Calucon Third-Party Embed Gate

No plugin can claim that, and this one does not. Calucon Third-Party Embed Gate implements a technical measure: it prevents third-party embed requests, and the storage they trigger on the visitor's device, until the visitor explicitly asks for the content. Whether your site's processing as a whole is lawful depends on things a plugin cannot know. The background — 25 TDDDG / ePrivacy Art. 5(3) for storage on the visitor's device, GDPR Art. 6(1)(a) for the processing after the click — is described in the documentation, and your privacy policy still has to name the providers you use.

Because there is nothing to announce at page load. If nothing third-party loads until the visitor asks for it, there is no third-party storage to consent to on page load. The consent is the click, given for the one embed it belongs to.

No. Out of the box the plugin ignores the banner and keeps gating: visitors see your banner for its categories and the placeholder for embeds, and nothing double-blocks, because the placeholder contains no iframe or script for a banner's blocker to catch. If you prefer one decision instead of two, enable the consent-platform bridge under Settings → Calucon Third-Party Embed Gate → Consent memory: a consent given in the platform then loads the embeds, and a withdrawal there re-gates them. The bridge works with the platforms listed on that screen; with any other it stays out of the way. If you would rather have your platform's own blocker handle a specific provider, disable that provider under Providers and the plugin steps aside for it.

By default, yes: once per embed, on every page, and nothing is stored on the visitor's device to remember it. If that is more friction than you want, Consent memory can remember the choice in the visitor's browser — for that one embed, for everything from that provider, or for all embeds — until the browser is closed or for a number of days you choose. It is off by default and stores nothing before the visitor's first click. When you turn it on, give visitors a way back: the "Withdraw embed consents" block or the [calucon_embed_gate_withdraw] shortcode clears what was remembered.

Yes. Gating happens on the server, so the page that gets cached is the gated one, and minified HTML is expected rather than a problem — the scanner is built for it. Deferring, combining or lazily injecting the plugin's script all work too. One setting is worth knowing about: "delay JavaScript until interaction" holds every script back until the visitor first interacts, and that interaction is spent switching the scripts on — so the first click on a "Load" button does nothing and they have to click again. Nothing third-party is contacted by the extra click, but the placeholder feels broken. Settings → Status & tools lists the exact files to paste into your optimisation plugin's exclusion list, and reports what it could read about that plugin's JavaScript settings. If your assets are served from a CDN hostname, that is recognised as your own: most CDN plugins filter the WordPress functions that say where your files live. A CDN that rewrites the finished page instead is invisible to that, so scripts and stylesheets on a /wp-content/ or /wp-includes/ path are left alone whatever host serves them — which does not cover images, one reason third-party image gating is off by default. And if the placeholder looks unstyled after an update: a minification setup that serves CSS from a long-cached URL can keep browsers on the old stylesheet. A hard reload fixes it; the plugin cannot. An embed from my page builder is not being gated Elementor's HTML and video widgets are gated out of the box. Other builders render outside WordPress's content filters, where the plugin listens by default: enable "Gate the whole page output" under Settings → Calucon Third-Party Embed Gate → Detection and the plugin reads the finished page instead. It is off by default because whole-page buffering can conflict with other buffering plugins. Something on my site is gated and I want it to load normally Open Settings → Calucon Third-Party Embed Gate → Providers and press "Check what is on my site". The scan lists every embed in your recent posts and pages with the address it would contact. Next to each one you can either name it — which keeps the gate on but gives the placeholder a proper label and icon — or let it through, which means it loads for every visitor with no placeholder. You never have to work out a host name yourself, and nothing changes until you press Save. Hosts you have let through stay listed at the top of the same screen with a one-click undo.

Videos: YouTube, Vimeo, Dailymotion, TED, VideoPress and WordPress.tv, TikTok. Audio: Spotify, SoundCloud, Apple Music, Mixcloud, Pocket Casts. Maps: Google Maps, OpenStreetMap. Social posts: X, Instagram, Facebook, Reddit, Tumblr, Bluesky, Pinterest, Imgur, GIPHY, Strava. Documents: Scribd, Speaker Deck, Issuu, Wolfram Cloud, Amazon Kindle, Kickstarter. Forms and calendars: Google Calendar, Google Forms, Typeform, Calendly, Crowdsignal. 3D: Matterport, Sketchfab. Everything else is gated too — that does not depend on a list. An embed from an unnamed host gets the same placeholder and the same button, named after the host it would contact, with a link to the content itself. What a named provider adds is the label, the icon, the privacy-policy link and a tidier "Open on …" link. A few of core's own embed blocks are not named yet (Flickr, SmugMug, Animoto, ReverbNation, Cloudup); you can name them yourself under Providers → Your own providers. Some embeds bring a loader script or stylesheets along with the player (VideoPress, Scribd, Wolfram Cloud). Those are gated together with the embed they belong to and load on the same click, not before it.

Yes, without code: Providers → Your own providers takes a name, the embed hosts (one per line) and, optionally, script hosts and a kind for the button icon. After saving it appears in the provider table with its own notice, button text and privacy-policy link. Unknown hosts are gated either way — a provider of your own only gives such a host a proper name and texts. Hosts the built-in providers handle stay with them, and your own providers are always gated; the never-gate list under Detection is the place to exempt a host.

Yes. The Appearance tab has quick styles, colours that can follow your theme's palette, and controls for corners, border, shadow, spacing, the button, the poster image and dark mode, with a live preview and an automatic readability check. One checkbox on the Providers tab adds a link to each provider's own privacy policy to the placeholder (off by default; the URL can differ per provider, and showing the link fetches nothing). Your own CSS still works on top: the panel exposes CSS custom properties and a template override (see docs/customizing.md in the plugin folder).

Yes. German ships with the plugin for all five German locales WordPress offers — Deutschland informal and formal ("de_DE", "de_DE_formal"), Österreich ("de_AT"), and Schweiz formal and informal ("de_CH", "de_CH_informal", spelled with ss instead of ß) — and it covers everything a person reads: the placeholder your visitors see, the settings screen and the block-editor controls. Set your site language and it follows. Other languages are welcome via translate.wordpress.org; a translation from there overrides the bundled one.

Consent Mode is deliberately not read or written. It is a signal that consent platforms send to Google's tags; Google publishes no API for other scripts to read it, and no Consent Mode signal governs iframes such as YouTube embeds. The bridge instead connects to the consent platform itself — the same place Consent Mode gets its state from — which is the reliable way to honour the same visitor choice. The plugin also never sends gtag('consent', …) updates: a click on one embed is consent for that embed, not a site-wide marketing consent, and misreporting that would be wrong.