Nymbl Cookie Sentinel is a lightweight plugin (no jQuery, no external assets of its own) for managing visitor consent to cookie usage. The plugin itself sends nothing to the plugin developer: the only external services that can be contacted are the counters and analytics you connect yourself in the “Integrations” tab, and only after the visitor has given consent. See the “External services” section for the exact list of services, the data they receive and links to their terms and privacy policies.

The plugin is a tool for collecting, storing and re-requesting visitor consent. It does not by itself guarantee legal compliance: review your cookie list, policy pages and processing rules with your legal advisor.

Features

Consent banner: “Accept all” / “Reject all” / “Customize”
Policy links integrated into the banner text: use the {policy} and {privacy} placeholders in the description and the plugin turns them into real links right inside the sentence (if a placeholder is missing, links are appended after the text; if a URL is not set, the placeholder renders as plain text)
Granular settings for 4 categories: necessary (non-disableable), functional, statistical, marketing
Script blocking until consent: type="text/plain" + data-cookiecategory, dynamic activation after choice without page reload
Cookie table with descriptions, storage durations, domains, and third-party info; templates for WordPress, WooCommerce, Yandex.Metrika, GA4, Matomo, Facebook Pixel; CSV import
Integrations tab (form-based, no code pasting): connect Yandex.Metrika, Google Analytics 4, Google Tag Manager, VK Pixel, Top.Mail.ru, Facebook Pixel or Matomo by entering the service ID only — the plugin generates the official counter snippet itself and keeps it blocked until consent; each integration has a category, placement (head / body / footer), load priority and an on/off toggle; every supported service is documented with links to its terms and privacy policy in the “External services” section
Re-open settings widget
Consent versioning: banner reappears when the cookie list or policy changes
Accent color (Color Picker) applies to all UI elements
Light / dark / auto theme, banner position top/bottom
WCAG 2.1 AA: keyboard, Escape, ARIA, focus trap, contrast >= 4.5:1
API hooks: filters nymcs_is_category_allowed and nymcs_register_cookie, actions nymcs_after_consent_updated and nymcs_clear_cache, JS event nymcs:consent-updated. The action and the JS event fire on every frontend request that carries valid consent, not only when the choice changes — if you need one-time side effects, record the fact of processing yourself.
Integrations: WooCommerce, Fluent Forms (CSRF = necessary, abandonment = statistics), Rank Math, Yoast SEO, Polylang/WPML
Multisite: network activation creates the cookie table on every site, and new sites in the network are set up automatically

Consent storage: localStorage (nymcs_consent) + fallback cookie for 12 months.

Security note: the plugin never accepts, stores or outputs arbitrary CSS/JS/PHP entered by users. The Integrations tab is a form: you pick a supported service and enter its ID (counter number, Measurement ID, Pixel ID…), every value is validated against a strict whitelist format, and the counter snippet is generated by the plugin programmatically.

External services

This plugin has no server of its own. It does not phone home and sends nothing to the plugin developer: all settings and the cookie registry live in your WordPress database, and the visitor’s consent is stored in the visitor’s browser (localStorage plus a fallback cookie).

The plugin can, however, connect counters and analytics that you enable in the “Integrations” tab. Every integration is off by default, and the plugin works fully without any external service. For an enabled integration the plugin generates the official snippet of that service and prints it blocked (type="text/plain"). The snippet is executed and starts contacting the service only after the visitor has given consent to the category the integration is assigned to (Statistics by default). If the visitor rejects that category, or has not chosen yet, no request is ever made to the service’s domain.

When a snippet does load, the plugin only supplies the service ID you entered (counter number, Measurement ID, Container ID, Pixel ID or Matomo URL). After that the service collects the data it normally collects: the visitor’s IP address, user agent, the page URL and referrer, plus its own browser identifiers and cookies (_ga, _ym_uid, _fbp and alike). The plugin never proxies, logs or stores this data.

Yandex.Metrika (mc.yandex.ru) – web analytics. Loaded only after consent to the category you assigned (Statistics by default). Data sent on load: page URL, referrer, browser, screen and device parameters, IP address, and the counter number you entered. Yandex.Metrika terms of use, Yandex privacy policy.
Google Analytics 4 (www.googletagmanager.com, google-analytics.com) – web analytics. Loaded only after consent. Data sent on load: page URL, referrer, browser and device parameters, IP address, and the Measurement ID you entered. Google Terms of Service, Google Privacy Policy.
Google Tag Manager (www.googletagmanager.com) – tag manager. Loaded only after consent. Data sent on load: page URL, referrer, browser and device parameters, IP address, and the Container ID you entered. Note: a GTM container can load any other tags you have configured inside it – those tags send data to their own providers according to your container setup, so review the container as well. Google Terms of Service, Google Privacy Policy.
VK Pixel / VK Ads (vk.com) – advertising pixel. Loaded only after consent to the category you assigned (Marketing by default). Data sent on load: page URL, referrer, browser and device parameters, IP address, and the Pixel ID you entered. VK terms of use, VK privacy policy.
Top.Mail.ru counter (top-fwz1.mail.ru, top.mail.ru) – web analytics. Loaded only after consent. Data sent on load: page URL, referrer, browser and device parameters, IP address, and the counter ID you entered. Top.Mail.ru license agreement, Top.Mail.ru privacy policy.
Facebook Pixel (connect.facebook.net, facebook.com) – advertising pixel. Loaded only after consent to the category you assigned (Marketing by default). Data sent on load: page URL, referrer, browser and device parameters, IP address, the Pixel ID you entered and the PageView event. Meta Terms of Service, Meta Privacy Policy, Meta Business Tools Terms.
Matomo – self-hosted analytics. Nothing is sent to matomo.org or to the plugin developer: the tracker sends data only to the Matomo URL you enter in the plugin settings, that is, to your own server or to the host you trust. Data sent on load: page URL, referrer, browser and device parameters, IP address, and the Site ID you entered. Matomo software: terms, privacy policy.

These are the only external services this plugin can contact. If you change the Matomo URL, data is sent to the host you specify there. You are responsible for having a lawful basis for the services you enable.