diff --git a/components/consent-init.tsx b/components/consent-init.tsx
index d13dee9..f9160b6 100644
--- a/components/consent-init.tsx
+++ b/components/consent-init.tsx
@@ -1,44 +1,23 @@
 /**
- * Google Consent Mode v2 — defaults set to "denied" before any tag loads.
- * After the user makes a choice, CookieBanner calls gtag('consent','update', ...).
+ * Google Consent Mode v2 — default consent state denied'da.
+ * Consent default ayarı `/public/consent-default.js`'den senkron yüklenir
+ * (script src ile — React'ın inline script warning'inden kaçınmak için).
  *
- * Next.js 16 / React 19'da `next/script` inline scripts ile sorunlu olduğu için
- * doğrudan <script dangerouslySetInnerHTML> kullanıyoruz. Script senkron olarak
- * HTML parse edildiği anda çalışır — gtag('consent','default') hiçbir analytics
- * scripti yüklenmeden önce kaydedilir.
+ * GTM script'i sadece gtm_id varsa yüklenir, aynı src pattern'i kullanır.
  */
 export function ConsentInit({ gtmId }: { gtmId?: string | null }) {
-  const defaultConsent = `
-    window.dataLayer = window.dataLayer || [];
-    function gtag(){dataLayer.push(arguments);}
-    window.gtag = gtag;
-    gtag('consent', 'default', {
-      ad_storage: 'denied',
-      ad_user_data: 'denied',
-      ad_personalization: 'denied',
-      analytics_storage: 'denied',
-      functionality_storage: 'granted',
-      personalization_storage: 'denied',
-      security_storage: 'granted',
-      wait_for_update: 500,
-    });
-  `;
-
-  const gtmSnippet = gtmId
-    ? `
-      (function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start': new Date().getTime(),event:'gtm.js'});
-      var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';
-      j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);
-      })(window,document,'script','dataLayer','${gtmId}');
-    `
-    : null;
-
   return (
     <>
-      <script dangerouslySetInnerHTML={{ __html: defaultConsent }} />
-      {gtmSnippet && (
+      {/* Default consent — synchronous, runs before any other JS */}
+      <script src="/consent-default.js" />
+
+      {/* GTM */}
+      {gtmId && (
         <>
-          <script dangerouslySetInnerHTML={{ __html: gtmSnippet }} />
+          <script
+            async
+            src={`https://www.googletagmanager.com/gtm.js?id=${gtmId}`}
+          />
           <noscript>
             <iframe
               src={`https://www.googletagmanager.com/ns.html?id=${gtmId}`}
diff --git a/next.config.ts b/next.config.ts
index a64b806..ffa7098 100644
--- a/next.config.ts
+++ b/next.config.ts
@@ -10,6 +10,8 @@ const nextConfig: NextConfig = {
       { protocol: "https", hostname: "db.kovaksoft.com" },
       { protocol: "https", hostname: "kovakyazilim.com" },
       { protocol: "https", hostname: "**.kovaksoft.com" },
+      { protocol: "https", hostname: "images.pexels.com" },
+      { protocol: "https", hostname: "images.unsplash.com" },
     ],
   },
 };
diff --git a/public/consent-default.js b/public/consent-default.js
new file mode 100644
index 0000000..0483be8
--- /dev/null
+++ b/public/consent-default.js
@@ -0,0 +1,15 @@
+// Google Consent Mode v2 — set defaults to "denied" before any analytics tag loads.
+// CookieBanner sonradan gtag('consent','update',…) ile günceller.
+window.dataLayer = window.dataLayer || [];
+function gtag() { dataLayer.push(arguments); }
+window.gtag = gtag;
+gtag('consent', 'default', {
+  ad_storage: 'denied',
+  ad_user_data: 'denied',
+  ad_personalization: 'denied',
+  analytics_storage: 'denied',
+  functionality_storage: 'granted',
+  personalization_storage: 'denied',
+  security_storage: 'granted',
+  wait_for_update: 500,
+});