by
OptionWeb
0 (0 reviews)
OW Consent
GDPR, CCPA and TCF v2.2 consent management: cookie banner, tracker blocker, scanner, DSAR workflow and hash-chained consent ledger.
OW Consent ranks #61,802 among WordPress.org plugins with 0+ active installations, is #3,855 of 5,058 in the Security category, and was last updated Oct 16, 2026. Data from WordPress.org, refreshed twice daily — see methodology.
Compatible with WP 7.1.4
v2.0.8
Current Version v2.0.8
Updated 2 weeks ago
Last Update on 16 Oct, 2026
Refreshed 2 days ago
Last Refreshed on
#3,855 of 5,058 in Security
Downloads -66% this week
Actively maintained
Rank
#61,802
—
No change
Active Installs
0+
—
No change
KW Avg Position
N/A
—
No change
Downloads
117
+4 today
Support Resolved
0%
—
No change
Rating
0%
Review 0 out of 5
0
(0 reviews)
Next Milestone 10
0+
10+
34,234
Ranks to Climb
-
Growth Needed
8,000,000
Active Installs
Pro
Unlock Exact Install Count
See the precise estimated active installs for this plugin, calculated from real-time ranking data.
- Exact install estimates within tiers
- Track install growth over time
- Milestone progress predictions
Need 8 more installs to reach 10+
Rank Changes
Current
#61,802
Change
Best
#
Downloads Growth
Downloads
Growth
Peak
Upgrade to Pro
Unlock 30-day, 90-day, and yearly download history charts with a Pro subscription.
Upgrade NowReviews & Ratings
0.0
0 reviews
Overall
0%
5
0
(0%)
4
0
(0%)
3
0
(0%)
2
0
(0%)
1
0
(0%)
Track This Plugin
Get detailed analytics, keyword tracking, and position alerts delivered to your inbox.
Start Tracking FreePlugin Details
- Version
- 2.0.8
- Last Updated
- Oct 16, 2026
- Requires WP
- 6.2+
- Tested Up To
- 7.1.4
- PHP Version
- 7.4 or higher
- Author
- OptionWeb
Support & Rating
- Rating
- ☆ ☆ ☆ ☆ ☆ 0
- Reviews
- 0
- Support Threads
- 0
- Resolved
- 0%
Keywords
Upgrade to Pro
Unlock keyword rankings, search positions, and detailed analytics with a Pro subscription.
Upgrade NowSimilar Plugins
Adminify – White Label, Admin Menu Editor, Login Customizer
6K+ installs
#2,757
Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits
30K+ installs
#1,015
LiteSpeed Cache
7M+ installs
#5
Akismet Anti-spam: Spam Protection
5M+ installs
#8
Wordfence Security – Firewall, Malware Scan, and Login Security
5M+ installs
#11
Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)
3M+ installs
#18
Hostinger Tools
3M+ installs
#20
WPS Hide Login
2M+ installs
#27
Limit Login Attempts Security - Login Security, 2FA, Firewall, Brute Force Prevention
1M+ installs
#33
WP Super Cache
1M+ installs
#36
Frequently Asked Questions
Common questions about OW Consent
Yes, and it is designed around that. The front-end HTML it produces is identical for every visitor; consent is read from the cookie in the browser and applied before the page is painted. Trackers are blocked in the cached markup and released client-side. Only genuinely per-visitor responses — the DSAR verification page and REST responses containing personal data — are marked uncacheable. No nonce is printed in cacheable HTML either; the banner fetches one from a no-store endpoint before each write.
For most sites it covers the same ground: banner, blocking, audit log, data-subject requests, geo routing and generated documents. Two things it does not do: it is not a CMP registered with IAB Europe (see the TCF question below), and it does not provide legal advice or reviewed legal documents — the generator produces drafts that you must have reviewed.
It is tamper-evident, under one condition. Each row is signed with HMAC-SHA-256 over the previous row's hash, so a modified or deleted row breaks the chain and verification reports where. The guarantee rests on the signing key being outside the database, which holds when you define OWCO_LEDGER_KEY in wp-config.php. Without it, the plugin signs with a random key it keeps in the database: the chain is still built and checked, but an attacker with database access could re-sign it, and the admin tells you so. The key is never derived from WordPress's authentication keys and salts.
No. It is off by default, and once enabled it runs as a WP-Cron job at the frequency you choose (weekly by default), fetching a sample of your own pages server-side. It never runs during a visitor's page view. Note that WP-Cron only fires when your site receives traffic, or when you have set up a real cron task; on a site with DISABLE_WP_CRON and no system cron, the scheduled scan will not run.
Partly. The scheduled server-side sweep reads the Set-Cookie headers your pages return, so it finds cookies set by the server, including HttpOnly ones, as well as scripts, iframes, stylesheets and pixels. It executes no JavaScript, so cookies written by scripts in the browser are not visible to it; those are collected by a diagnostic probe that by default runs only for logged-in administrators. Treat the result as an inventory of what was seen, not as an exhaustive list — and both screens say so rather than leaving you to assume otherwise: the Scanner tab states whether the last sweep finished, how many pages it read, how many it could not fetch and whether a browser has ever reported back, and the generated cookie policy repeats the same reservations to the reader.
The visitor submits the form and receives a verification e-mail. Confirming the request on the linked page starts the Article 12.3 deadline and opens a WordPress personal-data request. From the DSAR screen you can download a JSON export produced by every exporter registered on the site (OW Consent's own records, WordPress core's, and any other plugin's), run every registered eraser, and close the request with a written response that is stored with it. What the export and the erasure cover depends on which plugins on your site register those hooks; anything that registers none has to be handled by hand.
Yes, when OW Forms is active and the integration is enabled. Every stored submission is linked to the consent in force at that moment: the pseudonymous browser token, the ledger entry that was current, the categories granted, the compliance profile, the hash of the published documents, the timestamp, and the exact wording of the consent checkbox that was accepted. Erasure requests cascade to OW Forms submissions and their uploaded files, matched on the e-mail hash OW Forms itself stores, and OW Forms submissions are included in WordPress's Export and Erase tools. Three limits are worth stating: no consent event is written into the ledger for a submission (the link references the entry already in the chain); submissions recorded before 1.2.0, and submissions made while OW Forms is configured not to store them, have no link; and the e-mail address remains stored in clear text by OW Forms, because it is needed to answer the sender — the hash is a lookup key, not a privacy measure.
Only with your own CMP ID issued by IAB Europe, and even then with a caveat. Without a CMP ID the module does not load at all. With one, it emits a correctly encoded TC String and the panel displays every purpose and special feature that string can claim, but TCF policy requires a registered CMP to present purpose-level and vendor-level choices of its own; here the purpose switches follow the categories and there is no vendor-level choice, so it is not a registered CMP and vendors are entitled to reject its signal. If TCF-gated advertising revenue matters to your site, use a certified CMP.
The privacy notice and the cookie policy are generated for all eleven profiles in the jurisdiction's own language: English, French for France, Belgium, Luxembourg and Quebec, Portuguese for Brazil. The legal notice and the terms exist only in French, built around French law; for any other jurisdiction the generator refuses to produce them rather than publishing an inappropriate document.
The interface is written in English and is entirely translatable: every string goes through gettext under the ow-consent text domain, and languages/ow-consent.pot ships as the template. No translation is bundled with the plugin. Locale packs are built on translate.wordpress.org and installed and loaded by WordPress itself, which is how a plugin hosted here is meant to be translated; to have the interface in your language, contribute or review the strings for that locale there.
