Consentl

Consentl for WordPress

Install the Consentl plugin, click Connect, and the banner loads first in <head>. Works with the WP Consent API, page caches, WPML and Polylang, block and classic themes.

Loader first in <head>
Yes
Download
consentl-wordpress-1.1.0.zip · Version 1.1.0 · 248 KB · SHA-256

The Consentl plugin stores your site key, prints the Consentl loader as the first element of <head>, passes each choice to the WP Consent API and WooCommerce, and adds blocks and shortcodes for the cookie declaration, the privacy request form and the EU withdrawal form. The banner itself, its texts and regions are managed in the Consentl dashboard.

Requirements

  • WordPress 6.5 or later, PHP 7.4 or later.
  • A Consentl account (Free plan available).
  • Optional: the WP Consent API plugin (2.0+), WooCommerce 8.5+.

Install

  1. Download the plugin zip from Downloads. It will also be available from WordPress.org once published there.
  2. In WordPress, go to Plugins → Add New → Upload Plugin, choose the zip, click Install Now and Activate.
  3. Clear your page cache, if you use one.

Updates

From version 1.1.0 the plugin checks consentl.com for new versions, so they appear under Dashboard → Updates and on the Plugins screen like any other update, with View details, one-click updates and auto-updates (also in a multisite network admin). WordPress checks about twice a day; Check again under Dashboard → Updates checks at once. The check sends no site key, site address or visitor data. If you installed 1.0.0, upload the new zip once (Plugins → Add New → Upload Plugin, then Replace current with uploaded); later versions arrive by themselves.

If your server blocks outgoing requests (WP_HTTP_BLOCK_EXTERNAL), allow consentl.com next to api.wordpress.org in WP_ACCESSIBLE_HOSTS, or keep uploading new zips by hand. To switch the update check off, add define( 'CONSENTL_SELF_UPDATE', false ); to wp-config.php.

Connect your site

  1. Go to Settings → Consentl and click Connect to Consentl.
  2. Sign in or create a free account, then pick your site or create it. You are sent back to WordPress with the site key filled in, and the status shows Connected.

You can also paste the key (it starts with sk_) from the dashboard. To pin it per environment, add this line to wp-config.php; the field then becomes read-only:

define( 'CONSENTL_SITE_KEY', 'sk_…' );

Configure

In Settings → Consentl:

  • Banner language: Automatic (default) follows the page language from WPML or Polylang, or the WordPress locale. Site language uses the language from Settings → General. Fixed uses one language for every page.
  • WP Consent API (on by default): plugins that follow the WP Consent API (for example Site Kit by Google, WooCommerce, WP Statistics, Burst Statistics) get the visitor's choice automatically.
  • Open the Consentl dashboard for the banner design, texts, regions, cookies, the consent log and privacy requests. Changes appear on your site within about five minutes.

Then add these to your privacy or cookie policy page:

Block Shortcode
Cookie declaration [consentl_cookie_declaration heading="Cookies we use"]
Privacy request form [consentl_privacy_request]
EU withdrawal form (Pro and higher) [consentl_withdrawal_form]
Cookie settings link [consentl_cookie_settings label="Cookie settings"]

In menus, add a custom link to #consentl to re-open the preferences.

Check that it works

  1. Open your site in a private window and view the page source: the Consentl loader is the first <script> in <head>, right after <meta charset>.
  2. The banner appears. In the browser console, Consentl.get() shows the current choices.
  3. With the WP Consent API installed, wp_has_consent('statistics') is false before you accept analytics in an opt-in region and true after.

Caching and optimisation plugins

The page HTML is the same for every visitor and each choice is applied in the browser, so full-page caching is safe. The loader is automatically excluded from deferring, delaying and combining in WP Rocket, LiteSpeed Cache, Autoptimize, SiteGround Speed Optimizer, Jetpack Boost and Cloudflare Rocket Loader. For other optimisation plugins (Perfmatters, FlyingPress, WP-Optimize, Hummingbird, NitroPack and so on), exclude /v1/loader.js from "delay JS", "defer JS" and "combine JS".

For developers

  • consentl_has_consent( 'analytics' ) is true when the visitor allowed the category (necessary, preferences, analytics, marketing or sale). It reads the consentl cookie; do not use it in fragments that are cached per page.
  • consentl_get_consent() returns the stored decision, or null.
  • consentl_loader_tag() prints the loader yourself, for themes that output scripts before wp_head() (for example a Google Tag Manager snippet pasted straight after <head>).
  • JavaScript: Consentl.get(), Consentl.allowed('marketing'), Consentl.on('change', fn), Consentl.open('prefs') and the consentl:change event on document.
  • Filters: consentl_should_load, consentl_loader_attributes, consentl_head_priority, consentl_locale, consentl_has_consent, consentl_woocommerce_attribution_client_side, consentl_api_origin, consentl_app_origin.

Limitations

  • Do not run two consent plugins: Complianz, CookieYes, Cookiebot and similar plugins also answer the WP Consent API and would conflict. Deactivate the other one.
  • AMP pages do not load the banner (AMP needs amp-consent, which is not supported).
  • Scripts printed before wp_head() by a theme run before Consentl; use consentl_loader_tag() as described above.
  • With a Content Security Policy, allow https://api.consentl.com for script-src and connect-src (see Any website).
  • On a multisite network, each site needs its own site key.
  • When you delete the plugin, its settings are removed. Your consent log stays in your Consentl account, because it is your proof of consent.

Stuck? Write to [email protected] — we answer in English on business days.