Cookiebot – WordPress GDPR Cookie Consent and Control Plugin

Cookiebot by Usercentrics wins on scanning depth. Its crawler runs pages in a real browser environment, which means it catches cookies set by JavaScript, third-party embeds, and advertising networks – not just the first-party cookies your own WordPress sets. The declaration table updates after every scan, so the documentation matches what the site actually does. Combined with prior-consent blocking (nothing non-essential fires before the visitor chooses), IAB TCF support for the European ad ecosystem, and Google Consent Mode v2, it is the tool agencies standardize on when compliance evidence needs to survive scrutiny. Against lighter banner tools, the trade is clarity of setup versus depth of detection.

The 4.7 line is notable for operations people: WP-CLI commands (wp cookiebot status, verify, compliance, set-cbid, toggle-gcm) enable scripted configuration across server fleets, and the new Abilities API integration exposes configuration to REST clients and AI agents – with an audit log capping and recording every automated write. That is consent management treated as infrastructure, not just a banner.

Competitive Features

• Real-browser deep scanning – detects third-party, session, and persistent cookies from embedded services
• Prior consent blocking – no non-essential cookies before explicit visitor choice
• IAB TCF framework support – ad networks read consent state directly from Cookiebot
• Google Consent Mode v2 – full default/update signal passing to Google services
• Auto-updating declaration – cookie list refreshes after every scan with descriptions and durations
• 35+ language banners – automatic locale adaptation
• WP-CLI command suite – scripted configuration, verification, and compliance checks

Key Features

• Scheduled weekly scans – selective re-scan of changed pages keeps detection current
• Consent statistics – rates by category and country in the dashboard
• [cookie_declaration] shortcode – publish a live cookie list on any page
• Domain group management – one consent across multiple domains and subdomains
• Custom blocking rules – APIs for scripts the auto-detection misses
• Consent history log – timestamped records for compliance documentation
• Abilities API + audit log – six REST-exposed abilities with every automated write recorded

Comparison with Competitors

Cookiebot Premium vs Jetpack Security

Aspect	Cookiebot Premium	Jetpack Security
Job	Consent and cookie compliance	Backup, scan, and defense
Data location	Usercentrics cloud	Automattic cloud
Scanning	Real-browser cookie crawler	Malware scanning
Legal function	Core purpose	None
Multi-domain	Domain groups	Per-site

Bottom line: Both are cloud services with different mandates. Jetpack Security guards against attacks and data loss; Cookiebot governs what trackers may do with visitor data. Compliance-focused sites run both – they answer different regulatory questions.

Cookiebot Premium vs Wordfence Premium

Aspect	Cookiebot Premium	Wordfence Premium
Focus	Privacy compliance	Firewall and malware defense
Blocking scope	Trackers pre-consent	Exploits pre-request
Data location	Usercentrics cloud	Self-hosted + Wordfence cloud
Audit evidence	Consent records	Threat and scan logs
Overlap	None	None

Bottom line: Different halves of a defensible site. Wordfence Premium handles the attack surface; Cookiebot handles the privacy surface. Regulators and attackers ask different questions – this stack answers both.

Recommended Stack – consent platforms and backup tools both guard irreplaceable records. Pair Cookiebot with UpdraftPlus Premium so consent logs and configuration survive any site-level failure.

Official Changelog

Version 4.7.2

Release Date: June 22, 2026

• Improvement: WordPress tested-up-to version set to 7.0.
• Fix: Gutenberg block registered with API version 1 instead of version 3, resolving a deprecation warning in the block editor.

Version 4.7.1

Release Date: May 20, 2026

• Improvement: WordPress tested-up-to version set to 7.0-RC1.
• Improvement: Updated UTM parameters on AI assistant setup links in AGENTS.md and CLAUDE.md for improved tracking.

Version 4.7.0

Release Date: May 7, 2026

• New: WP-CLI commands for scripted configuration – wp cookiebot status, wp cookiebot verify, wp cookiebot compliance, wp cookiebot set-cbid, wp cookiebot toggle-gcm, and wp cookiebot install-ppg.
• New: WordPress Abilities API integration – six abilities expose plugin configuration to AI agents and REST clients: cookiebot/get-status, cookiebot/verify-setup, cookiebot/get-compliance-summary, cookiebot/set-cbid, cookiebot/toggle-gcm, and cookiebot/install-ppg.
• New: Audit log for AI-driven write operations – changes made via abilities are stored in cookiebot-ai-action-log (capped at 50 entries, with timestamp, ability name, user, old and new values).
• Improvement: Added AGENTS.md and CLAUDE.md to the plugin root with agent-readable setup guidance, compliance coverage map, and post-install verification checklist.

Frequently Asked Questions

How does Cookiebot scan for cookies?
The scanner loads your pages in a real browser environment, executing JavaScript and capturing cookies set by scripts, third-party embeds, and server responses. Each cookie is categorized by purpose, and the declaration updates automatically after each scan.

Is there a free version of Cookiebot?
Yes – a limited plan covers one domain with up to 50 subpages and one banner language. Paid tiers add unlimited subpages, multiple languages, prior consent, and statistics.

Does Cookiebot work with Google Consent Mode?
Yes, fully. It passes both default and update consent signals to Google Analytics, Google Ads, and Tag Manager, so measurement adapts in real time to each visitor’s choices.

What is IAB TCF support for?
The IAB Transparency and Consent Framework lets advertising networks and exchanges read the visitor’s consent state directly from Cookiebot. Without it, ad personalization on European traffic operates in a legal gray zone.

Can I manage consent across several domains?
Yes. Domain group management applies one consent state across multiple domains and subdomains from a single account – visitors tracked across your properties see consistent banner behavior.