Calucon Third-Party Embed Gate

When an editor pastes a YouTube URL, WordPress turns it into an iframe — and on every page view, before the visitor has been offered any choice, their browser contacts the provider. Measured on a plain GET to www.youtube.com/embed/… with no playback and no scripts run: five cookies, two of them ~18-month identifiers. The same request on www.youtube-nocookie.com sets zero.

Calucon Third-Party Embed Gate replaces third-party embeds with a server-rendered placeholder until the visitor clicks to load them — the two-click pattern (Zwei-Klick-Lösung). Nothing third-party is contacted before that click: no script, no iframe, no thumbnail, no preconnect. Nothing is stored on the visitor’s device before that click either — including by this plugin.

See it in action on the live demo, or read the details on the plugin page.

What it does

• Gates third-party iframes, embed SDK scripts and legacy <embed>/<object> markup in post content, blocks, widgets, comments and archive descriptions — including HTML that has been minified by caching plugins, where most implementations silently fail, and lazy-loaded markup that parks the real URL in a data-src attribute.
• Gates content delivered over AJAX and the REST API to visitors (“load more”, infinite scroll), while editors always see the original markup.
• Gates by host, not by a provider allowlist: an unknown third-party iframe is gated by default.
• Loads from privacy-preserving endpoints after the click where they exist: youtube-nocookie.com (measured: 0 cookies instead of 5), Vimeo with dnt=1.
• Renders the placeholder server-side, so a visitor without JavaScript still gets a real, working link to the content.
• Rebuilds embeds from an attribute safelist — sandbox is preserved, autoplay never survives, inline styles and event handlers are never copied.
• Strips preconnect/dns-prefetch/preload/prefetch resource hints pointing at gated providers and their CDN hosts (i.ytimg.com, pbs.twimg.com, …).
• Removes embeds from feeds and excerpts instead of showing a meaningless placeholder; a plain fallback link to the content stays for feed readers.
• Per-block override in the editor: gate a specific embed always, never, or per the site default.
• Optional poster image behind the consent panel, chosen per embed from your media library — served from your own site, never fetched from the provider.
• Optional, off by default: remember consent in the visitor’s browser (per embed, per provider, or for all embeds; session or with an expiry), with a withdrawal control via the [calucon_embed_gate_withdraw] shortcode.
• Optional, off by default: a bridge to your consent platform. When a tested platform (WP Consent API, Complianz, Cookiebot, CookieYes, Borlabs Cookie 3, Real Cookie Banner) reports consent for the embeds’ category, gated embeds load without a second click — and a withdrawal there re-gates them. The bridge only reads the platform’s state; with an untested platform, or when the platform gives no answer, gating stands unchanged.
• Accessible placeholder: named group, a real button, visible focus, sufficient contrast, focus kept after activation. Zero axe-core violations in CI.
• Never phones home. The plugin makes no outbound request from your server or your visitors’ browsers, on any path, for any reason.

What it is not

Calucon Third-Party Embed Gate is a technical measure. It is not a consent management platform, it does not produce consent records for accountability purposes, it does not scan your site, and it does not make legal claims about your site. What it technically does: it prevents the embed providers’ requests until the visitor acts, and the click is scoped to the embed (or, if you enable memory, the scope you configure). You remain responsible for your privacy policy, which still has to name the providers you embed from, and for your legal bases. If you need a documented consent record, you need a consent management platform.

Customisation

• Tabbed settings screen (Providers / Detection / Appearance / Consent memory / Status & tools): per-provider on/off, privacy-variant on/off, custom note and button text; own-host, never-gate and always-gate lists; rule toggles including opt-in third-party image gating; appearance presets, corner styles and colour pickers with a live preview and an automatic readability check — no CSS needed; opt-in whole-page buffering for page builders; consent memory; a generated Content-Security-Policy snippet; a Compatibility overview (detected cache plugin, consent platform, page builder — and what the plugin does about each); a read-only Status scan of recent content.
• Theme override: copy templates/placeholder.php to {your-theme}/calucon-embed-gate/placeholder.php.
• CSS custom properties on .cg-embed (--cg-bg, --cg-fg, --cg-accent, …) for restyling without specificity wars.
• WP-CLI: wp calucon-embed-gate scan (is every embed gated? --format=json for CI and automation) and wp calucon-embed-gate providers; the shipped docs/customizing.md is a self-contained customization reference for developers and AI agents.
• Documented filters: calucon_embed_gate_providers, calucon_embed_gate_provider_for_url, calucon_embed_gate_should_gate, calucon_embed_gate_is_own_host, calucon_embed_gate_own_hosts, calucon_embed_gate_placeholder_html, calucon_embed_gate_payload, calucon_embed_gate_note_text, calucon_embed_gate_action_text, calucon_embed_gate_fallback_url, plus the calucon_embed_gate_before_render and calucon_embed_gate_embed_gated actions. Adding a provider is a ten-line filter in functions.php.

External services

This plugin makes no request to any external service, on any page, at any time. It contacts no API, loads no remote script, font, image or update check, and sends no telemetry. Its entire purpose is the opposite direction: it prevents your pages from contacting embed providers.

Third-party content enters the picture only after a visitor explicitly clicks the “Load” button on an embed placeholder. At that moment the visitor’s browser loads that one embed from its provider (for example YouTube, Vimeo, or Google Maps) — exactly as it would have without this plugin, except that it now happens on the visitor’s request instead of automatically. Each placeholder names the provider and links its privacy policy before the click, and the provider hostnames in the plugin’s source code exist solely so it can recognise and gate that content. No data is sent anywhere by the plugin itself.