Blocking scripts and embeds

Under opt-in, anything that stores or reads information on the visitor's device for statistics or marketing must wait until the visitor allows it. The script does the blocking. It starts before other scripts and watches the page as it loads. When a category is allowed, it releases what it held back for that category, in page order. A held-back script never runs before that, though the browser may already have downloaded its file while reading the page; the scan shows such a request as held back rather than as tracking. To keep even the download from happening, mark the tag text/plain in the HTML, which the WordPress plugin does for you. Scripts placed above the consent script have already run by the time it starts and are left alone, which is why the tag belongs first in <head>.

Turning blocking on

In the banner editor, open the Blocking tab.

Setting	Effect
Mode: enforce	Matching scripts and iframes are held back until their category is allowed.
Mode: report	Nothing is held back; `ccs.blocked()` lists what would have been. Use it to try blocking on a live site.
Known services	Blocks a built-in list of analytics, advertising and embed hosts: Google Analytics and Ads, Meta, LinkedIn, TikTok, Hotjar, Microsoft Clarity, HubSpot, YouTube, Vimeo, Google Maps and more.
Rules	Your own matches: a URL fragment (or text in an inline script) and the category it needs. Rules are checked before the built-in list.
Allow	URL fragments that are never blocked.
Cookies	Refuses and deletes known tracking cookies (`_ga`, `_fbp`, `_hj`…) whose category is not allowed, including after a withdrawal.

Marking your own scripts

For tags the built-in list does not know, change the type to text/plain and add the category. The browser does not run a text/plain script; PXL Consent runs it once the category is allowed.

<script type="text/plain" data-ccs-category="statistics"
        src="https://example.com/analytics.js"></script>

<script type="text/plain" data-ccs-category="marketing">
  // inline tracking code
</script>

For a module script, add data-ccs-type="module".

Embeds

Move src to data-src and add the category. Until the category is allowed, the visitor sees a placeholder that explains why the content is blocked, with a button that allows the category and loads the embed, and one that opens the cookie choices. Its texts are the Blocked embeds group in the banner editor.

<iframe data-ccs-category="marketing"
        data-src="https://www.youtube.com/embed/VIDEO_ID"
        title="Product video" width="560" height="315"></iframe>

The placeholder names the service from data-ccs-name, then title, then the embed's hostname.

Moving from Cookiebot

Cookiebot's markup works as it is. A script with type="text/plain" data-cookieconsent="statistics" waits for statistics, and an iframe with data-cookieblock-src and data-cookieconsent gets a placeholder. When a tag lists several categories (data-cookieconsent="statistics, marketing"), it waits for all of them. ignore means the tag is never held back.

If scripts or plugins on the site read window.Cookiebot, turn on Cookiebot compatibility in the banner editor's Blocking tab. The script then provides:

Cookiebot.consent (necessary, preferences, statistics, marketing), consented, declined, hasResponse, doNotTrack and regulations;
show(), renew(), withdraw(), submitCustomConsent(preferences, statistics, marketing) and getScript();
the events CookiebotOnLoad, CookiebotOnConsentReady, CookiebotOnAccept and CookiebotOnDecline on window, and the matching CookiebotCallback_… functions.

Dialog events such as CookiebotOnDialogDisplay are not sent. Remove the Cookiebot script when you add PXL Consent's; if both are on the page, the stand-in stays out of the way.

Withdrawal

The browser cannot undo code that has already run. When a visitor withdraws a category they had allowed, blocked cookies are deleted and the page reloads, so nothing from that category keeps running.

Checking that it works

ccs.blocked() in the browser console lists what was held back on the page.
A cookie scan loads your pages without consent and lists anything that is stored or loaded anyway. It also lists anything that remains after the visitor rejects.