[WordPress] 外掛分享： COOKR – Cookie Consent & Script Blocking

內容簡介

COOKR 是一款專為滿足 GDPR 和 TTDSG 要求而設計的外掛，提供真正的 Cookie 同意管理與腳本阻擋功能。它在伺服器端阻擋第三方服務的腳本，確保使用者的隱私安全，並避免常見的 JavaScript 同意工具所帶來的問題。

【主要功能】
• 伺服器端腳本阻擋，確保隱私安全
• 支援 Google Consent Mode v2
• 自動阻擋第三方腳本和 iframe
• 提供同意橫幅與偏好設定介面
• 完整的 JavaScript API 支援
• 兼容性中心，實時執行狀態檢查

外掛標籤

開發者團隊

原文外掛簡介

GDPR cookie consent with real script blocking.
Block Google Analytics, Google Tag Manager, Meta Pixel, Hotjar, YouTube embeds, and other third-party services before they reach the browser.
Unlike JavaScript-based consent tools, blocked scripts never reach the browser at all.
Most cookie consent plugins display a banner and rely on JavaScript to stop tracking scripts. In many cases, those scripts can begin loading before the visitor has made a choice.
COOKR takes a different approach.
Scripts are blocked server-side before page delivery. Third-party services cannot execute until consent is explicitly granted. This helps website owners meet GDPR and TTDSG requirements more reliably.
Avoids the client-side race conditions common to JavaScript-only consent tools. No script guessing. No “hope it loads in time.”
Consent enforcement instead of consent theatre.
✓ Server-side script blocking — blocked before the browser receives them
✓ Google Consent Mode v2 support
✓ No external consent cloud
✓ No proxy infrastructure
✓ No visitor data sent to third parties
✓ Works entirely on your WordPress installation
Built for site owners, agencies, and developers who want real GDPR cookie consent enforcement.
COOKR CORE includes:

Consent banner & preferences UI
Server-side script interception via PHP output buffer
Auto-Blocker for third-party scripts and iframes
Runtime Inspector
CSP-aware restoration with nonce propagation
Google Consent Mode v2 support
Full JavaScript API (window.cookrConsent)
Compatibility Center — live enforcement status plus a tested-stack matrix with honest VERIFIED/PARTIAL/UNKNOWN/FAILED states
Automatic optimizer exclusions — LiteSpeed, WP Rocket, Autoptimize, FlyingPress
Self-hosted operation — no external services required

COOKR RADR additionally includes:

Privacy Radar — runtime detection and classification of third-party services
Enforcement Verification Framework — structured protocol for proving enforcement claims
Curated signature database with automatic weekly updates

How It Works
COOKR intercepts scripts in the PHP output buffer using WP_HTML_Tag_Processor before delivery to the browser. Matching script and iframe tags are neutralised server-side and restored only after the visitor grants consent.
There is no client-side race condition because blocking happens before the browser receives the page.
Reliability
Your consent choices are applied precisely — analytics, marketing, and external media are gated independently, with no mixups between categories. You can withdraw consent at any time; it takes effect starting with your next page load.
COOKR is safe to use with page caching. The server-rendered HTML is always consent-neutral — a cached page never carries one visitor’s consent-based content into another visitor’s response.
If COOKR encounters an internal enforcement failure, it fails closed rather than silently serving unblocked trackers.
Scope of Enforcement
COOKR blocks known trackers that are present in the server-rendered HTML as standard external