About this plugin
CookieBoxs is a cookie consent plugin for WordPress that helps site owners manage visitor consent preferences and configure consent-aware integrations.
Free features include:
- Google Consent Mode v2 support
- Automatic script blocker and cookie cleaner
- 25+ built-in integrations
- Content blockers for embedded media and maps
- 40 interface languages
- Region presets
- Consent logging in WordPress
- Floating settings badge
- Self-hosted plugin files
Optional PRO features include two-phase Cookie Scanner (server + browser-based detection), geo-targeting, additional templates, cookie declaration, consent analytics, tamper-proof consent records with CSV export and printable certificates, A/B testing of banner variants, granular per-service consent, a live banner design editor, branding options, and custom CSS.
com
Source Code
All JavaScript and CSS files included in this plugin are human-readable and not minified or compiled. No build tools (npm, webpack, composer) are required to work with this plugin’s source code. All plugin-authored JavaScript and CSS is written directly and included as-is.
Third-party libraries and embed snippets:
-
js library (MIT License). js
-
). These are the official JavaScript snippets provided by each service for website embedding, written in their standard compact form. Each snippet includes a source URL comment pointing to the official documentation.
A full list of source URLs is also available in the file header comments. The surrounding plugin logic (consent state management, Google Consent Mode v2 setup, custom script injection) is authored by this plugin and is fully human-readable.
Official documentation URLs for all embedded third-party snippets:
- Google Tag Manager: https://developers.google.com/tag-platform/tag-manager/web
- Meta Pixel: https://developers.facebook.com/docs/meta-pixel/get-started
- TikTok Pixel: https://ads.tiktok.com/help/article/get-started-pixel
- Microsoft Clarity: https://learn.microsoft.com/en-us/clarity/setup-and-installation/clarity-setup
- Hotjar: https://help.hotjar.com/hc/en-us/articles/115011639927
- Heap Analytics: https://developers.heap.io/docs/web
- Mixpanel: https://docs.mixpanel.com/docs/tracking-methods/sdks/javascript
- PostHog: https://posthog.com/docs/libraries/js
- LinkedIn Insight Tag: https://learn.microsoft.com/en-us/linkedin/marketing/integrations/ads-reporting/insight-tag
- Pinterest Tag: https://help.pinterest.com/en/business/article/install-the-pinterest-tag
- Snapchat Pixel: https://businesshelp.snapchat.com/s/article/snap-pixel-about
- Twitter/X Pixel: https://business.x.com/en/help/campaign-measurement-and-analytics/conversion-tracking-for-websites
- Microsoft Advertising UET: https://help.ads.microsoft.com/apex/index/3/en/56682
- LiveChat: https://developers.livechat.com/docs/getting-started/installing-livechat
- Crisp: https://docs.crisp.chat/guides/chatbox-sdks/web-sdk/
- Tawk.to: https://help.tawk.to/article/adding-a-tawk-to-widget-to-your-website
- Intercom: https://developers.intercom.com/installing-intercom/web/installation
- Yandex Metrica: https://yandex.com/support/metrica/code/counter-initialize.html
- Matomo: https://developer.matomo.org/guides/tracking-javascript-guide
Privacy Policy
CookieBoxs does not send visitor consent records to the plugin author’s servers.
Consent records are stored in the WordPress database. Optional third-party integrations that you configure, such as analytics, advertising, chat, or embedded media services, connect directly from the visitor’s browser to those third-party providers after the relevant consent conditions are met.
Admin-only connections used for plugin news, optional deactivation feedback, or optional license validation are described below.
External Services
This plugin uses external services only for user-configured integrations. Third-party integrations are optional, disabled by default, and only activated when the site administrator enables and configures them. The plugin does not offload any of its own assets (JavaScript, CSS, images) to external servers — all plugin files are included locally.
Plugin services
-
VisionSolutions API – plugin news and updates: used in the admin area only; sends plugin version, WordPress version, and site language when an administrator opens the settings page. pl
pl/regulamin/
pl/polityka-prywatnosci/
-
VisionSolutions API – deactivation feedback (optional): sends selected reason, optional comment, site URL, WordPress version, and PHP version only if an administrator submits feedback during deactivation. Provider: VisionSolutions
pl/regulamin/
pl/polityka-prywatnosci/
-
VisionSolutions API – PRO license validation (optional): sends license key, site domain, and plugin version on activation and periodic validation. Provider: VisionSolutions
pl/regulamin/
pl/polityka-prywatnosci/
-
co geolocation API (optional, PRO): used only when geo-targeting is enabled and fallback geolocation is needed; sends visitor IP address. Provider: ipapi
co/terms/
co/privacy/
-
Cookie Scanner (admin-initiated, PRO): two-phase scan. Phase 1 (server): sends requests from your server to your own website pages to detect cookies and tracking scripts from HTML. g.
pixels loaded via Google Tag Manager). All scanning happens locally — no external provider is contacted.
Optional integrations (services)
These are third-party services that the site administrator can optionally enable. When enabled, the plugin loads the official embed snippet provided by each service, which connects the visitor’s browser directly to that service provider. These are service integrations, not offloaded plugin assets.
Each integration is disabled by default and only activates when the administrator provides their account ID.
-
Google Tag Manager – tag management service; may load on page view and use Consent Mode signals. com. Provider: Google LLC.
com/about/analytics/terms/us/
com/privacy
-
com/gtag/js via wp_enqueue_script. Provider: Google LLC.
com/about/analytics/terms/us/
com/privacy
-
com/gtag/js via wp_enqueue_script. Provider: Google LLC.
com/intl/en/home/terms/
com/privacy
-
net. Provider: Meta Platforms, Inc.
com/legal/terms
com/privacy/policy/
-
com. Provider: TikTok Inc. / ByteDance Ltd.
com/i18n/official/policy/business-products-terms
com/legal/privacy-policy
-
ms. Provider: Microsoft Corporation.
com/terms
com/en-us/privacystatement
-
com. Provider: Hotjar Ltd.
com/legal/policies/terms-of-service/
com/legal/policies/privacy/
-
Matomo – analytics service; loaded from the site administrator’s configured Matomo instance URL. Provider: InnoCraft Ltd. or the site owner’s Matomo host.
org/matomo-cloud-terms-of-service/
org/matomo-cloud-privacy-policy/
-
ru. Provider: Yandex LLC.
com/legal/metrica_termsofuse/
com/legal/confidential/
-
com. Provider: Heap Inc.
io/legal/heap-terms-of-service
io/legal/privacy
-
com. Provider: Mixpanel, Inc.
com/legal/terms-of-use/
com/legal/privacy-policy/
-
PostHog – analytics and feature flags service; loaded from the site administrator’s configured PostHog host. Provider: PostHog, Inc.
com/terms
com/privacy
-
com. Provider: LinkedIn Corporation.
com/legal/l/li-marketing-terms
com/legal/privacy-policy
-
com. Provider: Pinterest, Inc.
com/en/terms-of-service
com/en/privacy-policy
-
net. Provider: Snap Inc.
com/en-US/terms
com/en-US/privacy/privacy-policy
-
com. Provider: X Corp.
com/en/tos
com/en/privacy
-
com. Provider: Microsoft Corporation.
com/en-us/policies/legal
com/en-us/privacystatement
-
io. Provider: Intercom, Inc.
com/legal/terms-and-policies
com/legal/privacy
-
com. Provider: LiveChat, Inc.
com/legal/terms-of-service/
com/legal/privacy-policy/
-
chat. Provider: Crisp IM SAS.
chat/en/terms/
chat/en/privacy/
-
to. to Ltd.
to/legal/terms-of-service/
to/legal/privacy-policy/
Script blocker safe domains
The automatic script blocker does not block scripts from essential service domains (payment gateways, CAPTCHAs, translation). These domains are whitelisted so the script blocker does not interfere with site-critical functionality provided by other plugins or themes. The CookieBoxs plugin itself does not load any files from these domains — they are only whitelisted to prevent breakage:
-
com. Provider: Stripe, Inc.
com/legal/ssa
com/privacy
-
com. Provider: PayPal Holdings, Inc.
com/us/legalhub/useragreement-full
com/us/legalhub/privacy-full
-
net. Provider: Google LLC.
com/terms
com/privacy
-
com. Provider: Intuition Machines, Inc.
com/terms
com/privacy
-
com. Provider: Cloudflare, Inc.
com/terms/
com/privacypolicy/
-
com. Provider: Google LLC.
com/terms
com/privacy
Content blockers
Content blockers are an optional feature that replaces embedded third-party media (YouTube, Vimeo, Google Maps) with a placeholder until the visitor grants consent. When consent is given, the embed loads normally from the service provider.
-
com. Provider: Google LLC.
com/t/terms
com/privacy
-
com. Provider: Vimeo, Inc.
com/terms
com/privacy
-
com. Provider: Google LLC.
com/maps-platform/terms
com/privacy