Umay Çerez Yöneticisi

Umay Çerez Yöneticisi (Umay Cookie Manager) is a cookie consent manager for websites that follow Turkey's Personal Data Protection Law (KVKK) and the Turkish Data Protection Authority's Cookie Guidelines (July 2025). It shows visitors the cookies used on the site by category and only lets tracking code run after the visitor allows the matching category. This plugin is developed by Umay Ajans. It is not affiliated with or endorsed by the Turkish Personal Data Protection Authority (KVKK). The admin screens and the texts shown to visitors are in Turkish, because the plugin is built for websites that serve visitors in Turkey. Every string is translatable. Consent banner

• Accept, Reject and Settings buttons are presented with equal weight, and optional categories start unticked.
• Four categories: necessary, functional, analytics and marketing. Category names, descriptions and all banner texts can be edited.
• Bar, card or modal layout with a live preview in the settings screen.
• A floating icon, a shortcode or a menu link lets visitors change their choice at any time.
• A "request consent again" button raises the policy version so that earlier choices expire.

Blocking before consent

• Scripts, iframes and tracking pixels that need consent are neutralised in the page HTML on the server and only activated in the browser after consent.
• Scripts that other code adds later (for example a video player API or a tag loaded through Google Tag Manager) are held back as well.
• Embedded videos and maps are replaced by a placeholder with an "allow and load" button.
• The page output is the same for every visitor, so the plugin works with page caching.

Integrations

• Google Consent Mode v2: every signal starts as denied and is updated when the visitor makes a choice.
• WP Consent API: the plugin registers as the consent provider.
• PixelYourSite: pixels and server side events follow the visitor's marketing and analytics choices.
• LiteSpeed Cache and WP Rocket: banner files are excluded from deferring and combining.

Cookie inventory and site scan The scanner requests pages of your own site from your server, as an anonymous visitor, and matches scripts, iframes, pixels and Set-Cookie headers against a built-in list of common services (Google Tag Manager, Google Analytics, Google Ads, Meta Pixel, YouTube, Vimeo, Google Maps, reCAPTCHA, Microsoft Clarity, Hotjar, Yandex Metrica, TikTok, LinkedIn and more). Found services are added to the inventory, which you can edit. The [kvkk_cerez_tablosu] shortcode prints the inventory as a cookie table (name, provider, type, purpose, duration) together with the providers located outside Turkey, for use on your cookie policy page. Consent records Each choice is stored in a table in your WordPress database so that you can show when and how consent was given. Records are searchable by consent ID and can be exported as CSV. They are deleted automatically after the retention period you choose (24 months by default). Data stored by the plugin The plugin does not send any data to external services. A consent record contains:

• a random consent ID generated by the server,
• the date and time (UTC), the action and the allowed categories,
• the policy version and the path of the page where the choice was made,
• optionally, a keyed hash (HMAC) of the visitor's shortened IP address (IPv4 /24, IPv6 /48).

It does not store the raw IP address, browser or device details, query strings or the logged in user. The visitor's choice is also saved in a first party cookie named kvkkc_consent so that it can be applied on the next page. Legal notice This plugin is a technical tool. It helps you apply the recommendations of the KVKK Cookie Guidelines on your site, but it is not legal advice and it does not guarantee legal compliance. The checklist in the settings screen only compares your settings with the guidelines. Shortcodes and developer notes

• [kvkk_cerez_tablosu] prints the cookie table. Use kategori="analitik" for a single category and aktarim="hayir" to hide the list of providers abroad.
• [kvkk_cerez_ayarlari text="..."] prints a link that opens the preferences window. A menu link with the address #kvkkc-ayarlar does the same.
• The kvkkc:consent event on document carries the allowed categories in detail.categories.
• A kvkkc_consent event is pushed to dataLayer with the kvkkc_islevsel, kvkkc_analitik and kvkkc_pazarlama variables, so tags in Google Tag Manager can use it as a trigger.
• Add the data-kvkkc-skip attribute to a script tag to exclude it from blocking.
• Manual blocking rules can be added in the advanced settings as address or code fragment|category lines.

Development The source code is developed in public on GitHub. Bug reports and pull requests are welcome.

1. Install and activate the plugin. Published pages with common legal page addresses (for example /kvkk-aydinlatma-metni/ or /cerez-politikasi/) are linked automatically.
2. Go to Umay Çerez > Çerez Envanteri, start the scan and add the services that were found to the inventory.
3. Go to Umay Çerez > Ayarlar to adjust the layout and texts. The live preview shows the result.
4. Add the [kvkk_cerez_tablosu] shortcode to your cookie policy page.

If the site is behind Cloudflare or another reverse proxy, define the header that carries the real visitor IP in wp-config.php. It is only used for the optional IP hash and for rate limiting: define( 'KVKKC_TRUSTED_PROXY_HEADER', 'HTTP_CF_CONNECTING_IP' );

1.0.0

• First public release.