CookieHawk › Guides › Cookie banners on WordPress: getting it right

Cookie banners on WordPress, without assuming the job is done

On WordPress it is easy to install a consent plugin and assume the matter is settled. The problem is that tracking rarely lives where you think. Here is where it actually hides, and how to verify the result.

Updated 2 September 2026 · 6 minute read

Why a plugin alone rarely suffices

A consent plugin does two things well: it shows the banner, and it stores the choice. What it often does not do is stop code that other parts of the website load.

On a typical WordPress site, tracking comes from at least four places:

The theme. Many themes have their own fields for an Analytics ID or Meta pixel in their settings.
Plugins. Contact forms, shops, chat, galleries and share buttons often load third-party code.
Pasted-in code. A field for custom HTML in the head, or a snippet added by someone who helped you two years ago.
Google Tag Manager. Which in turn can load anything, without it being visible in WordPress.

Your consent plugin only knows about what it controls itself. The rest loads as before.

Find out what actually loads

Start by measuring, not guessing. You only need the browser:

Open the website in a private window.
Open developer tools, the Network tab, and reload without clicking the banner.
Note which external hostnames are contacted.
Click “Reject all”, reload, and see which ones are still there.

The list you are left with after a no is your work list. Everything else is noise.

Trace each one back to its source

Once you know what loads, you have to find where from. The order that saves the most time:

Check the theme settings first. Search for “Analytics”, “tracking”, “pixel” or “head” in the theme's panel.
Look under Appearance and Customise for fields containing custom code.
Go through the plugin list and ask of each: can this load anything external? Shops, forms, chat and analytics are the usual suspects.
If you use Google Tag Manager, the rest belongs there. See the guide on consent in GTM.
If you still cannot find the source, search the theme files for the hostname. Use a child theme if you edit, or the change disappears at the next update.

Do not delete anything before you know what it does. A snippet you remove may be the conversion tracking your ad budget is measured on. The goal is for it to wait for consent, not necessarily to disappear.

How to make no mean no

There are three ways to solve it, and they combine:

Move the tracking into Google Tag Manager and set consent requirements on each tag. Cleanest if you already use GTM.
Use a consent solution that blocks before loading. That also catches code sitting directly in the theme, without you having to move it.
Remove what you do not use. Many sites load tools nobody has looked at since they were installed. The fastest consent problem to solve is the one you can delete.

If you run WooCommerce

Shops have more necessary cookies than ordinary websites, and that is fine: basket and session are strictly necessary for the service the customer asked for, and require no consent.

But the same shops usually also have conversion tracking for Google Ads and Meta. That is not necessary, and it should wait for a yes. It is worth testing the checkout specifically — tracking that only fires there will not show up in a test of the front page alone.

Test again after every update

This is the step people skip. A setup that was correct in January can be wrong in March because the theme was updated or a plugin added a new integration.

Set a reminder, or use a solution that tests automatically and tells you when something changes. The point is that someone notices before a visitor does.

Common questions

Which consent plugin is best for WordPress?

What matters is not which plugin, but whether it actually blocks tracking before it loads rather than just showing a banner and storing the choice. Test the result in the Network tab after “Reject all”; that reveals the difference faster than any feature list.

I installed a plugin but Analytics still measures. Why?

Almost always because the Analytics code sits somewhere the plugin does not control: in the theme settings, in a custom code field, or in Google Tag Manager. The plugin only sees what it loads itself.

Do I need consent for WooCommerce's own cookies?

Basket, session and login are as a rule strictly necessary for the service the customer requested, and fall under the exemption. Conversion and marketing tracking does not.

Is testing the front page enough?

It is a good starting point, but not always sufficient. Shops should test the checkout too, and sites with embedded maps or video should test a page that actually has them.

Want to see what your WordPress site loads?

The free check tests your front page in a clean browser and shows which services are contacted before the choice and after “Reject all” — whether they came from the theme, a plugin or Google Tag Manager.

Check your website free