Title: KEKSONAUT Consent
Author: keksonaut
Published: October 26, 2026
Last modified: October 28, 2026
---
Search plugins
# KEKSONAUT Consent
By [keksonaut](https://profiles.wordpress.org/keksonaut/)
[Download](https://downloads.wordpress.org/plugin/keksonaut-consent.0.5.3.zip)
* [Details](https://wordpress.org/plugins/keksonaut-consent/#description)
* [Reviews](https://wordpress.org/plugins/keksonaut-consent/#reviews)
* [Installation](https://wordpress.org/plugins/keksonaut-consent/#installation)
* [Development](https://wordpress.org/plugins/keksonaut-consent/#developers)
[Support](https://wordpress.org/support/plugin/keksonaut-consent/)
## Description
KEKSONAUT is a consent management service at https://keksonaut.com.
This plugin
connects your WordPress site to that service, loads its browser runtime early in
the page head, and provides settings and manual connection diagnostics under Settings
KEKSONAUT.
Configure banner layout, texts, colours, categories and services in the
KEKSONAUT
web app. The plugin needs the website’s public Settings ID; an API key is optional
and is used only for administrator-requested diagnostics. A KEKSONAUT business account
and a configured website are required for the hosted service. The data processing
agreement (AVV) is incorporated into the terms accepted during registration; no
separate acceptance step is needed. Service plans are described at https://keksonaut.
com/de/preise.
**Scope:** Google Consent Mode v2 signals and configurable script/iframe
blocking.
KEKSONAUT is not a TCF-certified CMP. Configure the relevant services and their
script integrations, and verify the result on your site. Scripts or iframes that
start before the runtime has loaded its settings cannot be blocked retroactively.
Site owners remain responsible for their consent setup and legal obligations.
No runtime or consent defaults are added until a valid Settings ID and HTTPS
API
base are configured. Simply opening the plugin settings makes no requests to the
KEKSONAUT API.
#### Configuration
* **Settings ID** — the public settings ID shown in the KEKSONAUT dashboard.
This
is different from the internal website ID.
* **API base URL** (optional) — leave empty to use
https://api.keksonaut.com.
Dedicated or self-hosted deployments may use an HTTPS base URL with an optional
path, without a query, fragment or embedded credentials.
* **API key** (optional, diagnostics only) — prefer a constant in
wp-config.php
to keep the key out of the WordPress options table:
* define( ‘COOKIEMONSTER_API_KEY’, ‘cm_live_…’ );
* The constant takes precedence over a key saved in the settings. The key is
never
included in the site’s front-end markup. Leave the password field empty to keep
a saved key; use Remove stored API key to delete it. That button does not change
a key defined in wp-config.php.
### External services
This plugin integrates with **KEKSONAUT**, https://keksonaut.com, to deliver a
configured consent banner and retain consent evidence. Saving a Settings ID connects
your site’s visitors to the configured service. Until it is configured, the plugin
adds no front-end integration and makes no diagnostic requests.
What is loaded or sent, and when:
* **Runtime and banner assets** — on front-end page views with a valid
configuration,
the browser requests `https://api.keksonaut.com/runtime.js` (or the configured
API host). Banner branding and configured logo assets may also be requested.
HTTP requests expose the visitor’s IP address, user agent and browser-controlled
referrer information to the asset host.
* **Banner settings and page counts** — the runtime requests
/runtime/settings/{
Settings ID} from that API host on page load. The service receives the Settings
ID and normal HTTP request information. It records aggregate page counts per
website and day for service statistics and plan quotas.
* **Browser storage** — the runtime stores category/service choices, banner
version
and decision validity in `localStorage` (`cm:consent`) by default. Depending
on the service plan and website settings, `sessionStorage` or a first-party consent
cookie (`cm_consent_{Settings ID}`) can be used instead. Decision validity is
configurable in the service (default: 365 days).
* **Consent evidence** — when a decision grants at least one optional category
or service, the runtime posts the Settings ID, decision type, banner version
and category/service choices to `/runtime/consent/update`. The current service
records the website host, origin verification result, user agent, timestamp,
banner version and a truncated, salted IP hash scoped to that website. The raw
IP address is not stored in the consent event. Showing the banner, rejecting
all optional processing or fully withdrawing consent does not create a consent
event. Retention is configured per website (default: 365 days); infrastructure
request logging is governed by the service policy.
* **Manual diagnostics** — only when an administrator with `manage_options`
requests
diagnostics, the WordPress server fetches the public settings endpoint. If an
API key is configured, it also requests `/api/v1/websites` with that key in an
Authorization header. The API host receives the server’s IP address and HTTP
headers, the Settings ID and, for the authentication check only, the API key.
Diagnostics use a bot user agent so that the current service excludes them from
page counts. This does not send the key to site visitors.
Service provider: rocket-ship, Inhaber Florian Bischof, An der Halde 7,
89081 Ulm,
Germany. Contact: support@keksonaut.com Legal notice: https://keksonaut.com/de/impressum
Terms of service: https://keksonaut.com/de/agb Privacy policy: https://keksonaut.
com/de/datenschutz
## Screenshots
[⌊Configure your public Settings ID and optional connection diagnostics under Settings
→ KEKSONAUT.⌉⌊Configure your public Settings ID and optional connection diagnostics
under Settings → KEKSONAUT.⌉[
Configure your public Settings ID and optional connection diagnostics under Settings
KEKSONAUT.
## Installation
1. In WordPress, go to Plugins Add Plugin (“Add New” in older versions), search for“
KEKSONAUT Consent”, click Install Now and then Activate.
2. Go to Settings KEKSONAUT and enter the Settings ID from your dashboard.
3. Save changes. Use Run diagnostics to check the connection if needed.
4. Test your site while logged out in a private window, including accepting, rejecting
and reopening preferences. Check that your configured optional services wait for
the appropriate consent.
Alternatively, download the plugin ZIP and upload it through Plugins Add Plugin
Upload Plugin, then activate KEKSONAUT Consent.
Avoid installing multiple copies of the plugin. For a migration from an older cookiemonster
folder, see the release installation instructions before switching folders; both
copies use the same configuration options.
## FAQ
### Where is the banner configured?
In the KEKSONAUT web app at https://app.keksonaut.com. Layout, texts, colours,
categories and services are managed in the app. Publish and verify the banner there
before relying on it on a public website.
### Do I need an API key?
No. The browser uses the public Settings ID. An API key enables the optional
API
authentication check from the WordPress server, only after you request diagnostics.
### Does the plugin store visitor decisions in WordPress?
The plugin stores configuration in WordPress: Settings ID, optional API base
URL
and optional API key. The service’s runtime stores the visitor’s decision in the
browser and may send consent evidence to the service as described below. Uninstall
removes configuration options for the current WordPress site. Network-wide multisite
cleanup is not implemented; options on other sites may remain. Uninstall does not
remove browser storage or external-service records.
### Does installing the plugin automatically block every tracker?
Configure categories and services in KEKSONAUT and follow the runtime integration
instructions. Automatic blocking is limited to configured services once settings
are available. Use explicit deferred script/iframe markup for integrations that
could run earlier, and check conflicts with caching or script optimisation tools.
### Can visitors change their choice?
The runtime offers a preferences button. If you disable it in the dashboard,
provide
an accessible link such as `Cookie settings` on your
site and verify that it works.
### Is KEKSONAUT a TCF-certified CMP?
No. KEKSONAUT implements Google Consent Mode v2 signals and script/iframe
blocking;
it does not provide IAB TCF certification.
### Can I self-host or use a dedicated endpoint?
Set the API base URL to the HTTPS base URL of your deployment. Server-side
diagnostics
accept public HTTPS endpoints and reject unsafe destinations. The external-service
details below describe the default hosted service; a self-hosted deployment has
its own operator and policies.
## Reviews
### [Simple, lightweight and easy to set up](https://wordpress.org/support/topic/simple-lightweight-and-easy-to-set-up/)
[picsure](https://profiles.wordpress.org/picsure/) October 26, 2026
We use Keksonaut on our WordPress website at picsure.ai and have had a very good
experience with it so far. Setup was quick and straightforward, and managing cookie
consent is much easier than with some of the more complex CMP solutions we have
used before. The plugin integrates cleanly with WordPress and does exactly what
we need without adding unnecessary complexity. A simple and well-designed solution
for managing consent on WordPress. Definitely recommended.
[ Read all 1 review ](https://wordpress.org/support/plugin/keksonaut-consent/reviews/)
## Contributors & Developers
“KEKSONAUT Consent” is open source software. The following people have contributed
to this plugin.
Contributors
* [ keksonaut ](https://profiles.wordpress.org/keksonaut/)
[Translate “KEKSONAUT Consent” into your language.](https://translate.wordpress.org/projects/wp-plugins/keksonaut-consent)
### Interested in development?
[Browse the code](https://plugins.trac.wordpress.org/browser/keksonaut-consent/),
check out the [SVN repository](https://plugins.svn.wordpress.org/keksonaut-consent/),
or subscribe to the [development log](https://plugins.trac.wordpress.org/log/keksonaut-consent/)
by [RSS](https://plugins.trac.wordpress.org/log/keksonaut-consent/?limit=100&mode=stop_on_copy&format=rss).
## Changelog
#### 0.5.3
* Use keksonaut.com for new default connections and service links.
* Preserve saved API endpoints, including api.keksonaut.de, settings IDs and API
keys.
#### 0.5.2
* Keep the public banner configuration available when script optimisers remove
data attributes or URL parameters.
* Exclude the runtime and early configuration/defaults from PageSpeed Ninja optimisation
using its supported ress-safe marker.
* Support runtime 0.6.2 with public configuration fallbacks. API keys remain server-
side only.
#### 0.5.1
* Allow installation on PHP 7.2 hosts while retaining the WordPress 6.0 minimum.
* Remove the duplicate optional plugin URL from the plugin header for WordPress.
org submission.
#### 0.5.0
* Show settings validation notices once, using the WordPress settings screen.
* Validate API endpoints as HTTPS base URLs and protect manual diagnostics against
unsafe requests and redirects.
* Keep saved API keys out of settings HTML and retain the wp-config.php constant
option.
* Set Google Consent Mode defaults before the early runtime, using WordPress script
APIs.
* Prepare the keksonaut-consent translation domain and first directory distribution
while preserving existing configuration keys.
* Correct installation instructions, blocking limitations and external-service
disclosures.
#### 0.4.0
* Renamed the service to KEKSONAUT. New installs use https://api.keksonaut.de;
saved custom endpoints and existing option keys remain unchanged.
#### 0.3.0
* License changed to GPLv2 or later.
* API base URL became optional, defaulting to the service’s former endpoint.
* Added API URL validation, uninstall cleanup, translations and external-service
documentation.
#### 0.2.0
* Corrected the runtime URL to /runtime.js and added the data-settings-id attribute.
* Added optional wp-config.php API key storage, settings ID sanitisation and a
settings shortcut.
#### 0.1.0
* Initial release: runtime integration, settings and diagnostics.
## Meta
* Version **0.5.3**
* Last updated **11 hours ago**
* Active installations **Fewer than 10**
* WordPress version ** 6.0 or higher **
* Tested up to **7.1.4**
* PHP version ** 7.2 or higher **
* Tags
* [consent](https://wordpress.org/plugins/tags/consent/)[cookie banner](https://wordpress.org/plugins/tags/cookie-banner/)
[cookies](https://wordpress.org/plugins/tags/cookies/)[GDPR](https://wordpress.org/plugins/tags/gdpr/)
[privacy](https://wordpress.org/plugins/tags/privacy/)
* [Advanced View](https://wordpress.org/plugins/keksonaut-consent/advanced/)
## Ratings
5 out of 5 stars.
* [ 1 5-star review ](https://wordpress.org/support/plugin/keksonaut-consent/reviews/?filter=5)
* [ 0 4-star reviews ](https://wordpress.org/support/plugin/keksonaut-consent/reviews/?filter=4)
* [ 0 3-star reviews ](https://wordpress.org/support/plugin/keksonaut-consent/reviews/?filter=3)
* [ 0 2-star reviews ](https://wordpress.org/support/plugin/keksonaut-consent/reviews/?filter=2)
* [ 0 1-star reviews ](https://wordpress.org/support/plugin/keksonaut-consent/reviews/?filter=1)
[Your review](https://wordpress.org/support/plugin/keksonaut-consent/reviews/#new-post)
[See all reviews](https://wordpress.org/support/plugin/keksonaut-consent/reviews/)
## Contributors
* [ keksonaut ](https://profiles.wordpress.org/keksonaut/)
## Support
Got something to say? Need help?
[View support forum](https://wordpress.org/support/plugin/keksonaut-consent/)