Find every script, style, and link the Cookie Consent kit puts in the page source

While the Cookie Consent kit in TermsFeed AutoTerms is on, every page gets 1 <head> script, a footer block with the vendor scripts, and by default a Preferences Center link. The <head> script loads TermsFeed Free Cookie Consent 4.2.0 from www.termsfeed.com, and the footer block starts it with your settings. Search the page source of your WordPress website for termsfeed-autoterms-cookie-consent to find the Additional CSS, the Callbacks, the run script, and each vendor script the plugin gives an id. The <head> script carries the id wpautoterms_js_cookie_consent-js, and the link the id open_preferences_center.

The kit prints the same output for every visitor, logged in or not. The Cookie Consent script then adds the consent banner and the Preferences Center to the page. Find their markup and classes in the Free Cookie Consent DOM and CSS Reference.

The plugin adds the Cookie Consent loader to the <head> with the script handle wpautoterms_js_cookie_consent. The address is https://www.termsfeed.com/public/cookie-consent/4.2.0/cookie-consent.js, and WordPress adds its own ver query parameter, because the plugin gives the script no version. WordPress prints the tag in this form.

<script src="https://www.termsfeed.com/public/cookie-consent/4.2.0/cookie-consent.js?ver=7.1.3" id="wpautoterms_js_cookie_consent-js"></script>

The ver value is the WordPress version of the site, 7.1.3 in this example. The loader fetches the rest of the Cookie Consent script from the same host. Read which requests it makes in How the Cookie Consent loader works.

The plugin prints the rest of the kit in the footer, inside <div id="wpautoterms-bottom-static-container">, after any Cookie Notice bar or Update Notices bar placed at the bottom with the static type. The block holds its parts in this order.

  1. The Additional CSS in <style id="termsfeed-autoterms-cookie-consent-style">, printed only while the "Additional CSS" field holds rules.
  2. The Callbacks in <script id="termsfeed-autoterms-cookie-consent-callbacks">, printed only while the Callbacks hold an object.
  3. The run script in <script id="termsfeed-autoterms-cookie-consent-script">, which passes the Configuration Parameters to cookieconsent.run(). It starts the Cookie Consent script at once when the page is already parsed, and on DOMContentLoaded otherwise.
  4. The credit line in a <noscript> element: "Free cookie consent management tool by TermsFeed", with a link to www.termsfeed.com.
  5. The vendor scripts, each one between 2 HTML comments that name it in capitals.

This footer block holds the default settings, the site title "My Website", 1 rule of Additional CSS, and Google Analytics 4 as a tracking vendor script.

<div id="wpautoterms-bottom-static-container">
<style id="termsfeed-autoterms-cookie-consent-style">
/* TermsFeed AutoTerms (WP AutoTerms) plugin */
#open_preferences_center { font-size: 14px; }
</style>
<!-- Cookie Consent by TermsFeed https://www.TermsFeed.com -->
<script type="text/javascript" charset="UTF-8" id="termsfeed-autoterms-cookie-consent-callbacks">
window.wpautotermsCookieConsentCallbacks = {
        'i_agree_button_clicked': () => {

        },
        'scripts_specific_loaded': (level) => {
            switch (level) {
                case 'targeting':
                    if (typeof gtag === 'function') {
                        gtag('consent', 'update', {
                            'ad_storage': 'granted',
                            'ad_user_data': 'granted',
                            'ad_personalization': 'granted',
                            'analytics_storage': 'granted'
                        });
                    }
                    break;
            }
        }
    }
;
</script>
<script type="text/javascript" charset="UTF-8" id="termsfeed-autoterms-cookie-consent-script">
(function () {
    function wpautotermsRunCookieConsent() {
        var config = {"website_name":"My Website","notice_banner_type":"headline","consent_type":"express","palette":"light","language":"en","page_load_consent_levels":["strictly-necessary"],"notice_banner_reject_button_hide":false,"preferences_center_close_button_hide":false,"page_refresh_confirmation_buttons":false};
        if (window.wpautotermsCookieConsentCallbacks && typeof window.wpautotermsCookieConsentCallbacks === 'object') {config.callbacks = window.wpautotermsCookieConsentCallbacks;}
        cookieconsent.run(config);
    }
    // NOTE: delay / defer JS plugins may run this script after DOMContentLoaded has already fired.
    if (document.readyState === 'loading') {
        document.addEventListener('DOMContentLoaded', wpautotermsRunCookieConsent);
    } else {
        wpautotermsRunCookieConsent();
    }
})();
</script>

<noscript>Free cookie consent management tool by <a href="https://www.termsfeed.com/">TermsFeed</a></noscript>
<!-- End Cookie Consent by TermsFeed https://www.TermsFeed.com -->

<!-- Cookie Consent by TermsFeed https://www.TermsFeed.com - GOOGLE ANALYTICS Vendor Script -->
<script type="text/plain" id="termsfeed-autoterms-cookie-consent-vendor-script-googleanalytics" data-cookie-consent="tracking" async src="https://www.googletagmanager.com/gtag/js?id=G-XXXXXXXXXX"></script>
<script type="text/plain" id="termsfeed-autoterms-cookie-consent-vendor-script-googleanalytics-2" data-cookie-consent="tracking">
  window.dataLayer = window.dataLayer || [];
  function gtag(){dataLayer.push(arguments);}
  gtag('js', new Date());

  gtag('config', 'G-XXXXXXXXXX');
</script>
<!-- End of Cookie Consent by TermsFeed https://www.TermsFeed.com - GOOGLE ANALYTICS Vendor Script -->
</div>

The run script carries every key of the Configuration Parameters except callbacks, which reaches the Cookie Consent script through window.wpautotermsCookieConsentCallbacks. Compare the keys with the JSON on the tab in Cookie Banner JSON Settings in WordPress.

Each JavaScript vendor script reaches the page as <script type="text/plain"> with a data-cookie-consent attribute that names its category, so the browser does not run it. The vendor attributes, such as async and src, follow the attributes the plugin adds.

A script without an id of its own gets one that starts with termsfeed-autoterms-cookie-consent-vendor-script-. A vendor id, such as id="ze-snippet", stays in place, and the plugin adds none. Look up the naming rule in The id the plugin gives each vendor script. Read how the Cookie Consent script releases a tagged script in Attributes of a Cookie Consent tagged script.

The plugin prints <a href="#" id="open_preferences_center">Update cookies preferences</a> in the footer of every page, after the footer legal links that the Links to Legal Pages kit prints and before the bottom containers. Clicking the link opens the Preferences Center. The link does not carry a class or a style of its own, so style it with Additional CSS through its id.

The link appears while the kit is on, "Insert link for users to open Preferences Center" is ticked, and the Configuration Parameters are valid JSON. Untick the field so that the plugin does not print the link, and add your own element with the id open_preferences_center in a widget or the footer of your WordPress theme. Place the element with Add a Cookie Settings Link With Free Cookie Consent.

A WordPress menu item has no field for an id, so it opens the Preferences Center through a class and the open_preferences_center_selector option of Cookie Consent. Add the menu item in the WordPress admin, then name its class in the Configuration Parameters.

  1. In a classic theme, open Appearance > Menus, open Screen Options at the top of the screen, and tick CSS Classes. In a block theme, open Appearance > Editor and select the Navigation block that holds the menu item.
  2. Open the menu item, type open-cookie-preferences in CSS Classes (optional), and click Save Menu. In a block theme, type it in Advanced > Additional CSS class(es) of the link, then save.
  3. Open the "Configuration Parameters" tab of the Cookie Consent kit, add "open_preferences_center_selector": "#open_preferences_center, .open-cookie-preferences", as a new line after the opening { of the JSON, and click the "Save Changes" button.
  4. Clear your page cache.
  5. Close every private window, load a page of your WordPress website in a new one, click the menu item, and check that the Preferences Center opens.

Compare the page source with each case to tell which one applies to your page.

Case What the page source shows
The kit is off No <head> script, no footer block, no vendor scripts, and no link. The vendor scripts are not printed untagged either.
wp-login.php and wp-register.php No output from the plugin
Invalid Configuration Parameters The <head> script, the Additional CSS, a run script that never calls cookieconsent.run(), the credit line, and the tagged vendor scripts. No Callbacks script and no link print. No consent banner appears and no vendor script runs.

The consent banner is missing in every one of these cases. Find the fix for a page with no consent banner in WordPress Cookie Banner Not Appearing.

What a Content Security Policy allows for the Cookie Consent kit

A Content Security Policy for a page with the kit allows https://www.termsfeed.com in script-src, plus the host each vendor script loads from. Every file of the Cookie Consent script comes from www.termsfeed.com. Each vendor script loads from its own host once its category runs, such as www.googletagmanager.com for Google Analytics 4.

The plugin prints the Callbacks script, the run script, and the Additional CSS inline, with no nonce attribute. The policy therefore keeps 'unsafe-inline' in script-src and style-src, as the minimum Cookie Consent policy does. Copy that policy and the hosts of Google Analytics 4 from The minimum Content Security Policy for Cookie Consent.

Exclude the Cookie Consent kit scripts from page speed plugins

Exclude the Cookie Consent script and the 2 inline scripts the kit prints from the "delay JavaScript" option of a page speed plugin. The run script calls the Cookie Consent script as soon as the page is parsed. Delaying the Cookie Consent script without the run script leaves the run script with nothing to call, and the page does not show the consent banner. Delaying both shows the consent banner only after the first scroll or click.

Combining and deferring scripts leave the Cookie Consent script and the 2 inline scripts of the kit working, and WP Rocket "Combine JavaScript files" still needs each vendor .js address excluded. Find the exact entries for WP Rocket and LiteSpeed Cache in Step 3: Set up page speed plugins for the notices and the Cookie Consent kit.