KATLA FOR WORDPRESS
Cookie consent that doesn't slow WordPress or WooCommerce down.
One plugin. It holds back non-consented scripts on the server, while WordPress is still assembling the HTML - not in the browser once they have already loaded. Any theme, any page builder, and on a WooCommerce store the cart and checkout are never touched.
WordPress 6.3+ · PHP 7.4+WooCommerce 7.0+ (optional)WP-CLI included
wp-content/plugins/katla-consentNo theme code
1. Install the plugin from the zip and activate it. 2. Paste your Site ID under Settings → Katla Consent, or do the whole thing from WP-CLI: wp plugin activate katla-consent wp katla site-id 00000000-0000-0000-0000-000000000000 wp katla verify 3. Pick a mode - Katla's hosted widget, the plugin's own banner, or your own UI on window.KatlaConsent. 4. Add [katla_policy] to your privacy page. WooCommerce needs no step of its own. Cart, session and fragment cookies bypass the guard automatically, and checkout's script handles can't be blocked by a rule.
Every shortcode has a matching Gutenberg blockFull guide →
WHY WORDPRESS SITES STRUGGLE WITH CONSENT
WordPress sites collect plugins, and plugins collect cookies.
THE PROBLEMBlocking a tracker in the browser is a race, and an optimisation plugin that reorders your scripts can decide who wins it.
WITH KATLAThe plugin rewrites blocked scripts to type="text/plain" with a data-katla-src while WordPress builds the page. There is no race to lose.
THE PROBLEMNeutralising a script usually throws away the inline configuration that was attached to it, and the tag comes back misconfigured.
WITH KATLAInline scripts added with wp_add_inline_script are held alongside their handle and replayed in source order once the category is allowed.
THE PROBLEMA cookie guard that blocks indiscriminately empties carts and loses sessions, and the symptom looks nothing like the cause.
WITH KATLAWooCommerce cart, session, fragment and store-notice cookies are allowlisted by name and by prefix as soon as the store is detected. The guard never touches them.
THE PROBLEMOne over-eager blocking rule can take checkout down, and you hear about it from customers rather than from a test.
WITH KATLAwc-cart-fragments, wc-checkout and wc-blocks-checkout are stripped from the blocked list whatever the rule says, so the mistake cannot reach checkout.
THE PROBLEMEvery plugin you add can bring trackers the privacy page has never heard of.
WITH KATLAKatla scans the rendered page, classifies what it finds, and regenerates the cookie and privacy policies from it. [katla_policy] renders them server-side, so they are in the HTML and indexable.
SETUP
Install, scan, done.
- Install the pluginUpload the zip, or drop katla-consent into wp-content/plugins and activate it. WooCommerce support is built in, not a separate add-on.
- Connect your sitePaste the Site ID from your Katla dashboard, or run wp katla site-id and wp katla verify.
- Review the scanCookies come back classified and described - cart and session as functional, pixels as marketing. Override any call from the dashboard.
- PublishChoose a banner mode, add [katla_policy] or its block to your privacy page, and optionally a preferences link to checkout and My Account.
BUILT FOR WORDPRESS
One plugin, both jobs.
Server-side blockingGate a script by its registered handle, or by a fragment of its URL for the ones a theme injects without registering anything.
Checkout-safe by defaultThe store cookies WooCommerce needs bypass the guard, and the script handles checkout depends on are unblockable. HPOS and the cart and checkout blocks are declared compatible.
Three banner modesKatla's hosted widget, the plugin's own banner translated through WordPress and styled with CSS custom properties, or no UI at all if you are building it yourself. Reject and Accept share size, padding and weight, as the DMA requires.
Blocks and shortcodes[katla_policy], [katla_cookie_table], [katla_cookie_settings], [katla_block] and [katla_consent] - each with a matching Gutenberg block.
WP-CLI and filterswp katla status, site-id, verify, cookies, policy and flush for a scripted install, and katla_blocked_handles, katla_cookie_allowlist, katla_categories, katla_translations and katla_banner_css_vars instead of a fork.
Consent Mode v2 and GTMGA4 and Google Ads get all four signals, denied by default. Your existing GTM triggers read the same decision from window.dataLayer.
CORE WEB VITALS
That's how the cookie crumbles. Except your SEO shouldn't.
Consent plugins are a common reason WordPress sites fail Core Web Vitals - hundreds of kilobytes, loaded before anything else, on a store where speed is revenue. Katla's hosted banner is 18 KB in a single request, and the cookie and policy responses the plugin needs are cached in transients rather than fetched per page view.
How headless mode works →18 kBOver the wireBanner and your cookie data, brotli
0 msAdded LCPAgainst the same page without it
0Layout shiftThe banner reserves no space in flow
2RequestOne script, cached at the edge
Our own measurements, taken - how they were taken.
Questions WordPress teams ask
- Do I need anything besides the WordPress plugin for WooCommerce?
- No. It is one plugin, and the WooCommerce behaviour switches on when WooCommerce is active. There is nothing else to install and nothing to configure for it.
- Will it break my cart or checkout?
- That is the case the WooCommerce support exists for. Cart, session and fragment cookies are allowlisted, the checkout script handles are removed from the blocked list even when a rule names them explicitly, and the plugin declares compatibility with HPOS and with the cart and checkout blocks.
- What about order attribution?
- sbjs_* is treated as marketing rather than necessary, because that is what it is. Gate the wc-order-attribution handle and the cookies are never set; leave it and they wait for consent like any other marketing cookie.
- Does it replace my current consent plugin?
- Yes. Deactivate the old one once Katla is active, so two banners are not competing for the same cookies.
- Will it work with my page builder?
- Yes. Blocking matches on enqueued handles and on URL fragments, and the scan reads the rendered page rather than the builder, so whatever the builder outputs is what Katla sees.
- Anything to watch out for?
- One thing. Exclude cdn.katla.app from JS deferral or combination in WP Rocket, Autoptimize and friends. The cookie guard has to run before anything that sets cookies, and deferring it is the most common way an install looks fine and is not compliant.
Scan your site, then install the plugin.
The free plan scans your WordPress site and generates a cookie policy, without a card.