Cookies & Consent Management
You manage visitor measurement and the cookies HEIMWALL writes at Console → WAF → [domain] → Cookies. There are two independent measurements: estimated visitor analytics that leaves no cookies, and a persistent visitor ID that only works while valid consent is present.
Cookie-less visitor analytics
Section titled “Cookie-less visitor analytics”When you switch on Cookie-less Visitor Analytics, an estimated unique-visitor count appears on the Analytics/Visitors pages. No cookie or trace is left on the visitor’s device; the count is an estimate produced from IP and browser signals using anonymous identities that rotate daily.
- Because no personal data is stored, it is KVKK/GDPR-friendly and requires no consent mechanism.
- Informing your visitors about this on your own site remains your responsibility.
- Metrics appear on the Visitors page: Analytics.
Consent-gated persistent visitor
Section titled “Consent-gated persistent visitor”The Consent-Gated Persistent Visitor feature writes a persistent, anonymous identity (the hw_vid cookie) to the visitor’s device while valid consent exists, recognizing returning visitors across days.
| Property | Value |
|---|---|
| Cookie name | hw_vid |
| Type | Analytics (consent-gated) |
| HttpOnly | Yes |
| SameSite | Lax |
| Duration | Default 180 days (configurable 1–400 days) |
Configured in the dialog opened with the Change button:
- Consent Detection is one of three modes:
- Off — no consent is detected, the ID is never written
- IAB TCF v2 — the TCF v2 consent string written by your CMP is read
- Custom consent cookie — you enter the name of the cookie your CMP writes (e.g.
cookie_consent); its value must be truthy (1,true,yes,granted,allow,on)
- ID lifetime (days) — 1–400; left empty, 180 days applies.
The persistent ID is written only when valid consent is detected via the selected method. If the feature is on but the consent mode is Off, hw_vid is never written — only cookie-less estimated analytics works.
Your KVKK / GDPR obligations
Section titled “Your KVKK / GDPR obligations”hw_vid counts as personal data; ensuring the following, as the data controller, is your obligation:
- Obtain explicit consent — valid, freely given consent under KVKK (6698) and GDPR.
- Inform visitors — disclose the purpose and duration of the data.
- List it in your privacy policy — add the
hw_vidcookie with its name, purpose and duration to your cookie/privacy policy. - Install a consent management platform (CMP) — HEIMWALL detects consent from your CMP’s output.
- Make consent revocable — visitors must be able to withdraw consent easily.
HEIMWALL’s strictly necessary cookies
Section titled “HEIMWALL’s strictly necessary cookies”The cookies below are managed by HEIMWALL for the protection service to function; they require no consent (the ePrivacy “strictly necessary” exemption / KVKK legitimate interest). We still recommend listing them in your privacy policy.
| Cookie | Purpose | Duration | Attributes |
|---|---|---|---|
_hwp | Marks a visitor who passed the JS/Captcha challenge as “verified”, so they are not re-challenged on every request | JS: 30 min · Captcha: 60 min | HttpOnly · Secure · SameSite=Lax |
_hwq | Holds the visitor’s place/ticket in the virtual waiting room — created only while a waiting room is active | Waiting: ~1 hour | HttpOnly · Secure · SameSite=Lax |
The content of _hwp is encrypted with AES-128-GCM and contains no raw personal data — only an irreversible hash of the IP and User-Agent, the TLS fingerprint and a random nonce. There is no advertising or tracking purpose. _hwq is likewise an AES-GCM-sealed ticket (room ID, ticket number, state).