{"id":392544,"date":"2026-10-26T10:12:52","date_gmt":"2026-10-26T10:12:52","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/keksonaut-consent\/"},"modified":"2026-10-28T22:16:02","modified_gmt":"2026-10-28T22:16:02","slug":"keksonaut-consent","status":"publish","type":"plugin","link":"https:\/\/wordpress.org\/plugins\/keksonaut-consent\/","author":23592591,"comment_status":"closed","ping_status":"closed","template":"","meta":{"version":"0.5.3","stable_tag":"0.5.3","tested":"7.1.4","requires":"6.0","requires_php":"7.2","requires_plugins":null,"header_name":"KEKSONAUT Consent","header_author":"KEKSONAUT","header_description":"Connect your WordPress site to the KEKSONAUT consent management service.","assets_banners_color":"f2f5ff","last_updated":"2026-10-28 22:16:02","external_support_url":"","external_repository_url":"","donate_link":"","header_plugin_uri":"","header_author_uri":"https:\/\/keksonaut.com","rating":5,"author_block_rating":0,"active_installs":0,"downloads":74,"num_ratings":1,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":{"0.5.3":{"tag":"0.5.3","author":"keksonaut","date":"2026-10-28 22:16:02","revision":3771770}},"upgrade_notice":{"0.5.3":"<p>The default endpoint for an empty API base URL is now https:\/\/api.keksonaut.com. Saved endpoints and credentials are preserved. Clear page caches after updating and verify your banner.<\/p>","0.5.2":"<p>Clear page and script optimisation caches after updating. Verify your Settings ID and test the banner in a private window.<\/p>","0.5.1":"<p>The plugin now supports PHP 7.2 and newer. Existing settings are preserved.<\/p>","0.5.0":"<p>Custom API endpoints must use HTTPS. Recheck your configured services and deferred markup after updating. Folder migrations require care because old and new copies share settings.<\/p>"},"ratings":{"1":0,"2":0,"3":0,"4":0,"5":1},"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3766089,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3766089,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256},"icon.svg":{"filename":"icon.svg","revision":3766089,"resolution":false,"location":"assets","locale":false}},"assets_banners":{"banner-1544x500-de.png":{"filename":"banner-1544x500-de.png","revision":3766089,"resolution":"1544x500","location":"assets","locale":"de","width":1544,"height":500},"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3766089,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250-de.png":{"filename":"banner-772x250-de.png","revision":3766089,"resolution":"772x250","location":"assets","locale":"de","width":772,"height":250},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3766089,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["0.5.3"],"block_files":[],"assets_screenshots":{"screenshot-1.png":{"filename":"screenshot-1.png","revision":3766089,"resolution":"1","location":"assets","locale":"","width":1440,"height":1100}},"screenshots":{"1":"Configure your public Settings ID and optional connection diagnostics under Settings \u2192 KEKSONAUT."}},"plugin_section":[],"plugin_tags":[20011,20272,389,131785,396],"plugin_category":[54],"plugin_contributors":[288665],"plugin_business_model":[],"class_list":["post-392544","plugin","type-plugin","status-publish","hentry","plugin_tags-consent","plugin_tags-cookie-banner","plugin_tags-cookies","plugin_tags-gdpr","plugin_tags-privacy","plugin_category-security-and-spam-protection","plugin_contributors-keksonaut","plugin_committers-keksonaut"],"banners":{"banner":"https:\/\/ps.w.org\/keksonaut-consent\/assets\/banner-772x250.png?rev=3766089","banner_2x":"https:\/\/ps.w.org\/keksonaut-consent\/assets\/banner-1544x500.png?rev=3766089","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":"https:\/\/ps.w.org\/keksonaut-consent\/assets\/icon.svg?rev=3766089","icon":"https:\/\/ps.w.org\/keksonaut-consent\/assets\/icon.svg?rev=3766089","icon_2x":false,"generated":false},"screenshots":[{"src":"https:\/\/ps.w.org\/keksonaut-consent\/assets\/screenshot-1.png?rev=3766089","caption":"Configure your public Settings ID and optional connection diagnostics under Settings \u2192 KEKSONAUT."}],"raw_content":"<!--section=description-->\n<p>KEKSONAUT is a consent management service at https:\/\/keksonaut.com.\nThis plugin connects your WordPress site to that service, loads its browser\nruntime early in the page head, and provides settings and manual connection\ndiagnostics under Settings \u2192 KEKSONAUT.<\/p>\n\n<p>Configure banner layout, texts, colours, categories and services in the\nKEKSONAUT web app. The plugin needs the website's public Settings ID; an API\nkey is optional and is used only for administrator-requested diagnostics.\nA KEKSONAUT business account and a configured website are required for the\nhosted service. The data processing agreement (AVV) is incorporated into the\nterms accepted during registration; no separate acceptance step is needed.\nService plans are described at https:\/\/keksonaut.com\/de\/preise.<\/p>\n\n<p><strong>Scope:<\/strong> Google Consent Mode v2 signals and configurable script\/iframe\nblocking. KEKSONAUT is not a TCF-certified CMP. Configure the relevant services\nand their script integrations, and verify the result on your site. Scripts or\niframes that start before the runtime has loaded its settings cannot be\nblocked retroactively. Site owners remain responsible for their consent setup\nand legal obligations.<\/p>\n\n<p>No runtime or consent defaults are added until a valid Settings ID and HTTPS\nAPI base are configured. Simply opening the plugin settings makes no requests\nto the KEKSONAUT API.<\/p>\n\n<h4>Configuration<\/h4>\n\n<ul>\n<li><strong>Settings ID<\/strong> \u2014 the public settings ID shown in the KEKSONAUT dashboard.\nThis is different from the internal website ID.<\/li>\n<li><strong>API base URL<\/strong> (optional) \u2014 leave empty to use\n  https:\/\/api.keksonaut.com. Dedicated or self-hosted deployments may use an\nHTTPS base URL with an optional path, without a query, fragment or embedded\ncredentials.<\/li>\n<li><p><strong>API key<\/strong> (optional, diagnostics only) \u2014 prefer a constant in\n  wp-config.php to keep the key out of the WordPress options table:<\/p>\n\n<p>define( 'COOKIEMONSTER_API_KEY', 'cm_live_...' );<\/p>\n\n<p>The constant takes precedence over a key saved in the settings. The key is\nnever included in the site's front-end markup. Leave the password field\nempty to keep a saved key; use Remove stored API key to delete it. That\nbutton does not change a key defined in wp-config.php.<\/p><\/li>\n<\/ul>\n\n<h3>External services<\/h3>\n\n<p>This plugin integrates with <strong>KEKSONAUT<\/strong>, https:\/\/keksonaut.com, to deliver a\nconfigured consent banner and retain consent evidence. Saving a Settings ID\nconnects your site's visitors to the configured service. Until it is configured,\nthe plugin adds no front-end integration and makes no diagnostic requests.<\/p>\n\n<p>What is loaded or sent, and when:<\/p>\n\n<ul>\n<li><strong>Runtime and banner assets<\/strong> \u2014 on front-end page views with a valid\nconfiguration, the browser requests <code>https:\/\/api.keksonaut.com\/runtime.js<\/code>\n(or the configured API host). Banner branding and configured logo assets may\nalso be requested. HTTP requests expose the visitor's IP address, user agent\nand browser-controlled referrer information to the asset host.<\/li>\n<li><strong>Banner settings and page counts<\/strong> \u2014 the runtime requests\n  \/runtime\/settings\/{Settings ID} from that API host on page load. The\nservice receives the Settings ID and normal HTTP request information. It\nrecords aggregate page counts per website and day for service statistics\nand plan quotas.<\/li>\n<li><strong>Browser storage<\/strong> \u2014 the runtime stores category\/service choices, banner\nversion and decision validity in <code>localStorage<\/code> (<code>cm:consent<\/code>) by default.\nDepending on the service plan and website settings, <code>sessionStorage<\/code> or a\nfirst-party consent cookie (<code>cm_consent_{Settings ID}<\/code>) can be used instead.\nDecision validity is configurable in the service (default: 365 days).<\/li>\n<li><strong>Consent evidence<\/strong> \u2014 when a decision grants at least one optional category\nor service, the runtime posts the Settings ID, decision type, banner version\nand category\/service choices to <code>\/runtime\/consent\/update<\/code>. The current\nservice records the website host, origin verification result, user agent,\ntimestamp, banner version and a truncated, salted IP hash scoped to that\nwebsite. The raw IP address is not stored in the consent event. Showing the\nbanner, rejecting all optional processing or fully withdrawing consent does\nnot create a consent event. Retention is configured per website (default:\n365 days); infrastructure request logging is governed by the service policy.<\/li>\n<li><strong>Manual diagnostics<\/strong> \u2014 only when an administrator with <code>manage_options<\/code>\nrequests diagnostics, the WordPress server fetches the public settings\nendpoint. If an API key is configured, it also requests <code>\/api\/v1\/websites<\/code>\nwith that key in an Authorization header. The API host receives the server's\nIP address and HTTP headers, the Settings ID and, for the authentication\ncheck only, the API key. Diagnostics use a bot user agent so that the current\nservice excludes them from page counts. This does not send the key to site\nvisitors.<\/li>\n<\/ul>\n\n<p>Service provider: rocket-ship, Inhaber Florian Bischof, An der Halde 7,\n89081 Ulm, Germany. Contact: support@keksonaut.com\nLegal notice: https:\/\/keksonaut.com\/de\/impressum\nTerms of service: https:\/\/keksonaut.com\/de\/agb\nPrivacy policy: https:\/\/keksonaut.com\/de\/datenschutz<\/p>\n\n<!--section=installation-->\n<ol>\n<li>In WordPress, go to Plugins \u2192 Add Plugin (\"Add New\" in older versions),\nsearch for \"KEKSONAUT Consent\", click Install Now and then Activate.<\/li>\n<li>Go to Settings \u2192 KEKSONAUT and enter the Settings ID from your dashboard.<\/li>\n<li>Save changes. Use Run diagnostics to check the connection if needed.<\/li>\n<li>Test your site while logged out in a private window, including accepting,\nrejecting and reopening preferences. Check that your configured optional\nservices wait for the appropriate consent.<\/li>\n<\/ol>\n\n<p>Alternatively, download the plugin ZIP and upload it through Plugins \u2192 Add\nPlugin \u2192 Upload Plugin, then activate KEKSONAUT Consent.<\/p>\n\n<p>Avoid installing multiple copies of the plugin. For a migration from an older\n    cookiemonster folder, see the release installation instructions before\nswitching folders; both copies use the same configuration options.<\/p>\n\n<!--section=faq-->\n<dl>\n<dt id=\"where%20is%20the%20banner%20configured%3F\"><h3>Where is the banner configured?<\/h3><\/dt>\n<dd><p>In the KEKSONAUT web app at https:\/\/app.keksonaut.com. Layout, texts, colours,\ncategories and services are managed in the app. Publish and verify the banner\nthere before relying on it on a public website.<\/p><\/dd>\n<dt id=\"do%20i%20need%20an%20api%20key%3F\"><h3>Do I need an API key?<\/h3><\/dt>\n<dd><p>No. The browser uses the public Settings ID. An API key enables the optional\nAPI authentication check from the WordPress server, only after you request\ndiagnostics.<\/p><\/dd>\n<dt id=\"does%20the%20plugin%20store%20visitor%20decisions%20in%20wordpress%3F\"><h3>Does the plugin store visitor decisions in WordPress?<\/h3><\/dt>\n<dd><p>The plugin stores configuration in WordPress: Settings ID, optional API base\nURL and optional API key. The service's runtime stores the visitor's decision\nin the browser and may send consent evidence to the service as described below.\nUninstall removes configuration options for the current WordPress site.\nNetwork-wide multisite cleanup is not implemented; options on other sites may\nremain. Uninstall does not remove browser storage or external-service records.<\/p><\/dd>\n<dt id=\"does%20installing%20the%20plugin%20automatically%20block%20every%20tracker%3F\"><h3>Does installing the plugin automatically block every tracker?<\/h3><\/dt>\n<dd><p>Configure categories and services in KEKSONAUT and follow the runtime integration\ninstructions. Automatic blocking is limited to configured services once settings\nare available. Use explicit deferred script\/iframe markup for integrations that\ncould run earlier, and check conflicts with caching or script optimisation tools.<\/p><\/dd>\n<dt id=\"can%20visitors%20change%20their%20choice%3F\"><h3>Can visitors change their choice?<\/h3><\/dt>\n<dd><p>The runtime offers a preferences button. If you disable it in the dashboard,\nprovide an accessible link such as <code>&lt;a href=\"#\" data-cm-open&gt;Cookie settings&lt;\/a&gt;<\/code>\non your site and verify that it works.<\/p><\/dd>\n<dt id=\"is%20keksonaut%20a%20tcf-certified%20cmp%3F\"><h3>Is KEKSONAUT a TCF-certified CMP?<\/h3><\/dt>\n<dd><p>No. KEKSONAUT implements Google Consent Mode v2 signals and script\/iframe\nblocking; it does not provide IAB TCF certification.<\/p><\/dd>\n<dt id=\"can%20i%20self-host%20or%20use%20a%20dedicated%20endpoint%3F\"><h3>Can I self-host or use a dedicated endpoint?<\/h3><\/dt>\n<dd><p>Set the API base URL to the HTTPS base URL of your deployment. Server-side\ndiagnostics accept public HTTPS endpoints and reject unsafe destinations.\nThe external-service details below describe the default hosted service; a\nself-hosted deployment has its own operator and policies.<\/p><\/dd>\n\n<\/dl>\n\n<!--section=changelog-->\n<h4>0.5.3<\/h4>\n\n<ul>\n<li>Use keksonaut.com for new default connections and service links.<\/li>\n<li>Preserve saved API endpoints, including api.keksonaut.de, settings IDs and API keys.<\/li>\n<\/ul>\n\n<h4>0.5.2<\/h4>\n\n<ul>\n<li>Keep the public banner configuration available when script optimisers remove data attributes or URL parameters.<\/li>\n<li>Exclude the runtime and early configuration\/defaults from PageSpeed Ninja optimisation using its supported ress-safe marker.<\/li>\n<li>Support runtime 0.6.2 with public configuration fallbacks. API keys remain server-side only.<\/li>\n<\/ul>\n\n<h4>0.5.1<\/h4>\n\n<ul>\n<li>Allow installation on PHP 7.2 hosts while retaining the WordPress 6.0 minimum.<\/li>\n<li>Remove the duplicate optional plugin URL from the plugin header for WordPress.org submission.<\/li>\n<\/ul>\n\n<h4>0.5.0<\/h4>\n\n<ul>\n<li>Show settings validation notices once, using the WordPress settings screen.<\/li>\n<li>Validate API endpoints as HTTPS base URLs and protect manual diagnostics against unsafe requests and redirects.<\/li>\n<li>Keep saved API keys out of settings HTML and retain the wp-config.php constant option.<\/li>\n<li>Set Google Consent Mode defaults before the early runtime, using WordPress script APIs.<\/li>\n<li>Prepare the keksonaut-consent translation domain and first directory distribution while preserving existing configuration keys.<\/li>\n<li>Correct installation instructions, blocking limitations and external-service disclosures.<\/li>\n<\/ul>\n\n<h4>0.4.0<\/h4>\n\n<ul>\n<li>Renamed the service to KEKSONAUT. New installs use https:\/\/api.keksonaut.de; saved custom endpoints and existing option keys remain unchanged.<\/li>\n<\/ul>\n\n<h4>0.3.0<\/h4>\n\n<ul>\n<li>License changed to GPLv2 or later.<\/li>\n<li>API base URL became optional, defaulting to the service's former endpoint.<\/li>\n<li>Added API URL validation, uninstall cleanup, translations and external-service documentation.<\/li>\n<\/ul>\n\n<h4>0.2.0<\/h4>\n\n<ul>\n<li>Corrected the runtime URL to \/runtime.js and added the data-settings-id attribute.<\/li>\n<li>Added optional wp-config.php API key storage, settings ID sanitisation and a settings shortcut.<\/li>\n<\/ul>\n\n<h4>0.1.0<\/h4>\n\n<ul>\n<li>Initial release: runtime integration, settings and diagnostics.<\/li>\n<\/ul>","raw_excerpt":"Connect WordPress to KEKSONAUT for cookie banners, Google Consent Mode v2 signals and script\/iframe gating.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/392544","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=392544"}],"author":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/keksonaut"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=392544"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=392544"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=392544"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=392544"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=392544"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=392544"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}