Izini on WordPress and WooCommerce

The Izini Consent Banner plugin connects a WordPress site to an Izini project without pasting any code. It works on WooCommerce shops too. The banner's wording, categories, languages and colours stay in Izini; the plugin puts them on your site.

You need: an Izini account with a project for the website, and an administrator login for WordPress 6.2 or later (PHP 7.4 or later). Holding back scripts needs WordPress 6.9 or later.

• The banner on every public page, loaded before your other scripts, with Google Consent Mode set to "denied" until the visitor chooses. It is not added to wp-admin or the login page.
• Scripts that wait for consent. On the Scripts tab you give a tracking script a category (a Facebook Pixel, a Google tag, a chat widget, your theme's or a plugin's own files). The plugin then prints it so it runs only after the visitor accepts that category.
• A "Privacy choices" link that reopens the banner's preferences: a block, the shortcode [izini_privacy_choices], or a menu link to #izini-preferences.
• The WP Consent API: when that plugin is active, the visitor's choice is passed to it, so plugins that read it wait for consent too.
• Consent totals and cookie scans in wp-admin (plugin 1.3 or later), once the site is connected by an Izini admin, owner or Privacy Engineer. See step 5 below.

Either way gives you the same plugin.

• From the WordPress plugin directory: in wp-admin, go to Plugins > Add New Plugin, search for Izini, then Install Now and Activate. The listing is in WordPress.org review; until it appears, download it from Izini instead.
• From your Izini dashboard: go to Consent > Installation, open the WordPress tab and press Download the plugin. In wp-admin, go to Plugins > Add New Plugin > Upload Plugin, choose the zip (keep it zipped), press Install Now, then Activate.

Open the new Izini menu in wp-admin and press Connect with Izini. Sign in to Izini, choose the project for this website, and you come back connected. The banner shows on the site straight away.

Prefer not to sign in from WordPress? Copy the project code from Consent > Installation in Izini, paste it on the plugin's Overview tab and press Save.

The project code is public: it appears in your pages' source anyway. The plugin keeps no password.

On the Scripts tab, press Scan the home page. The list also fills in as visitors view your pages. Give each tracking script the category it belongs to, such as Analytics or Marketing; scripts you leave as Runs straight away are not held back. For a script the list does not show, add a rule by hand: part of its file address, or the start of its inline code.

On WooCommerce, the order attribution script WooCommerce adds to shop pages can be held back the same way, with a rule on its file address (sourcebuster).

The banner also holds back scripts it recognises from the cookies in your project's categories (Consent > Cookies in Izini). Google tags and plugins that read the WP Consent API wait for the visitor's choice on their own.

Visitors need a way to change their mind. Add the Privacy choices block, or the shortcode [izini_privacy_choices], to your footer; or add a custom menu link whose address is #izini-preferences. The plugin's Privacy link tab has step-by-step guides for menus, block themes, page builders and widget areas.

When the person who connects the site is an Izini admin, owner or Privacy Engineer, the site also gets a site token, and the plugin's Overview shows:

• Consent on this site: choices in the last 30 days, as accepted all, accepted some and refused all optional. Counts only, refreshed every ten minutes. The same counts appear in an Izini widget on the WordPress dashboard.
• When Izini last saw the banner load from WordPress.
• Cookie scan: the result of the latest scan of this site and your cookie list by category, with Scan this site now. One scan a day can be started from WordPress, within the scans your Izini plan includes. New cookies wait in Izini for your review.

Anyone else who connects gets the banner only; the Overview says so.

How the token is kept safe:

• It never passes through a browser. The browser brings back only a one-time code, which the site's server exchanges for the token, once.
• It reaches counts and scans of this site only, never personal data. Requests from people and consent records stay in Izini, behind its sign-in and two-factor.
• Izini accepts it only from a server, and stops accepting it after 90 days unused.
• Turn off statistics and scans on the Overview, connecting another project, or deleting the plugin revokes it in Izini.

In Izini, Consent > Installation > WordPress lists the connected sites: who connected each, when, and when it was last used. Admins, owners and the Privacy Engineer can revoke one there.

Open your site in a private window: the banner should appear. Then, in Izini, run the health check under Consent > Installation. It checks your home page for the banner script and the project code.

• Updating a plugin installed from the zip: download the new version from Consent > Installation and upload it the same way. WordPress asks whether to replace the installed one: choose Replace current with uploaded. Your settings stay.
• Removing: empty the project code and save, or deactivate the plugin. Deleting it revokes its site token in Izini and removes all its settings.

Nothing is loaded or sent until an administrator connects a project. After that, visitors' browsers load the banner from cdn.izini.ng like any embedded script, and record their choices with Izini. The plugin's readme lists every request it makes and what each one carries, with links to the Izini Terms and privacy policy.