Next DB 6.1: Auto-Updating Tables, Printing, Phone Layout and SEO Next Task 6.0.0: a task manager for Joomla Next Inventory 6.1.1: smoother Check Out, no more list limits, and much faster PHP2Shell: Is Your Joomla Site Safe? What to Do Today Introducing Next Boards: Kanban project and task boards for Joomla Building the Future of Joomla Extensions
NextSoftware
Smart Local Google Maps — Documentation

How Consent Works

This page explains the step-by-step consent process, what gets blocked before consent, and the security measures protecting the flow.

Diagram of the consent flow: map blocked, visitor accepts or declines, cookie set, map shown or kept blocked

What Gets Blocked

Before the visitor makes a consent decision, the plugin ensures no contact with Google Maps:

  • Map iframes are stripped from the HTML output (google.com/maps/embed, maps.google.com, and component-specific markup)
  • The Maps API script (maps.googleapis.com) is removed so no map JavaScript loads
  • Component and page-builder map markup (Widgetkit, Phoca, SP Page Builder, and others) is stripped
  • No Google cookies are set
  • No data — including the visitor's IP — is sent to Google's servers
  • No map tiles are requested from Google's CDN

This applies to both detected maps and maps created with the {smartmap} shortcode — shortcode maps render as a consent placeholder until accepted. See The {smartmap} Shortcode.

If you turn on geo-detection, visitors outside your consent regions are auto-accepted by default; you can change this.

Accept

  1. The consent cookie slgm-consent is set to agree, valid for the whole site
  2. On the next page load (and all subsequent loads while the cookie is valid), the original Google Maps code is left untouched
  3. Maps load and display normally

Decline

  1. The consent cookie slgm-consent is set to decline
  2. Map code continues to be stripped from the HTML on every page load
  3. The consent box is not shown again until the cookie expires
  4. Shortcode maps show a short notice that Google Maps was not loaded

Security Features

CSRF Protection

Every consent form submission includes a Joomla CSRF token. The plugin validates this token before setting the consent cookie. This prevents cross-site request forgery attacks that could set consent on behalf of a visitor.

The consent cookie is set with:

  • HttpOnly — Cannot be read or modified by JavaScript, preventing XSS-based cookie theft
  • Secure — Only transmitted over HTTPS (when Force HTTPS is set to Entire Site)
  • SameSite=Lax — The cookie is not sent with cross-site requests, preventing CSRF via third-party sites

Input Validation

  • The consent value is strictly validated to only accept agree or decline
  • All user-facing text (headline, consent text, button labels) is escaped with htmlspecialchars
  • Shortcode attributes are normalized, whitelisted, and clamped (zoom 1–21, map type to a fixed set, dimensions to %/px) before any URL is built
  • A malformed custom regex pattern is ignored rather than breaking the page

There is no built-in revoke button. Visitors can revoke consent by:

  1. Clearing their browser cookies (the slgm-consent cookie specifically, or all cookies)
  2. Waiting for the cookie to expire (if set to a day-based lifetime)

Once the cookie is gone, the consent dialog appears again on the next visit.

All Extensions