內容簡介
Okito Cookie Consent 是一款可自訂的 Cookie 同意橫幅外掛，幫助 WordPress 網站遵循 GDPR、CCPA 等隱私法規，並根據訪客的選擇管理 Google Analytics、Google Ads 等標籤。無需編碼或佈景主題變更，簡單設置即可使用。
【主要功能】
• 自訂 Cookie 同意橫幅設計
• 支援 Google Consent Mode v2
• 自動阻擋追蹤腳本
• Cookie 掃描與分類
• 記錄同意決策
• 50 多種語言支援
外掛標籤
開發者團隊
原文外掛簡介
Okito Cookie Consent adds a customizable cookie consent banner to your WordPress site and keeps Google Analytics, Google Ads and your other tags in line with each visitor’s choice. It helps you meet the GDPR, UK GDPR, ePrivacy, CCPA/CPRA and other US state privacy laws, Brazil’s LGPD and Türkiye’s KVKK.
You design the banner in the Okito dashboard; the plugin connects your site with one click and loads a single asynchronous script. No coding and no theme changes are needed.
Why Okito
Google Consent Mode v2 — ad_storage, analytics_storage, ad_user_data and ad_personalization are set before your Google tags run and updated the moment a visitor decides. Works with Google Analytics 4, Google Ads, Google Tag Manager and Site Kit by Google.
IAB TCF v2.4 — registered IAB Europe CMP (ID 508) with the full __tcfapi, Google Additional Consent (AC string) and Google’s enableAdvertiserConsentMode, for sites that run AdSense, Ad Manager or programmatic ads.
WP Consent API — every choice is passed to the WP Consent API, so Site Kit and other compatible plugins follow it automatically.
Geo-targeting by privacy law — show the banner only where consent is required (EEA, UK, Switzerland, Türkiye, Brazil and similar) and keep measurement on elsewhere.
US privacy — opt-out notice with a “Do Not Sell or Share My Personal Information” link, the IAB US Privacy API (__uspapi) and Global Privacy Control (GPC) support.
Automatic script blocking — tracking scripts wait until the visitor consents to their category.
Cookie scanner — Okito scans your site and sorts cookies into categories for your cookie policy.
Cookie table — the [okito_cookie_table] shortcode lists your site’s cookies on your cookie policy page, by category, and updates itself after every scan.
Consent records — every decision is logged as proof of consent.
50+ languages — the banner speaks your visitor’s language automatically.
Built for WordPress
Connect with Okito — sign in, pick your site and the banner is live. No key to copy.
Fast — one small asynchronous script. Nothing is rendered by PHP, so your pages stay light.
Caching and optimization friendly — works with WP Rocket, LiteSpeed Cache, Autoptimize, SiteGround Optimizer, W3 Total Cache and Cloudflare; the consent scripts are never delayed, combined or deferred.
Site Health checks — Tools → Site Health warns you about a second cookie plugin, a missing WP Consent API, Site Kit’s Consent Mode setting and Google tags that load before your consent defaults.
Debug mode — add ?okito_debug=1 to any URL to see whether the consent defaults load before your Google tags.
Free plan
Start free and upgrade when you need more websites or advanced features. See Okito pricing.
External services
This plugin relies on Okito, a third-party cookie consent and compliance platform operated by Okito (https://okito.com). It is required for the plugin to function: the banner, consent storage, IAB TCF v2.4 signals, Google Consent Mode v2 and the cookie scanner are all delivered by Okito’s service. A free plan is available.
The plugin contacts the Okito service in five ways:
CDN script load (visitor’s browser, public pages only when the banner is enabled)
Endpoint: https://cdn.okito.com/js/{WEBSITE_KEY} (and https://cdn.okito.com/js/{WEBSITE_KEY}/blocker.js when the Early blocker is on and no copy of it is available on your server, see 5)
When: On every public page view in the visitor’s browser, after the plugin is enabled and a Website Key is configured.
What is sent: The visitor’s browser performs a standard HTTPS request for the script file. This means Okito receives the Website Key (as part of the URL), the visitor’s IP address, User-Agent and the standard Referer header sent by the browser. While the banner is displayed, it stores the visitor’s consent choices in the browser (cookies / local storage) and reports anonymized consent metrics to Okito so they can be shown in your Okito dashboard.
Why: This is what renders the cookie consent banner, captures the visitor’s choice, blocks/unblocks tagged third-party scripts and feeds the Okito analytics for that website.
Admin “Test Connection” request (server-side, WordPress admin only)
Endpoint: https://cdn.okito.com/js/{WEBSITE_KEY}
When: Only when an administrator clicks the “Test Connection” button on the Okito → Settings page.
What is sent: A standard HTTPS GET request from your server containing only the Website Key entered in the form. No visitor data, posts or user information is transmitted.
Why: To verify that the Website Key is valid against the Okito CDN.
“Connect with Okito” (administrator’s browser, WordPress admin only)
Endpoint: https://app.okito.com/integrations/wordpress/connect
When: Only when an administrator clicks “Connect with Okito”.
What is sent: The site’s home URL, the URL of the plugin settings page and a random one-time code. After the administrator signs in to Okito and chooses a website, Okito sends the browser back to the settings page with the Website Key and the same code, which the plugin checks before saving the key.
Why: To connect the site to an Okito account without copying the Website Key by hand.
IAB TCF check (server-side)
Endpoint: https://cdn.okito.com/api/embed/{WEBSITE_KEY}/tcf-stub
When: When the Website Key is saved, then at most once an hour (every 5 minutes while Okito cannot be reached or the site is paused), in the background through WP-Cron after a public page is viewed. Pages do not wait for this request, except while there is no answer yet for the Website Key: then one public page every 5 minutes waits for it (up to 3 seconds) until Okito answers. On sites where WP-Cron does not run, a public page makes the request instead, as before version 1.1.6.
What is sent: A standard HTTPS GET request from your server containing only the Website Key. No visitor data, posts or user information is transmitted.
Why: To learn whether the site’s banner uses IAB TCF, so the IAB TCF stub is printed in the page head only when it is needed.
Early blocker script (server-side, public pages)
Endpoint: https://cdn.okito.com/js/{WEBSITE_KEY}/blocker.js (with a v parameter that changes every hour, so caches return a current copy)
When: While the Early blocker setting is on, at most once every 12 hours (every 10 minutes while Okito cannot be reached), in the background through WP-Cron after a public page is viewed. Pages do not wait for this request; on sites where WP-Cron does not run, a public page makes it instead (waiting at most 3 seconds).
What is sent: A standard HTTPS GET request from your server containing only the Website Key. No visitor data, posts or user information is transmitted.
Why: The early blocker (the same small script for every site) is printed inline at the top of the page, so visitors’ browsers do not wait for a separate request before the page renders. The last copy is kept in the WordPress options table.
The plugin does not send any other data to Okito or any other third party. No personal data of WordPress visitors is transmitted by PHP code in this plugin.
Use of the Okito service is subject to:
Okito Terms of Service: https://okito.com/terms-of-service/
Okito Privacy Policy: https://okito.com/privacy-policy/
Site administrators are responsible for ensuring their own privacy policy describes the use of Okito where required by law. Suggested wording is registered with WordPress and visible under Settings → Privacy after this plugin is active.
Privacy
This plugin:
Saves your Okito Website Key and an enabled/disabled flag in the WordPress options table.
When enabled, loads the script described in External services on public pages so visitors see the cookie banner and consent features.
Suggested wording for your Privacy Policy is available in WordPress under Settings → Privacy after this plugin is active.
