CookieFlame Wordpress Plugin - Rating, Reviews, Demo & Download
Plugin Description
CookieFlame is a cookie consent plugin for WordPress that does three things most other free plugins do not. It finds the cookies on your site automatically by watching real visitor sessions. It runs entirely on your own server with no outside connections. And it shows the right banner for each visitor based on where they are, rather than showing a single GDPR banner to the whole world.
It is built by [Zoobu] and the full product site is at cookieflame.com.
🔍 Cookie discovery, continuously
Most consent plugins expect you to know which cookies your site sets. CookieFlame does not. A lightweight beacon watches real visitor sessions in the background and reports any cookies it has not seen before. New plugin installed? Its cookies surface automatically. Tracking tag changed? Picked up next time a visitor triggers it. No scheduled scans, no headless browsers, no external scanning service.
For a one-off inventory you can also run an on-demand Discovery scan from the admin. Browse your own site as logged in, watch the discovery bar accumulate cookies and detected services, click Finish when done.
🌍 Correct behaviour per region
CookieFlame detects visitor country and shows the banner that region actually requires:
- EU, UK, EEA, Switzerland: full two-step GDPR opt-in banner with Accept, Manage Preferences, and Decline
- California and other US states with similar laws: compact CCPA opt-out notice with a Do Not Sell link
- Brazil (LGPD) and South Africa (POPIA): GDPR-style opt-in banner
- Everywhere else: no banner, all cookies auto-granted
Detection uses three layers in order: Cloudflare and other CDN country headers first (zero latency, works with every caching setup), then a local MaxMind GeoLite2 database if uploaded, then a browser timezone heuristic as a last-resort fallback. If all three fail, the plugin defaults to GDPR opt-in for safety rather than silently granting consent.
🔒 No outside connections
CookieFlame does not load JavaScript from any content delivery network, does not call any geo API, does not phone home. Every part of the consent flow runs on your server and in the visitor’s browser. The only optional outbound request is Google Tag Manager itself, if you enter a GTM container ID in the settings (see the External services section below).
This matters because a consent tool that itself sets third-party cookies is an awkward contradiction, and because self-hosted plugins keep working during outages of services you did not choose to depend on.
🚫 Server-side script blocking
When a visitor has not granted consent, CookieFlame rewrites tracking scripts in the HTML output so the browser does not execute them. This happens before the page leaves your server, which means it works with any caching stack: WP Rocket, LiteSpeed, Cloudflare APO, W3 Total Cache, and others all hold the correct pre-modified HTML. A lighter JavaScript layer handles scripts injected later by GTM or other plugins.
Known trackers are blocked from the moment you install the plugin. Ten services ship with built-in patterns: Google Analytics, Google Ads, Google Tag Manager, Microsoft Ads, Meta and Facebook, Twitter and X, LinkedIn, Pinterest, Reddit, TikTok. Anything else you classify in the Cookie Manager gets a matching block rule generated automatically.
🪟 Iframe facades
YouTube, Vimeo, Google Maps, Spotify, SoundCloud, Dailymotion, and Elementor video widgets are replaced with click-to-accept placeholders until the visitor grants consent. The iframe source is stripped synchronously before the embed has a chance to contact its origin.
📊 Google Consent Mode v2
All seven Google consent signals are managed automatically and set to denied by default before any tag runs. When a visitor grants consent, the correct signals update immediately. Returning visitors keep their stored choices, with the signals restored before GTM loads (so the first dataLayer push is already correct).
Works with a GTM container ID you paste into the settings. No separate GTM consent template, no additional configuration. The plugin also injects the body noscript tag in the correct position.
🛡️ Global Privacy Control
GPC is detected automatically and suppresses marketing consent for CCPA visitors. Required by California, Colorado, Connecticut, Texas, and nine other US states. Turning GPC off later restores the visitor’s original stored choice rather than overwriting it.
📜 IAB TCF v2.2
A TCF v2.2 stub is registered on every page so ad-tech vendors that need TCF signals can read them.
🚀 Lightweight and framework-free
The frontend JavaScript is a single 37 KB file (12 KB gzipped) with no jQuery and no framework dependencies. A separate facades bundle is only loaded on pages that actually contain a blockable embed. The Discovery bundle only loads for administrators during an active scan.
👨💻 Developer-friendly
- Event API with CustomEvents: cc:ready, cc:update, cc:accept-all, cc:decline-all, cc:save
- Public JavaScript API for reading consent state and showing the banner on demand
- Per-category onAccept and onReject callbacks
- Extension points via WordPress filters and actions
- Optional consent log endpoint for audit trails
✨ Want automatic classification?
CookieFlame Pro adds automatic cookie classification using a central database and AI. You click Auto-Identify All, and the plugin classifies every unclassified cookie with vendor, category, and purpose, then generates the blocking rules automatically. Flat annual pricing by number of sites, no pageview limits. Learn more at cookieflame.com.
📋 Compliance note
CookieFlame provides tools that help support compliance with GDPR, CCPA, LGPD, POPIA and similar regulations. Compliance itself is the site owner’s responsibility and depends on how the plugin is configured. For legal advice, consult a qualified professional.
External services
CookieFlame is a self-hosted plugin. By default it does not contact any external service from the visitor’s browser, and it does not phone home.
There is one optional external interaction, only if the site owner configures it.
Google Tag Manager (optional)
If the site owner enters a Google Tag Manager container ID on the CookieFlame Tag Managers settings tab, CookieFlame injects the standard Google Tag Manager script (https://www.googletagmanager.com/gtm.js) into the site front-end under the visitor’s consent. This script is provided by Google and is loaded from Google’s servers when the page is viewed.
- What is sent: standard Google Tag Manager request, including the container ID and whatever browser request data Google receives for any embed.
- When: only if the admin has set a GTM container ID, and only when a visitor loads a page and has consented.
- Google Tag Manager terms: https://marketingplatform.google.com/about/analytics/tag-manager/use-policy/
- Google privacy policy: https://policies.google.com/privacy
If no GTM container ID is set, no request is made.
Microsoft UET (Bing Ads tag, optional)
If the site owner enters a Microsoft UET tag ID on the CookieFlame Tag Managers settings tab, CookieFlame injects the standard Microsoft UET loader script (https://bat.bing.com/bat.js) into the site front-end. The loader is provided by Microsoft and is loaded from Microsoft’s servers when the page is viewed.
The UET runtime reads Microsoft Consent Mode v2 signals from the dataLayer that CookieFlame already manages, so the loader honours visitor consent internally: tracking events do not record until the visitor has granted Marketing consent. The loader script itself is fetched on every page load while a UET tag ID is configured.
- What is sent: the UET tag ID, plus the standard browser request data Microsoft receives for any third-party script load (visitor IP, user agent, page URL, referer).
- When: every page load while a UET tag ID is configured, except for visitors whose browser sends the Do Not Track header in which case CookieFlame suppresses the injection entirely.
- Microsoft Advertising agreement: https://about.ads.microsoft.com/en/resources/policies/microsoft-advertising-agreement
- Microsoft privacy statement: https://privacy.microsoft.com/en-gb/privacystatement
If no UET tag ID is set, no request is made.
Consent log endpoint (optional, site-owner-nominated webhook)
If the site owner enters a URL in the Consent Log endpoint setting, CookieFlame sends a JSON record of each consent decision to that URL from the visitor’s browser via navigator.sendBeacon (with a fetch fallback for browsers without sendBeacon). The default for this setting is empty, in which case nothing is sent. The destination URL is nominated by the site owner; terms and privacy obligations for that URL are the site owner’s responsibility, not CookieFlame’s.
- What is sent: a JSON payload containing an anonymous ID, an ISO-8601 timestamp, the action that produced the record (accept-all, decline-all, save, or one of the region-based auto-grants), the per-category consent decision (necessary, preferences, analytics, marketing), the compliance mode (gdpr, ccpa, none), the visitor country code, the page URL, the user agent string, the TCF v2.2 flag, the Global Privacy Control flag, the consent policy version, and the plugin version. No cookie values are included. No IP address is included in the payload, although the receiving endpoint will of course see the visitor IP via the underlying HTTP request, the same as any other request.
- When: every time the visitor’s consent state is set. This includes banner actions (accept-all, decline-all, save) and region-based auto-grants for visitors outside GDPR regions and for CCPA opt-out visitors.
If no Consent Log endpoint URL is set, no request is made.
Domain strings in the plugin code
The plugin code contains many third-party domain names (for example, connect.facebook.net, googletagmanager.com, and similar). These are pattern strings used for local matching only. They identify scripts that may already be present on the admin’s site so CookieFlame can detect them, show them to the admin in the Cookie Manager, and block them until the visitor has given consent. CookieFlame does not fetch from these domains.
Screenshots
No screenshots provided
