Almost every site you visit greets you with a box about cookies, and yours does not. Maybe a customer in Europe asked about it, or your new analytics setup mentioned consent, or you simply wondered whether you are missing something. Now you want to add a cookie banner in WordPress, and you want it to be more than decoration.
That last part is where most banners fall short. A box that appears while tracking scripts load behind it anyway is decoration. What follows is how to judge whether a banner is relevant to you, how the common plugins work, how to make one genuinely hold scripts back until a visitor agrees, and how to check that it does.
A note before you start: this is general information, not legal advice. Privacy rules differ by country and change over time. If your business has visitors or customers in several regions, or you run advertising, ask a qualified adviser what applies to you.
Do you need a cookie banner at all?
The answer depends on two things: where your visitors are, and what your site loads.
What your site loads. Cookies that a site needs to work, such as a shopping cart or a login session, are usually treated differently from cookies used for analytics, advertising or embedded content from other companies. A plain brochure site with no analytics, no ad pixels and no embedded videos may set very few cookies beyond the essential ones. Most business sites, though, carry at least Google Analytics, and often a Meta pixel, a chat widget, YouTube embeds or a map.
Where your visitors are. In the EU and the UK, the rules on cookies and similar technologies generally require consent before non-essential cookies are stored or read, and the GDPR sets out what valid consent looks like. The UK has its own regulator, the ICO, and its rules can differ in detail from the EU’s, so check the regulator’s current guidance rather than older articles. In India, the Digital Personal Data Protection Act deals with personal data in general rather than cookies as such; how it applies to tracking on your site is a fair question for an adviser, and the form side is covered in our note on form consent and India’s DPDP Act. In the US there is no single national rule, and the state laws that exist differ from one another.
If you sell to Europe or the UK, or simply want a site that treats every visitor the same careful way, a working banner is a sensible thing to have.
What a cookie banner has to do
The visible box is the easy part. The work happens behind it.
- Hold back non-essential scripts until the visitor chooses. Analytics, ad pixels and similar tags should not fire on the first page view if the visitor has not agreed.
- Offer a real choice. Accept and reject should be equally easy to find. European privacy regulators have made the point that refusing should not take more effort than accepting.
- Use no pre-ticked boxes. A category that is switched on before the visitor touches it is not their choice.
- Remember the answer and let the visitor change it later, usually through a small floating icon or a “Cookie settings” link in the footer.
- Explain in plain words what each category does, with a link to your cookie or privacy policy.
Choosing a cookie consent plugin
You do not need to build any of this yourself. Two well-known options in the WordPress plugin directory are Complianz and CookieYes, and there are others. When comparing them, look at:
- Cookie scanning. Can it scan your site and list the cookies and services it finds? You will still need to check the list, but it is a good start.
- Script blocking. Does it block scripts automatically, or do you have to tag each script by hand? This is the feature that separates a working banner from a badge.
- Integrations. Does it recognise the way you add analytics (a plugin such as Site Kit, Google Tag Manager, or code in the theme)?
- Google Consent Mode support, if you use Google Analytics or Google Ads (explained below).
- Region handling. Some plugins can show different banners to visitors from different regions. Useful, but it adds settings to get right.
Read the plugin’s own documentation for what its free version includes. What each version includes changes over time, so do not rely on an old review. For a wider view on picking plugins, the group guide on adding features to a WordPress site has a checklist worth running through first.
How to add a cookie banner in WordPress, step by step
- List what your site loads. Go through the plugins list and the pages. Note analytics, pixels, chat, video and map embeds, fonts from other services, and any code pasted into the header by a previous developer.
- Take a backup, or set the plugin up on a staging copy first.
- Install the consent plugin and run its setup wizard. It will usually ask for your business details, the regions you serve, and which services you use.
- Run the cookie scan if it has one, then compare the result with your own list. Add anything the scan missed.
- Turn on script blocking and check that each service is placed in the right category: necessary, preferences, statistics or marketing, or whatever names the plugin uses.
- Write the banner text. Short, plain, and honest about what you use. Keep the buttons equal in weight.
- Link your policy. The banner should point to your cookie or privacy policy. If that policy is old, update it to match what the scan found; the post on keeping a privacy policy current describes a review routine.
- Add a way back. Turn on the floating settings icon, or add the plugin’s “manage consent” link to the footer.
- Clear your caching plugin’s cache and test (see below).
Google Consent Mode, in general terms
If you use Google Analytics or Google Ads, you will see Consent Mode mentioned in their settings and in consent plugins. It is a way for your banner to tell Google’s tags what the visitor agreed to, for example whether analytics storage or ad storage is allowed. The tags then adjust how they behave.
There are broadly two ways to run it. In the stricter set-up, Google tags do not load at all until the visitor agrees. In the other, the tags load but, without consent, send limited signals without setting cookies. Which is appropriate for you is a choice to make with your adviser, not something the plugin should decide silently. Google also expects advertisers who reach visitors in Europe to pass consent signals, so if you run ads there, read Google’s current requirements in your Ads account. If you are still setting up analytics itself, see adding Google Analytics to WordPress first.
Testing that the banner really blocks
- Open the site in a private browser window, so no earlier choice is remembered.
- Before clicking anything, open the browser’s developer tools. In Chrome or Edge, look at Application → Cookies; the Network tab shows which outside services the page contacts.
- Check that no analytics or advertising cookies are present and no requests have gone to those services yet.
- Click reject. Browse two or three pages and check again.
- Open a fresh private window, click accept, and confirm the tags now load.
- Repeat on a phone, where banners often cover more of the screen than you expect.
If tracking loads before consent, the most common cause is a script added outside the plugin’s reach: pasted into the theme, added by a header-code plugin, or injected by a page builder. Move it into a place the consent plugin manages, or tag it as the plugin’s documentation explains.
Where cookie banners usually go wrong
- Two banners. Some themes, page builders and analytics plugins include their own notice. Keep one tool in charge and switch the others off.
- A banner that blocks the whole page on mobile with a tiny reject link. It frustrates visitors and makes the choice unequal.
- Forgetting embeds. YouTube and map embeds set cookies too. Good consent plugins can show a placeholder until the visitor agrees.
- Set and forget. Every new plugin or service you add can bring new cookies. Rescan after changes.
- Stacking it with a popup. If you also run an offer popup, make sure it does not cover the banner; the post on adding a popup that people can close has more on timing.
A cookie banner sits among the routine settings covered in our WordPress owner’s guide, alongside the privacy policy it points to.
Frequently asked questions
Why does the banner keep appearing every time I visit?
The banner remembers a choice by storing a small consent cookie in the browser. If you browse in private windows, clear cookies on closing, or use a browser that blocks them, that record is lost and the banner returns. If ordinary visitors report it too, check whether a caching or security plugin is stripping the consent cookie.
Do logged-in admins see the banner differently?
Some consent plugins hide the banner or behave differently for logged-in administrators, and caching plugins often skip the cache for logged-in users too. That is why testing in a private window, logged out, matters. What you see while logged in to WordPress may not be what a first-time visitor sees.
What happens to my analytics numbers after adding a banner?
If the banner blocks analytics until consent, visitors who reject or ignore the banner are not counted in the usual way, so your reports will usually show fewer visits than before. That reflects the change in measurement, not a fall in real traffic. Note the date you switched the banner on so you can explain the change later.
Can I write my own banner text instead of the plugin’s default?
Yes, and it is usually worth doing. Default text is generic and sometimes mentions services you do not use. Say in a sentence or two what you use cookies for, keep the accept and reject buttons equally clear, and link to your policy. If you are unsure what wording your situation needs, ask your adviser.
If the banner and the scripts will not cooperate
On a tidy site the steps above go smoothly. Older sites are harder: tracking code ends up scattered across the theme, several plugins and a page builder, and nobody remembers what loads from where. We can help with that technical side through WordPress support from our team, finding where each script comes from and moving it under the banner’s control. What your banner needs to say legally is a question for your adviser, not for us.
Next in this series: How to Add a Popup in WordPress Without Annoying People
