Install FlowConsent on WordPress

On WordPress, the FlowConsent snippet goes into the Header field of the WPCode plugin (Code Snippets → Header & Footer), or, for custom-built sites, into a child theme's functions.php. Installation takes three steps: copy the snippet, paste it, clear the cache. The main trap: caching or minification plugins that move or delay the script, and Google plugins such as Site Kit that inject their own gtag above the banner.

Before you start

An account on app.flowconsent.com (the Free plan is free, no credit card, up to 25,000 sessions per month).
A banner created and deployed. On the Free plan, deployment runs through your own Cloudflare account (see the Cloudflare guide); on Pro and Enterprise, it is one click.
Administrator access to WordPress.

Step 1: Copy the snippet

In FlowConsent, open Builder → Deployment → Integration, HTML / No-code tab. The snippet has two parts, in this order:

FlowConsent snippet

html

<script>
// FlowConsent Loader - place BEFORE any other script in the <head>
window.dataLayer=window.dataLayer||[];
function gtag(){dataLayer.push(arguments);}
gtag('consent','default',{
  'ad_storage':'denied',
  'analytics_storage':'denied',
  'ad_user_data':'denied',
  'ad_personalization':'denied',
  'wait_for_update':500
});
gtag('set','url_passthrough',true);
gtag('set','ads_data_redaction',true);
</script>
<!-- FlowConsent CMP -->
<script src="https://YOUR-LICENSE-CODE.consent.flowconsent.com/cookie-manager.js?code=YOUR_LICENSE_CODE"></script>

The first block sets the Google Consent Mode v2 denied defaults, the second loads the banner. Both must sit as high as possible in the <head>, before any tracking script (Google Analytics, Meta Pixel, Google Tag Manager…): anything placed above them escapes prior blocking.

Step 2, recommended method: the WPCode plugin

WPCode (formerly "Insert Headers and Footers") is the most widely used plugin for this job, with more than 3 million active installations.

From the Plugins menu, search for WPCode, install it and activate it.
Open Code Snippets → Header & Footer in the left-hand menu.
Paste the snippet at the very top of the Header field, above any existing code (Google Analytics, GTM, pixels).
Save.

Step 2, alternative: a child theme

If you would rather not add a plugin, use a child theme: WordPress advises against editing the parent theme directly, since the next update would wipe your changes. In the child theme's functions.php, hook the snippet to wp_head with priority 1, which runs before scripts enqueued by plugins are printed (priority 9):

wp-content/themes/your-child-theme/functions.php

php

<?php
add_action( 'wp_head', function () {
  ?>
  <!-- Paste the full FlowConsent snippet here (both blocks) -->
  <?php
}, 1 );

Avoid the built-in file editor for this change: it keeps no backup, and a PHP error can take the site down. Use SFTP or your host's file manager.

Step 3: Clear the caches

Clear your caching plugin, your host's cache and your CDN, otherwise visitors keep receiving the old version of your pages, without the banner.

WordPress-specific traps

Only one cookie banner should be active: deactivate any other consent plugin before putting FlowConsent live.

Verify the installation

Open the site in a private window: the banner appears.
In the developer tools Network tab, no request goes to Google, Meta or any other third party before you click Accept.
Run the installation assistant (Builder → Integration): it checks the live page (loader present with your license code, Consent Mode stub present, stub placed before every Google tag). See the setup wizard guide.
Finish with a refusal scan from the Compliance tab (compliance verification).

Do it from your AI agent (MCP)

FlowConsent has an official MCP server, https://mcp.flowconsent.com, usable from Claude, ChatGPT or any MCP client. You connect with OAuth 2.0 using your FlowConsent account, no API key needed. Your agent fetches the snippet and placement instructions (get_banner_snippet and get_setup_instructions tools), verifies the installation with a real scan (verify_consent_compliance) and can set up recurring monitoring (monitor_compliance). It does not edit your WordPress site for you: pasting the snippet stays on your side.

Example request: "Give me my banner snippet for my WordPress site and check that it is installed correctly on https://mysite.com".

See the MCP server guide and the FlowConsent MCP page.

Frequently asked questions

Can I load FlowConsent through Google Tag Manager?

No. A banner loaded from GTM arrives too late for prior blocking. Place the snippet in the <head> above the GTM container: Google tags then honor the Consent Mode v2 signals, and other tags need "Additional consent settings". Details in the Consent Mode guide.

Almost always, it is the cache: clear the plugin, host and CDN caches, then test in a private window. Then check the page source to confirm the snippet is inside the <head>.

Do I need a child theme if I use WPCode?

No, the two methods are alternatives. WPCode keeps the snippet across theme updates; a child theme is only useful if you do not want another plugin.

Does it work with a block theme (Full Site Editing)?

Yes. WPCode and the wp_head hook work with classic themes and block themes alike.