About this plugin
com.
This plugin connects your WordPress site to that service, loads its browser
runtime early in the page head, and provides settings and manual connection
diagnostics under Settings → KEKSONAUT.
Configure banner layout, texts, colours, categories and services in the
KEKSONAUT web app. The plugin needs the website’s public Settings ID; an API
key is optional and is used only for administrator-requested diagnostics.
A KEKSONAUT business account and a configured website are required for the
hosted service. The data processing agreement (AVV) is incorporated into the
terms accepted during registration; no separate acceptance step is needed.
Free plan: one website with 5,000 page views per month, free of charge
with no time limit. Paid plans and their limits are listed at
com/en/pricing.
Scope: Google Consent Mode v2 signals and configurable script/iframe
blocking. KEKSONAUT is not a TCF-certified CMP. Configure the relevant services
and their script integrations, and verify the result on your site. Scripts or
iframes that start before the runtime has loaded its settings cannot be
blocked retroactively. Site owners remain responsible for their consent setup
and legal obligations.
No runtime or consent defaults are added until a valid Settings ID and HTTPS
API base are configured. Simply opening the plugin settings makes no requests
to the KEKSONAUT API.
Configuration
- Settings ID — the public settings ID shown in the KEKSONAUT dashboard.
This is different from the internal website ID.
- API base URL (optional) — leave empty to use
com. Dedicated or self-hosted deployments may use an
HTTPS base URL with an optional path, without a query, fragment or embedded
credentials.
-
API key (optional, diagnostics only) — prefer a constant in
php to keep the key out of the WordPress options table:
define( ‘COOKIEMONSTER_API_KEY’, ‘cm_live_…’ );
The constant takes precedence over a key saved in the settings. The key is
never included in the site’s front-end markup. Leave the password field
empty to keep a saved key; use Remove stored API key to delete it. That
php.
External services
com, to deliver a
configured consent banner and retain consent evidence. Saving a Settings ID
connects your site’s visitors to the configured service. Until it is configured,
the plugin adds no front-end integration and makes no diagnostic requests.
What is loaded or sent, and when:
- Runtime and banner assets — on front-end page views with a valid
js
(or the configured API host). Banner branding and configured logo assets may
also be requested. HTTP requests expose the visitor’s IP address, user agent
and browser-controlled referrer information to the asset host.
- Banner settings and page counts — the runtime requests
/runtime/settings/{Settings ID} from that API host on page load. The
service receives the Settings ID and normal HTTP request information. It
records aggregate page counts per website and day for service statistics
and plan quotas.
- Browser storage — the runtime stores category/service choices, banner
version and decision validity in localStorage ( cm:consent ) by default.
Depending on the service plan and website settings, sessionStorage or a
first-party consent cookie ( cm_consent_{Settings ID} ) can be used instead.
Decision validity is configurable in the service (default: 365 days).
- Consent evidence — when a decision grants at least one optional category
or service, the runtime posts the Settings ID, decision type, banner version
and category/service choices to /runtime/consent/update. The current
service records the website host, origin verification result, user agent,
timestamp, banner version and a truncated, salted IP hash scoped to that
website. The raw IP address is not stored in the consent event. Showing the
banner, rejecting all optional processing or fully withdrawing consent does
not create a consent event. Retention is configured per website (default:
365 days); infrastructure request logging is governed by the service policy.
- Manual diagnostics — only when an administrator with manage_options
requests diagnostics, the WordPress server fetches the public settings
endpoint. If an API key is configured, it also requests /api/v1/websites
with that key in an Authorization header. The API host receives the server’s
IP address and HTTP headers, the Settings ID and, for the authentication
check only, the API key. Diagnostics use a bot user agent so that the current
service excludes them from page counts. This does not send the key to site
visitors.
Service provider: rocket-ship, Inhaber Florian Bischof, An der Halde 7,
89081 Ulm, Germany. com
com/de/impressum
com/de/agb
com/de/datenschutz