Manual: setting up and running the cookie plugin

What Ehrenplatz-Cookie does

Ehrenplatz-Cookie is a consent management plugin for WordPress. It finds the services on your site that send data to third parties, blocks them until the visitor agrees, and documents that agreement in a way you can show later.

Three things set it apart from a plain cookie banner:

• It finds services itself instead of expecting you to know them — by scanning the whole site, and weekly in the background.
• It really blocks, including content a page builder only loads later by JavaScript. A banner that asks but stops nothing does not do its job.
• It hosts Google Fonts and the Tag Manager locally, with no extra plugin and for good.

Requirements

The plugin runs on ordinary shared hosting. It needs no server of its own, no Node.js and no Chromium.

Installation

• Download the ZIP file
• In WordPress, choose it under Plugins → Add New → Upload Plugin
• Install Now, then Activate
• Ehrenplatz-Cookie appears in the WordPress menu

Finding your way around

The plugin brings a sidebar of its own. You reach every area through the single menu entry Ehrenplatz-Cookie, not through WordPress submenus:

Two small things that help day to day: ⌘K opens a command palette and jumps straight to an area. At the bottom of the sidebar you switch between the light and dark appearance.

The dashboard shows at a glance whether automatic blocking is on, how many services are active, how many consents have been logged, when the last scan ran and whether any scan findings are waiting for you. Test as a visitor starts from there as well.

The first step after installing, though, is the licence key — without it the other areas stay locked.

Entering the key

The licence key has the form EPC-XXXX-XXXX-XXXX-XXXX. You will find it in the purchase email and in the licence certificate.

As long as no licence is stored, the plugin shows nothing but the licence page — every other area is locked. Once entered, the licence lives under Settings.

• Paste the key
• Save licence

Upper and lower case make no difference, and spaces are stripped. After saving, the key is only ever shown shortened (EPC-A7F3-••••-••••-••••) — so it cannot be read even by someone who gets into your WordPress backend. To change other settings without touching the key, simply leave the field empty.

Below the field you can see how many seats of your licence are taken. Remove licence detaches this installation from the licence again.

How seats are counted

Every installation takes a seat — staging environments, local copies and installations on subdomains included. A project made up of a live site, a staging site and a local copy therefore uses three seats.

www.your-domain.com and your-domain.com count as the same site and take one seat between them.

Moving to another site

• Deactivate the plugin on the old site — the seat is free at once
• Enter the key on the new site

This works as often as you like. You need no customer portal and no word with support.

Support code

In the licence area, Request support code gets you a code. It is valid for 30 minutes and identifies your installation to support.

Include this code with your enquiries — not your licence key. That way your installation can be identified without the key travelling through inboxes and ticket systems.

If the licence server cannot be reached

In short: nothing happens.

The plugin checks the licence once a day and remembers the last valid answer. Trouble at our end does not switch your consent management off — that would be exactly the wrong moment for an outage.

• After 7 days without successful contact a notice appears in the backend
• After 30 days without any contact the licence is downgraded

Only an explicit refusal from the server — for a cancelled licence, say — switches off at once. A freshly entered key never locks immediately either: if the server cannot be reached while you save, the key is stored anyway and the activation is caught up automatically.

Messages during activation

Setup assistant

Once the licence is active, the setup assistant takes you through the basic settings in five steps. You can call it up again at any time: Settings → Restart setup assistant.

Step 1 — Welcome

The opening screen explains what the next steps will do.

Step 2 — Scan

The assistant searches your site and splits what it finds into two groups: Detected and activated — services the plugin knows and could sort by itself — and Unknown services, which you have to sort. The second group is the important one: anything left there is not categorised correctly.

Step 3 — Design

Here you choose the basic look of the banner. The finer points come later under Design.

Step 4 — Wording

Language, form of address — formal or informal — and the link to your privacy policy. The form of address runs through all the banner wording; setting it right here saves reworking it later.

Step 5 — Done

A summary, and links into the areas that make sense next.

The first scan

Ehrenplatz-Cookie → Scan searches your site for services that send data to third parties.

• Up to 150 addresses per run are checked — not just the home page
• The scan runs in sections so that it does not hit a time limit on your server
• Very large pages are evaluated up to 3 MB
• Sites with more than 150 addresses are catered for; the services found are kept across the runs

On top of that, an automatic scan runs in the background once a week and reports newly added services. That is the case that counts in practice: someone embeds a YouTube video on a subpage, and nobody thinks about the cookie banner.

The four categories

Every service belongs to exactly one category:

If a service is given no category, it lands under Statistics automatically — never under Essential. So an unknown service is never loaded without consent by accident.

Sorting the services

Under Ehrenplatz-Cookie → Services you give each service found its category and enter the details that later appear in the cookie table.

The AI assistant can suggest that sorting for you. It runs on your own API key at Anthropic or OpenAI — the cost is not included in the licence, and in return there is no limit from us. Do check the suggestions, particularly anything proposed as Essential.

Where you assign them

• Open Services and call up the service you want to edit
• Expand the advanced area in the form
• Assign the fields under „Control Google Consent Mode“

Without an assignment of your own:

Shortcodes

For the privacy policy you will usually want [epc_cookie_list] and [epc_settings]. The right shortcode, with a preview, is under Service list.

Consent log

Under Ehrenplatz-Cookie → Consent log you will find the logged consents, exportable as CSV. IP addresses are stored hashed, not in the clear.

Providers

Under Providers you record, for each service, who processes the data. These details appear in the banner and in the cookie table.

Statistics

Statistics shows how visitors respond to the banner — acceptances, refusals, partial consents.

A service is not being blocked

Check the master switch first: Settings → „Automatic blocking“. With it off, the plugin blocks nothing, however the services are configured.

That sounds obvious, but it is by far the most common cause — and it is regularly missed, because people think of caches and configuration errors first. Only once this switch is on is further searching worthwhile.

Whether the switch is on can also be seen at a glance on the Dashboard.

A video in Elementor is not being blocked

Page builders like Elementor often load videos later by JavaScript. Classic blockers that only search the HTML source therefore do not find them. Ehrenplatz-Cookie has a watcher in the browser for exactly that, which catches embeds loaded after the fact.

One special case: YouTube appears under several addresses — youtube.com, youtu.be and youtube-nocookie.com, the last one when Privacy Mode is on in Elementor. All variants are recognised and mapped to the same service definition.

Google Fonts still load despite local hosting

Usually this is because the font is only embedded on a subpage. Run a full scan, not just a check of the home page.

The banner does not appear

A known cause: WP Rocket with LazyRender switched on. The feature sets content-visibility: auto, which leaves the banner present in the DOM but invisible. Exclude the banner container from LazyRender.

If the banner does not appear at all on a fresh installation, check in the browser console whether the configuration could be loaded.

Is Google reCAPTCHA not essential?

No. reCAPTCHA belongs to External media and needs consent.

The common assumption to the contrary is that reCAPTCHA is technically necessary to run the form. That does not hold: there are alternatives for spam protection that need no consent, and that removes the basis for filing it as essential.

Ehrenplatz-Cookie detects reCAPTCHA and, since version 1.52.0, files it correctly.

After a plugin update I see old content

After each of its own updates the plugin automatically clears the cache of the common caching plugins: WP Rocket including its minify cache, W3 Total Cache, WP Super Cache, LiteSpeed Cache and SiteGround Optimizer. You need do nothing.

If you use a different caching plugin or a server cache, clear that yourself after the update.

What happens when my licence runs out?

See chapter 02. In short: trouble at the licence server changes nothing; a licence that has genuinely expired or been cancelled leads to a downgrade.

Constants for wp-config.php

Limits and intervals

Areas in the sidebar

Dashboard · Scan · Services · Providers · AI assistant · Design · Google Fonts · Consent log · Statistics · Service list · Custom CSS · Settings

The licence lives in the settings, as does Restart setup assistant. ⌘K opens the command palette and jumps straight to an area.