Short answer
Audit a WordPress banner by testing the live site in a clean session, then checking all plugin, theme, builder, and GTM paths that can inject analytics or marketing scripts. WordPress compliance failures commonly come from a second plugin or optimization setting bypassing the banner.
Do not stop when the banner looks correct. Confirm that Reject, Analytics only, and Accept all produce the expected network and cookie behaviour across the templates visitors actually use.
What to check
- Header/footer insertion plugins, theme code, child themes, and page builders.
- GTM, GA4, Meta Pixel, chat, video, heatmap, and affiliate plugins.
- Caching, defer, delay-JavaScript, and script-combining settings.
- Homepage, post, landing page, shop, form, and logged-out templates.
Practical steps
- List active plugins and custom code injection locations.
- Use a private window to test initial, reject, granular, and accept choices.
- Inspect Network and storage before and after each choice.
- Check caching/optimization order and ensure the consent runtime wins the race.
- Run a GDPRChecker scan on representative URLs, then enable scheduled monitoring.
Common mistakes
- Testing only while logged in as WordPress admin.
- Excluding the banner from cache but allowing GA4 to load first.
- Assuming a plugin’s ‘GDPR’ label guarantees its scripts are gated.
- Forgetting app-like embeds in Elementor, Divi, or custom HTML blocks.
Important boundary
Know the scope
A scanner can observe common requests and site behaviour, but a WordPress owner must still verify plugin settings and obtain advice for policy or lawful-basis decisions.