How to Add a Cookie Consent Banner to a Small Website

You added analytics and an embedded video to your site, and now a visitor has asked where your cookie consent banner is. Or you installed a banner plugin, and it covers half the screen on phones and still loads tracking scripts before anyone clicks a thing.

Both problems are common on small websites, from a local bakery's page to a guild site with a few hundred members. A cookie consent banner is not hard to get right, but most of the work happens behind the banner, not in how it looks. This guide walks through what to check, which setup fits a small site, and the mistakes I see most often when reviewing WordPress installs.

Do you actually need a cookie consent banner

Start by listing what your site sets. Open your site in a private browser window, open the developer tools (F12 in most browsers), go to the Application or Storage tab, and look at Cookies. Then click around three or four pages and look again.

You will usually find cookies in three groups:

• Strictly necessary: login sessions, shopping cart contents, security tokens from your firewall plugin. These generally do not need consent.
• Analytics: tools that count visitors and track paths through your pages.
• Marketing and embeds: social share buttons, embedded videos, ad pixels, chat widgets that load third party scripts.

If you have visitors from the EU or UK and you set anything in the second or third group, privacy rules there generally expect consent before those cookies are set. Other regions have their own rules. If your site only sets a WordPress login cookie for admins, you may not need a banner at all, and adding one just to look official annoys readers for no reason. This is general guidance, not legal advice, so check the rules where your visitors live if you are unsure.

What a working cookie consent banner has to do

A banner that only says "We use cookies" with an OK button is decoration. To be useful it needs to do four things:

1. Block non-essential scripts until consent. Analytics and embeds should not fire on the first page load.
2. Offer accept and reject with equal weight. Two buttons, same size, same prominence. A tiny grey "reject" link next to a big green "accept" button is the pattern regulators have criticised most.
3. Let visitors change their mind. A small "Cookie settings" link in the footer that reopens the choices.
4. Remember the choice. Visitors should not see the banner again on every page or every visit for months.

The first point is where most small sites fail. The banner appears, but the analytics script in the header has already run.

Setting it up on WordPress in about 30 minutes

For a typical small site, a free consent plugin is enough. Look for one with script blocking, a consent log and Google Consent Mode support if you use Google tools. Then follow these steps.

1. Take a backup first. Banner plugins inject code into every page. If something breaks, you want a clean restore point, which is why backups that actually restore matter here.
2. Install and run the cookie scan. Most plugins scan your site and sort found cookies into categories. Check the result by hand, because scanners miss scripts added through theme options or custom HTML blocks.
3. Move tracking scripts into the plugin. If you pasted an analytics snippet into your theme header or a header plugin, remove it there and add it through the consent plugin's script manager, tagged as analytics. Otherwise it keeps running regardless of consent.
4. Replace video embeds with click-to-load placeholders. Many plugins do this automatically. The visitor sees a thumbnail and a note that playing the video loads content from another service.
5. Set equal buttons. Accept all, Reject all, and Preferences. Same style for the first two.
6. Add the footer link. Most plugins provide a shortcode for "Cookie settings".
7. Clear every cache. Page cache plugins and your host's server cache can keep serving the old pages without the banner for hours.

Test it like a stranger would

Open a private window, load your homepage, and before clicking anything, check the Network tab in developer tools for requests to analytics or video domains. There should be none. Click Reject, reload, and check again. Then click Accept and confirm the analytics requests now appear. This five minute test catches more problems than any plugin dashboard.

Why a bigger banner is not a safer banner

A lot of advice says to make the banner full screen so nobody can miss it. I disagree for small sites. Full screen walls push your content below the fold, hurt how fast the page feels on phones, and can trigger layout shift as the banner loads late. On a slow shared host, a heavy consent script can add 200 to 400 milliseconds before the page is usable.

A compact bar at the bottom of the screen, roughly 120 to 160 pixels tall on mobile, with three clear buttons, does the legal job and keeps the page readable. Search engines can still see your content, and readers who came for a guide or a store's opening hours can find it without fighting a pop-up.

Also be careful with the plugin itself. Some consent tools load 100 KB or more of JavaScript and styles. Check the plugin's footprint with a page speed test before and after. If your score drops sharply, try a lighter option. Speed tools have their own blind spots, a point made in why page speed scores mislead community admins, but a big jump after one plugin is still a signal.

Common mistakes on small sites

• Pre-ticked boxes for analytics or marketing in the preferences panel. Consent should be an action, not a default.
• Forgetting the contact form. Some form plugins load anti-spam scripts from third parties. Check whether yours sets cookies, and see why contact forms quietly stop working if blocking that script breaks submissions.
• Language mismatch. A site written in Dutch with a banner in English confuses visitors. Most plugins let you edit every line of text.
• No privacy policy link. The banner should link to a page that lists what you collect and why.
• Never rescanning. Every new plugin can add cookies. Rescan after big changes, or at least every three months.

Frequently asked questions

Does a small website need a cookie banner?

Only if it sets cookies that are not strictly necessary, such as analytics, ads or embedded third party content, and has visitors from places with consent rules. A site with only login and cart cookies often does not need one. Check your actual cookies before deciding.

Can a cookie consent banner slow down my site?

Yes. Some consent plugins load large scripts and styles on every page. Measure your page load before and after installing one, and pick a lighter tool if the difference is noticeable on mobile.

Is it allowed to hide the reject button?

Making reject harder to find than accept is widely seen as a poor practice and has been criticised by privacy regulators in Europe. Give both options the same size and position. It is also simply more honest with your readers.