HTML / Static Site
Add it as the first line inside the <head> tag. Setup takes 30 seconds.
<head> <script src="https://cerez.io/sdk/loader.js" data-cerez-key="YOUR_KEY"></script> <!-- mevcut etiketler --> </head>
Get started with a single line of code. HTML, WordPress, Shopify, Next.js or GTM: a step-by-step guide for every platform.
Follow the steps below.
14-day free trial. No credit card required; you sign up with your email address.
Enter your domain URL on the Admin Panel > Domains screen. An API key and secret key are generated automatically.
Add the single-line installation code as the first line inside your site's <head> tag. The banner and widget load automatically.
Add the code below right after the opening <head> tag of your site, before every other script. Get the data-cerez-key value from the Admin Panel > Installation page.
<!-- cerez.io Cookie Consent + Accessibility --> <script src="https://cerez.io/sdk/loader.js" data-cerez-key="YOUR_API_KEY"></script>
async or defer. The small loader has to run before every other script: it writes the Google Consent Mode default first and holds back known trackers added with JavaScript until consent is given. It loads the banner and widget code async by itself. The configuration is cached server-side for 5 minutes; the SDK reflects your changes on the next load.
The @cerez-io/sdk package is for developers who build apps with React, Next.js or Vue and want to manage the setup in their own code. The package runs the same code as the installation tag: it writes the Consent Mode default, holds known trackers added with JavaScript until consent, and loads the banner with your panel settings.
<head>; the npm package does not replace it. The package runs after your app code has loaded and cannot stop trackers that sit in the HTML or run before it. Mark those tags with type="text/plain" and data-cb-category. Do not use the package together with the installation tag: only one of them should be on the page.
npm install @cerez-io/sdk
Call init before any other tracker code (Google Analytics, Meta Pixel, GTM). Replace YOUR_SITE_KEY with the site key from the Installation page in the panel.
import { init, on, hasConsent } from '@cerez-io/sdk';
init({ key: 'YOUR_SITE_KEY' });
on('consent', () => {
if (hasConsent('analytics')) {
startAnalytics();
}
});
Call page() after client-side navigation; the first load is counted automatically. The example is for Vue Router.
import { page } from '@cerez-io/sdk';
router.afterEach(() => page());
init must run in the browser; called on the server it does nothing. Add the component once to the root layout.
'use client';
import { useEffect } from 'react';
import { init } from '@cerez-io/sdk';
export default function CerezIo() {
useEffect(() => {
init({ key: 'YOUR_SITE_KEY' });
}, []);
return null;
}
Other functions: getConsent(), hasConsent(category), showBanner(), on('consent', fn). Options (host, lang, autoBlock, nonce, userId) are described on the package's npm page.
A detailed step-by-step installation guide is available for every platform.
Add it as the first line inside the <head> tag. Setup takes 30 seconds.
<head> <script src="https://cerez.io/sdk/loader.js" data-cerez-key="YOUR_KEY"></script> <!-- mevcut etiketler --> </head>
Download the WP Plugin ZIP, install the plugin, enter the API key.
# Seçenek A: Plugin ile (önerilen) Admin Panel > Eklentiler > Yeni Ekle ZIP yükle > Etkinleştir > API Key gir # Seçenek B: Manuel (functions.php) add_action('wp_head', function() { echo '<script src="https://cerez.io/sdk/loader.js" data-cerez-key="YOUR_KEY"></script>'; }, PHP_INT_MIN);
Add it inside theme.liquid or use a Custom Code Injector.
<!-- theme.liquid içinde, <head> etiketinin hemen altına --> <script src="https://cerez.io/sdk/loader.js" data-cerez-key="YOUR_KEY"></script>
Use a plain <script> as the first element inside <head> in the root layout; the next/script strategies load the script late.
// app/layout.tsx export default function RootLayout({ children }) { return ( <html> <head> <script src="https://cerez.io/sdk/loader.js" data-cerez-key="YOUR_KEY" /> </head> <body>{children}</body> </html> ) }
Create a Custom HTML tag and publish it with the Consent Initialization - All Pages trigger. Code installed through GTM runs after GTM has loaded; it cannot stop the GTM container or tags written into the page before consent. If you can, add the code directly to the head tag.
<!-- GTM > Tags > New > Custom HTML --> <script src="https://cerez.io/sdk/loader.js" data-cerez-key="YOUR_KEY"></script> <!-- Trigger: Consent Initialization - All Pages -->
Paste it at the very top of Site Settings > Custom Code > Head Code.
<!-- Site Settings > Custom Code > Head Code --> <script src="https://cerez.io/sdk/loader.js" data-cerez-key="YOUR_KEY"></script>
You can open the banner from your own UI, check consent and listen to events. All methods live under the window.cerez.io namespace.
CerezBanner.show()
Shows the banner manually. It can be called from custom triggers such as a "Manage My Cookie Preferences" button.
// Footer'daki "Çerez Tercihlerim" linkine event listener document.querySelector('#cookie-prefs').addEventListener('click', () => { CerezBanner.show(); });
CerezBanner.getConsent()
Returns the user's current consent state. If no decision has been made yet, it returns null.
const consent = CerezBanner.getConsent(); // Örnek dönüş: // { necessary: true, analytics: true, marketing: false, functional: true, timestamp: 1717000000 } if (consent?.analytics) { // Google Analytics'i yükle }
CerezBanner.on(event, callback)
Listen to consent changes. Supported events: consent.given, consent.updated, consent.rejected, banner.shown.
CerezBanner.on('consent.given', (data) => { console.log('Onay verildi:', data.categories); if (data.categories.marketing) { // Facebook Pixel başlat fbq('init', 'YOUR_PIXEL_ID'); } });
CerezBanner.reset()
Clears the current consent and shows the banner again. Suitable for functions such as "Reset My Preferences".
CerezBanner.reset(); // cb_consent cookie silinir, banner yeniden açılır
CerezBanner.hide()
Hides the banner programmatically. No consent is recorded; only the visibility changes.
CerezBanner.hide(); // Banner DOM'dan kaldırılmaz, gizlenir
Scripts such as GA4, Facebook Pixel and Hotjar must not run until consent is granted (a KVKK/GDPR requirement). The installation code automatically holds back tags that known providers add with JavaScript (such as the GTM and Meta Pixel snippets) until consent is given. Script tags written directly into the page (<script src>) are downloaded by the browser before any code runs; mark them with the type="text/plain" and data-cb-category attributes.
<!-- YANLIŞ: script anında yüklenir --> <script src="https://www.googletagmanager.com/gtag/js?id=G-XXX" ></script>
<!-- DOĞRU: sadece onay sonrası yüklenir --> <script type="text/plain" src="https://www.googletagmanager.com/gtag/js?id=G-XXX" data-cb-category="analytics" ></script>
<!-- Inline script için: type="text/plain" + data-cb-category --> <script type="text/plain" data-cb-category="marketing"> fbq('init', 'PIXEL_ID'); fbq('track', 'PageView'); </script>
necessary (cannot be blocked), analytics, marketing, functional
For YouTube, Vimeo, Google Maps and social network embeds, write data-cb-src instead of src and set the category with data-cb-category. The content does not load until consent is given; a placeholder of the same size with "Allow and show" and "Preferences" buttons appears in its place. Once allowed, all embeds in the same category load; when consent is withdrawn they return to the placeholder. For YouTube the youtube-nocookie.com address is recommended.
<iframe data-cb-src="https://www.youtube-nocookie.com/embed/VIDEO_ID" data-cb-category="marketing" width="560" height="315" title="Video"></iframe>
src cannot be blocked: the browser loads it before the installation code runs. The installation code only catches known embeds added later by JavaScript (YouTube, Vimeo, Google Maps, Instagram, X, TikTok, Facebook) on a best-effort basis.
Turn on the "Consent Mode v2" toggle under Admin Panel > Site Settings > Google Integration. The SDK automatically manages gtag('consent', 'default', {...}) and the update signals.
// Sayfa yüklenir yüklenmez, kullanıcı henüz karar vermedi gtag('consent', 'default', { 'ad_storage': 'denied', 'ad_user_data': 'denied', 'ad_personalization': 'denied', 'analytics_storage': 'denied', 'functionality_storage': 'denied', 'personalization_storage': 'denied', 'security_storage': 'granted' }); // Kullanıcı onay verdikten sonra, analytics + marketing kabul edildi gtag('consent', 'update', { 'ad_storage': 'granted', 'analytics_storage': 'granted' });
Ayrıntılı GCM v2 rehberi için Google Consent Mode v2 sayfasına bakın.
You can customize the SDK's behavior by adding extra attributes to the embed code.
By adding ?cb_preview=true to the URL, you can bypass the existing consent and show the banner every time. Ideal for testing and development.
Under Admin Panel > Site Settings > Banner Language, you can select a fixed language or set automatic switching (auto) based on the visitor's browser language. TR / EN / DE are supported.
If your site has a CSP, allow https://cerez.io in script-src, connect-src, style-src, font-src and img-src. If you use a nonce, the SDK passes the tag's nonce to its own elements. Details: CSP section.
After loading, the SDK stores the banner configuration in sessionStorage. No further server call is made within the same session; page load time is reduced.
Set the validity period of the cb_consent cookie under Admin Panel > Site Settings > Consent Duration (default 180 days). The recommended period for KVKK compliance is 6 months.
Restrict API access by opening the IP Restriction toggle under Admin Panel > Installation and entering the allowed IP addresses (CIDR notation supported).
If your site sends a Content-Security-Policy header, allow https://cerez.io in the directives below so the installation code can run. Your trackers' own domains (Google, Meta and so on) are needed separately; cerez.io does not load them until consent is given.
| Directive | Value | Why |
|---|---|---|
script-src | https://cerez.io | Installation code (loader.js), cookie banner and accessibility tool files. |
connect-src | https://cerez.io | Banner configuration, consent log, session and usage counter requests, language packs; with a regional rule, the country code request. |
style-src | https://cerez.io | Font stylesheet. The banner and the tool add their styles with a <style> element: without a nonce, style-src also needs 'unsafe-inline'. |
font-src | https://cerez.io | Fonts of the banner and the accessibility tool. If not allowed, both keep working with system fonts; the browser console shows a CSP error. |
img-src | https://cerez.io data: | Logo in the banner and the tool; data: for the accessibility tool's large cursor feature. |
If your policy uses a nonce (script-src 'nonce-...'), put the same nonce on the installation code tag. The SDK passes it to the script and style elements it creates, so style-src does not need 'unsafe-inline'.
<script nonce="SAYFANIZIN-NONCE-DEGERI" src="https://cerez.io/sdk/loader.js" data-cerez-key="API_ANAHTARINIZ"></script>
Content-Security-Policy: script-src 'self' https://cerez.io; connect-src 'self' https://cerez.io; style-src 'self' 'unsafe-inline' https://cerez.io; font-src 'self' https://cerez.io; img-src 'self' data: https://cerez.io
Keep your own directives; only add the cerez.io domain.
<script> etiketiyle kurulum önerilir (bu sayfadaki Next.js bölümüne bakın).
cb_consent (which stores the consent decision, default 180 days). Because this cookie is in the functional category, it does not require user consent under KVKK/GDPR.
<script> tag, the first element inside <head>; the next/script strategies load the script late.
https://cerez.io in script-src, connect-src, style-src, font-src and img-src. If you use a nonce, put the same nonce on the installation code tag. Details: CSP section.
Create an account, add a domain, copy the code. The SDK handles the rest.