WORDPRESS PLUGIN · FREE · GPLv2
A Banner That Actually Blocks
Nothing loads before the visitor says yes.
Melon Consent is a consent banner with a real blocking engine behind it. Scripts, inline snippets, iframes, oEmbeds and resource hints stay inert until the visitor decides. It runs entirely on your own installation. No cloud service, no account, no monthly fee, no telemetry.
Free & GPLv2 · Works with page caching and CDNs · Google Consent Mode v2 · No external requests, fonts or CDNs · Tested up to WordPress 7.0
The problem: most banners are decoration
A notice appears, the visitor clicks it away, and the analytics script fired three seconds before they read the first word. The YouTube thumbnail already reached Google. The map already sent an IP address. The banner asked a question whose answer no longer mattered. Meanwhile the tools that do block properly want an account, a subscription and a connection to a service you cannot inspect.
The solution: block first, ask, then release
Melon Consent neutralises non-essential scripts, iframes and embeds before the page reaches the browser. Blocked content sits in the markup as inert placeholders, so the HTML is identical for every visitor and your cache keeps working. Once someone decides, their browser activates exactly what they allowed. Nothing more.
It really blocks
No request to youtube.com, youtube-nocookie.com or ytimg.com before consent, thumbnails included. The same for maps, analytics and tag containers.
Your cache stays intact
Every visitor receives identical HTML and the activation happens client side. No cache variants, no bypass rules, no fighting with your CDN.
No cloud, no account, no fee
Everything runs on your own installation. The plugin makes no external requests of its own, loads no remote assets and sends nothing to its author.
Plugin features
Everything a consent layer needs to do its job technically, with nothing that phones home.
A blocking engine, not a notice
Enqueued scripts, inline snippets matched by conservative signatures, iframes, oEmbeds, Gutenberg embeds and resource hints are all neutralised before consent. An HTML rewriter catches whatever a theme or plugin prints directly into the output.
Consent per category and per service
Necessary, Statistics, Marketing and External media, each expandable into the individual services behind it. A visitor can allow YouTube without allowing maps, which is what people actually want.
Cache-safe by architecture
The served HTML never differs between visitors. Blocked content is inert in the markup and the browser activates what was allowed after reading the consent cookie. Page caches and CDNs need no special treatment.
Google Consent Mode v2, GA4 and GTM
All four consent signals start at denied and are updated after the decision. Strict basic mode loads no Google tag before consent and is the default. Advanced mode is an explicit opt-in. Analytics 4 and Tag Manager can be managed by the plugin or left to an existing integration.
Placeholders visitors can act on
A blocked video or map is replaced by a locally rendered placeholder with two clear choices: load this one now, or always allow this service. Keyboard operable, with a focus trap and reduced-motion support.
Four layouts, five presets, live preview
Compact card, centre modal, top or bottom bar, side drawer. Five design presets from Clean Light to Dark Contrast, with custom colours, corner radius and font size, and a contrast warning when a combination falls below WCAG AA.
Custom services without regular expressions
Define your own services with safe matching rules: hosts, wildcards, URL substrings, script handles and inline signatures. A shortcode wrapper handles anything a rule cannot reach, including self-hosted Leaflet maps.
Revoking is easy on purpose
A floating privacy button, the Change privacy settings shortcode, a link with a data attribute, or a JavaScript call. After revocation the known Google cookies are removed and the page reloads, because scripts already in memory cannot be unloaded reliably.
A real developer API
window.MelonConsent exposes the consent state, per-category and per-service checks, and methods to open settings or load a single element. PHP filters cover services, blocking decisions, front-end config and placeholder markup, and a melonConsentChanged event fires on every change.
Nothing stored, nothing sent
The decision lives in one first-party cookie in the visitor’s browser. No personal data, no IP addresses, no consent log in your database, and no data to the plugin author. Diagnostics warn about conflicting consent plugins, and settings import and export as JSON.
What people use it for
Agencies & freelancers
One consent layer across every client site, without a per-domain subscription and without explaining a third-party service to each of them.
Sites full of embeds
Videos, maps and external players on dozens of pages. The blocking is automatic and each embed carries a placeholder the visitor can release on its own.
Anyone running GA4 or GTM
Consent Mode v2 signals set correctly from the start, with a strict mode that keeps Google out of the page entirely until a decision is made.
Public sector & healthcare
Where an auditor may ask what exactly loads before consent, and the honest answer has to be nothing.
Live in five steps
- Install and activate the plugin from the WordPress plugin directory.
- Open Melon Consent and select the services your site actually uses.
- Enter your tracking IDs, if you use Analytics 4 or Tag Manager.
- Pick a layout and preset, then review the texts and link your privacy policy and imprint.
- Test the site in a private browser window.
The Overview tab shows the current status at a glance and offers a reset for your own browser, which makes testing the banner straightforward instead of a cookie-clearing ritual.
Technical details
| Version | 1.0.0 |
| WordPress | 6.5 or higher |
| Tested up to | 7.0 |
| PHP | 7.4 or higher |
| Consent storage | first-party cookie only |
| Shortcodes | Change privacy settings · |
| JavaScript API | window.MelonConsent |
| License | GPLv2 or later |
Screenshots
What visitors see first, then every tab of the admin from services to the blocking engine.
What it is, and what it isn’t
Melon Consent handles the technical half of consent: nothing optional runs before a decision, the decision is respected per service, and the visitor can change it at any time. That is the part software can actually do well, and this plugin does it without a cloud dependency.
What no plugin can do is make a website legally compliant. Compliance depends on your whole site, your texts, your processing and your jurisdiction. A banner is one component of that, not a certificate, and nothing here is legal advice.
Two more honest limits. No blocker detects every custom third-party integration automatically, which is why there are custom rules and a manual wrapper for the cases the signatures miss. And a script that has already executed cannot always be removed from memory, which is why revoking consent reloads the page instead of pretending otherwise.
Frequently asked questions
How do I add a cookie banner with real blocking to WordPress?
Install Melon Consent, open the plugin in the admin menu and select the services your site uses. Enter your Analytics or Tag Manager IDs if you have them, pick a layout and preset, review the texts and link your privacy policy. Blocking for YouTube, Google Maps and OpenStreetMap is on from the start.
Does it guarantee legal compliance?
No plugin can. Melon Consent implements consent and blocking technically. Whether your site is compliant depends on your texts, your configuration and your jurisdiction, and this is not legal advice.
Does it work with caching plugins?
Yes, by design. The served HTML is identical for every visitor because blocked content stays inert in the markup. The browser activates what was allowed after reading the consent cookie, so no cache variants are needed.
Does it really block YouTube before consent?
Yes. No request reaches youtube.com, youtube-nocookie.com or ytimg.com before consent, thumbnails included. A locally rendered placeholder is shown instead, and after consent the privacy-enhanced player is used.
Is youtube-nocookie.com enough on its own?
No. The privacy-enhanced mode reduces cookie usage but does not prevent every data transfer, so Melon Consent blocks it before consent as well.
Does it support Google Consent Mode v2?
Yes. All four signals start at denied and are updated after the decision. The strict basic mode is the default and loads no Google tag before consent. Advanced mode, where tags may load with denied signals, is an explicit opt-in.
Does it store consent logs?
No. The decision is kept only in a first-party cookie in the visitor’s browser: consent version, timestamp and the choices per category and service. No personal data, no IP addresses, no history in your database.
How do visitors change their mind later?
Through the floating privacy button, the Change privacy settings shortcode, a link carrying the settings data attribute, or a JavaScript call. After revocation the known Google cookies are removed and the page reloads.
Can it block a script it does not know?
Not automatically, and no plugin can claim otherwise. Well-known services are covered out of the box, and for everything else you define custom rules by host, wildcard, URL substring, script handle or inline signature, or wrap the embed in the content shortcode.
Does the plugin send data anywhere?
No. It contains no telemetry, makes no external requests for its own operation and loads no remote fonts or CDN assets. The domain lists in the code are matching rules used to block those hosts, not to contact them.
Is Melon Consent free?
Yes. It is published in the official WordPress plugin directory under GPLv2 or later, with no paid tier, no per-domain licence and no upsell inside the plugin.
Changelog
1.0.0
- Initial release: consent banner with four layouts and five design presets, plus category and service level consent.
- Cache-safe blocking engine for scripts, inline scripts, iframes, oEmbeds, Gutenberg embeds and resource hints.
- Google Analytics 4, Google Tag Manager and Google Consent Mode v2 in basic and advanced mode.
- Placeholders for YouTube, Google Maps and OpenStreetMap, custom services and a manual content wrapper.
- Floating privacy button, diagnostics, JSON import and export, privacy policy suggestion.
- English and German included, with WPML and Polylang string translation support.
Let visitors decide, before anything loads
Free, GPL-licensed, and running on your own server from the first minute.
Version 1.0.0 · GPLv2 or later · Desk9 Design