Home / Plugins / Cookie Banner & Content Blocker

Freev1.0.0 · updated Aug 10, 2026 · GPL · no Pro version

Cookie Banner & Content Blocker: nothing loads until your visitor says so

A free WordPress plugin that does what most cookie banners only claim. YouTube, Google Maps, Analytics and Tag Manager stay inert until the visitor decides, then exactly what was allowed loads. The HTML is the same for everyone, so page caching and CDNs keep working.

Download free on wordpress.org How it works ↓

Is a cookie notice enough?

Most cookie banners are a notice. The page loads, the video player loads, the analytics tag fires, and then a box asks whether that was all right. By the time the visitor answers, the requests have already been made.

Consent asked for after the fact is a receipt, not a decision. What matters technically is the order: the request to youtube.com or googletagmanager.com must not happen until the visitor has said yes. A banner that cannot hold those requests back is a design element, whatever its wording promises.

Holding them back is harder than showing a box. Embeds arrive as iframes, oEmbeds and Gutenberg blocks, tags arrive as enqueued scripts and inline snippets, and a page cache serves every visitor the same HTML. So the blocked content has to be made inert in the markup itself, and the browser has to be the one that activates what was allowed.

That is what this plugin does, and it is the whole reason it exists. The banner is the visible part. The blocking engine underneath is the part that earns its keep.

It implements consent and blocking technically. Whether your site is compliant depends on the whole site, your texts and your configuration; this is not legal advice.

This is what it looks like

Requests held: 3

yoursite.com/how-it-works

The placeholder where a video would be, the banner, and the requests the browser has not made yet. Every control here is a real setting in the plugin.

How it works

Tick the services you use

Google Analytics 4, Google Tag Manager and Consent Mode v2 sit in the Services tab with their IDs. YouTube, Google Maps and OpenStreetMap are blocked from the start. Anything else, a chat widget, a font, a custom map, gets a rule of its own: hosts, wildcards, URL substrings or script handles, no regular expressions.

Services settings with Google Analytics 4, Google Tag Manager and Consent Mode v2 in the top row, and blocking switches for YouTube, Google Maps and OpenStreetMap below. — Each service is a card: switch it on, paste the ID, done.

Everything optional stays inert

Before a decision the served HTML carries blocked scripts and embeds in a neutralized form: enqueued scripts, inline snippets with known signatures, iframes, oEmbeds, Gutenberg embeds and resource hints. No request goes out, not even for a YouTube thumbnail. Because that HTML is identical for every visitor, page caches and CDNs need no variants.

The visitor decides, the browser does the rest

Accept all, only necessary, or the settings dialog with a switch per category and per service. Where a video or map would be, a placeholder rendered from your own server offers Load once for this embed and Always allow for the service. After a yes the browser activates what was allowed; YouTube then plays through the privacy-enhanced nocookie player.

Compact consent card over a dimmed page with a short privacy note, an Accept all button, an Only necessary button and a Settings link. — Two sentences, two buttons, one link to the details.

Privacy settings dialog with toggles for Necessary, Statistics, Marketing and External media, and single switches for YouTube, Google Maps and OpenStreetMap. — Decide per category, or per service.

Make it look like part of the site

Four layouts: compact card, centered modal, top or bottom bar, side drawer. Five presets from Clean Light to Brand Accent, or your own colors, with a live preview and a contrast warning when text and accent fall under 4.5:1. Every string is a field; English and German ship, and WPML and Polylang read the strings.

What it does not do

This is the part most plugin pages leave out.

It does not guarantee compliance. It implements consent and blocking. Whether the site as a whole is compliant depends on your texts, your configuration and everything else on it.

It does not catch every custom script by itself. Well-known services are covered reliably. Anything else needs a rule you write, with hosts, wildcards, script handles or inline signatures, or the wrapper shortcode.

It keeps no consent log. The decision lives in one first-party cookie: version, timestamp, choices. No IP address, no history in your database, nothing to export on request.

It sends nothing to the author. No telemetry, no external request of its own, no remote fonts, no CDN. Every asset is served from your installation.

It does not unload what already ran. Revoking removes known Google cookies and reloads the page, because a script that has executed cannot be reliably pulled out of memory.

It does not block Search Console verification. On purpose. DNS, HTML file or meta tag involve no tracking of visitors, so verification is not a blockable service.

Why not just a cookie notice?

A notice plugin is easy to build and easy to install, and it changes nothing about what the page does. The scripts it is supposed to govern are already loaded by the time the box appears. The only thing the visitor’s click controls is whether the box goes away.

A blocker has to reach into the page before it is delivered. It neutralizes scripts and embeds in the markup, keeps that markup identical for every visitor so caches keep working, and hands the activation to the browser after the decision. That is more work, and it is the work that makes the banner mean something.

The difference shows in the network tab. Open a private window, load a page with a video, and watch. With a notice, youtube.com has been contacted before you touch anything. With this plugin, the first request to youtube.com is the one you trigger yourself.

Set up in three steps

Install it

Plugins, Add New, search for Melon Consent, install, activate. No account and no license key.

Pick your services

Melon Consent, Services: tick what the site uses and enter the GA4 or Tag Manager ID if you have one. YouTube, Google Maps and OpenStreetMap are blocked from the start.

Design, texts, test

Choose a layout and a preset, adjust the texts, link privacy policy and legal notice. Then open the site in a private window and watch the network tab stay empty until you click.

Free forever, and why

This plugin is free and stays free. There is no Pro tier and none is planned. It exists because I needed a consent banner that actually blocks, with no account, no monthly fee and no data leaving the site, and could not find one I trusted to do all three.

If it saved you an afternoon, the useful things are a rating on wordpress.org, a post in the support forum when something is off, or a hand with the translation.

Screenshots

Admin overview with a status table showing banner active, consent version, enabled services, layout and Consent Mode, beside a numbered list of five setup steps. — One table tells you whether the site is covered.

Layout and design settings for the consent banner beside a live preview of the card, with a switch between desktop and mobile view. — Change a value on the left, see it on the right before saving.

Text settings for the banner title, description and three buttons, and below them the same fields for the settings dialog. — Every word the visitor reads is a field you can change.

Advanced settings for consent lifetime and version, administrator bypass, excluded pages, the HTML rewriter, automatic script detection and data removal on uninstall. — The dials you touch once: how long a decision lasts, and what the blocker catches.

Frequently asked questions

Does it block YouTube before consent?

Yes. No request is made to youtube.com, youtube-nocookie.com or ytimg.com before consent, thumbnails included. A placeholder rendered from your own server is shown instead; after consent the player loads from youtube-nocookie.com.

Does youtube-nocookie.com remove the need for consent?

No. The privacy-enhanced mode reduces cookie usage but does not prevent every data transfer, so the plugin blocks it before consent as well.

Does it support Google Consent Mode v2?

Yes. analytics_storage, ad_storage, ad_user_data and ad_personalization default to denied and are updated after the decision. The strict basic mode loads no Google tag before consent; the advanced mode is an explicit opt-in.

Does it work with caching plugins?

Yes, by design. The served HTML is identical for every visitor and blocked content is inert in the markup; the browser activates allowed content after reading the consent cookie. No cache variants are needed.

Can visitors revoke consent?

Yes: via the floating privacy button, the Change privacy settings shortcode, a link with the data-melon-open-settings attribute, or MelonConsent.openSettings(). Known Google Analytics cookies are removed and the page reloads.

Does it store consent logs?

No. The decision is stored only in a first-party cookie in the visitor browser: consent version, timestamp and the choices. No personal data, no IP addresses, no history in the database.

Can every third-party script be detected automatically?

No plugin can. Well-known services are covered reliably; for everything else there are custom rules with hosts, wildcards, script handles and inline signatures, and the manual wrapper shortcode.

Does it guarantee legal compliance?

No plugin can. It implements consent and blocking technically. Compliance depends on your whole site, your texts and your configuration; the plugin is not legal advice.

Does it slow the site down?

It loads only local assets, no fonts, no CDN, no external request of its own. Blocked embeds are inert markup, so before consent the page carries less than it would without the plugin, not more.

Is there a Pro version?

No, and none is planned. Every feature is in the free plugin.

Changelog

1.0.0

Aug 10, 2026: first release: banner with four layouts and five presets, consent per category and per service, cache-safe blocking of scripts, inline snippets, iframes, oEmbeds, Gutenberg embeds and resource hints, Google Analytics 4, Tag Manager and Consent Mode v2, placeholders for YouTube, Google Maps and OpenStreetMap, custom services, floating privacy button, diagnostics, import and export, English and German.

Full changelog on WordPress.org

More from desk9

AI Content Disclosure One quiet notice that says where AI helped. The other thing a reader should not have to guess.

Broken Content Reporter Readers report the dead link or missing image in two clicks, with the page URL attached.

All desk9 plugins Ten of them, maintained monthly, seven free.

Free forever. No Pro, no nag screens.

Every feature is in the free version. Updates arrive through WordPress, no account and no license key.

Download free All desk9 plugins →

At a glance

Version1.0.0

Last updateAug 10, 2026

Requires WP6.5+

Tested up to7.0.7

PHP7.4+

LicenseGPL

Why it is free

Every feature is in the free plugin, and it stays that way. If it saves you time, a review on wordpress.org is the best way to say thanks.

All desk9 plugins →