog is also available in CHANGELOG.md.
1.3.5
- The Diagnostics panel now detects analytics by running your homepage's real JavaScript (not just the server HTML), removing GA4/GTM false negatives and also detecting trackers loaded via JS.
- Diagnostics now run in real time: "Check again" refreshes the results in place, without reloading the page.
- When Google Tag Manager is detected, the panel no longer flags GA4 as "missing" — GA4 is usually configured inside the GTM container and does not appear in the page HTML (verify it in GA4 Realtime). A missing-GA4 warning is only shown for direct gtag setups with Google Ads but no GA4 and no GTM.
- The homepage is now fetched with a browser user-agent and a cache-buster so caches/CDNs return the same page a real visitor sees.
- Renamed the plugin title to better describe what it does (GDPR/CCPA cookie consent banner with Google Consent Mode, self-hosted). The plugin slug and your settings are unchanged.
- The banner now has a close (×) button in the top-right corner, and the floating cookie button hides while the panel is open and reappears when it closes. The × and click-outside only close the panel once a consent choice has already been made (on the first visit a choice is still required).
- Admin: the optional REPLAI connection is shown again at the top of the settings screen (not as a tab).
- Diagnostics: besides the Google stack and Meta Pixel, the panel now also lists other common trackers detected on the homepage (Mixpanel, Hotjar, Clarity, LinkedIn, TikTok, Matomo, Plausible, Segment, Yandex, Pinterest, Microsoft Ads, FullStory, Amplitude) so you can check they are being consented.
- Consent Mode / analytics diagnostics panel: a new "Diagnostics" tab loads your homepage and checks whether the plugin is injecting Google Consent Mode and which analytics tags are present (GA4, Google Ads, GTM, Meta Pixel). It warns when Google Ads or GTM are detected but GA4 (a
G-...config) is missing, so you can spot a missing Google Analytics 4 tag. Includes a "Check again" action and a note reminding that GA4 may live inside a GTM container. - Settings reorganised into coherent tabs: all sections now live in tabs inside a single form — General, Appearance, Categories & cookies, Consent Mode & regions, Advanced compliance, Diagnostics and REPLAI connection.
- Clicking outside the panel now closes it without changes only when a consent choice was already made (e.g. reopening from the floating button). On the first visit, clicking outside does not dismiss the banner and never counts as acceptance — a choice is still required.
- Region-based consent is now the default: prior consent (opt-in) in the EU/EEA/UK/Switzerland via Google's native region defaults, and opt-out where the law allows it — more conversions outside the EU while EU visitors keep full prior consent. Non-Google trackers stay blocked until consent when no country signal is available. You can switch back to "prior consent everywhere" from the settings.
- Embeddable cookie declaration via the
[replai_cookie_declaration]shortcode: a ready-to-paste table per category (Necessary, Preferences, Statistics, Marketing) listing each declared cookie with provider, purpose, duration and type — plus a "Your consent" block showing the per-category status, the consent ID and the date (filled from the stored consent). - Global Privacy Control (GPC) support: when a visitor has not consented yet and their browser sends the GPC signal, non-essential categories are automatically rejected and logged, without showing an intrusive banner. The floating button still lets them change their choice. Can be turned off from the new "Advanced compliance" card.
- Automatic banner language: the banner is now shown in the visitor's browser language across 7 languages (English, Spanish, Catalan, French, Italian, Portuguese, German), independently of the site language. Any custom title/message set by the admin still takes precedence and is not translated. Can be disabled to fall back to the site locale.
- Expanded auto-blocking: many more known trackers are blocked by default — Plausible, Segment, FullStory, LogRocket, Amplitude, Heap, Yandex Metrica, WordPress Stats (statistics); Bing Ads, Pinterest, Twitter/X Ads, Criteo, Taboola, Outbrain, AdRoll, Reddit, Quora (marketing); Disqus, SoundCloud, Spotify embeds (preferences).
- Consent log CSV export: the consent log can be streamed to a CSV file (consent id, date, language, per-category choices, method, policy version and hashed IP — never a raw IP).
- Google Consent Mode Advanced (recommended, new default): Google tags are no longer blocked, so they load and send cookieless pings, recovering anonymous data and modeling conversions even before consent. Adds
gtag('set','url_passthrough',true)andgtag('set','ads_data_redaction', ...). A Basic mode keeps the previous behavior (Google tags fully blocked until consent). Every non-Google tracker (Meta, Hotjar, TikTok...) is still blocked in both modes. - Region-based consent with Google-native region defaults: in geo mode the plugin emits a global
grantedconsent default plus adeniedoverride withregion:[EU/EEA/UK/CH], so Google itself applies prior consent only where required — no dependency on hosting geo headers. It also reads the visitor country from hosting/CDN headers (CloudflareCF-IPCountry, GeoIP, App Engine...) with areplai_cc_visitor_countryfilter to gate non-Google trackers; when there is no signal, prior consent is applied for safety. - Mixpanel domains added to the Statistics blocklist.
- Both options are configured from a new "Google Consent Mode & regions" card in the admin panel.
- New gradient hero header (REPLAI logo in white plus version and release chips) on the Settings, About, Help and Consent log screens.
- The whole admin (menu items, Settings, About and Help) is now translated to the site language right away through an internal string table, without waiting for translate.wordpress.org.
- New commercial About page: intro, a grid of four features and a final call-to-action — always making clear that connecting REPLAI is optional.
- Token validation reworked: it now runs over AJAX without reloading the page, saves the token automatically on success and disables the Test button while the token field is empty.
- Added a soft, optional call-to-action on the Settings screen when no token is set, inviting you to (optionally) connect this site to REPLAI. The plugin keeps working 100% self-hosted with no token.
- Added multilingual WordPress.org banners (Spanish, Catalan, French, Italian, Portuguese and English base).
- Fixed the last Plugin Check notice: annotated the one-off schema migration query. The plugin now passes Plugin Check with no errors or warnings.
- Added a friendly, dismissible invitation on the plugin's Settings screen (shown after 30 days of use) to enable the optional "Powered by REPLAI" credit. The credit remains opt-in and disabled by default; enabling it is always an explicit admin action.
- Code quality pass (Plugin Check): all database queries now use $wpdb->prepare() with identifier placeholders, the CSV export no longer uses direct file handles, translator comments added, and template variables prefixed. Minimum WordPress version is now 6.2.
- Compliance and privacy pass: the optional "Powered by REPLAI" credit is opt-in and disabled by default; the optional REPLAI connection is documented under "External services" with terms and privacy links; IP hashing uses a plugin-specific salt; translations are served by WordPress.org.
- The banner and the floating button now render inside a Shadow DOM, providing full style isolation between the plugin and the site theme.
- Floating reopen button redesigned: cookie icon with side and bottom styles, three sizes and a styled tooltip.
- Banner buttons hardened against aggressive theme CSS.
- Consent aggregates are now kept accurate in real time.
- Cookie declaration: each category shows its cookie count and can be expanded by provider (name, description, storage duration and type), with a built-in catalog of common cookies and support for custom entries.
- The visitor's language is now recorded with each consent (locally and in the CSV export).
- Smoother preferences area: collapsible sections and internal scrolling for long cookie lists.
- Optional REPLAI connection for REPLAI customers: token validation, connection status card with on-demand test, and installation monitoring (site info, consent aggregates and events with hashed IPs, daily heartbeat).
- Optional "Powered by REPLAI" credit in the banner.
- Refreshed admin design aligned with the REPLAI plugin family; native WordPress color picker for the accent color.
- Initial public release: consent banner with granular categories, prior blocking of third-party scripts, Google Consent Mode v2, local consent log with CSV export and shortcodes.
- Banner as bottom bar or corner box (right/left) and floating reopen button with position and style options.
- Live page search for the privacy and cookie policy fields.
- Available in English, Spanish, French, Catalan, Italian and Portuguese.