# Install FlowConsent on WordPress

On WordPress, paste the FlowConsent snippet in Code Snippets → Header & Footer (WPCode) or a child theme, then clear caches and remove the Site Kit gtag.

> Canonical: https://www.flowconsent.com/en/doc/install-wordpress
> Last updated: 2026-10-01
On WordPress, the FlowConsent snippet goes into the **Header** field of the WPCode plugin (**Code Snippets → Header & Footer**), or, for custom-built sites, into a child theme's `functions.php`. Installation takes three steps: copy the snippet, paste it, clear the cache. The main trap: caching or minification plugins that move or delay the script, and Google plugins such as Site Kit that inject their own `gtag` above the banner.

## Before you start

- An account on [app.flowconsent.com](https://app.flowconsent.com) (the Free plan is free, no credit card, up to 25,000 sessions per month).
- A banner created and deployed. On the Free plan, deployment runs through your own Cloudflare account (see the [Cloudflare guide](/en/doc/cloudflare-deployment)); on Pro and Enterprise, it is one click.
- Administrator access to WordPress.

## Step 1: Copy the snippet

In FlowConsent, open **Builder → Deployment → Integration**, **HTML / No-code** tab. The snippet has two parts, in this order:

```html title="FlowConsent snippet"
<script>
// FlowConsent Loader - place BEFORE any other script in the <head>
window.dataLayer=window.dataLayer||[];
function gtag(){dataLayer.push(arguments);}
gtag('consent','default',{
  'ad_storage':'denied',
  'analytics_storage':'denied',
  'ad_user_data':'denied',
  'ad_personalization':'denied',
  'wait_for_update':500
});
gtag('set','url_passthrough',true);
gtag('set','ads_data_redaction',true);
</script>
<!-- FlowConsent CMP -->
<script src="https://YOUR-LICENSE-CODE.consent.flowconsent.com/cookie-manager.js?code=YOUR_LICENSE_CODE"></script>
```

The first block sets the Google Consent Mode v2 `denied` defaults, the second loads the banner. Both must sit as high as possible in the `<head>`, **before** any tracking script (Google Analytics, Meta Pixel, Google Tag Manager…): anything placed above them escapes prior blocking.

## Step 2, recommended method: the WPCode plugin

WPCode (formerly "Insert Headers and Footers") is the most widely used plugin for this job, with more than 3 million active installations.

1. From the **Plugins** menu, search for **WPCode**, install it and activate it.
2. Open **Code Snippets → Header & Footer** in the left-hand menu.
3. Paste the snippet at the **very top** of the **Header** field, above any existing code (Google Analytics, GTM, pixels).
4. Save.

> [!TIP]
> If a Google tag or Google Tag Manager is already in that field, keep it **below** the FlowConsent snippet. For Google Analytics and ad pixels, the cleanest option is to remove them and declare them in **Builder → Services** instead: the banner then loads them only after consent.

## Step 2, alternative: a child theme

If you would rather not add a plugin, use a [child theme](https://developer.wordpress.org/themes/advanced-topics/child-themes/): WordPress advises against editing the parent theme directly, since the next update would wipe your changes. In the child theme's `functions.php`, hook the snippet to `wp_head` with priority `1`, which runs before scripts enqueued by plugins are printed (priority `9`):

```php title="wp-content/themes/your-child-theme/functions.php"
<?php
add_action( 'wp_head', function () {
  ?>
  <!-- Paste the full FlowConsent snippet here (both blocks) -->
  <?php
}, 1 );
```

Avoid the built-in file editor for this change: it keeps no backup, and a PHP error can take the site down. Use SFTP or your host's file manager.

## Step 3: Clear the caches

Clear your caching plugin, your host's cache and your CDN, otherwise visitors keep receiving the old version of your pages, without the banner.

## WordPress-specific traps

> [!WARNING]
> **Caching and minification.** Options such as "defer JavaScript", "delay JavaScript execution" or "combine JS files" (WP Rocket, LiteSpeed Cache, Autoptimize, W3 Total Cache…) can move the snippet to the bottom of the page or hold it until the first interaction. Tracking scripts then run before the banner. Exclude the Consent Mode stub (`FlowConsent Loader`) and the `consent.flowconsent.com` domain from these optimizations.

> [!WARNING]
> **Google plugins that inject gtag.** Site Kit by Google, like other Google Analytics plugins, prints its own `gtag` in the `<head>`, often above the WPCode output. Turn off its snippet in **Site Kit → Settings → Connected Services → Analytics → Edit**, toggle **Place Google Analytics code**, then declare Google Analytics in **Builder → Services**. Site Kit keeps showing your stats in the WordPress dashboard.

Only one cookie banner should be active: deactivate any other consent plugin before putting FlowConsent live.

## Verify the installation

1. Open the site in a private window: the banner appears.
2. In the developer tools **Network** tab, no request goes to Google, Meta or any other third party before you click **Accept**.
3. Run the **installation assistant** (**Builder → Integration**): it checks the live page (loader present with your license code, Consent Mode stub present, stub placed before every Google tag). See the [setup wizard guide](/en/doc/setup-wizard).
4. Finish with a **refusal scan** from the **Compliance** tab ([compliance verification](/en/doc/compliance-verification)).

## Do it from your AI agent (MCP)

FlowConsent has an official MCP server, `https://mcp.flowconsent.com`, usable from Claude, ChatGPT or any MCP client. You connect with OAuth 2.0 using your FlowConsent account, no API key needed. Your agent fetches the snippet and placement instructions (`get_banner_snippet` and `get_setup_instructions` tools), verifies the installation with a real scan (`verify_consent_compliance`) and can set up recurring monitoring (`monitor_compliance`). It does not edit your WordPress site for you: pasting the snippet stays on your side.

Example request: "Give me my banner snippet for my WordPress site and check that it is installed correctly on https://mysite.com".

See the [MCP server guide](/en/doc/mcp-server) and the [FlowConsent MCP](/en/mcp) page.

## Frequently asked questions

### Can I load FlowConsent through Google Tag Manager?

No. A banner loaded from GTM arrives too late for prior blocking. Place the snippet in the `<head>` above the GTM container: Google tags then honor the Consent Mode v2 signals, and other tags need "Additional consent settings". Details in the [Consent Mode guide](/en/doc/google-consent-mode).

### Why doesn't the banner show after installation?

Almost always, it is the cache: clear the plugin, host and CDN caches, then test in a private window. Then check the page source to confirm the snippet is inside the `<head>`.

### Do I need a child theme if I use WPCode?

No, the two methods are alternatives. WPCode keeps the snippet across theme updates; a child theme is only useful if you do not want another plugin.

### Does it work with a block theme (Full Site Editing)?

Yes. WPCode and the `wp_head` hook work with classic themes and block themes alike.