Adding a cookie banner to your MODX website

To add a cookie banner to a MODX website, paste the consent script at the top of the <head> in your base Template, or in the shared head Chunk every Template includes, above any analytics or marketing tag. Save, then clear the MODX cache, or visitors keep getting cached pages without the banner. The rest of this guide covers the cookies a MODX site sets, how to hold Google Analytics back until consent and the mistakes that leave trackers running.

Why your MODX site needs a cookie banner

MODX Revolution powers many websites that rely on analytics, marketing pixels and session tracking. Every one of those tools stores cookies on your visitors' devices. Under Article 5(3) of the ePrivacy Directive, storing or reading information on a visitor's device needs prior consent unless the cookie is strictly necessary to deliver a service the visitor explicitly asked for.

That rule applies whatever your CMS. If your MODX site sets _ga, _fbp or any other non-essential cookie before a visitor opts in, it breaks the rule.

Regulators are acting on it. On 15 April 2025 the Dutch data protection authority, the AP, wrote to 50 organisations about misleading cookie banners and gave them three months to fix them before an investigation, the first of 500 it plans to warn each year. On 1 September 2025 the CNIL fined SHEIN 150 million euros for placing advertising cookies before visitors made any choice and for a refusal that did not stop them. Smaller businesses are in scope too: the AP's letters went to online stores, media companies and insurers.

Cookies commonly found on MODX websites

Before adding a banner, find out what your site actually sets. A cookie scan gives you the full picture, but MODX sites usually include these.

MODX itself relies on the PHP session cookie, PHPSESSID by default, for both the front end and the Manager, and it is strictly necessary. Everything else waits until the visitor makes a choice. A language cookie set by a multilingual extra sits in a grey area: some regulators treat a remembered language choice as strictly necessary, others want opt-in. Check the rules for the countries you target with the cookie laws by region.

How MODX Templates and Chunks work for code injection

MODX builds pages from three core elements: Templates, Chunks and Snippets. Templates define the overall HTML structure of a page. Chunks are reusable blocks of HTML that you place inside Templates with the [[$chunkName]] syntax. Snippets run PHP logic.

For a cookie consent banner, the key location is the <head> section of your Template. Many MODX sites use a shared head Chunk, often called head or htmlHead, that every Template references. Placing the consent script there loads it on every page without duplicating code.

It is the same approach you would use for any site-wide script, with one difference: a consent script must load before any analytics or marketing tag.

Adding the banner script to MODX in four steps

The pattern is short: paste the consent script into your head Chunk or Template, make sure it sits above every tracking script, save and clear the cache.

Step 1: Locate your head Chunk

Open the MODX Manager. Go to Elements in the left panel, expand Chunks and find the Chunk that holds your <head> content. If your Template contains the head HTML directly rather than a Chunk, edit the Template itself under Elements > Templates.

Step 2: Paste the consent script

Place the consent script as the first item inside <head>, before Google Analytics, Meta Pixel or any other tracking code. For Kukie.io the line looks like this:

<script src="https://cdn.kukie.io/s/YOUR-SITE-KEY/c.js" async></script>

Copy the exact line, with your own site key, from your Kukie.io dashboard.

Step 3: Move tracking scripts below the consent script

Any analytics or marketing scripts in your head Chunk must sit after the consent script, so the consent tool can hold them until the visitor grants permission. If you use Google Tag Manager, the container script also goes below the consent script.

Step 4: Clear the MODX cache

MODX caches aggressively. After saving your Chunk or Template, select Manage > Clear Cache in the Manager toolbar. Without this step, visitors may still get the old version of your site without the banner.

Holding back a Google Analytics snippet stored in a Chunk

Many MODX sites keep the Google Analytics tag in its own Chunk, such as [[$googleAnalytics]], included in the head. Left as it is, that tag runs on every page load and sets _ga before anyone has chosen.

The fix happens inside the Chunk. Change the script's type to text/plain so the browser does not run it, and label it with the consent category it belongs to. Kukie.io reads the data-cc-category attribute and runs the script once that category is accepted:

<script type="text/plain" data-cc-category="analytics"
        src="https://www.googletagmanager.com/gtag/js?id=G-XXXXXXX"></script>
<script type="text/plain" data-cc-category="analytics">
  window.dataLayer = window.dataLayer || [];
  function gtag(){dataLayer.push(arguments);}
  gtag('js', new Date());
  gtag('config', 'G-XXXXXXX');
</script>

Clear the cache again after editing the Chunk, then reload the site in a private window and check that _ga appears only after you accept analytics.

Google Consent Mode for the same tag

If your MODX site uses Google Analytics 4 or Google Ads, Google Consent Mode v2 is worth setting up. Consent Mode passes the visitor's choice to Google's tags, which then either measure in full or send cookieless pings.

Without Consent Mode, a refusal means no data from that visitor. With it, Google can model some of the missing conversions. The setting lives in your consent banner, not in MODX itself.

Blocking cookies before consent in MODX

Showing a banner is only half the job. The banner must also stop non-essential cookies from being set until the visitor opts in. Recital 32 of the GDPR is explicit: silence, pre-ticked boxes and inactivity do not count as consent.

There are two ways to block cookies on a MODX site. The first is conditional script loading, where your consent tool holds script tags until consent, as in the Chunk example above. The second is server-side blocking with a MODX Snippet that checks the consent cookie before it outputs tracking code.

A consent tool handles the first approach for you, and Kukie.io's script blocking also recognises more than 30 known trackers without any tagging. If you prefer server-side control, a Snippet can read the consent cookie and include your analytics Chunk only when analytics is accepted. Most site owners find the client-side approach easier to maintain.

Configuring cookie categories

European regulators expect granular consent. Visitors must be able to accept analytics cookies while rejecting marketing cookies, or the other way round. A single "Accept all" button without alternatives does not meet the GDPR's conditions for consent.

Set up your cookie categories to reflect what your MODX site actually uses. A typical setup:

• Strictly necessary: PHPSESSID (always on, no switch)
• Functional: language preferences and interface settings
• Analytics: _ga, _ga_<container-id>, Matomo cookies
• Marketing: _fbp, advertising pixels, retargeting tags

Map each cookie to its category. A cookie scanning tool does most of this by loading your pages, finding every cookie and suggesting a category.

Geo-detection and regional consent rules

Not every visitor needs the same consent experience. The GDPR and the ePrivacy Directive apply to visitors from the EU and EEA. UK visitors are covered by the UK GDPR and PECR. The CCPA gives California residents opt-out rights rather than an opt-in requirement.

If your MODX site attracts international traffic, geo-detection shows each visitor the banner their region calls for. EU visitors get an opt-in banner. Visitors in California see an opt-out notice. Visitors from places without cookie rules can see no banner at all.

This also helps the visitor experience: an opt-in dialog where no law asks for one adds friction for nothing.

Common mistakes with MODX cookie banners

Several patterns appear again and again on MODX sites that fail a consent check.

Placing the consent script after tracking scripts. If Google Analytics loads before the consent tool, cookies are set before the visitor can object. Script order in your head Chunk matters.

Forgetting to clear the MODX cache. You save your changes, preview them in the Manager and everything looks right. But the live site still serves the cached version without the banner. Always clear the cache after changing a Template or Chunk.

Using a cookie wall. Blocking access to your site unless the visitor accepts all cookies goes against EDPB guidance. Consent must be freely given, so the visitor needs a real choice.

Ignoring dark patterns. Hiding the "Reject" option, using confusing double negatives or colouring buttons to push acceptance are practices regulators object to, as the AP's April 2025 letters show.

MODX cookie banner questions

Check your MODX pages for cookies set before consent

Once the banner is in your head Chunk and the cache is clear, test the result the way a visitor meets it. The Cookie scanner loads your MODX pages and lists every cookie it finds by name and category, so you can see whether anything still runs before a choice.

Scan your website