[WordPress] 外掛分享： MantaWeb Consent Shield – Cookie Consent Banner & Real Cookie Blocker (GDPR, CCPA, Tikun 13)

內容簡介

MantaWeb Consent Shield 是一款針對 WordPress 的隱私同意管理外掛，提供可配置的同意橫幅和主動的腳本及 Cookie 阻擋功能，幫助網站遵循各項隱私法規，如 GDPR、CCPA 和 Tikun 13。

【主要功能】
• 可配置的四類同意橫幅
• 真實的腳本和 Cookie 阻擋器
• 合規工具與檢查清單
• 審計和數據管理功能
• 可訪問的同意橫幅設計

外掛標籤

開發者團隊

原文外掛簡介

MantaWeb Consent Shield is a privacy consent management plugin for WordPress built by MantaWeb. It combines a configurable consent banner with an active script and cookie blocker, a full audit log, and a compliance checklist – all without sending any data to external servers.
Who it is for
Any WordPress site that needs to comply with:

Israeli Privacy Law Amendment 13 (Tikun 13, in force August 2025)
GDPR + ePrivacy Directive (EU / UK)
CCPA “Do Not Sell My Personal Information” (California)

How it works
When a visitor lands on your site, Consent Shield shows a consent banner before any third-party scripts run. Scripts are blocked server-side using an output-buffer HTML rewriter – not just via the WordPress wp_enqueue_script filter. This means inline scripts (Google Tag Manager, Meta Pixel, GA4 config calls), iframes (YouTube, Vimeo, Google Maps), and tracking pixels are all held until the visitor gives consent, even when the page is served from a Cloudflare cache or WP-Rocket.
After consent, the plugin stores the record in a local database table with an INSERT-only write path (a stored record is never rewritten) and fires Google Consent Mode v2 signals automatically for GA4 and Google Ads. Records leave the table only through the retention policy you configure, or an explicit “Clear Log”.
Key features – Free
4-category consent banner
* Necessary, Functional, Analytics, Marketing categories
* 1-button, 2-button, and 3-button layouts (configurable in the wizard)
* Fully customizable text – edit every word the visitor sees from the admin UI
* Floating privacy pill for post-consent withdrawal (required by Tikun 13)
* [mantacs_dsar_button] shortcode: adds a “Request my data” button that opens the visitor’s mail client with a pre-filled DSAR email addressed to your DPO
Real script and cookie blocker
* Output-buffer HTML rewriter – blocks scripts and iframes that bypass wp_enqueue_script
* Click-to-load placeholders for YouTube, Vimeo, and Google Maps embeds
* Cookie Sweeper removes cookies not belonging to consented categories on consent change
* Works behind Cloudflare cache, WP-Rocket, and other full-page caching systems
* Survives page optimisers: the banner’s position is set on the element itself, so “remove unused CSS” tools cannot flatten it; WP Rocket gets the needed exclusions (Remove Unused CSS, Delay JS, Defer JS, Lazy Rendering) automatically, and its page and minify caches are purged after each plugin update
* Self-check: the banner verifies it rendered as a floating layer and flags an admin notice if an optimiser broke it; a “Check the live page” button on the Compliance tab verifies the inline scripts reached visitors intact
* pcm_consent_update dataLayer event with the state of every category, for Google Tag Manager triggers
* ~50 built-in service definitions including Israeli payment gateways (Tranzila, Cardcom, Bit, iCount, ActiveTrail, Smoove)
Compliance tools
* Google Consent Mode v2 automatic wiring for GA4
* IP anonymization – IPv4 masked to /24, IPv6 to /48 (default ON)
* Tikun 13 compliance checklist with automatic checks and manual-check guidance
* Policy versioning – one click forces re-consent from all visitors
* Bot detection – hides the popup from search engine crawlers
Audit and data management
* INSERT-only consent log: a stored record is never rewritten, so the log is an audit trail for as long as your retention policy keeps it (default 365 days / 20,000 records, both adjustable, and “keep forever” is an option)
* CSV export from the admin UI
* Admin activity log tracks every settings change
* WP-CLI commands: wp pcm status, wp pcm consents export, wp pcm policy bump, wp pcm tikun13 check, wp pcm wizard reset, wp pcm cache flush
Accessible consent banner
* Built to meet WCAG 2.1 AA for the consent interface – keyboard and screen-reader accessible, EAA-aware
* Proper dialog semantics: role="dialog" + aria-modal for the overlay banner, a labelled role="region" for the quiet inline banner
* Focus is moved into the banner on open, kept inside it while it is open, and restored on close – and it is never pre-placed on “Accept”
* Real and controls with visible focus indicators, not clickable

s
* Live contrast badges in the admin colour picker warn you before you ship a low-contrast palette
* prefers-reduced-motion honoured in both CSS and the JS fade helpers
Setup
* 5-step guided setup wizard (~3 minutes)
* All banner texts editable from the admin “Custom Texts” tab
* Light/dark mode support via CSS custom properties
What makes it different
Real blocker, not just an enqueue filter. Most consent plugins only hook into wp_enqueue_script. Consent Shield rewrites the HTML output server-side, so GTM’s dataLayer push, inline fbq() calls, and hardcoded