Script Blocking

Script blocking decides what CookieRay does with tracking scripts before a visitor has given consent. You pick the behavior in Settings, choosing between two modes: Log Only and Strict.

In the admin, the two options under Settings → Consent Behavior are labelled Log Consent Only (Log Only) and Block Until Consent (Strict).

Log Only mode

In Log Only mode, CookieRay records consent without enforcing blocking. It captures what each visitor agreed to, but it does not stop any scripts from running.

In Log Only mode, you must ensure your third-party integrations respect consent themselves. CookieRay is keeping the record, but it is not standing between the visitor and the scripts.

Log Only does not block scripts, but CookieRay still removes known tracking cookies for categories the visitor has not accepted.

Use this mode when your tracking tools already have their own consent handling, or when you want to observe consent activity before enforcing anything.

Strict mode

In Strict mode, CookieRay delays known tracking scripts until the visitor agrees to matching categories. It intervenes early so that known tracking snippets don’t execute before consent is given.

Once a visitor consents to a category, the scripts mapped to that category are allowed to run.

Built-in patterns

CookieRay includes built-in patterns to recognize common tracking scripts, including:

• Google Analytics
• Meta Pixel
• Hotjar
• HubSpot
• TikTok Pixel
• and many others

These patterns let Strict mode identify and hold known trackers without you having to configure each one by hand. Strict mode works on external scripts (a src that matches a known pattern, including scripts added to the page later). An inline snippet is not held back unless it loads one of those external scripts, or you mark it yourself as described below. You can also add your own Script pattern to a cookie in the Cookie Inventory.

Block a script yourself

Strict mode recognizes common trackers automatically. For a script it doesn’t recognize, you can mark it yourself so it waits for consent. Change the script tag’s type to text/plain and add the category it belongs to in data-cookieray-category:

<!-- Inline script held until Marketing consent -->
<script type="text/plain" data-cookieray-category="marketing">
  // your tracking code here
</script>

For an external file, put the original address in data-cookieray-src instead of src:

<script type="text/plain"
        data-cookieray-category="analytical"
        data-cookieray-src="https://example.com/tracker.js"></script>

Use one of the category names analytical, functional, or marketing. When the visitor allows that category, CookieRay restores the script and runs it. This works in Strict mode only. In Log Only mode, scripts marked this way stay inert.

Cookies that are still uncategorized in your Cookie Inventory are blocked by default. Under Settings → Uncategorized Cookie Handling you can choose Always Block Uncategorized Cookies or Treat Uncategorized Cookies as Marketing.

Choosing a mode

Pick the mode that matches how much enforcement you want CookieRay to handle directly.

For developers

Allow a host through the early blocker, or switch CookieRay off on chosen pages, with WordPress filters. See Developer Hooks and Hide the cookie banner on specific pages.