FAIR

Federated and Independent Repositories

Riza Kayit – KVKK Cookie Consent

Plugin Banner

Riza Kayit – KVKK Cookie Consent

by rizakayit

Download
Description

Riza Kayit is a consent management platform (CMP) that helps websites meet their obligations under KVKK (Turkish Personal Data Protection Law no. 6698) and the GDPR.

This plugin adds the Riza Kayit widget to your WordPress site, in the right order and with the right settings.

Why a plugin? When the snippet is pasted into a theme by hand, it disappears the next time the theme is updated, and site owners rarely notice. What remains is a site with no cookie banner and no compliance. A plugin survives theme updates.

What it does

  • Cookie consent banner — Accept and Reject are presented with equal weight
  • Blocks trackers before consent — Google Analytics, Meta Pixel, Hotjar, GTM and similar tools stay inactive until the visitor chooses
  • Google Consent Mode v2 support
  • Automatic cookie scanning — detects provider, category and retention period
  • Automatically generated cookie policy (added to a page with a shortcode or block)
  • Visitors can view their own consent record and request its deletion (KVKK art. 11)
  • Banner available in 7 languages

Admin dashboard

The settings screen is organised into five tabs:

  • Dashboard — consent records this month, acceptance rate, quota usage and current plan
  • Appearance — a read-only summary of your banner settings (position, colours, logo, categories)
  • Behaviour — blocking status, Google Consent Mode and blocking exceptions
  • Cookie Policy — the shortcode and block for your policy page
  • Plan — your quota and available plans

Requires an account

This plugin does not work on its own; a free Riza Kayit account is required. You can create one without leaving WordPress, or paste the site ID from your existing account.

Cookie policy

To publish your automatically generated cookie policy on a page, use the shortcode:

[rizakayit_cerez_politikasi]

The height can be adjusted:

[rizakayit_cerez_politikasi yukseklik="800"]

In the block editor you can also search for the Riza Kayit — Cookie Policy block.

External services

This plugin connects to Riza Kayit (https://rizakayit.com), a third-party service. The plugin does not function without it.

When is data sent, and what data?

  1. Visitor side (front end): The plugin loads a script from https://rizakayit.com/widget.js into your site’s <head>. While the widget runs:

    • It fetches your banner settings (your site ID is sent).
    • When a visitor makes a choice, a consent record is sent: consent ID, selected categories, page address, browser information, language and a masked IP address. Raw IP addresses are never stored; they are masked and hashed irreversibly.
    • Only the names of cookies detected on your site are reported; their values are never sent.

  2. Admin side — creating an account: When you click “Create a free account and connect”, the e-mail address you enter, your site’s domain and your site title are sent to https://rizakayit.com/api/plugin-signup.php. This happens only when you click the button. No password is requested; a link to set your password is e-mailed to you.

  3. Admin side — connection test: When you click “Test connection”, your site ID is sent to https://rizakayit.com/api/site-check.php and your site name and domain are returned. This happens only when you click the button.

  4. Admin side — plan list: When the “Plan” tab is opened, the plan and price list is fetched from https://rizakayit.com/api/plugin-plans.php (cached for 6 hours). If an account key is present, your current plan is returned in the same request. No personal information is sent or received.

  5. Admin side — dashboard figures: When the “Dashboard”, “Appearance” or “Plan” tabs are opened, your consent count for the month, acceptance rate, quota usage and a summary of your banner settings are fetched from https://rizakayit.com/api/plugin-stats.php. The response is cached for 12 hours; you can refresh it manually with the “Refresh data” button. The request contains only the account key stored by the plugin — site IDs are public, so these figures cannot be requested with one. No visitor-level records are returned, only totals.

  6. Opening the panel: When you click “Switch to this plan”, “Open my panel” or “My consent records”, the account key stored by the plugin is sent to https://rizakayit.com/api/plugin-login.php and your session is opened. Payment happens on rizakayit.com, not in this plugin; card details are never entered on your WordPress site.

  7. Cookie policy: On pages where you use the shortcode or block, the policy content is displayed in an iframe served from https://rizakayit.com/api/cookie-declaration.php.

  8. Connection diagnostics (optional): When you click “Test your server”, three requests are made: https://api.wordpress.org/core/version-check/1.7/ (to check whether your server can reach the internet at all), https://rizakayit.com/api/ping.php and https://rizakayit.com/api/plugin-signup.php (deliberately with invalid data, so no account is created). This happens only when you click the button, and no personal data is sent.

Data is processed on servers hosted in Istanbul, Turkey.

  • Terms of service: https://rizakayit.com/legal?doc=terms
  • Privacy policy: https://rizakayit.com/legal?doc=privacy
  • Data processing agreement (DPA): https://rizakayit.com/legal?doc=dpa
  1. Install and activate the plugin.
  2. On the setup screen that opens after activation, enter your e-mail address and click Create a free account and connect (skip this step if you already have an account).
  3. If you already have an account, copy your site ID from the Riza Kayit panel.
  4. Paste the ID into the plugin settings and save.
  5. Visit your site — the cookie banner should be visible.

Settings screen: Settings Riza Kayit

  1. Dashboard — consent records this month, acceptance rate, quota and plan

    Dashboard — consent records this month, acceptance rate, quota and plan

  2. Setup screen — create a free account without leaving WordPress

    Setup screen — create a free account without leaving WordPress

  3. Behaviour tab — blocking status, Google Consent Mode and exceptions

    Behaviour tab — blocking status, Google Consent Mode and exceptions

  4. Cookie consent banner (visitor view)

    Cookie consent banner (visitor view)

  5. Preference management dialog

    Preference management dialog

Is it free?

The plugin is free. Riza Kayit has a free plan; a higher consent record quota, multiple languages and showing your own logo are available on paid plans.

Will it slow my site down?

The widget is self-contained and pulls no external libraries. It is loaded synchronously because it has to run before the trackers do; the file is small and served from the browser cache.

Can I turn off blocking before consent?

No. Blocking is always on and there is no setting for it. Without it, tools such as Google Analytics and Meta Pixel would run before the visitor has chosen, and “Reject all” could not stop anything — the banner would be a sign rather than a control. If a service on your site must never be blocked, add it to the exception list instead.

I already have another cookie plugin. Can I run both?

You can, but you should not. Two banners appear at once and the visitor cannot tell which one to trust. Deactivate the other plugin.

Is the cookie policy page created automatically?

The content of the policy is generated automatically from the scanned cookies. You create the page yourself and add the shortcode or block to it.

Where are consent records stored?

On servers hosted in Istanbul, Turkey. Records are stored in a tamper-evident form and kept for two years for evidentiary purposes.

Why does the dashboard say figures could not be retrieved?

Your server could not reach rizakayit.com. This does not affect the banner: it is loaded by the visitor’s browser, and consent records continue to be stored normally. Use the “Test your server” button on the setup screen to find out where the connection fails.

1.0.1

  • The source strings are now English, so the plugin can be translated on translate.wordpress.org. A Turkish translation is bundled, so Turkish users see no change.
  • New setting: “I use Sign in with Google”. The Google identity script also powers One Tap, so it is blocked before consent; without this setting visitors could not sign in with Google until they answered the banner.
  • Meta Pixel is now handled through Meta’s own consent API instead of being blocked outright. Blocking it caused queued events (init, PageView, Purchase, AddToCart) to be lost when the script loaded late.

1.0.0

  • First release.
  • Tabbed admin screen and dashboard (consent count, acceptance rate, quota, plan).
  • Setup wizard, connection test and connection diagnostics.
  • Blocking of trackers before consent (always on) and a Google Consent Mode v2 option.
  • Cookie policy shortcode and block editor block.
Back to top