外掛標籤
開發者團隊
原文外掛簡介
Consentfold is a consent management plugin that keeps visitor data on your own site. It shows a cookie banner, blocks scripts and embeds until the visitor agrees, tells Google about the choice with Consent Mode v2, and keeps a consent log you can prove it with. Nothing is metered and your visitors’ data is never sent to a third party; the only request a visitor’s browser can make to one is an optional video preview they ask for with a click (see “External services”).
Banner designer
Three layouts: Bar, Popup and Side panel, with placement, entrance and exit animations, optional animated interactions, and a live preview.
Palettes checked for contrast (WCAG AA) in light and dark, input styles, fonts, sizes, spacing and radius.
A Google Fonts finder over the full list. The font you choose is downloaded once to your site and served from there, so visitors never contact Google.
Banner regime: Automatic, Opt-in (EU / EEA), Opt-in (Brazil), Opt-out (United States) or No banner.
An optional small “Powered by Consentfold” link at the foot of the banner. It is off unless you switch it on in the Banner designer or say yes in the setup wizard; nothing is shown by default.
Setup wizard and Overview
The Overview shows what needs attention (health checks, the last scan, the consent log). A fresh site gets a “Run setup” card that goes through who sees a banner, the design, Google Consent Mode, the policy page and a first scan, in a few minutes.
Script blocking and Scanner
Known trackers, embeds and iframes (including srcdoc iframes) are held back until the matching category is accepted, with a placeholder the visitor can click.
The Scanner finds the cookies and scripts your site really sets and sorts them into categories. It builds the cookie policy table.
Works behind page caches and optimisers: WP Super Cache, Cache Enabler and Autoptimize are covered by end-to-end tests, as are Polylang, WooCommerce, Wordfence, GTM4WP and Site Kit.
Google Consent Mode v2
Defaults are sent before any Google tag runs, and updated when the visitor decides. Works with gtag.js, Google Tag Manager, GTM4WP and Site Kit, and with the WP Consent API.
Consent log
One record per decision on your own site, with the retention you set. WordPress’s personal data export and erase tools include it. A WP-CLI command (wp consentfold log) counts and prunes it.
Import from another plugin
The Import tab reads the saved settings of CookieYes and Complianz from the database, even when that plugin is not active, and shows a preview of what will change, what is kept and what is not supported. Apply it, and Undo import restores the settings from before your first import, even if you imported from both plugins. Consentfold never deactivates the other plugin on its own; a “Deactivate now” button does it when you say so.
Accessible and light
The banner is keyboard operable, announced to screen readers and checked with axe-core. It loads in under 15 KB of JavaScript and 4 KB of CSS, gzipped, and no jQuery.
The admin uses icons from Phosphor Icons (https://phosphoricons.com), copyright (c) 2023 Phosphor Icons, MIT License. The licence text is in licenses/phosphor-icons.txt. The icons are part of the plugin; nothing is loaded from a CDN.
Privacy
Consentfold stores the consent cookie in the visitor’s browser and, when the consent log is on, one record per decision on your own site: a random consent ID, the accepted categories, the method, the banner and policy versions, the region, the language and a coarse browser class. It never stores an IP address or a user agent; a one-way hash of both, salted and changing daily, is used only to limit the rate of the consent endpoint. Consent records are never sent to a third party. Records are deleted after the retention you set (365 days by default).
Logged-in users: their consent IDs are kept in their user meta, so WordPress’s Export Personal Data and Erase Personal Data tools (by email address) include and delete their records.
Visitors: they can find their consent ID in the cookie settings panel; delete the records of an ID in the Consent log tab.
Command line: wp consentfold log count|prune.
External services
Consentfold contacts three external services. Two are contacted only from your admin: Google Fonts, when an administrator uses the font finder in the Banner designer or previews a Google font there (a font you choose is downloaded once to your own site and served from there), and Freemius, which handles the upgrade, checkout and license flow. The third, YouTube/Google or Vimeo, is contacted from a visitor’s browser only when the visitor clicks Show preview on a blocked video embed.
Google Fonts (fonts.googleapis.com and fonts.gstatic.com), operated by Google LLC
What it is used for: letting you search the Google Fonts list, see a sample of each font, preview the font you choose in the banner preview before it is on your site, and download it to your site. The list of fonts itself ships with the plugin.
When: (1) while the finder is open in your admin, your browser asks fonts.googleapis.com for a small stylesheet with a sample of the fonts shown, and Google serves the matching font data; and while a chosen font is not saved yet, the banner preview in your admin loads that font from Google the same way. The preview loads fonts from Google in the admin only, never on your site’s pages; (2) when you save the design with a Google font you chose, your server asks fonts.googleapis.com for the font’s stylesheet and fonts.gstatic.com for its files. Nothing is requested when the finder is not used, on any visitor page, or by a cron job.
What is sent: the name of the font and the weights you chose, the sample text you type (letters only, as a list of characters), and the technical data every web request carries: the IP address of your browser (samples) or of your server (download) and a browser user agent. No visitor data and no data about your site is sent.
The fonts are open-source licensed (SIL Open Font License or Apache License 2.0), which allows hosting them yourself.
Google’s terms of service: https://policies.google.com/terms and privacy policy: https://policies.google.com/privacy (Google Fonts FAQ: https://developers.google.com/fonts/faq/privacy).
Freemius (freemius.com), operated by Freemius, Inc.
Consentfold bundles the Freemius WordPress SDK, which handles the upgrade, checkout and license flow.
What it is used for: the connect screen shown after activation, the Upgrade page, starting a purchase, license activation and plugin updates for the paid version.
When: nothing is sent, and the SDK does not run its usage tracking, until you explicitly opt in on the connect screen shown after activation (or enter a license key). Choosing Skip there leaves the plugin fully functional and shares no usage data, user details or plugin list. Three things you do yourself still contact Freemius after a Skip: opening Consentfold > Upgrade loads pricing from the Freemius API, and every such request carries your site’s address in its user agent; starting a checkout from there puts your WordPress user’s first and last name, email address and your site’s address in the checkout link; and submitting the feedback form shown when you deactivate the plugin sends Freemius an anonymous uninstall event with the reason you gave.
What is sent if you opt in: your WordPress user’s first and last name and email address; your site’s homepage URL and title, WordPress and PHP versions and site language; the plugin and SDK versions and whether the plugin is active or uninstalled; and the names, slugs, versions and active state of your installed plugins and themes. A license activation shares your WordPress user’s first and last name and email address (unless the license already has a known owner), the homepage URL, plugin and SDK versions and plugin state, plus the diagnostic details (WordPress and PHP versions, site language and title), which are ticked by default and can be unticked, and the plugin and theme list, which is unticked by default.
Visitor data: none. Consent records and visitor information never go to Freemius.
To stop sharing, open the Plugins screen and click Opt Out under Consentfold; this stops future sharing and does not recall what was already sent. If you chose Skip, the same place offers Opt In should you change your mind.
Freemius terms of service: https://freemius.com/terms/ and privacy policy: https://freemius.com/privacy/
YouTube video previews (i.ytimg.com), operated by Google LLC, and Vimeo video previews (vimeo.com and the i.vimeocdn.com image host), operated by Vimeo.com, Inc.
What it is used for: showing the thumbnail of a blocked YouTube or Vimeo embed in its placeholder, so the visitor can see which video it is before deciding to load it.
When: only when a visitor clicks Show preview on the placeholder of a blocked YouTube or Vimeo embed, before they have agreed to the video’s category. Nothing is requested when the page loads, when the visitor does not click, for any other embed, or from your server. Loading the video itself, or accepting the category, loads the embed from the provider as usual and is not part of this preview.
What is sent: for YouTube, a request for the thumbnail image https://i.ytimg.com/vi/
Deleting the plugin with “delete data on uninstall” switched on also deletes the downloaded font files.
Translations
Consentfold ships translations of the admin, the block editor and the default banner texts in Hungarian, German, French, Dutch, Spanish, Italian and Polish. These translations are drafts that have not been reviewed by native speakers. Check the wording of the banner and the policy before you rely on it, and edit the banner texts in the plugin where needed. Corrections are welcome on translate.wordpress.org.
