Consenta v1.7.0 introduces real HMAC-SHA256 for cookie signatures, protects all outgoing HTTP calls against SSRF and hardens the entire plugin architecture against modern attack vectors.
14-day money-back · Cancel anytime · GDPR-compliant · Local in WordPress
A cookie consent plugin runs on every single page of your website, processes personal data and writes cookies with legal significance. It is therefore a critical part of your infrastructure — and a potential attack target. Manipulated consent cookies could simulate false consents and lead to GDPR violations. SSRF vulnerabilities in outgoing HTTP calls could expose internal network resources. Consenta addresses all these risks with a security-first architecture.
Consent cookies are signed with real HMAC-SHA256 using the WordPress AUTH_KEY. Server-side verification via hash_equals() protects against timing attacks. Unsigned cookies are consistently rejected.
All outgoing HTTP calls — webhooks, cookie scanner, geolocation — are secured by an SSRF guard. Private IP ranges, loopback addresses and internal network resources cannot be accessed.
API tokens and access keys are never stored in plain text. SHA-256 hashes are stored in the database, so even with a database dump no valid tokens can be extracted.
REST API endpoints and AJAX handlers are equipped with rate limiting. Brute-force attacks on consent endpoints and admin actions are detected and blocked.
CSV exports of consent data are protected against formula injection attacks. Cell contents are sanitized so no Excel macros or shell commands can be executed via exported data.
No style attribute is output unsanitized. All outputs pass through wp_kses() or esc_html(). Dynamic content in admin areas and frontend outputs is fully protected against cross-site scripting.
Consenta enforces WCAG AA-compliant contrast ratios for all UI elements of the consent banner. Customizations that would fall below the minimum contrast are prevented.
All PHP files are protected against direct access with ABSPATH guards. All token comparisons use hash_equals() for timing-attack-safe checks — no direct string comparison for security-critical operations.
A consent plugin is executed on every single page request. A single security vulnerability can therefore affect the entire website.
Consent data such as IP addresses, timestamps and user decisions are personal data under the GDPR. Their protection is not optional.
The consent cookie documents a legally binding consent. If it is manipulated, this can lead to invalid consents and thus to GDPR violations.
Cancel anytime
Cancel anytime · 14-day money back
Cancel anytime · 14-day money back
HMAC-SHA256 · SSRF Protection · Rate Limiting · XSS Hardening · WCAG AA · GDPR-compliant
14-day money-back guarantee · Cancel anytime · Available in 30+ languages
