WordPress Plugin

Official CMP for WordPress — connect once, then manage the banner, cookie inventory, scanner, and consent log from wp-admin.

Install

  1. Upload the cookiewise folder to wp-content/plugins/ (or install the zip from Plugins → Add New → Upload).
  2. Activate Cookiewise.
  3. Open the Cookiewise menu in WordPress admin.

Connect

  1. In the Cookiewise dashboard, go to Settings → API Keys and generate a key. Copy it immediately — it is shown once.
  2. Paste the key into the WordPress Connect screen.
  3. The plugin matches your site host to a Cookiewise website, or creates one if you allow it.

The API key is encrypted in the WordPress database using the site authentication salt. Admin JavaScript never receives the raw key; WordPress REST proxies requests server-side with Authorization: Bearer.

Keys look like cw_live_ followed by hex. Older 64-character hex keys still work.

What the plugin does

  • Banner in <head> — prints the hosted script first (priority 0) so Google Consent Mode v2 defaults are set before GTM/GA4.
  • Dashboard — consent rate, cookie counts, compliance score.
  • Banner editor — position, colours, copy, auto-block, Consent Mode.
  • Cookies — inventory, category changes, approve items that need review.
  • Consent log — audit records stay in Cookiewise; WordPress only displays them.
  • Scanner — start a cloud scan and poll progress.

Google Consent Mode v2

You do not add a separate Consent Mode snippet. Load Cookiewise first; the hosted banner sets gtag('consent', 'default', …) to denied and updates signals when visitors choose. Keep GTM/GA4 tags after the Cookiewise script. See GTM Consent Mode v2.

Cookie settings shortcode

Add a control that reopens the banner:

[cookiewise_preferences]

Optional attributes: label and class.

WP Consent API

If the WP Consent API plugin is active, Cookiewise maps categories on cookiewise-consent-updated:

  • functional → functional
  • analytics → statistics / statistics-anonymous
  • marketing or social → marketing

Manual script (without the plugin)

You can still paste the embed yourself. Prefer the plugin so the tag stays first in <head> across theme updates:

<script src="https://www.cookiewise.net/api/script.js?website_id=YOUR_WEBSITE_ID"></script>

Security

  • Capability manage_options on every admin REST route
  • Fail closed: no valid UUID website id → no frontend script
  • Script origin allowlisted (https://www.cookiewise.net, filter cookiewise_script_origins)
  • Disconnect wipes the encrypted key; uninstall deletes plugin options