WordPress Consent Plugins That Actually Block Scripts Before Consent
Here is a test almost nobody runs. Open your site in a private window with developer tools recording, and watch the network tab before you touch the cookie banner. If Google Analytics, a Facebook pixel, or a YouTube embed has already fired, your banner is decoration and you are non-compliant regardless of how carefully its categories are worded.
This is the requirement regulators actually enforce, and it is the one plugin comparisons rarely test. A banner asks for permission; blocking is what makes the answer meaningful. This article covers how blocking works, which plugins do it properly, and the specific embeds that escape almost every implementation.
Verified August 2026. Related: our Consent Mode v2 guide covers the Google requirements and the pricing meters.
Automatic blocking versus manual wrapping
Automatic blocking means the plugin intercepts third-party scripts before they execute, without you doing anything. It recognises known trackers, holds them, and releases them only when the matching consent category is granted. This is what “automatic script blocking that intercepts third-party scripts without manual PHP wrapping” means in a feature list, and it is the property to buy on.
Manual wrapping means you find every tracking script yourself and wrap it in a conditional so it only runs after consent. It works, it is precise, and it fails the moment somebody installs a new plugin that adds a pixel nobody wrapped. On a site with several people making changes, manual wrapping degrades silently.
The distinction matters commercially because a banner plugin that only manages the banner is much easier to build than one that intercepts scripts reliably. Several tools present themselves as consent solutions while doing only the first job, which is why the test at the top of this article is worth more than any feature table.
The 6 options compared
1. Borlabs Cookie
The strongest blocker in this comparison and the one built around the problem rather than around the banner. Borlabs has a long-standing reputation for thorough interception, including the content-blocker treatment of embeds that most implementations let through.
Its handling of embedded content is the specific thing to note. A YouTube video, a Google Map, or an embedded font is a third-party request that fires on page load, and blocking it means replacing it with a placeholder the visitor can click to load. Borlabs does this properly, with per-service placeholders rather than blanket removal, so a blocked video shows a “click to load” panel instead of a gap. Pricing is from €49 a year for a single site, flat, with no traffic or pageview metering. Its German GDPR orientation produces conservative defaults, which suits the goal.
- Pricing: From €49 a year, single site, flat
- Blocking: Strongest here, including per-service embed placeholders
- Best for: Sites with embedded video, maps, and third-party content
- Watch out for: Conservative defaults reduce measured analytics
2. Complianz
The WordPress-native option with genuine automatic blocking and the most sensible pricing in the category at $59 a year for a single site, flat regardless of traffic. For most WordPress sites this is the right combination of capability and cost.
Its advantage over generic platforms is plugin awareness. Because it is built for WordPress, it recognises the plugins you have installed and configures blocking and categories around them, rather than requiring you to enumerate every script by hand. That reduces the most common cause of failure, which is not a plugin blocking badly but a human forgetting something. It handles Consent Mode v2 and consent logging alongside blocking, so it covers the full 2026 requirement set in one licence.
- Pricing: From $59 a year, single site, flat
- Blocking: Automatic, with plugin-aware configuration
- Best for: Most WordPress sites, as the default choice
- Watch out for: Still verify the unusual embeds yourself
3. Real Cookie Banner
A WordPress-focused consent plugin built with the same European regulatory orientation as Borlabs, and worth shortlisting specifically for blocking behaviour rather than banner design.
Its approach centres on treating each third-party service as a defined entity with known cookies, purposes, and blocking rules, rather than treating blocking as a generic script filter. That service-oriented model produces more accurate categorisation and, importantly, better handling when a service changes what it sets. It also keeps a consent log, which the 2026 requirement set makes non-negotiable. Confirm current pricing on the vendor’s site, and evaluate it head to head with Borlabs if embedded content is a significant part of your pages, since those two are the specialists here.
- Pricing: Free version available; confirm paid tiers with the vendor
- Blocking: Service-oriented model with defined blocking rules
- Best for: Accurate categorisation and consent records
- Watch out for: Compare directly against Borlabs on your own embeds
4. Cookiebot
Strong on the half of the problem that comes before blocking: discovering what your site actually sets. Its automatic scanner crawls your pages, identifies cookies including ones you did not know about, and rescans on a schedule so newly introduced trackers get caught.
You cannot block what you have not found, which is why discovery quality matters and why Cookiebot has a genuine claim here. Its blocking then operates on that inventory. Pricing is by page count, around €12 a month under 500 pages, €28 under 5,000, and €49 above, which is a meter worth checking against your archive size rather than your traffic. A content site with thousands of posts pays the top tier regardless of how few visitors it has, so at €588 a year the discovery advantage needs to be worth ten times a flat-fee plugin.
- Pricing: ~€12, €28, or €49 a month by page count
- Blocking: Good, operating on a strong automatic inventory
- Best for: Finding cookies you did not know you had
- Watch out for: Page count, not traffic, sets your tier
5. CookieYes
Priced from $10 a month on a pageview meter, easy to configure, and capable of handling several jurisdictions from one banner. For a small site wanting something working within an hour, it is a reasonable choice.
On blocking specifically it does the standard job for well-known trackers and is the one in this group where running the developer tools test matters most, because ease of setup and thoroughness of interception are different properties and this optimises for the first. Check your own site rather than the feature list, particularly if you run less common analytics, heatmapping, or chat widgets. The pageview meter also means your bill grows with your traffic while flat-fee alternatives do not, so model two years ahead before committing.
- Pricing: From $10 a month, scaling with pageviews
- Blocking: Standard coverage; verify unusual scripts yourself
- Best for: Quick setup across jurisdictions
- Watch out for: Cost rises with traffic; test your own stack
6. The scripts that escape everything
Not a product, and the section most likely to save you. Some requests slip past automatic blocking regardless of vendor, and they are predictable enough to check deliberately.
Server-side and hardcoded scripts added directly to a theme file are invisible to a plugin operating on the front end. Google Fonts loaded from Google’s servers transmit visitor IP addresses before any consent and have been the subject of enforcement in several jurisdictions; self-hosting fonts fixes this permanently and improves performance. Embedded maps, videos, and social widgets fire on load unless specifically placeholdered. Tag manager containers are a single allowed script that can load anything, so a blocked container is fine and an allowed one is a hole. And plugins that add pixels, particularly ecommerce and marketing plugins, frequently inject tracking your consent tool has never heard of.
- Cost: Free to check, and the highest-value ten minutes here
- Blocking: These are the gaps every vendor shares
- Best for: Everyone, after installing any consent tool
- Watch out for: Self-host fonts; placeholder every embed
Comparison table
| Option | Price | Meter | Automatic blocking | Embed placeholders |
|---|---|---|---|---|
| Borlabs Cookie | From €49/yr | None | Strongest | Yes, per service |
| Complianz | From $59/yr | None | Yes, plugin-aware | Yes |
| Real Cookie Banner | Free tier; confirm paid | None published | Yes, service-oriented | Yes |
| Cookiebot | €12 to €49/mo | Page count | Yes, on strong inventory | Yes |
| CookieYes | From $10/mo | Pageviews | Standard | Partial |
| Known gaps | Free to check | Not applicable | Not applicable | Your responsibility |
The ten-minute blocking test
- Open a private window with developer tools on the Network tab. Clear it, then load your homepage and do not touch the banner.
- Filter for the domains that matter. Look for google-analytics, googletagmanager, facebook, doubleclick, hotjar, and fonts.googleapis. Any request to these before consent is a failure.
- Repeat on a page with an embed. Videos, maps, and social feeds are where blocking most often stops. A properly blocked embed shows a placeholder, not the content.
- Check the Application tab for cookies. Anything beyond strictly necessary cookies set before a choice is the same failure in a different place.
- Now click Reject All and reload. Everything above should still be absent. Some implementations block only until a choice is made, then load regardless of which choice it was.
- Then accept, and confirm things fire. A banner that blocks permanently is also broken, just less legally.
Repeat this after any plugin installation that touches marketing, analytics, or embeds. That is when new scripts appear, and it is when a previously compliant site quietly stops being one.
Related guides
Frequently asked questions
Is a banner without blocking actually illegal?
Setting non-essential cookies before consent is the breach, and a banner that appears while tracking has already fired does not cure it. Automatic blocking before consent is listed among the mandatory features for 2026 compliance for exactly this reason.
What about Google Fonts?
Loading them from Google’s servers transmits visitor IP addresses before consent and has drawn enforcement in several jurisdictions. Self-host them. It resolves the privacy issue permanently and removes a render-blocking third-party request.
Do I need to block YouTube embeds?
Yes, unless consent has been given, because the embed contacts Google on load. A placeholder that loads the video when clicked is the standard pattern and the better plugins here supply one.
Does blocking break my site?
It should not, but test it. Chat widgets, review carousels, and payment scripts occasionally sit in a category you blocked, and the symptom is a missing feature nobody reports. Walk your key pages after configuring.
Will I lose analytics data?
Yes, from visitors who decline, which is the intended outcome. Consent Mode v2 recovers some of it through modelling, which is a reason to implement that properly rather than to weaken your blocking.
Can a tag manager container be blocked?
It can, and it is the highest-leverage single block because everything inside it inherits the decision. The alternative is managing consent inside the container itself, which works but moves the responsibility somewhere your consent plugin cannot see.
The verdict
If your pages carry embedded video, maps, or social content: Borlabs Cookie from €49 a year. Its per-service placeholders handle the case that defeats most implementations, and the pricing is flat.
For most WordPress sites: Complianz at $59 a year, flat, with plugin-aware automatic blocking that reduces the chance of somebody forgetting a script.
If you do not know what your site sets: Cookiebot for discovery, budgeting by page count rather than traffic. You cannot block what you have not found.
Then run the ten-minute test regardless of what you bought. Self-host your fonts, placeholder your embeds, and check the network tab before touching the banner. That test is the only thing here that tells you about your site rather than about a product.
