Installing the UserGuard snippet

Where does the snippet go?

It goes in the <head> of every page on your site. UserGuard runs from that single <script> tag, so there's no second tag and nothing else to add. The script is self-contained, with no dependencies. It includes the banner, the preference center and, when you switch it on, the accessibility widget. How it works shows where it sits in the whole lifecycle.

• In the app, open Sites, in the sidebar, and select your site. The Install panel is at the top of the site's Settings tab and shows your tag.
• Copy the tag exactly as shown, and don't edit its attributes.
• Paste it into the <head> of every page, then publish.

Any platform that lets you edit the page head works, including WordPress, Shopify, Webflow or a hand-rolled site. If your platform has a field for header code, use that field, as long as its output lands in the <head> on every page and doesn't stop at the homepage.

Can you add async or defer?

No. The tag has to load synchronously. Don't add an async or defer attribute, and don't wrap it in a loader that injects it after the page has started.

It comes down to ordering. The snippet holds tracking tags until the visitor has made a consent choice, and it can only hold a tag that hasn't run yet. An async loader races the same tags it's supposed to hold. If a tracking tag gets there first, it fires before the banner can gate it, and once a request has left the browser, no banner can recall it.

Loading synchronously has a cost, so we keep the script small. It's about 20KB gzipped and self-contained, with no dependencies.

Keep it out of your tag manager

A tag manager may look like a convenient place to paste the snippet, but the snippet can't do its job from inside one. It has to run before the tag manager. A script loaded by a container can't gate the container that loaded it, and it can't reliably beat sibling tags in the same container.

Paste the tag directly into the page head, ahead of your tag manager snippet. Your tag manager stays where it is, and UserGuard runs first.

Verification is automatic

Until the snippet is live, the dashboard shows the site as Awaiting install for the first 3 days, then Not installed. You don't need to click a verify button or trigger anything manually. The first time any visitor's browser fetches your site's config, the app marks the install verified, so loading one page of your own site in a normal browser is enough. That page has to be on the domain the site is set up with, or a subdomain of it. If a snippet answers only from another host, the site shows as Domain mismatch until a page on the right domain loads the snippet. A staging host you've listed on the Settings tab doesn't verify the install or cause a mismatch. Listing one afterward doesn't clear a mismatch, but the first page load on the right domain does. The Install panel names the domain it verifies on, and an admin can change it there.

We verify this way because a config fetch shows that the snippet ran on a real page in a real browser, and that's what you need to know. A manual "verify" click can't show that.

What site health tells you afterward

Once verified, the dashboard keeps reporting on the install. Site health has three states:

• Live means config fetches are arriving normally.
• Quiet means there's been no config fetch in 7 or more days.
• Silent means there's been no config fetch in 21 or more days.

Silent usually has one cause, which is a redesign or theme change that went out without the snippet. Nothing visibly breaks when that happens. The banner stops appearing and consent recording stops with it. The notifications bell flags a Silent site, so you can find out from the dashboard before it comes up in an audit.

If a site goes Quiet or Silent, view the source of a live page and search for the tag. If it's missing, paste it again from the Install panel on the site's Settings tab. Verification passes again on the next config fetch, with no extra steps.