Install guides

How do I start using CookieConsentHQ?

Create a free CookieConsentHQ account, add your website's domain and publish your banner configuration. The dashboard then gives you a site-specific loader in the Install tab.

Follow these steps:

1. Create a free account.
2. Add the domain where the banner will run.
3. Configure and publish the banner.
4. Open the site's Install tab.
5. Copy the installation snippet.

The Free plan includes one site, 25,000 monthly pageviews, monthly scans and one year of consent log retention. The pricing page lists every plan.

Every plan includes automatic blocking of known trackers before consent, Global Privacy Control support, all four Google Consent Mode v2 signals and consent records with CSV export.

Banner text comes in English, German, French, Spanish, Italian, Dutch and Portuguese. You can edit the text for your website.

Where should I place the installation script?

Place the CookieConsentHQ script first inside <head>, before analytics, advertising and other tracking tags. Load it synchronously, without async or defer.

The Install tab provides a snippet in this format:

<script src="https://cdn.cookieconsenthq.com/s/YOUR_SITE_KEY.js"></script>

Replace YOUR_SITE_KEY with the site key from your dashboard.

The loader is about 5 KB gzip. It needs early placement because its consent defaults and blocking controls must run before tracking scripts.

If your platform inserts scripts automatically, inspect the published HTML to see whether the CookieConsentHQ loader really runs first.

How do I install CookieConsentHQ on WordPress or an HTML website?

WordPress supports installation through the CookieConsentHQ plugin or a manually inserted header script. A plain HTML website uses the snippet directly as the first tag inside <head>.

For WordPress:

1. Download the plugin ZIP.
2. Go to Plugins, Add New, Upload Plugin.
3. Upload and activate the ZIP.
4. Open Settings, CookieConsentHQ.
5. Paste the script URL, the complete script tag or the bare site key.
6. Save.

The plugin prints the loader through wp_head at priority -9999. It supports the WordPress Consent API and provides the [cchq_cookie_table] shortcode.

The plugin is not yet listed on WordPress.org. See the WordPress installation guide for its caching attributes and where it does not print the loader.

For an HTML website, place the script immediately after the opening <head> tag and publish the updated file. If you use a header-scripts plugin or another injection method, check the resulting script order.

Where do I install the script on Shopify, Webflow, Wix and Squarespace?

These platforms use a script-tag installation, not a native CookieConsentHQ app. Each has its own code placement controls, so check the final script order after publishing.

Shopify

1. Open Online Store, Themes.
2. Open the three-dot menu and select Edit code.
3. Open layout/theme.liquid.
4. Paste the snippet immediately after the opening <head> tag.
5. Save.

Go to Settings, Customer privacy and turn off Shopify's own cookie banner so visitors don't see two banners.

The theme snippet runs on theme pages. Shopify controls checkout pages, so this method does not cover checkout.

Read the Shopify installation guide for the theme-specific limits.

Webflow

1. Open Site settings.
2. Select Custom code.
3. Paste the snippet at the top of Head code.
4. Save.
5. Publish the site.

Webflow inserts site-wide Head code before the closing head tag, so the top of that field is not necessarily the first position in the whole head.

See the Webflow installation guide for the placement details.

Wix

Wix only allows custom code on a published site with a connected domain.

1. Go to Settings in your site's dashboard.
2. Click Custom Code.
3. Click Add Custom Code.
4. Paste the snippet.
5. Choose All pages.
6. Under Place Code in, choose Head.
7. Click Apply.

Wix adds Google Analytics, Google Tag Manager and the Meta and TikTok pixels through its own marketing integrations, not custom code. CookieConsentHQ cannot block trackers added that way.

See the Wix installation guide for what that means for your site.

Squarespace

Squarespace offers code injection on its Core, Plus and Advanced plans and some legacy plans.

1. Open the Code Injection panel.
2. Paste the CookieConsentHQ snippet into the Header field.
3. Save.

Squarespace injects Header code into <head> on every page. Its checkout pages don't accept custom code, so the banner does not run there. Check the head order on the published site, since other code may still come before the snippet.

Can I install CookieConsentHQ through Google Tag Manager?

Yes, CookieConsentHQ provides a Google Tag Manager template that sets Consent Mode defaults and loads the banner. The template is not yet listed in the Community Template Gallery, so you import it by hand.

Download the GTM template, then:

1. Open Templates, Tag Templates, New.
2. Use the three-dot menu and select Import.
3. Import the template file.
4. Open Tags, New and choose CookieConsentHQ Consent Mode.
5. Paste your script URL.
6. Select Consent Initialization - All Pages.
7. Preview and publish.

The template uses setDefaultConsentState and supports regional defaults. After a visitor chooses, the banner sends consent updates and pushes cchq_consent to the dataLayer.

The recommended installation is still the standalone snippet first in <head>, above GTM. Loading the banner through GTM can gate GTM-managed tags but cannot block hardcoded page trackers that run earlier.

Load the banner through one method only. See the GTM installation guide.

How do I stop scripts from making requests before consent?

For editable external scripts, change the script type to text/plain and give it a CookieConsentHQ category. The browser then neither fetches nor runs the script until the visitor allows that category.

For example:

<script
  type="text/plain"
  data-cchq="marketing"
  src="..."
></script>

The category values are marketing, analytics and functional.

CookieConsentHQ automatically blocks known trackers written with ordinary <script src> tags before consent. Browsers may still fetch those files early, even though they don't run.

Use the manual markup when stopping the early request matters. You need to be able to edit the script tag to use it.

The cookie scanner shows which cookies its browser-based scans find.

How do I block embeds and display the cookie table?

For an iframe such as an embedded YouTube video, move the external URL into data-cchq-src and give it a consent category. For a cookie declaration table, place the CookieConsentHQ placeholder in the page content.

Example iframe:

<iframe
  data-cchq="marketing"
  data-cchq-src="..."
></iframe>

Cookie declaration placeholder:

<div data-cchq-cookie-table></div>

The scanner categorizes the cookies it finds and can fill the cookie table automatically. Free scans cover up to 50 pages and paid plans up to 150 pages per scan.

WordPress users can place [cchq_cookie_table] in page content instead of the HTML placeholder.

How do I reopen preferences and use the JavaScript API?

CookieConsentHQ exposes JavaScript methods for reopening preferences, applying choices and reading the current consent state. Add a footer link that calls CCHQ.showPreferences() so visitors can return to their settings.

Example footer link:

<a href="#" onclick="CCHQ.showPreferences(); return false;">
  Cookie preferences
</a>

The API methods are:

• CCHQ.showPreferences() opens preferences.
• CCHQ.acceptAll() accepts all categories.
• CCHQ.rejectAll() rejects all optional categories.
• CCHQ.getConsent() reads the current consent state.
• CCHQ.onConsent(callback) registers a consent callback.

To link a privacy request to a consent record, the website can read:

const consentId = CCHQ.getConsent().id;

The site can include that ID in a privacy request form, and the owner opens the matching record by ID in the dashboard's consent log. The banner itself does not show the consent ID.

How do I check the published installation?

Open the published website and confirm that CookieConsentHQ loads before the tracking tags. Then use the free checker to inspect one page for cookies set before consent, hardcoded tracker tags and Consent Mode v2 defaults.

The checker also recognizes 22 consent tools, so it works on a page running a different banner. It scans one page, not the whole website.

For broader coverage, use the scheduled cookie scanner. Free scans monthly, Starter weekly, and Growth, Business and Agency daily.

If you use Google Consent Mode, follow the Consent Mode testing guide. From Starter, the Consent Mode Health Monitor reads the consent information in Google's requests during each scheduled scan.

A working banner and a clean page check describe the configuration you tested. They don't show that every script or legal requirement has been handled. The website owner remains responsible for that. This documentation is not legal advice.