Cookie Consent for WordPress Sites: Plugin vs Platform
A WordPress site with twelve plugins, three of which set cookies, asked for a consent setup that would not need a developer every time a plugin changed. The two options were a plugin that runs inside WordPress, or a platform that runs outside it and injects the banner with a script tag. Both work. They fail in different ways, and the failure mode is what should decide it.
The plugin route
A plugin lives in the same dashboard as everything else on the site. Complianz is the common choice, at 59 dollars a year for a single site, and it scans the site, writes the cookie policy, and blocks scripts until consent. The advantage is proximity: the person who maintains the site can see the consent setup in the same place as the content, and the scan finds the plugins that set cookies.
The weakness is the same as the strength. The plugin only knows what WordPress knows. A script added by a theme, a tracking pixel pasted into a template, or a third-party embed that loads its own scripts can sit outside the plugin's view. And the plugin has to be updated like any other plugin, which means the consent setup depends on someone keeping it current. A plugin that is three versions behind is a banner running on last year's vendor list.
The platform route
A platform like CookieYes or Enzuzo manages consent from outside the site. CookieYes has a free tier and paid plans from about 10 dollars a month per domain; Enzuzo starts at about 9 dollars a month. The banner loads from the platform's script, the vendor list and the consent records live on the platform, and the site owner manages it from a dashboard that covers every site at once.
The advantage is central control. One dashboard, one vendor list, one set of records, and updates that do not depend on the site's own maintenance. The disadvantage is the extra request. The banner script has to load before the tags it gates, and on a slow connection the tags can fire first. The platform also adds a vendor to the data flow: the consent records live on someone else's servers, and that has to be in the privacy notice.
The test that decides it
Count the sites and the maintainers. One site, one maintainer who already lives in WordPress: take the plugin. The setup stays where the work happens, and the scan catches the plugins that matter. Five sites, or a maintainer who does not touch WordPress: take the platform. Managing five plugin installs, five scans, and five vendor lists is a part-time job, and a platform turns it into one dashboard.
Then run the same test either way. Open the site in a fresh browser, reject everything, and watch the network. If a tag fires before the choice, the setup has failed, plugin or platform. The route does not matter. The result does.
Keep reading: how to choose a white-label consent setup, where the CMP script belongs in the head, and Cookiebot alternatives for 2026 cover the nearby cases in this series.
Frequently asked questions
What does Complianz cost for a single WordPress site?
About 59 dollars a year for a single site. It scans the site, writes the cookie policy, and blocks scripts until consent. The price is per site, so it grows with every site you add, which is the main reason multi-site owners look at platforms instead.
Is there a free cookie consent option for WordPress?
Yes. CookieYes has a free tier that covers a basic banner and consent records for a single domain. The free tier is enough for a small site with a handful of cookies, but it caps the features, so check what it leaves out before relying on it.
Does a consent platform slow the site down?
It adds a request, and the banner script has to load before the tags it gates. On a fast connection the cost is small. On a slow connection the tags can fire before the banner renders, which is a consent failure, not just a speed problem. Load the script early in the head and test on a slow connection.
Can a plugin see scripts added directly to the theme?
Not reliably. A plugin scans what WordPress knows about, which is the installed plugins and the content. A tracking pixel pasted into a template or a third-party embed that loads its own scripts can sit outside the plugin's view, and those are the tags that most often fire before consent.