Verification confirms that your website loads the Kukie.io banner script with this site's key. It is a check for you: the banner works for visitors whether the site shows as verified or not.
Check your installation
- Open your site in the dashboard. On Overview, find the Installation card. The same card is on the Installation tab of the Banner Editor.
- Select Verify installation. The button shows Checking... while Kukie.io looks at your site, which usually takes a few seconds.
- Read the result under Installation status. What the result means explains each one.
With the WordPress plugin, you can run the same check from WordPress: go to Kukie.io > Settings and select Check installation.
What the check looks at
Kukie.io works through these steps in order and stops as soon as one of them confirms the installation:
- Your latest cookie scan. If your most recent cookie scan from the last 30 days found the banner script with this site's key on any page, the site is verified straight away and no request is sent to your site. A scan that could not read your pages does not count. The scanner opens your pages in a real browser, so it also sees a script that Google Tag Manager adds. A script your site's Content Security Policy refuses does not count, because visitors' browsers refuse it too.
- Your homepage. Kukie.io's server requests your homepage at
https://example.com, with your own domain in place ofexample.com. If that fails, it trieshttp://example.comand thenhttps://www.example.com. In the HTML it receives, it looks for your banner script,cdn.kukie.io/s/YOUR_SITE_KEY/c.js, whereYOUR_SITE_KEYis the site key in your embed code. It reads the page even when your server answers with an error status, because some firewalls send the full page with a 403. When the homepage loads normally, Kukie.io also reads its Content Security Policy. If the policy stops the banner from loading or from reaching Kukie.io, the check ends here with Blocked by security policy and lists the changes to make. - Google Tag Manager. If your homepage loads a Google Tag Manager container and its HTML also contains your site key, the site is verified.
- Recent consents. If visitors have made consent choices on your site in the last 14 days, the banner is running, so the site is verified. This covers sites whose firewall blocks the server request. It does not apply when your homepage's Content Security Policy blocks the banner, because the policy your homepage sends today outweighs earlier choices.
The server request reads your homepage only, so for that step the embed code must be on the homepage. A scan or visitors' consent choices on other pages can still verify the site.
What the result means
| Status | What it means | What to do |
|---|---|---|
| Verified | Your homepage loads the banner script with this site's key. Before you run a check, it means the site was verified earlier. | Nothing. |
| Verified via cookie scan | Your latest cookie scan found the banner script. | Nothing. |
| Verified via GTM | Your homepage loads a Google Tag Manager container and contains your site key. | Nothing. |
| Verified via consent data | The server request could not find the script, but visitors made consent choices on your site in the last 14 days. | Nothing. If a firewall blocked the request, you can allow Kukie.io's servers so that the next check reads the page. |
| GTM detected | Your homepage loads a Google Tag Manager container, but the Kukie.io tag inside it runs only in the browser, so the server request cannot see it. This is normal right after setup. | Wait for a visitor's first consent choice, or run a cookie scan. Either one verifies the site. |
| Blocked by security policy | Your homepage sends a Content Security Policy that stops the banner from loading, or from reaching Kukie.io to record visitors' consent choices. The message lists the changes the policy needs. | Change the policy as the message lists, publish the change, then check again. Allow Kukie.io in your Content Security Policy explains each change. |
| Pending verification | Your site's bot protection answered with a challenge page instead of your homepage. | Allow Kukie.io's servers in your bot protection, or wait for a visitor's first consent choice. |
| Not verified | The site has not been verified yet, or it went back to Not verified on its own. After a check, the message under the status says what it found. | See Troubleshooting. |
Once a site is verified, the card shows Last verified with the date. A check that fails does not remove an earlier verification: the status stays Verified and the message under it shows what the latest check found, until the site goes back to Not verified as described below. Two results replace the status while you read them, because they need you to act: Blocked by security policy and Pending verification.
When the status changes on its own
- A cookie scan that finds the banner script with this site's key verifies the site.
- When a visitor makes a consent choice on your site's domain, a site that is not verified becomes verified.
- A site goes back to Not verified overnight when its latest verification is more than 14 days old and no visitor has made a consent choice for 14 days. The next consent choice, scan that finds the script or successful check verifies it again.
If a site is still not verified a day after you add it, the organisation owner receives one reminder email. A site that goes back to Not verified can trigger another. The owner can turn these emails off: open Notifications from the account menu and turn off Site verification reminder.
Verification on the Sites page
On the Sites page, a verified site shows Live and a site that is not verified shows Awaiting setup. A frozen site shows Frozen instead, whatever its verification. Each site's Overview shows Verified or Not verified next to its title.
KukieBot in your server logs
Requests with the User-Agent KukieBot/1.0 (Site Verification; +https://kukie.io/docs/verify) come from this check. Kukie.io sends them only when someone checks the installation from the dashboard or the WordPress plugin, never on a schedule. Each check tries at most the three addresses listed above. Kukie.io server IP addresses lists where the requests come from.
Troubleshooting
Script not found
The check reached your homepage but did not find the banner script with this site's key in its HTML. Common causes:
- The embed code is only in some templates. Add it to the layout that every page uses, including the homepage.
- A caching plugin or a CDN serves an older copy of the page. Clear the cache, then check again.
- A script loader adds the banner after the page loads. The server request reads only the HTML your server sends, so run a cookie scan instead.
- The embed code was edited. Copy it again from the Installation card.
Blocked by security policy
Your homepage sends a Content-Security-Policy header, or a <meta http-equiv="Content-Security-Policy"> tag, that leaves out something the banner needs. Visitors' browsers then refuse the banner script or its styles, or stop it from sending consent choices to Kukie.io. This happens with every installation method: with Google Tag Manager, the tag still shows as fired, because the browser refuses the script only after GTM has added it.
The message lists each change for your policy, such as adding https://cdn.kukie.io to script-src. Make the changes where your site sets the policy (your server, CDN, hosting panel or a security plugin), then check again. Allow Kukie.io in your Content Security Policy explains what each change allows.
Site key mismatch
The result says Script found but site key doesn't match: your homepage loads a script named c.js, but not with this site's key. This usually means the embed code of another site was copied. Replace it with the embed code from this site's Installation card.
Connection and HTTP errors
- Could not connect: Kukie.io's server could not reach your domain. Check that the site is online and public. A site on your computer, behind a password or on a private network cannot be checked.
- Domain resolves to a private or reserved IP address: the domain points to a private network, so Kukie.io does not request it.
- HTTP 403 or 503: a firewall or bot protection usually blocked the request. Allow the Kukie.io servers or the
KukieBot/1.0User-Agent, as If verification or a scan fails with HTTP 403 describes. - Another HTTP status: your server answered with an error. Open your homepage in a private browser window to check that it loads.
- A verification is already running for this site: a check started a moment ago is still running. Wait a few seconds, then try again.
In each of these cases the banner still runs for visitors if the embed code is on your pages, and their consent choices verify the site on their own.
Check the banner in your browser
Verification tells you that the script is installed. To see what the banner does on a page, add ?kukie_debug=1 to the page address (or &kukie_debug=1 if the address already contains a ?) and open your browser's developer console. Debug mode explains what it shows.
