COOKR blocks tracking scripts server-side on WordPress before they load, enforcing cookie consent with a free CORE tier and an optional RADR add-on.
Category
Security
Pricing
Freemium: COOKR CORE is free with the full self-hosted runtime, auto-blocker, runtime inspector, CSP-aware mode, JavaScript API, and Google Consent Mode v2 support; the optional RADR add-on is €149/year (early access) for automatic third-party service detection and risk classification.
COOKR is consent infrastructure for WordPress sites, built by the German agency RipTight Marketing & Advertising. Instead of relying on JavaScript-based consent banners that toggle scripts after the fact, COOKR intercepts HTML output using WordPress's WP_HTML_Tag_Processor and rewrites tracking scripts to a non-executing type='text/plain' state inside the PHP output buffer, before anything reaches the visitor's browser. Consent state is stored in a first-party 'cookr_consent' cookie, and the default behavior is to block all configured scripts until consent is granted. Once a visitor consents, COOKR restores blocked scripts to their original executable form in their original order. The plugin supports a CSP-aware mode that propagates nonce values to restored scripts on WordPress 6.3+, integrates with Google Consent Mode v2, and exposes a JavaScript API (window.cookrConsent) with methods like has(), require(), and whenConsented() plus consent/change/decline/reset events for developers who need conditional script loading. It requires WordPress 6.2+ and PHP 7.4+ with no external dependencies, and is designed to work alongside caching plugins such as WP Rocket and LiteSpeed Cache. COOKR ships as a free CORE tier plus an optional paid RADR add-on for automated third-party service detection.
Key Features
Server-side script blocking — Intercepts HTML output with WordPress's WP_HTML_Tag_Processor and rewrites tracking scripts to a non-executing state in the PHP output buffer before the page reaches the browser.
Runtime Inspector — A debug panel (accessible via ?cookr_debug=1) that shows third-party scripts and iframes running on a page for discovery and troubleshooting.
CSP-aware restoration — Automatically propagates nonce values to restored scripts on WordPress 6.3+ so consented scripts run without needing unsafe-inline CSP exceptions.
Google Consent Mode v2 support — Configurable integration with Google Consent Mode v2 for consent-aware analytics and advertising signals.
JavaScript API — Exposes window.cookrConsent with has(), require(), and whenConsented() methods plus consent/change/decline/reset events for conditional script loading.
RADR automatic detection (paid add-on) — Adds automatic third-party service detection, risk classification, and a curated signature database on top of the free CORE tier.
Pros & Cons
Pros
Blocks tracking scripts server-side in the PHP output buffer, avoiding the race conditions common with JS-only consent banners
Free CORE tier gives full enforcement guarantees with no external dependencies or ongoing cost
CSP-aware nonce propagation and Google Consent Mode v2 support fit modern WordPress security setups
Cons
Limited to the WordPress ecosystem, so it isn't usable on other CMS or custom-built sites
Automatic third-party service detection requires the paid RADR tier rather than being included free
As an agency side-product with a narrow public footprint, it has less third-party track record than established consent-management platforms
Frequently Asked Questions
What platform does COOKR run on?
COOKR is a WordPress plugin that requires WordPress 6.2+ and PHP 7.4+, with no additional dependencies.
How does COOKR block tracking scripts?
It intercepts HTML output using WordPress's WP_HTML_Tag_Processor and rewrites script tags to a non-executing type='text/plain' state in the PHP output buffer, before the page reaches the browser.
Is COOKR free?
Yes, the CORE tier is free and includes the runtime, auto-blocker, runtime inspector, and JavaScript API. A paid RADR add-on (€149/year, early access) adds automated third-party detection.
Does COOKR work with caching plugins?
Yes, it's compatible with WP Rocket and LiteSpeed Cache as long as pages without a consent cookie are excluded from caching.