How to add a cookie consent banner to WordPress

Where to paste the snippet in WordPress

The snippet must print inside <head> on every page, above every analytics or marketing tag. There are two reliable ways to do that on WordPress.

With WPCode (no code). Install the free WPCode plugin, then go to Code Snippets, then Header & Footer. Paste the snippet at the top of the Header box and click Save Changes. WPCode prints the Header box inside the head of every page, and it works with classic themes and block themes such as Twenty Twenty-Five.

html
<script src="https://cookiequiet.com/cq.js" data-site="YOUR_SITE_KEY" data-consent-mode="1" data-auto-block="1" defer></script>

With a child theme or a small plugin. The wp_head action fires inside the head of the theme. Hook it at priority 0 so the snippet prints before the tags that other plugins add at the default priority of 10:

php
add_action( 'wp_head', function () {
  echo '<script src="https://cookiequiet.com/cq.js" data-site="YOUR_SITE_KEY" data-consent-mode="1" data-auto-block="1" defer></script>';
}, 0 );

Do not edit the parent theme's header.php: the next theme update would remove the line. Whichever method you use, purge your page cache afterwards.

How to handle the tags your plugins add

WordPress sites rarely paste tags by hand; plugins do it. Three cases:

• Google tag printed by Site Kit. Site Kit prints the Google tag itself, so you cannot mark it. Turn on consent mode in Site Kit, then Settings, then Admin Settings: Site Kit then prints Google's default consent state (denied for visitors in the EEA, the UK and Switzerland) before its tag. Cookiequiet sends the consent update command when the visitor chooses, which the Google tag applies whatever printed the tag. Site Kit asks you not to enable the consent mode feature of another consent plugin at the same time; Cookiequiet has none to enable, so there is no conflict. The Google Analytics 4 guide explains what the tag does while consent is denied.
• Tags you pasted in a snippet. Mark them. For the Google tag, both script tags change:

html
<script type="text/plain" data-cq-category="analytics" src="https://www.googletagmanager.com/gtag/js?id=G-XXXXXXX"></script>
<script type="text/plain" data-cq-category="analytics">
  window.dataLayer = window.dataLayer || [];
  function gtag(){dataLayer.push(arguments);}
  gtag('js', new Date());
  gtag('config', 'G-XXXXXXX');
</script>

The Meta Pixel base code gets data-cq-category="marketing". Tags marked with data-cookiecategory or data-cookieconsent from CookieYes or Cookiebot keep working; see switching from CookieYes.

• Chat widgets and pixels loaded by their own plugin. Most of them insert their script with JavaScript. With data-auto-block="1", Cookiequiet holds the scripts and iframes of about 80 known trackers (Hotjar, Clarity, Meta, TikTok, LinkedIn, HubSpot and others) created this way until their category is granted. A tracker that a plugin prints as plain HTML before our snippet runs before we can stop it: move it below the snippet or mark it.

YouTube embeds from the block editor are printed as plain iframes, so they load at once. To make a video wait for consent, use a Custom HTML block with data-cq-src instead of src, as explained in YouTube embeds and consent.

How to add the Cookie preferences link

Visitors must be able to change their mind as easily as they consented. Cookiequiet opens the preferences centre from any link whose URL is #cq-preferences, and from any element carrying data-cq-show-preferences.

• Classic themes: Appearance, then Menus, add a Custom Link with URL #cq-preferences and label "Cookie preferences" to the footer menu.
• Block themes: Appearance, then Editor, open the footer template part, select the Navigation block and add a link with the same URL.

If you cannot edit the footer, the banner settings offer a small floating "Cookie preferences" button shown after a choice.

How to test the installation

1. Open the site in a private window. The banner shows with Accept all and Reject all of the same size.
2. Click Reject all. In the browser's developer tools (Application, then Cookies in Chrome), only cq_consent and WordPress's own cookies should be present: no _ga, _gid, _fbp or _hjSession.
3. Clear the cookies, reload, click Accept all: the marked scripts run and their cookies appear.
4. Open the consent log in the dashboard: both choices are recorded with date, categories and country.

If the banner does not show, check that the snippet is in the page source (View source, search for cq.js), that the cache was purged, and that geo-targeting is set to everywhere while you test from an unregulated country.

What is specific to WordPress

• Two banners. Any other consent plugin (Complianz, CookieYes, Cookie Notice, GDPR Cookie Compliance, Cookiebot's plugin) shows its own banner and may block or rewrite tags. Deactivate it after the switch; see switching from Cookiebot.
• Optimization plugins. Script delay and aggregation features (WP Rocket's Delay JavaScript execution, LiteSpeed Cache, Autoptimize) can move cq.js after the tags it must precede. Add cq.js to the exclusion list of such features.
• WooCommerce. Its cart and session cookies are strictly necessary: they need no consent, and the scanner lists them under Necessary in the cookie table. A shop that also runs analytics or marketing tags still needs the banner for those tags.
• Multisite. Each site of the network needs its own site key, so the consent log and the policies stay separate.

The free cookie scanner shows which tags your plugins actually print, which is the quickest way to find the ones to mark.