WordPress Plugin
Official CMP for WordPress — connect once, then manage the banner, cookie inventory, scanner, and consent log from wp-admin.
Install
- Upload the
cookiewisefolder towp-content/plugins/(or install the zip from Plugins → Add New → Upload). - Activate Cookiewise.
- Open the Cookiewise menu in WordPress admin.
Connect
- In the Cookiewise dashboard, go to Settings → API Keys and generate a key. Copy it immediately — it is shown once.
- Paste the key into the WordPress Connect screen.
- The plugin matches your site host to a Cookiewise website, or creates one if you allow it.
The API key is encrypted in the WordPress database using the site authentication salt. Admin JavaScript never receives the raw key; WordPress REST proxies requests server-side with Authorization: Bearer.
cw_live_ followed by hex. Older 64-character hex keys still work.
What the plugin does
- Banner in
<head>— prints the hosted script first (priority 0) so Google Consent Mode v2 defaults are set before GTM/GA4. - Dashboard — consent rate, cookie counts, compliance score.
- Banner editor — position, colours, copy, auto-block, Consent Mode.
- Cookies — inventory, category changes, approve items that need review.
- Consent log — audit records stay in Cookiewise; WordPress only displays them.
- Scanner — start a cloud scan and poll progress.
Google Consent Mode v2
You do not add a separate Consent Mode snippet. Load Cookiewise first; the hosted banner sets gtag('consent', 'default', …) to denied and updates signals when visitors choose. Keep GTM/GA4 tags after the Cookiewise script. See GTM Consent Mode v2.
Cookie settings shortcode
Add a control that reopens the banner:
[cookiewise_preferences]
Optional attributes: label and class.
WP Consent API
If the WP Consent API plugin is active, Cookiewise maps categories on cookiewise-consent-updated:
- functional →
functional - analytics →
statistics/statistics-anonymous - marketing or social →
marketing
Manual script (without the plugin)
You can still paste the embed yourself. Prefer the plugin so the tag stays first in <head> across theme updates:
<script src="https://www.cookiewise.net/api/script.js?website_id=YOUR_WEBSITE_ID"></script>
Security
- Capability
manage_optionson every admin REST route - Fail closed: no valid UUID website id → no frontend script
- Script origin allowlisted (
https://www.cookiewise.net, filtercookiewise_script_origins) - Disconnect wipes the encrypted key; uninstall deletes plugin options