Install

Your snippet is one tag, available on the site's Embed tab in the dashboard:

<script src="https://api.consentinel.co/storage/v1/object/public/bundles/s/cs_YOUR_SITE_KEY.js"></script>

Publish first. The bundle behind that URL is created when you publish a banner configuration. You can install the tag beforehand, but nothing will render until you go to Customize and choose Save & publish.

Placement is the product

The tag must be the first synchronous script inside <head>:

above every other <script>, including inline ones;
above your tag manager;
with no async and no defer attribute.

Synchronous loading is intentional. The blocker has to own fetch, XMLHttpRequest, sendBeacon and createElement before any tracker runs, and a deferred script cannot do that. The cost is a few milliseconds of parse time for a bundle that is typically around 12 KB gzipped.

If a tracker loads above the snippet, that tracker is not blocked. Not "partially" — it has already run.

Script optimizers will break this silently

Performance plugins and CDN features that delay, combine, or move JavaScript will happily relocate your consent tag and leave no error behind. Exclude the snippet, or turn the feature off:

Tool	Setting	Fix
Cloudflare Rocket Loader	Delays all scripts	Add `data-cfasync="false"` to the tag
WP Rocket	Delay JavaScript execution, Combine JS	Add the bundle URL to the exclusion list
Autoptimize	Aggregate / defer JS	Exclude the bundle URL
LiteSpeed Cache	JS defer / combine	Exclude the bundle URL
NitroPack, Perfmatters, and similar	Script delay	Exclude the bundle URL

The data-cfasync="false", data-no-defer, and data-no-minify attributes together cover most of these. The Consentinel WordPress plugin emits the tag with all three already applied.

After changing any optimizer setting, purge the cache and re-check the rendered page — see Verify your install.

Platform guides

Plain HTML

Paste the snippet immediately after the opening <head> tag, above everything else.

<head>
  <script src="https://api.consentinel.co/storage/v1/object/public/bundles/s/cs_YOUR_SITE_KEY.js"></script>
  <meta charset="utf-8">
  <!-- everything else -->
</head>

WordPress

Use the Consentinel plugin. It is free, it places the tag correctly without you touching a theme file, and — uniquely — it can gate tracker tags server-side, before the page is ever sent to the browser. That reaches tags no client-side tool can touch, including trackers emitted by other plugins. See What can and cannot be blocked.

Connecting the plugin to your Consentinel Cloud account ("bridging") makes Cloud the source of truth: the plugin prints your published Cloud bundle at wp_head priority 0 and suppresses its own banner and blocker, so there is exactly one consent system on the page.

If you already pasted the snippet by hand, remove it before connecting the plugin. Otherwise the page ends up with two copies of the same bundle: two banners a few pixels apart, two blockers patching the same APIs, and consent evidence split across two stores. We have seen this on real sites. To check, view the rendered page source and count occurrences of bundles/s/cs_ — there should be exactly one.

Without the plugin, add the snippet with a header-scripts plugin (WPCode and similar) set to output in <head> at the highest priority, or hook wp_head at priority 0 in a child theme.

Shopify

Online Store → Themes → Edit code → layout/theme.liquid. Paste the snippet directly after <head>, above content_for_header — Shopify injects its own scripts through that tag and yours must come first.

Shopify's behavior with its own Web Pixels is not something we have measured. Those pixels run in a sandboxed worker gated by Shopify's Customer Privacy API, and they may behave better than the equivalent on other builders. We do not claim either way. Crawl your store and read the evidence.

Wix

Settings → Custom code → add to Head, apply to all pages, load once.

Read this before promising anyone a result on Wix. Wix renders its own Marketing Integrations (GA4, GTM, pixels) at the top of the same injection block your custom code lands at the bottom of. Measured on a live site, the platform's GA4 tag sat at byte ~36,000 and the Consentinel snippet at byte ~43,000 — so the browser had already begun fetching GA4 before our code existed. No client-side consent tool can block those tags, including Wix's own banner. What we do deliver there is cookie suppression, correct Google Consent Mode signals, and full blocking of custom-code trackers such as session recorders. The dashboard's scan will tell you honestly when this is what is happening on your site.

Squarespace

Settings → Advanced → Code Injection → Header. Code injection requires a Business plan or higher.

Other builders

Anywhere with a "custom head code" box works, with the same caveat as Wix: the platform decides whether your code lands above or below its own tags. Install it, then verify — do not assume.

Do not load Consentinel through a tag manager

Tag managers load asynchronously. A tracker fired by GTM will beat a GTM-loaded blocker essentially every time, so installing the consent tool through the tag manager defeats the entire mechanism.

Install the snippet directly in <head>, above the GTM container. Keep GTM — Consentinel emits Google Consent Mode v2 signals, so consent-aware tags inside your container respond correctly, and the blocker still guards everything else. See the SDK reference.

After installing

Verify the placement and the blocking in your own browser.
Run a deep crawl from the site's Scan tab. It visits your pages twice, once without consent and once with, and reports what actually fired pre-consent — including vendors nobody has a signature for.
Re-publish whenever you change your configuration. Bundles are built at publish time; live visitors keep the previous one until you do.