Check what your WooCommerce plugins really do

On WordPress, consent, withdrawal and accessibility each come from a different plugin or theme, and they don’t always agree. untick checks the result in a real browser, so you see what visitors get.

  • A banner that doesn’t block

    The WP Consent API only shares the choice between plugins. Blocking scripts is the consent plugin’s job, and hand-added tags can slip past it.

  • One plugin per obligation

    Cookies, the withdrawal button, the newsletter box and the theme all come from different authors. An update to one can break another.

  • Guests who can’t withdraw

    Most WooCommerce shops let people check out as guests. They need a withdrawal link they can reach without an account.

The four checks on WooCommerce

The four checks every EU-facing WooCommerce shop should run, which plugins people use for each, and what to look at after every update.

Cookie consent that really stops tracking

What WooCommerce gives you
WooCommerce core has no cookie banner. Its order attribution feature works with the WP Consent API, which plugins such as Complianz and CookieYes support. Both list cookie or script blocking among their features.
Where it goes wrong
The WP Consent API doesn’t block anything by itself: third-party scripts have to be blocked by the consent plugin. Tags pasted into the theme, a page builder or Tag Manager are the usual leaks.
Test it yourself
Open the shop in a private window, don’t click the banner, and look for tracking requests in DevTools › Network. Click Reject, reload, and look again.

No pre-ticked boxes or fake pressure

What WooCommerce gives you
Newsletter boxes at checkout come from your email plugin, and urgency badges from marketing plugins. WooCommerce core doesn’t add either.
Where it goes wrong
A newsletter or terms box that starts ticked, countdown plugins that reset on reload, and stock badges that don’t match real stock.
Test it yourself
Add something to the cart, go to checkout and see if any box is already ticked. Reload a product page with a timer and see if it starts over.

The EU withdrawal button

What WooCommerce gives you
WooCommerce says a contact form plugin can work, as long as it sends a confirmation email, and its order and refund tools handle the rest. Plugins like Germanized add a withdrawal button and form for Directive (EU) 2023/2673.
Where it goes wrong
A plain contact form often misses the confirm step or the automatic receipt with date and time. Check the button is labelled clearly and easy to find from every page; the footer or main menu is the usual place.
Test it yourself
As a guest, find the withdrawal link from any page, send a request for a test order, and check you get an email with its content, date and time.

Accessibility (WCAG 2.2, the EAA)

What WooCommerce gives you
WordPress themes can carry the “accessibility-ready” tag after a review by a member of the accessibility team.
Where it goes wrong
WordPress itself says the tag doesn’t mean a theme meets WCAG AA. Page builders, sliders and checkout plugins add their own markup on top.
Test it yourself
Tab through home, a product, the cart and checkout without a mouse. Check every field has a visible label and every error is announced in words, not only in red.

Platform facts checked on .Platforms change their settings often. This page explains what we found in their own documentation; it is not legal advice.

Sources

  1. WooCommerce: order attribution tracking
  2. WordPress.org: WP Consent API plugin
  3. WordPress.org: Complianz plugin
  4. WordPress.org: CookieYes plugin
  5. WooCommerce: the EU withdrawal link requirement (2026)
  6. WordPress.org: Germanized for WooCommerce
  7. WordPress Theme Handbook: accessibility-ready themes

The checks that matter most for WooCommerce stores

Each one links to the rule, the law behind it and how to fix it.

Also in untick

Common questions

Which cookie plugin should a WooCommerce shop use?

Any plugin that blocks scripts before consent and supports the WP Consent API, such as Complianz or CookieYes. What matters is the result, so scan the live shop after setting it up and after each plugin update.

Does the WP Consent API block trackers?

No. It passes the visitor’s choice between plugins. Blocking is done by your consent plugin, and only for scripts it knows about.

Is a contact form enough for the EU withdrawal button?

It can be, if the button is clearly labelled, a confirm step follows, and the customer gets an automatic receipt with the date and time. Many form setups miss the receipt, so test it.

Do I need to install a plugin for untick?

No. untick visits your shop from the outside like a customer. The free scan checks your homepage, Starter up to 3 key pages, and Pro and Agency up to 6.

See what your own site does.

Free, no signup, about a minute for your homepage.