Goal: make sure non-essential services stay paused before consent and only start when the visitor’s choice (via Access Levels and Purpose Categories) allows them.

Quick checks (one screen)

• Verify both switches in WP admin first: WordPress admin → Compliance → Cookie Consent tab (classic settings screen: Cookie Consent Settings). Since plugin 3.1.10 there are two: Script blocking engine (the master switch — off means nothing is blocked for anyone, ever) and Autoblocking (block before consent). Autoblocking does nothing while the engine is off, so confirm the engine first. Autoblocking can also be set in the Admin Portal (Configuration → Laws → Site-wide autoblocking), which WordPress picks up with plugin 3.1.11 or later; the Script blocking engine is plugin-only. On a snippet install they are the blocking and blockingEngine keys in the snippet instead, and the Portal setting does not change them.
• Then check script blocking: WordPress admin → Compliance plugin → Overview tab. In the Script blocking box, confirm blocking is on; to review your providers and URL patterns, open the Admin Portal → Autoblocking. Then proceed with the browser checks below.
• Fresh session: Start with a clean browser session and visit a page that normally loads analytics/ads/media.
• Before consent: You shouldn’t see non-essential cookies, pixels, or third-party iframes. (A held script file may still appear as a download in the Network tab; it does not run.) Two limits: a script that an already-allowed script adds later is not held (for example a tag that Google Tag Manager fires while Google Consent Mode lets GTM run, so gate those inside GTM), and on the Free plan blocking stops once the site passes its visit limit for the current cycle.
• Balanced selected: Content Personalization and Site Optimization should start; Ad Personalization stays off.
• Personalized selected: Personalization and advertising services start.
• Update consent: Use the Update consent icon to change your choice, then reload—services you enabled should stop again.
• If WooCommerce, Site Kit, Burst, or other consent-aware plugins are active: they self-gate via the WP Consent API integration (v3.1.0+), independently of autoblocking. Confirm Cookie Consent tab → Technical Settings → WP Consent API (classic settings screen: Cookie Consent Settings) is on (or intentionally off), and that those plugins reflect the visitor’s choice in their own dashboards.
• If Smash Balloon Instagram or Twitter feeds are on the page: they are handled by a native bridge inside the banner — no snippet required. Smash Balloon Facebook and YouTube feeds still need the legacy-cookie bridge.