Installing the UserGuard snippet
One script tag in the head of every page. Where to get it, why it must load synchronously, and how UserGuard confirms it is working.
Where the snippet goes
UserGuard runs from a single <script> tag. It goes in the <head> of every page on your site. There is no second tag and nothing else to add. The script is self-contained, with no dependencies.
- In the app, open Sites — the first entry in the sidebar's Workspace section — and select your site. The Install panel sits at the top of the site's Settings tab and shows your tag.
- Copy the tag exactly as shown. Do not edit its attributes.
- Paste it into the
<head>of every page, then publish.
Any platform that lets you edit the page head works: WordPress, Shopify, Webflow, or a hand-rolled site. If your platform has a field for header code, that field is the right place, as long as its output lands in the <head> on every page, not just the homepage.
Do not add async or defer
The tag must load synchronously. Never add an async or defer attribute, and never wrap it in a loader that injects it after the page has started.
The reason is ordering. The snippet exists to hold tracking tags until the visitor has made a consent choice, and it can only hold a tag that has not run yet. An async loader races the very tags it exists to hold. If a tracking tag wins that race, it fires before the banner can gate it, and no banner can recall a request that has already left the browser.
This is why the script is kept small: about 15KB gzipped, self-contained, no dependencies. Loading it synchronously is a deliberate trade, and the script is sized so the cost stays low.
Keep it out of your tag manager
A tag manager looks like the convenient place to paste the snippet. It is the wrong place. The snippet must run before the tag manager, not from inside it. A script loaded by a container cannot gate the container that loaded it, and it cannot reliably beat sibling tags in the same container.
Paste the tag directly into the page head, ahead of your tag manager snippet. The tag manager stays where it is; UserGuard just has to run first.
Verification is automatic
Until the snippet is live, the dashboard shows the site as Awaiting install. You do not need to click a verify button, and there is nothing to trigger manually. The first time any visitor's browser fetches your site's config, the app marks the install verified. Loading one page of your own site in a normal browser is enough. That page has to be on the domain the site is set up with, or a subdomain of it. Until a page there loads the snippet, a snippet answering only from another host shows as Domain mismatch. A staging host you have listed on the Settings tab neither verifies the install nor causes a mismatch, and listing one afterwards does not clear it: the first page load on the right domain does. The Install panel names the domain it verifies on, and an admin can change it there.
This works the way it does because a config fetch is evidence. It proves the snippet actually ran on a real page in a real browser, which is the thing you care about, and the thing a manual "verify" click cannot prove.
What site health tells you afterwards
Once verified, the dashboard keeps reporting on the install. Site health has three states:
- Live — config fetches are arriving normally.
- Quiet — no config fetch in 7 or more days.
- Silent — no config fetch in 21 or more days.
Silent usually has one cause: a redesign or theme change shipped without the snippet. Nothing visibly breaks when that happens. The banner simply stops appearing and consent recording stops with it, silently, which is exactly the failure you want surfaced. The notifications bell flags a Silent site so you find out from the dashboard, not from an audit.
If a site goes Quiet or Silent, view the source of a live page and search for the tag. If it is missing, re-paste it from the Install panel on the site's Settings tab. Verification will pass again on the next config fetch, with no extra steps.