Wowhead Cookie Compliance Report

Wowhead

wowhead.com

Compare

https://wowhead.com

Scanned Apr 17, 2026 · 35.5s

Your website score is

0/100

Critical

Grade

BannerConsent Banner

Yes

Regulatory Compliance

Multi-regulation overview — click any regulation for details

Technical scan only. A passing score does not equal legal compliance. Consult qualified legal counsel for your jurisdiction.

Tag Leak detected 46 user data leaks before consent on wowhead.com, including WordPress VIP (Analytics Tracker), Advertising Tracker, Ahrefs (Advertising Tracker) and 11 more.

Security Headers

2/6 present

Strict-Transport-Security

Add HSTS header to enforce HTTPS connections and prevent downgrade attacks

Content-Security-Policy

upgrade-insecure-requests;

X-Frame-Options

DENY

X-Content-Type-Options

Set X-Content-Type-Options to 'nosniff' to prevent MIME type sniffing

Referrer-Policy

Set a Referrer-Policy header to control how much referrer information is shared

Permissions-Policy

Add a Permissions-Policy header to restrict browser features like camera, microphone, and geolocation

Google Consent Mode

70/100

GTM Containers:GTM-KN7HXDF

Consent Parameters

ParameterDefaultUpdated

Ad Storagenot_setgranted

Ad User Datanot_setgranted

Ad Personalizationnot_setgranted

Analytics Storagenot_setgranted

Functionality Storagenot_setgranted

Personalization Storagenot_setgranted

Security Storagenot_setgranted

Issues (1)

No default consent call detected — consent mode may not be initialised correctly

Post-Rejection Audit

Reject Button

Found

Post-Rejection Fires

1 vendor

Consent Mode

Not Detected

GTM Load

697ms pre-consent

Google Tag Manager(GTM-KN7HXDF)

Loaded 697ms after page load — before the consent banner was detected (banner appeared at 7703ms). Per a 2022 German court ruling, GTM itself transmits the user's IP to Google pre-consent.

Consent Mode V2: Not Detected

Google Consent Mode was not detected on this site.

✓ gtag('consent', 'update') call detected on rejection

Vendors firing after rejection (1)

Vendor	Category	Timing	URL
OneTrust — OneTrust	consent_management	15688ms	cdn.cookielaw.org

Consent Record Audit

Pass

Consent record stored after interaction

GDPR Art. 7(1)

Found: OptanonConsent (OneTrust)

Record contains timestamp

Art. 7(1)

Timestamp field detected

Record contains consent state

Art. 7(1)

Accept/reject state detected

Record contains consent categories

Art. 7(1)

Consent categories (analytics, marketing, etc.) not found in record

Consent withdrawal mechanism accessible

GDPR Art. 7(3)

Cookie settings link / floating button found

Consent record and withdrawal mechanism are both correctly implemented

Tracker categories detected

Advertising8 vendors

Analytics5 vendors

Security4

Functional1 vendor

Tag Management1 vendor

Critical26

Data was transmitted to a third-party or storage was written on the user’s device before consent. This is a GDPR/ePrivacy violation, not just a script load.

Google Analytics6 findingsID tracked

region1.google-analytics.com, www.google-analytics.com, _gid, _gat, _ga_1G60NXCNZF, _ga

criticalNetworkAnalyticsGA4

GA4 (Google) loaded before consent: Sends pageview and event data to Google Analytics

ID: G-1G60NXCNZFHost: region1.google-analytics.comFired: 2097ms after load

criticalNetworkAnalyticsGA4

GA4 (Google) loaded before consent: Sends pageview and event data to Google Analytics

Host: www.google-analytics.comFired: 528ms after load

criticalCookieAnalyticsGoogle Analytics

Google Analytics cookie "_gid" set before consent

Cookie: _gidDomain: .wowhead.com

criticalCookieAnalyticsGoogle Analytics

Google Analytics cookie "_gat" set before consent

Cookie: _gatDomain: .wowhead.com

criticalCookieAnalyticsGoogle Analytics

Google Analytics cookie "_ga_1G60NXCNZF" set before consent

Cookie: _ga_1G60NXCNZFDomain: .wowhead.com

criticalCookieAnalyticsGoogle Analytics

Google Analytics cookie "_ga" set before consent

Cookie: _gaDomain: .wowhead.com

WordPress VIP (Analytics Tracker)2 findings

cdn.parsely.com, p1.parsely.com

criticalNetworkAnalyticsWordPress VIP (Analytics Tracker)

WordPress VIP (analytics) loaded before consent

Host: cdn.parsely.comFired: 124ms after load

criticalNetworkAnalyticsWordPress VIP (Analytics Tracker)

WordPress VIP (analytics) loaded before consent

Host: p1.parsely.comFired: 1527ms after load

Advertising Tracker3 findings

experiments.parsely.com, p.typekit.net, ab.dns-finder.com

criticalNetworkAdvertisingAdvertising Tracker

advertising tracker at experiments.parsely.com loaded before consent

Host: experiments.parsely.comFired: 124ms after load

criticalNetworkAdvertisingAdvertising Tracker

advertising tracker at p.typekit.net loaded before consent

Host: p.typekit.netFired: 331ms after load

criticalNetworkAdvertisingAdvertising Tracker

advertising tracker at ab.dns-finder.com loaded before consent

Host: ab.dns-finder.comFired: 3263ms after load

criticalNetworkAdvertisingAhrefs (Advertising Tracker)

Ahrefs (advertising) loaded before consent

Host: analytics.ahrefs.comFired: 124ms after load

criticalNetworkAnalyticsDataDog (Analytics Tracker)

DataDog (analytics) loaded before consent

Host: www.datadoghq-browser-agent.comFired: 528ms after load

criticalNetworkAdvertisingAditude (Advertising Tracker)

Aditude (advertising) loaded before consent

Host: htlbid.comFired: 528ms after load

criticalNetworkAdvertisingBoltive (Advertising Tracker)

Boltive (advertising) loaded before consent

Host: tagan.adlightning.comFired: 528ms after load

Google (Tracker Tracker)2 findings

securepubads.g.doubleclick.net, ad.doubleclick.net

criticalNetworkGoogle (Tracker Tracker)

Google (tracker) loaded before consent

Host: securepubads.g.doubleclick.netFired: 528ms after load

criticalNetworkGoogle (Tracker Tracker)

Google (tracker) loaded before consent

Host: ad.doubleclick.netFired: 3263ms after load

Quantcast2 findings

secure.quantserve.com, pixel.quantserve.com

criticalNetworkAdvertisingQuantcast

Quantcast (Quantcast) loaded before consent: Quantcast audience measurement and advertising

Host: secure.quantserve.comFired: 1299ms after load

criticalNetworkAdvertisingQuantcast

Quantcast (Quantcast) loaded before consent: Quantcast audience measurement and advertising

Host: pixel.quantserve.comFired: 2572ms after load

eyeo (Advertising Tracker)2 findings

btloader.com, api.btloader.com

criticalNetworkAdvertisingeyeo (Advertising Tracker)

eyeo (advertising) loaded before consent

Host: btloader.comFired: 1673ms after load

criticalNetworkAdvertisingeyeo (Advertising Tracker)

eyeo (advertising) loaded before consent

Host: api.btloader.comFired: 4016ms after load

Crazy Egg2 findings

script.crazyegg.com, _ce.s

criticalNetworkAnalyticsCrazy Egg

Crazy Egg (Crazy Egg) loaded before consent: Crazy Egg heatmap and scroll tracking

Host: script.crazyegg.comFired: 2015ms after load

criticalCookieAnalyticsCrazy Egg

Crazy Egg cookie "_ce.s" set before consent

Cookie: _ce.sDomain: .wowhead.com

criticalNetworkAdvertisingQuantcast (Advertising Tracker)

Quantcast (advertising) loaded before consent

Host: rules.quantcount.comFired: 2570ms after load

criticalNetworkAdvertisingAdDelivery (Advertising Tracker)

AdDelivery (advertising) loaded before consent

Host: ad-delivery.netFired: 3263ms after load

criticalPost-RejectionConsent MgmtOneTrust — OneTrust

OneTrust — OneTrust fires after user rejected consent

Fired: 15688ms after load

Warnings21

A tag container or script loaded before consent but tags appear correctly gated (e.g. GTM with Consent Mode v2). Not a violation on its own — review to confirm downstream tags stay blocked.

Google Tag Manager2 findingsID tracked

www.googletagmanager.com

warningNetworkTag ManagementGoogle Tag Manager

Google Tag Manager loads before consent — this is expected and required for GCM v2 to initialise consent defaults before any tags fire

ID: GTM-KN7HXDFHost: www.googletagmanager.comFired: 528ms after load

warningGTMTag ManagementGoogle Tag Manager

GTM loaded before consent banner — IP address transmitted to Google pre-consent (container: GTM-KN7HXDF)

warningNetwork

Unknown third-party request to wow.zamimg.com before consent

Host: wow.zamimg.comFired: 107ms after load

warningNetwork

Unknown third-party request to use.typekit.net before consent

Host: use.typekit.netFired: 288ms after load

warningNetwork

Unknown third-party request to cdn.dotaoutpost.com before consent

Host: cdn.dotaoutpost.comFired: 528ms after load

warningNetwork

Unknown third-party request to zaf.api.fanbyte.com before consent

Host: zaf.api.fanbyte.comFired: 536ms after load

warningNetwork

Unknown third-party request to raven-edge.aditude.io before consent

Host: raven-edge.aditude.ioFired: 1972ms after load

warningNetwork

Unknown third-party request to edge.aditude.io before consent

Host: edge.aditude.ioFired: 1972ms after load

warningNetwork

Unknown third-party request to geo-location.prebid.cloud before consent

Host: geo-location.prebid.cloudFired: 1972ms after load

warningNetwork

Unknown third-party request to cdn.abrankings.com before consent

Host: cdn.abrankings.comFired: 2015ms after load

warningNetwork

Unknown third-party request to abrankings.com before consent

Host: abrankings.comFired: 2160ms after load

warningNetwork

Unknown third-party request to raven-static.aditude.io before consent

Host: raven-static.aditude.ioFired: 2160ms after load

warningStorage

localStorage key "test" written before consent

Key: testType: localStorageFired: 424ms after load

warningStorage

sessionStorage key "wh.test" written before consent

Key: wh.testType: sessionStorageFired: 775ms after load

warningStorage

localStorage key "wh:/wow.todayInWow.filter" written before consent

Key: wh:/wow.todayInWow.filterType: localStorageFired: 934ms after load

warningStorage

sessionStorage key "wh.nav.loginRedirect" written before consent

Key: wh.nav.loginRedirectType: sessionStorageFired: 1374ms after load

warningStorage

localStorage key "wh:/newsletter.cta.popover.visits" written before consent

Key: wh:/newsletter.cta.popover.visitsType: localStorageFired: 1388ms after load

warningStorage

localStorage key "cwgl" written before consent

Key: cwglType: localStorageFired: 2163ms after load

warningStorage

localStorage key "cwglt" written before consent

Key: cwgltType: localStorageFired: 2163ms after load

warningStorage

sessionStorage key "BT_sid" written before consent

Key: BT_sidType: sessionStorageFired: 3238ms after load

warningStorage

localStorage key "BT_AA_DETECTION" written before consent

Key: BT_AA_DETECTIONType: localStorageFired: 4953ms after load

Info8

Neutral observations — activity we detected that isn’t a violation but is useful context (e.g. essential cookies, CMP initialisation).

OneTrust2 findings

cdn.cookielaw.org, OptanonConsent

infoNetworkConsent MgmtOneTrust

OneTrust (OneTrust) loaded before consent: OneTrust cookie consent management

Host: cdn.cookielaw.orgFired: 111ms after load

infoCookieConsent MgmtOneTrust

OneTrust cookie "OptanonConsent" set before consent

Cookie: OptanonConsentDomain: .wowhead.com

Google (Cdn)2 findings

fonts.googleapis.com, fonts.gstatic.com

infoNetworkGoogle (Cdn)

Google (cdn) loaded before consent

Host: fonts.googleapis.comFired: 287ms after load

infoNetworkGoogle (Cdn)

Google (cdn) loaded before consent

Host: fonts.gstatic.comFired: 580ms after load

infoNetworkConsent MgmtOneTrust CMP

OneTrust CMP (OneTrust) loaded before consent: OneTrust geo-lookup — determines which consent banner to show based on user location

Host: geolocation.onetrust.comFired: 560ms after load

infoNetworkAmazon (Cdn)

Amazon (cdn) loaded before consent

Host: dn0qt3r0xannq.cloudfront.netFired: 1670ms after load

Parse.ly2 findings

_parsely_session, _parsely_visitor

infoCookieFunctionalParse.ly

Parse.ly cookie "_parsely_session" set before consent — JSON document storing information identifying a browsing session according to Parsely’s proprietary definition

Cookie: _parsely_sessionDomain: .wowhead.comRetention: 30 minutes

infoCookieFunctionalParse.ly

Parse.ly cookie "_parsely_visitor" set before consent — JSON document uniquely identifying a browser and counting its sessions

Cookie: _parsely_visitorDomain: .wowhead.comRetention: 13 months

Compliant1

Tags that fired only after the user gave consent — working as intended.

CompliantCookieConsent MgmtOneTrust

OneTrust cookie "OptanonAlertBoxClosed" set correctly after consent

Cookie: OptanonAlertBoxClosedDomain: .wowhead.com

Is this your site?

Run a full multi-page scan with monitoring and get detailed remediation steps

Scan wowhead.com →

This audit is based on publicly observable website behavior. To request removal from the index, email support@tagleak.com