FTHCNDR Çerez Onayı (KVKK)

FTHCNDR Çerez Onayı is a cookie consent manager built around the Turkish Personal Data Protection Authority’s (KVKK) “Guide on Cookie Practices” (Çerez Uygulamaları Hakkında Rehber, updated July 2025). It is also suitable for GDPR-style opt-in consent.

Many cookie plugins only show a banner while analytics and advertising tags keep running in the background, or treat “continuing to browse” as consent. Under KVKK, browsing is not consent and non-essential cookies may only be set after explicit opt-in. This plugin actually stops those tags until the visitor agrees.

The admin interface and the visitor-facing texts are in Turkish. All banner texts can be edited from the settings page.

Prior blocking

• Scripts that need consent (Google Analytics, Google Tag Manager, Meta Pixel, Microsoft Clarity, Hotjar, Yandex Metrica, TikTok, LinkedIn, WooCommerce order attribution and more) are converted to inert type="text/plain" on the server and only run after consent.
• YouTube, Vimeo and Google Maps iframes are replaced with a placeholder until the visitor allows them.
• Scripts and iframes added later by JavaScript are also intercepted in the browser.
• Works with full page caching (LiteSpeed Cache, WP Rocket, Cloudflare APO), because blocking is the same for every visitor.

KVKK-oriented consent banner

• “Accept all”, “Reject all” and “Preferences” buttons with equal colour, size and font.
• Category-based preference center: Necessary, Functional, Analytics, Performance, Advertising. Optional categories are off by default.
• Consent can be withdrawn as easily as it was given, from a floating icon. On withdrawal, related cookies are deleted and the page reloads.
• Changing the policy version asks every visitor for consent again.

Consent signals

• Google Consent Mode v2 (default denied, updated on consent), optional url_passthrough.
• Microsoft Advertising UET consent mode and Microsoft Clarity Consent API v2.
• WP Consent API support.
• Optional automatic rejection for Global Privacy Control (GPC) signals.
• The banner is not shown to search engine and PageSpeed bots.

Consent records

• Every decision is stored with a random consent ID, date, categories, policy version, IP address (masked, full or none — your choice) and browser.
• Filter by date range, action, category and policy version; view a visitor’s full history; export to CSV.
• Old records are deleted automatically after the retention period you set.

Cookie inventory and policy

• Built-in scanner and “discovery mode” find the cookies your site sets; hundreds of well-known cookies are classified automatically.
• Automatically generated Cookie Policy page (KVKK information notice) with cookie tables that stay up to date.
• Shortcodes: [fthcndr_cerez_politikasi], [fthcndr_cerez_tablosu], [fthcndr_cerez_ayarlari].

Appearance

• Bottom bar, box or popup layout; colours, button radius, uppercase and theme font options.
• Floating preferences icon: 6 positions, 8 built-in icons or your own image, size, shape, label, offsets (separate on mobile), hide on mobile, live preview.

Compatibility notes

• Shows an admin suggestion to turn off WooCommerce usage tracking when it is enabled.
• Warns when the WoodMart theme’s own cookie notice is enabled, so visitors do not see two banners.
• Code injected at the edge (for example Cloudflare “Google tag gateway” or Cloudflare Web Analytics automatic injection) bypasses WordPress and cannot be blocked by any plugin; disable those or switch to manual setup.

Disclaimer

Before the settings can be used, an administrator must read and accept a short notice (terms of use and disclaimer). The acceptance is recorded with the user name, date and plugin version.

• This plugin is a technical tool and does not constitute legal advice. The banner texts, cookie descriptions and the generated cookie policy are general templates.
• The website operator is the data controller and remains responsible for complying with KVKK and other applicable laws.
• Some cookies may not be blocked (unknown scripts, code injected by the server or CDN, caching). Test your site after setup.
• The plugin is provided free of charge under the GPLv2 license, “as is”, without any warranty.

External services

This plugin does not connect to, load from, or send data to any third-party or external service, and it sends no data to the plugin author.

• Consent records are saved only in your own WordPress database, via your own site’s REST API (/wp-json/fthco/v1/consent).
• The cookie scanner only requests pages of your own site (home_url()), using wp_remote_get().
• No external scripts, fonts, images or APIs are loaded by the plugin.

Third-party domains such as googletagmanager.com, google-analytics.com, connect.facebook.net, maps.google.com, youtube.com, embed.tawk.to or widget.intercom.io appear in includes/class-known.php only as text patterns. The plugin compares the scripts and iframes that your site (your theme, other plugins or your own code) already outputs against these patterns, so it can block them until the visitor gives consent, and so it can describe the cookies those services set in the cookie policy. The plugin never requests these domains itself; it only prevents them from loading without consent.