WordPress cookie banners

1. List what can add tracking

Start with the site you actually run, not just the cookie plugin settings. Make a short inventory before changing anything.

• Check active plugins, theme settings, page-builder integrations and tag-manager containers.
• Include advertising pixels, embedded video, booking tools, chat widgets and analytics.
• Record who added each tool, what it does and where its settings live. Unknown does not mean unlawful.

2. Set consent rules

For technology that needs consent, identify the setting that prevents it running before permission. Advertising storage or access needs consent; other purposes can have exceptions with conditions. A plugin name or “compliant” badge does not settle that assessment.

ICO: advertising and consent ↗ · ICO: exceptions and their conditions ↗

3. Check for duplicate tools

The same tool may be inserted by a plugin, the theme and a tag manager. Blocking one copy can leave another running. Compare the inventory with observed activity before removing or disabling anything. Work on a staging copy and keep a backup when changes could affect the live site.

4. Test the visitor journey

Use a clean browser session for each starting condition. A remembered choice from yesterday can hide the behaviour you are trying to inspect.

• Open the page without clicking the banner.
• Choose Reject and check what happens.
• Reload and visit another page after rejecting.
• In a separate clean session, choose Accept.
• Find the settings link and test changing an earlier choice. Repeat on a phone.

5. Update and retest

Your cookie information should explain the technologies and purposes actually in use. After changing the setup, repeat the same tests and keep before-and-after evidence. A new plugin, embed or tag-manager change is a reason to check again.

What GDPRFix contributes

The free scan tests up to five public pages and reports observed activity, warnings and testing gaps. It does not change WordPress, enter your dashboard or prove every legal requirement is met. Copy the developer brief for your maintainer; use the captured evidence to decide what needs investigation.