Autoblocking Checklist

Goal: make sure non-essential services stay paused before consent and only start when the visitor’s choice (via Access Levels and Purpose Categories) allows them.

Quick checks (one screen)

• Verify both switches in WP admin first: WordPress admin → Compliance plugin → Cookie Consent tab, in the setting cards. Since plugin 3.1.10 there are two: Script blocking engine (the master switch — off means nothing is blocked for anyone, ever) and Autoblocking (block before consent). Autoblocking does nothing while the engine is off, so confirm the engine first. The engine switch is only in WordPress; Autoblocking can also be set in the Admin Portal at Configuration → Laws → Site-wide autoblocking, which updates the plugin’s Autoblocking switch with plugin 3.1.11 or later. On a snippet install they are the blockingEngine and blocking keys in the snippet instead.
• Then check blocking is on: WordPress admin → Compliance plugin → Overview tab. The Script blocking box should read On (or Default allow, if your selected laws allow scripts to run until a visitor opts out). To see which providers are blocked, open the Admin Portal → Autoblocking. Then proceed with the browser checks below.
• Fresh session: Start with a clean browser session and visit a page that normally loads analytics/ads/media.
• Before consent: You shouldn’t see non-essential cookies, pixels, or third-party iframes.
• Balanced selected: Content Personalization and Site Optimization start; Ad Personalization stays off.
• Personalized selected: Personalization and advertising services start.
• Revoke: Reopen the banner with the Update consent icon, lower your choice, and reload—services you enabled should stop again.
• If WooCommerce, Site Kit, Burst, or other consent-aware plugins are active: they self-gate via the WP Consent API integration (v3.1.0+), independently of autoblocking. Confirm Cookie Consent tab → Technical Settings → WP Consent API is on (or intentionally off), and that those plugins reflect the visitor’s choice in their own dashboards.
• If Smash Balloon Instagram or Twitter feeds are on the page: they are handled by a native bridge inside the banner — no snippet required. Smash Balloon Facebook and YouTube feeds still need the legacy-cookie bridge.