Hyvä-Specific Settings

Which additional configuration options a Hyvä theme adds to the backend that Luma doesn't have.

Depending on which Hyvä modules are installed, Hyvä themes add their own configuration areas under Stores > Configuration, usually in a dedicated "Hyvä Themes" section:

• Hyvä Theme (base module): settings for cookie consent behavior, image compression/lazy loading, and Content Security Policy (CSP), since Hyvä themes use a strict CSP by default.
• Hyvä CSP: actively used on this project — every inline script included has to be explicitly registered via $hyvaCsp->registerInlineScript() in the code so the browser doesn't block it (a developer-side concern, not backend-configurable).
• GraphQL caching: since Hyvä themes rely heavily on client-side GraphQL (e.g. for the cart), there are sometimes dedicated cache settings for GraphQL responses.

The most important conceptual difference from Luma: Hyvä does away with Knockout.js entirely and doesn't load jQuery — interactivity runs through Alpine.js instead. Among other things, that means classic Luma extensions built with Knockout components do NOT work with Hyvä without adaptation; when buying new extensions, look for explicit Hyvä compatibility.

Cookie Consent Management in Detail

The Hyvä cookie consent module lets you, under Stores > Configuration > Hyvä Themes, not only turn the consent banner on or off but also maintain several cookie categories (e.g. essential, functional, statistics and marketing cookies), each with its own texts. Scripts assigned to a non-essential category are only loaded on the storefront after the visitor has actively given consent — technically implemented through Alpine.js bindings that react to the stored consent state.

Practical tip: When embedding a new tracking or marketing script, it needs to be assigned to the right consent category and — because of the active CSP — registered as an allowed source (see the next section). Forgetting either step is a common reason a script suddenly fails to load on the storefront.

CSP: Maintaining Allowed Hosts for Third-Party Scripts

When embedding third-party services like Google Maps, Google Tag Manager, a chat widget provider, or payment scripts, the Content Security Policy that Hyvä enables by default blocks the call unless the respective domain is explicitly allowed. Under Stores > Configuration > Hyvä Themes > Hyvä CSP, additional allowed hosts can be entered per directive (including script-src, style-src, img-src, connect-src, and font-src).

Practical tip: Before pushing a new CSP rule to production, the report-only mode helps — it only logs violations instead of blocking them, so missing hosts can be identified without affecting customers with a broken script.

Compatibility with Classic Luma Extensions

For third-party extensions originally built for Luma with Knockout.js components that haven't been ported to Hyvä yet, a separate compatibility module exists that runs such components in isolation within a Hyvä page. It isn't a substitute for a native Hyvä integration but a stopgap solution that loads additional JavaScript (RequireJS/Knockout) — which works against the actual goal of a lean, jQuery-free frontend.

Practical tip: Before purchasing a new extension, always check whether a native Hyvä version exists before falling back on a compatibility module — the latter should remain the exception, not the rule, since it increases load time and CSP complexity again.