Next DB 6.1: Auto-Updating Tables, Printing, Phone Layout and SEO Next Task 6.0.0: a task manager for Joomla Next Inventory 6.1.1: smoother Check Out, no more list limits, and much faster PHP2Shell: Is Your Joomla Site Safe? What to Do Today Introducing Next Boards: Kanban project and task boards for Joomla Building the Future of Joomla Extensions
NextSoftware
Smart Local Youtube — Documentation

How Consent Works

This page explains the step-by-step consent process, what gets blocked before consent, and the security measures protecting the flow.

Diagram of the consent flow: page request, YouTube code detected and removed, consent box, then Load YouTube or Do not load videos

What Gets Blocked

Before the visitor makes a consent decision, the plugin removes every detected piece of YouTube code from the page before it is sent:

  • YouTube iframes (both youtube.com/embed and youtube-nocookie.com/embed)
  • The IFrame API script (youtube.com/iframe_api), so no player JavaScript loads
  • Extension and page-builder markup: Smart Slider 3 video layers, the YouTube Gallery player script, oEmbed links and entity-encoded iframes

So the browser makes no request to YouTube, receives no YouTube cookie, and sends nothing to Google for the detected videos.

Two exceptions you control:

  • YouTube thumbnail placeholder mode (opt-in) loads poster images from img.youtube.com before consent, which sends the visitor's IP address to Google. Every other placeholder mode keeps images on your server. See Placeholder Images.
  • Geo-detection (off by default): when it is on, visitors outside your consent regions are auto-accepted by default. See Geo-Detection.

Videos the plugin does not detect (for example a player built by JavaScript after the page loads) are not blocked. Use Debug Mode to check your pages.

Accept (Load YouTube)

  1. The consent cookie sly-consent is set to agree
  2. On the next page load (and all subsequent loads while the cookie is valid), the original YouTube code is left untouched
  3. Videos play normally

Decline (Do not load videos, or the × close button)

  1. The consent cookie sly-consent is set to decline
  2. YouTube code continues to be stripped from the HTML on every page load
  3. The consent box is not shown again until the cookie expires

Security Features

CSRF Protection

Every consent form submission includes a Joomla CSRF token. The plugin validates this token before setting the consent cookie. This prevents cross-site request forgery attacks that could set consent on behalf of a visitor.

The consent cookie is set with:

  • HttpOnly — Cannot be read or modified by JavaScript, preventing XSS-based cookie theft
  • Secure — Only transmitted over HTTPS (when Force HTTPS is set to Entire Site)
  • SameSite=Lax — The cookie is not sent with cross-site requests, preventing CSRF via third-party sites

Input Validation

  • The consent value is strictly validated to only accept agree or decline
  • All user-facing text (headline, consent text, button labels) is escaped with htmlspecialchars
  • A malformed Custom Regex Pattern fails silently rather than breaking the page

There is no built-in revoke button. Visitors can revoke consent by:

  1. Clearing their browser cookies (the sly-consent cookie specifically, or all cookies)
  2. Waiting for the cookie to expire (if set to a day-based lifetime)

Once the cookie is gone, the consent dialog appears again on the next visit.

All Extensions