Script blocking: exactly what the plugin does

Blocking here means: the plugin rewrites the finished page before it reaches the browser. A neutralized script is still in the source, but it is neither loaded nor executed. This page describes what happens technically and where the limits are.

What happens on delivery

If no matching consent is present, the plugin places an output buffer over the page. Every script element whose address contains one of the blocked host patterns loses its type attribute, is given type="text/plain", and its original address moves into a data attribute. External stylesheets are switched from rel="stylesheet" to rel="preload" with as="style", and their address is moved into a data attribute as well. Once the decision has been made, the frontend reports it to the server, sets the cookies and reloads the page — the server then delivers it without any rewriting.

<script type="text/plain" data-kwpc-src="…">

Where the list of blocked hosts comes from

• Every recorded service that is active and sits in “Statistics”, “Marketing” or “Media & external content”
• Every pattern from the “Custom blocking rules” card — additional host patterns that are always blocked
• If both are empty, the built-in list of known tracker hosts in the Statistics and Marketing categories applies instead
• With “Block Google Fonts until consent” switched on, additionally fonts.googleapis.com and fonts.gstatic.com
• Services in “Necessary”, “Functional” and “Other” are never on this list

1. Open “Kakapo Consent” and select the “Rules” group, then the “Resources” (in German: „Ressourcen“) item.
2. Check the “Script Blocking active” switch — it is switched on for a new installation.
3. Use “Add rule” to add a host pattern of your own, for example tracker.example.com.
4. On the “Currently blocked hosts” card, look up which hosts are being blocked at the moment and where they come from.
5. For scripts that a plugin enqueues under a name of its own, enter one rule per line on the “Handle rules” card in the format handle, vertical bar, category.

google-analytics | statistik

Additional layers and limits

• Script Blocking does not take embedded frames apart. For that, the same panel has the “Lock embeds” switch: it replaces iframes without consent with a placeholder before delivery; the original markup travels along encoded and is only inserted on click. Invisible counting frames (height or width 0, display:none, aria-hidden) are left untouched
• Inline scripts that are attached to a handle via wp_add_inline_script remain in place — they carry no handle of their own in the markup
• WooCommerce: without consent for “Statistics”, wc-cart-fragments, wc-analytics and woocommerce-analytics are unhooked, without “Marketing” the scripts wc-marketing and woocommerce-marketing
• Alternatively, Google Fonts can be self-hosted locally. Only families that are actually stored locally are redirected; if a download fails, the original embedding stays in place
• The “Conditional content” block works even earlier: without consent its content is not rendered at all; a replacement box is delivered instead

When nothing is blocked at all

• The “CMP enabled” switch is off
• The domain that was called is not in the list under “Domains” (an empty list means: everywhere)
• The mode is set to “Notice only”
• A pattern under “Excluded URLs” or “Excluded user agents” matches
• “Preview mode” is active and the visitor is not a logged-in administrator
• “Geolocation — EU/EEA only” is active and the server reports a country outside it
• The visitor chose “Accept all”

kwpc_auth