RXN Cookie Kit is a cookie-consent management layer. It displays a banner, remembers each visitor’s choice, blocks scripts for which consent is not given and displays a list of cookies that the site actually uses.
It also works independently, but it’s made to stand alongside the RXN Legal Kit. When both are on the site, one writes the document, the other fills it with real data.
How it works in pairs with Legal Kit
Cookie policy is the only legal document that cannot be written in advance. To be accurate, it must specify the cookies that this site sets, how long they last and what they serve. — This depends on what is installed on the site.
That is why Legal Kit leaves two empty places in its cookie policy: one for the list of cookies, the other for the button visitors use to change their choice — not a copied list, but one that someone has actually reviewed and confirmed.
- Legal Kit makes a cookie policy as a draft.
- Cookie Kit itself recognizes that blueprint and connects to it, without any adjustments.
- You review the list of cookies and complete what is missing.
- When you publish that same page, the banner turns itself on.
The order is intentionally so. The banner must not work until the policy is published, and the policy cannot be accurate until the list is confirmed — So if it wasn’t for this handshake, the two tools would have blocked each other and never started.
Cookie Kit also works without Legal Kit. Then you just choose your existing cookie policy page.
Consent that survives caching
This is the place where banners are most often broken in practice. If the page changes depending on what the visitor has chosen, the cash remembers one version and serves it to everyone — So the man who refused everything gets the page of someone who accepted everything.
Cookie Kit therefore sends the exact same HTML to everyone. The choice is applied in the visitor’s browser, not on the server. For a normal consent decision there are no queries to the database or calls to the server at all.
- Works with WP Rocket and Cloudflare without special exceptions for cash.
- The choice is stored as a first-party cookie, with the version of the notice and the time it was given.
- When the settings are saved, the cache is cleaned by itself.
A choice that is really a choice
“Accept everything” and “Decline options” are equal buttons — the same level, the same position, without hiding the rejection in a tiny link. The visitor can also enter into individual categories and enable only the categories they want.
Everything marked as optional by default is disabled until consent arrives. The button for changing the selection remains available later, so the decision is not a one-time one.
Blocking before consent
The banner that just stands on the screen, and the scripts load in the background anyway, did nothing. Cookie Kit turns external scripts for which consent is not given into inactive ones, so after consent it includes them in the same order in which they were on the page.
The same goes for embedded videos from YouTube and Vimeo. — Instead of the player, there is a place waiting for consent, so the video is uploaded only when the visitor approves it.
List of cookies that someone has actually viewed
The tool passes through the published pages of the site and records the names of cookies, keys from the browser memory and external addresses from which something is withdrawn.
- The name found does not enter a public table until its purpose and duration are entered. An incomplete entry stops the list confirmation.
- If a cookie disappears from three consecutive successful views, the tool asks you to explicitly say whether you are retaining or removing it — It does not delete it automatically.
- For WooCommerce there are prepared suggestions of necessary cookies.
- The list is displayed on the site with a short code
.
Check before you leave the site
This is the part that usually does not exist anywhere. The tool opens several pages of the site in three states — a visitor who has not made a choice, one who rejected optional cookies and one who accepted all categories — and then reports what actually happened in each state.
If an optional cookie appears before consent or after refusal, it is logged. Known addresses of analytics, advertising and external video services are marked for review, but are not declared a violation — This is decided by man.
The report only remembers names and counters. The cookie values, full address, IP address and anything by which the visitor would be recognized are not stored.
Where are the boundaries
We write this openly, because the tool that claims to see everything — can’t see.
- For security reasons, the browser does not allow reading cookies set by someone else’s domain, nor those protected at the server level. Such services remain an item for manual verification.
- Blocking covers scripts that WordPress logs neatly. Plugins that print their settings separately, manually inserted HTML frames and tools that are added at the network level require a special setting.
- Automatic verification works in the logged-in administrator session, so services that are turned off for logged-on users should be checked out and checked out, in an anonymous window.
- Consent is stored in the visitor’s browser. The certificate register on the server is not part of this release.
If you are already using Compliant or CookieYes
Use one solution, not two. Cookie Kit recognizes when one of them is turned on and warns, because two banners on the same site mean two consent requests and blocking rules that cancel each other.
Nothing leaves your site.
The tool does not contact any external service — There are no cloud scanners, no content delivery network, no telemetry. It also does not execute JavaScript that an administrator would have stuck somewhere, as this is the most common way for the consent tool to become a security hole.
The banner and administration were translated into Serbian.
Frequently Asked Questions
Do I need a Legal Kit?
No. Cookie Kit works independently — just specify which page contains your cookie policy. Together they work better, because then the policy and the list of cookies come from the same source and cannot be separated.
Is the site slowing down?
For the consent decision, there are no queries to the database or calls to the server, and the site is the same for all visitors, so the cash is working at full capacity. In practice, blocking even speeds up the first upload, because scripts for which consent is not given are not withdrawn at all.
What if I add a new service to the site?
The list of cookies should be checked again. The tool will report the new name at the next review, but the purpose and duration must be reviewed by a person. That is why the inventory belongs in ongoing maintenance rather than a one-time setup.
Is there proof that the visitor gave consent?
The choice is kept with the visitor, along with the version of the notification and the time when it was given. The certificate register on the server is not part of this release and we do not claim that it exists.