[WordPress] 外掛分享： MantaWeb Consent Shield – Cookie Consent Banner & Real Cookie Blocker (GDPR, CCPA, Tikun 13)

內容簡介

MantaWeb Consent Shield 是一款針對 WordPress 的隱私同意管理外掛，提供可配置的同意橫幅以及主動的腳本和 Cookie 阻擋功能，幫助網站遵循 GDPR、CCPA 和 Tikun 13 法規，並且不會將任何數據發送至外部伺服器。

【主要功能】
• 四類別同意橫幅：必要、功能、分析、行銷
• 真實腳本和 Cookie 阻擋器，支援多種嵌入內容
• 合規工具，包含 Google Consent Mode v2 自動連接
• 審計和數據管理，提供可調整的記錄保留政策
• 無障礙同意橫幅，符合 WCAG 2.1 AA 標準
• 5 步驟引導設置精靈，快速完成設置

外掛標籤

開發者團隊

原文外掛簡介

MantaWeb Consent Shield is a privacy consent management plugin for WordPress built by MantaWeb. It combines a configurable consent banner with an active script and cookie blocker, a full audit log, and a compliance checklist – all without sending any data to external servers.
Who it is for
Any WordPress site that needs to comply with:

Israeli Privacy Law Amendment 13 (Tikun 13, in force August 2025)
GDPR + ePrivacy Directive (EU / UK)
CCPA “Do Not Sell My Personal Information” (California)

How it works
When a visitor lands on your site, Consent Shield shows a consent banner before any third-party scripts run. Scripts are blocked server-side using an output-buffer HTML rewriter – not just via the WordPress wp_enqueue_script filter. This means inline scripts (Google Tag Manager, Meta Pixel, GA4 config calls), iframes (YouTube, Vimeo, Google Maps), and tracking pixels are all held until the visitor gives consent, even when the page is served from a Cloudflare cache or WP-Rocket.
After consent, the plugin stores the record in a local database table with an INSERT-only write path (a stored record is never rewritten) and fires Google Consent Mode v2 signals automatically for GA4 and Google Ads. Records leave the table only through the retention policy you configure, or an explicit “Clear Log”.
Key features – Free
4-category consent banner
* Necessary, Functional, Analytics, Marketing categories
* 1-button, 2-button, and 3-button layouts (configurable in the wizard)
* Fully customizable text – edit every word the visitor sees from the admin UI
* Floating privacy pill for post-consent withdrawal (required by Tikun 13)
* [mantacs_dsar_button] shortcode: adds a “Request my data” button that opens the visitor’s mail client with a pre-filled DSAR email addressed to your DPO
Real script and cookie blocker
* Output-buffer HTML rewriter – blocks scripts and iframes that bypass wp_enqueue_script
* Click-to-load placeholders for YouTube, Vimeo, and Google Maps embeds
* Cookie Sweeper removes cookies not belonging to consented categories on consent change
* Works behind Cloudflare cache, WP-Rocket, and other full-page caching systems
* ~50 built-in service definitions including Israeli payment gateways (Tranzila, Cardcom, Bit, iCount, ActiveTrail, Smoove)
Compliance tools
* Google Consent Mode v2 automatic wiring for GA4
* IP anonymization – IPv4 masked to /24, IPv6 to /48 (default ON)
* Tikun 13 compliance checklist with automatic checks and manual-check guidance
* Policy versioning – one click forces re-consent from all visitors
* Bot detection – hides the popup from search engine crawlers
Audit and data management
* INSERT-only consent log: a stored record is never rewritten, so the log is an audit trail for as long as your retention policy keeps it (default 365 days / 20,000 records, both adjustable, and “keep forever” is an option)
* CSV export from the admin UI
* Admin activity log tracks every settings change
* WP-CLI commands: wp pcm status, wp pcm consents export, wp pcm policy bump, wp pcm tikun13 check, wp pcm wizard reset, wp pcm cache flush
Accessible consent banner
* Built to meet WCAG 2.1 AA for the consent interface – keyboard and screen-reader accessible, EAA-aware
* Proper dialog semantics: role="dialog" + aria-modal for the overlay banner, a labelled role="region" for the quiet inline banner
* Focus is moved into the banner on open, kept inside it while it is open, and restored on close – and it is never pre-placed on “Accept”
* Real and controls with visible focus indicators, not clickable

s
* Live contrast badges in the admin colour picker warn you before you ship a low-contrast palette
* prefers-reduced-motion honoured in both CSS and the JS fade helpers
Setup
* 5-step guided setup wizard (~3 minutes)
* All banner texts editable from the admin “Custom Texts” tab
* Light/dark mode support via CSS custom properties
What makes it different
Real blocker, not just an enqueue filter. Most consent plugins only hook into wp_enqueue_script. Consent Shield rewrites the HTML output server-side, so GTM’s dataLayer push, inline fbq() calls, and hardcoded