ONiDEA Consenso Cookie Conforme Italia

1. 01Upload the onidea-cookie-consent folder to /wp-content/plugins/ .
2. 02Activate the plugin from the WordPress Plugins screen.
3. 03In the admin sidebar, open “Consenso Cookie” and configure categories, banner text, and links to your privacy/cookie policy (under the “Settings” entry of the new menu).
4. 04If the site uses AdSense/Google Ads/GA4, enable “Google Consent Mode”.
5. 05See the quick-start guide (Italian) for how to tag third-party scripts that need blocking.

Why doesn’t the REST endpoint that logs consent use a nonce?

Deliberate choice, not an oversight. A WordPress nonce is generated when the page is rendered: on a site with page caching (practically all of them, in production) it ends up baked into the cached HTML and is replayed identically by every visitor for as long as that cache lives — often longer than the nonce’s own lifetime. The practical result, observed during development: consents silently rejected by the endpoint (a 200 response with {"logged":false} , no visible error) for the entire lifetime of the cache.

A nonce, in this specific case, does not protect anything worth protecting: the route is public by design ( permission_callback is __return_true , deliberately — it must be callable by an anonymous visitor who has no account yet), it doesn’t write anything privileged (only a row in an accountability-only log), and for a logged-out visitor the token is identical for everyone anyway. In its place: strict per-argument validation (type, length, and a category whitelist, so only well-formed rows can ever be written), a same-origin check on the request, and a 20-calls-per-hour-per-IP limit against abuse — computed from REMOTE_ADDR only by default, since request headers like X-Forwarded-For are attacker-controllable and are not trusted unless a site explicitly opts in via the occit_trust_proxy_ip_headers filter (for sites that know they sit behind a proxy/CDN they control). None of this is a substitute for authentication; it bounds the worst case to “some extra rows in a low-sensitivity accountability log,” which is the actual risk on this endpoint. Details in the code, in class-occ-frontend.php and the REST handler.

Does the plugin send data to external services?

No. The banner engine (the “CookieConsent” library by Orest Bida) is downloaded once during development and distributed inside the plugin itself: it runs entirely on your own site, with no call to any third-party service either at runtime or during configuration. The consent log is a table in your own database.

How do I tag a third-party script so it’s blocked until consent?

Add two attributes to its <script> tag: type="text/plain" (in place of text/javascript ) and data-category="analytics" (or marketing / functional , matching the category it belongs to). The script only runs once the visitor accepts that category. The quick-start guide (Italian) walks through this with examples, where to find scripts to edit, and how to verify it worked. Google Analytics/Ads/AdSense need no tagging: enable Google Consent Mode instead.