Security update: Your website is being protected
On 21 October, critical security vulnerabilities affecting PHP, the technology behind WordPress and many other websites, required urgent action across the hosting industry.
Castlegate IT worked closely with our hosting providers to prepare for the necessary security updates. Importantly, our hosting partners and Cloudflare implemented additional firewall protections before the security patches were released, helping to protect websites against attempts to exploit these vulnerabilities.
The necessary patches have now been applied across our main managed hosting environments. A small number of legacy environments remain protected by additional firewall measures while their updates are completed.
No action is required from our clients. We continue to monitor the situation and manage the necessary security measures on their behalf.
Cybake’s paid social campaigns were successfully attracting visitors to video case studies, but people who declined tracking cookies then faced a barrier if they wanted to watch the embedded video. We developed a click-to-load system that respected their original consent choice while still allowing them to request and watch individual videos.
Cookie compliance and good user experience should not be competing objectives. When they appear to be, the right response is not necessarily to weaken the consent controls, but to understand why the conflict exists and find a better technical solution.
We recently worked through exactly this problem with Cybake, a provider of bakery ERP software. Its paid social campaigns were successfully attracting visitors to video case studies, but there was an unintended consequence of the website’s consent controls. Visitors who had chosen not to accept tracking cookies could use the website normally, but if they then wanted to watch an embedded video, they encountered another barrier.
The solution required us to look beyond the cookie banner itself and reconsider when, and under what circumstances, the website established a connection with the third-party video provider.
Earlier this year, we moved Cybake’s website to Cookiebot as part of a wider review of its cookie compliance. The implementation covered services including Google Analytics, the Meta Pixel, the Leadoo chat widget and embedded YouTube videos, preventing non-essential services from loading unless the visitor had given the appropriate consent.
We also introduced an automatically maintained cookie declaration and regular scans to identify new cookies and services appearing on the website. This gave Cybake a considerably stronger foundation for managing its UK GDPR and PECR obligations.
The difficulty became apparent when the marketing team started looking closely at the journey taken by visitors arriving from paid campaigns.
Cybake was using LinkedIn and Facebook advertising to direct potential customers to a video case study. The advertising itself was performing well, with one LinkedIn campaign achieving a click-through rate of more than 5%.
When visitors arrived, they encountered the website’s normal consent banner and could choose whether to accept or reject the relevant tracking technologies. Those who accepted the appropriate categories could subsequently watch the embedded video without any further interruption.
The problem concerned visitors who had chosen not to accept tracking. Their choice was correctly respected: the website didn’t load the third-party video player because doing so could involve storage, identifiers or communication with the external video provider. However, if that visitor subsequently decided they did want to watch the case-study video, they couldn’t simply press Play. They needed to reopen the website’s cookie settings and change the consent decision they had already made.
This created an awkward conflict. Someone could quite reasonably decide that they didn’t want to consent to general marketing and tracking technologies, but did want to watch this particular video. The website didn’t provide a straightforward way to express those two choices independently.
For campaign traffic arriving specifically to watch a video case study, that was significant friction at an important point in the journey.
We investigated several ways of improving the experience without weakening the site’s wider consent controls.
The wording around consent was reviewed and simplified so that visitors had clearer information about what they were agreeing to. That improved the presentation of the choice, but didn’t address the underlying problem for somebody who had legitimately declined tracking and subsequently wanted to watch a video.
We also investigated whether using Vimeo rather than YouTube would make a meaningful difference. It didn’t solve the fundamental issue because loading another third-party video platform still raises privacy and consent considerations.
Privacy-enhanced options such as YouTube’s youtube-nocookie.com domain and Vimeo’s privacy settings are useful and worth implementing, but they don’t by themselves solve the underlying problem. The important question wasn’t simply which video provider we should use, but when the visitor’s browser should establish a connection with that provider.
That led us to a different approach.
We developed a click-to-load system for Cybake’s YouTube and Vimeo embeds. When a page initially loads, the website displays a locally served thumbnail and play button without loading the third-party video player. This means a visitor can decline the website’s general tracking categories and still reach the video content without being told to go back and change that decision.
If they subsequently press Play, they are making a separate, deliberate request to load that particular piece of third-party content. The website explains that the video will be loaded from the relevant provider and may involve cookies or similar technologies, then establishes the connection and loads the player. We also use the privacy-enhanced options available from YouTube and Vimeo as an additional safeguard.
This creates a much more logical distinction between general consent to tracking across the website and a visitor deliberately requesting a particular third-party resource. Someone doesn’t have to reverse their wider privacy preference simply because they want to watch one video.
It would have been possible to implement this manually on individual campaign pages, but that would have created an unnecessary maintenance burden and left the same issue elsewhere on the site.
Instead, we built the functionality so that it applies automatically to video embeds throughout the website, including existing content and videos added in future. Cybake’s team doesn’t need to remember a special procedure or revisit every historic article containing an embedded video.
This is an important part of the solution. Fixing the immediate campaign page was only part of the job; the implementation also needed to work consistently as the website develops.
Visitors can now make their normal consent choice when they arrive at Cybake’s website. Those who accept the relevant categories continue to use the site as expected, while those who decline general tracking aren’t subsequently forced to reverse that decision simply because they want to watch an individual video.
Instead, the video is presented immediately as part of the page and the visitor can choose to load it with a single click, with appropriate information about what that action involves.
The main Cookiebot implementation remains in place and continues to govern the other services on the website. We haven’t improved the marketing journey by weakening Cybake’s wider privacy controls; we’ve made the handling of third-party video more precise.
That was particularly important because Cybake was working towards ISO certification at the same time. The objective was therefore not simply to improve campaign performance, but to find a solution consistent with the organisation’s wider approach to compliance and governance.
This case illustrates an interesting consequence of implementing consent management properly. Once non-essential third-party technologies genuinely stop loading without consent, user-experience issues that were previously hidden can become apparent.
The answer isn’t necessarily to persuade more visitors to accept everything. In this case, the better solution was to give visitors more granular control over what happened. Someone who doesn’t want general tracking should be able to make that choice, while still being able to make a separate, informed decision to load a particular third-party resource.
For Cybake, changing the sequence allowed us to retain the site’s wider privacy controls while removing an unnecessary obstacle from an important marketing journey.
That’s a better example of what effective consent management should achieve: not simply obtaining more consent, but designing the website so that privacy, usability and commercial objectives can coexist.
Visitors who accepted the relevant consent categories could watch the videos normally. The problem affected people who had declined tracking cookies and subsequently decided to watch an embedded video. Because the third-party player remained blocked, they previously had to reopen their cookie settings and change their wider consent choice before the video would load.
A click-to-load implementation initially displays content served by the website itself, such as a video thumbnail and play button, without contacting YouTube or Vimeo. The external player is only requested when the visitor chooses to watch the video. This allows the decision to load a particular piece of third-party content to be handled separately from the visitor's wider tracking preferences.
Not necessarily. YouTube's privacy-enhanced mode reduces some of the tracking associated with an embedded player, but youtube-nocookie.com should not be interpreted as meaning that every privacy and consent consideration has disappeared. We use privacy-enhanced embeds as an additional safeguard rather than treating them as a complete consent-management solution.
Yes. Consent controls can introduce friction into a user journey, particularly when somebody arrives from a paid campaign expecting to access specific content. The answer isn't simply to weaken or remove those controls. In Cybake's case, changing when the third-party video service was contacted allowed us to simplify the journey while retaining the site's wider privacy and consent framework.
'
'
Castlegate IT, The Bonding Warehouse, Terry Avenue, York, YO1 6FA
Castlegate IT, Blake House, 18 Blake Street, York, YO1 8QG
Copyright © 2026 Castlegate IT Limited. All rights reserved. | Registered in England No. 7824836 | VAT No. 938 6395 71