How to Add a Cookie Consent Banner in WordPress

If your site uses analytics, embeds social media widgets, or loads any third-party scripts, it almost certainly sets cookies on visitors’ devices. In the EU, UK, and several other regions, those cookies require informed consent before they run. Most new WordPress sites have a privacy policy and maybe a cookie policy page, but no visible mechanism for collecting or managing that consent.

The gap matters. A banner that says “we use cookies — OK” with a single button is not consent under GDPR. Neither is a footer notice. Real compliance means giving visitors a genuine choice, blocking non-essential cookies until they accept, and keeping a record of what they consented to. A good cookie consent plugin handles all of that automatically once it’s configured correctly.

This guide walks through adding a cookie consent banner to a new WordPress site, covering plugin choice, the setup wizard, cookie blocking, and testing. If you haven’t yet created your cookie policy page, do that first — the banner needs to link to it. How to Create a Cookie Policy Page for Your Website covers what to include and how to set it up.

In Short

Install a cookie consent plugin (Complianz or CookieYes are the most complete free options), run the setup wizard, connect your cookie policy URL, enable automatic cookie blocking for non-essential scripts, and save. The banner appears automatically on every page and blocks tracking cookies until a visitor gives consent.

Why Cookie Consent Matters for a New Website

GDPR (General Data Protection Regulation, EU), PECR (UK), LGPD (Brazil), and other regional laws require websites to obtain consent before setting non-essential cookies. Non-essential cookies include Google Analytics, Facebook Pixel, advertising cookies, and most tracking scripts from third-party services.

Two things catch new site owners off guard. First, Google Analytics sets cookies — so if you have analytics running without a consent mechanism, you’re non-compliant for EU and UK visitors from day one. Second, many generic “cookie notice” plugins only display an informational message without actually blocking cookies until consent is given. That satisfies the notice requirement but not the consent requirement.

A properly configured cookie consent banner handles both: it informs visitors of what cookies your site uses, collects their decision, and prevents non-essential cookies from loading until they’ve agreed. It also links to your cookie policy, where visitors can find the full details. How to Secure a WordPress Website covers the broader steps of protecting your site from day one, including plugin choices that affect compliance.

Choosing a Cookie Consent Plugin

For most new WordPress sites, two plugins stand out at the free tier, and they take genuinely different approaches:

• Complianz — GDPR/CCPA Cookie Consent is local-first: the setup wizard, styling, and cookie database all live inside your own WordPress dashboard, with no external account to manage. It scans your site for cookies and third-party services, categorises them, and generates a banner configured for the relevant laws based on your settings. Its free tier covers most small sites; the paid version starts at roughly $59/year per site if you need multi-region compliance features.
• CookieYes is cloud-first — the cookie scan, consent logs, and banner design are managed through CookieYes’s own dashboard rather than WordPress, which keeps the processing off your server. It’s generally the quicker of the two to get a working banner live, often in under ten minutes. Its free tier has usage limits, with paid plans starting around $10/month per domain.

Avoid plugins that only display a notice without offering a way to decline. These don’t satisfy GDPR consent requirements and can leave you exposed. Both Complianz and CookieYes support Google Consent Mode v2, which matters if you also want Google Analytics to keep collecting anonymised data from visitors who decline. In my experience, Complianz is the better fit for a site that lives entirely on WordPress and wants everything managed from the same dashboard; CookieYes suits anyone who wants the banner live with minimal configuration.

How to Set Up a Cookie Consent Banner in WordPress

Step 1 — Install the Plugin

Go to Plugins → Add New in your WordPress dashboard, search for “Complianz” or “CookieYes”, install, and activate. You’ll see a new menu item in your dashboard after activation.

Step 2 — Run the Setup Wizard

Both Complianz and CookieYes prompt you to start a setup wizard after activation. Work through it — it asks for:

• Your business location — determines which laws apply by default
• Which regions’ laws you want to comply with — GDPR (EU/UK), CCPA (California), and others can be enabled individually
• What your site does — whether it collects personal data, runs ads, or uses analytics
• Your cookie policy URL — the URL of the cookie policy page on your site

If you’re using Complianz, it will also run an automated scan of your site to detect third-party cookies and scripts. The scan results appear in the dashboard and form the basis of the banner categories (necessary, analytics, marketing, etc.).

Step 3 — Connect Your Cookie Policy Page

The banner needs a link to your cookie policy so visitors can read the full details before deciding. In the plugin settings, find the “Cookie Policy URL” field and enter the URL of your cookie policy page.

If you haven’t created a cookie policy page yet, How to Create a Cookie Policy Page for Your Website walks through exactly what to include. The cookie policy should list each category of cookie your site sets, who sets them, and how long they persist.

Step 4 — Enable Automatic Cookie Blocking

This is the step most people miss. Displaying a banner is not the same as blocking cookies. For GDPR compliance, non-essential cookies must not fire until a visitor accepts them.

In the plugin settings, look for “Automatic Cookie Blocking”, “Script Blocking”, or similar. Enable it. This setting intercepts third-party scripts (like Google Analytics) and holds them until consent is granted. In Complianz, this is managed through their “Integrations” section, which auto-configures blocking for common plugins like Google Site Kit and MonsterInsights.

Step 5 — Customise the Banner Appearance

Both plugins offer layout and colour options. Choose a banner style that suits your site (bottom bar, floating button, or full popup), adjust the colours to match your branding, and review the button labels.

A few things to check for compliance:

• The “Accept” and “Decline” or “Reject” options should be equally prominent — hiding or de-emphasising the decline option is not GDPR-compliant
• No categories should be pre-ticked except “Necessary” cookies, which don’t require consent
• The banner text should be clear about what visitors are consenting to, not vague

Step 6 — Test in an Incognito Window

Open your site in a fresh incognito or private browsing window. The banner should appear immediately, before any tracking cookies are set. Use your browser’s developer tools (Application → Cookies) to verify that only “Necessary” cookies are present before you accept anything.

After clicking Accept All, check again — analytics and marketing cookies should now appear. After clicking Decline or Reject, they should not.

Worth Doing Once You’re Live

• Rescan after adding new plugins or embeds. If you add a new analytics tool or embedded widget later, run the cookie scanner again. New third-party cookies won’t be automatically categorised until you do.
• Enable Google Consent Mode integration if available. If you use Google Analytics 4, Complianz and CookieYes both support Google Consent Mode, which lets Analytics collect anonymised data even when a visitor declines cookies. This preserves some data while respecting their choice.
• Your cookie policy and your banner categories should match. If your banner lists “analytics” and “marketing” categories, your Cookie Policy page should describe exactly which cookies fall into each category.
• Don’t ignore “Necessary” cookies. These don’t need consent but should still be listed in your cookie policy. Examples include session cookies, login tokens, and cookies used for the consent banner itself.

Common Mistakes to Avoid

• Displaying a notice instead of a consent mechanism. A banner with only an “OK” or “Got it” button doesn’t collect meaningful consent. Visitors need a genuine option to accept or decline non-essential cookies.
• Not enabling cookie blocking. The banner is visual — the blocking is functional. Without it, cookies fire regardless of what visitors click, which defeats the purpose entirely.
• Pre-ticking non-essential categories. Under GDPR, consent must be freely given and un-coerced. Pre-ticking “Analytics” or “Marketing” is not compliant.
• Linking to the wrong policy URL. Double-check that the banner links to your actual cookie policy, not your privacy policy (though both are important — How to Create a Privacy Policy Page for Your Website covers that separately).
• Skipping the incognito test. Your own browser may be storing previous cookie preferences, so testing while logged in or in a regular browser window won’t show you what new visitors see.

When to Revisit Your Cookie Settings

Your cookie consent setup isn’t a one-time task. Revisit it when:

• You add a new third-party plugin or embed that may set additional cookies
• You add a new advertising or marketing tool (Facebook Pixel, Google Ads tag, etc.)
• Privacy law changes affect how consent must be collected in your target regions
• You expand to serve visitors from additional regions with their own consent requirements

Running the plugin’s cookie scanner again takes a few minutes and keeps your categories accurate.

The Bottom Line

Cookie consent is one of those compliance tasks that’s easy to put off because it doesn’t feel urgent until someone raises it. Install Complianz or CookieYes, run the setup wizard, enable cookie blocking, and test it in incognito mode. Once it’s done, it runs automatically in the background. Just remember to rescan whenever you add new third-party tools to your site.