When to use this
Install the runtime script immediately after your site is verified. The snippet loads GDPRChecker’s consent manager, enforcement layer, and heartbeat reporter. It must execute early in the page—ideally in the document head before marketing tags—so runtime telemetry can start before later consent and blocking checks run. Skipping or deferring the script is the most common reason setup stays on Step 2 even when the banner UI looks fine in preview mode.
You will copy a single line similar to a standard analytics tag, pointing at GDPRChecker’s /api/script endpoint with your encoded site id. Every template that renders HTML for public visitors needs this tag: marketing pages, blogs, landing pages, and localized variants. Admin-only backends and native apps do not need it unless they render web views that load third-party trackers.
Teams using Google Tag Manager should still add a dedicated Custom HTML tag fired on All Pages at priority higher than Analytics or Ads containers. Consent Mode and enforcement mode integrations are configured later on Growth (Step 4 Tracker Blocking); the runtime must boot first.
Step-by-step instructions
- Open Dashboard → Setup → Step 2 · Install Script and copy the provided snippet for your verified site (complete Step 1 · Connect Site first if you have not verified the domain).
- Paste the script as the first or among the first tags inside <head> on your site template or global layout.
- If you use WordPress, Webflow, Shopify, or similar, use their custom code / header injection area—avoid footers for this tag.
- For Google Tag Manager, create a Custom HTML tag with the snippet, trigger on All Pages, and set firing priority above analytics tags.
- Publish your CMS or GTM container changes to production, not only preview mode.
- Load your homepage in a private browser window with ad blockers disabled to generate a clean heartbeat.
- Return to the dashboard install step and confirm status changes from missing to detected or installed.
- If detection is slow, wait two minutes and hard-refresh; CDN HTML caches sometimes delay new head markup.
- Continue to Verify installation before editing consent categories so enforcement baselines are correct.
Expected result
The dashboard marks Step 2 complete when GDPRChecker receives either an install confirmation ping or a fresh runtime heartbeat from your live origin. The install panel shows script detected, and later setup steps unlock. Your site’s Protection view will begin showing connection status instead of offline.
View-source on your live homepage should include the script src pointing at your GDPRChecker host with the site query parameter. Do not minify away the site id or host it on a different domain unless documentation explicitly allows it.
Troubleshooting
Script not detected after publishing
Confirm you edited the production theme, not a draft. Check Content Security Policy script-src allows your GDPRChecker app origin. Remove duplicate CMP snippets that might error before our tag runs. Load the page without query parameters that strip head content, and verify you are testing the same hostname you registered.
Tag manager fires too late
Move the GDPRChecker tag earlier in GTM priority or inject via native head markup. Late firing lets analytics pixels run before blocking initializes, which fails runtime verification even if the banner eventually appears.
CSP or cookie blocking extensions
Enterprise CSP rules must whitelist the script endpoint. Test in a clean browser profile; privacy extensions can block heartbeats and make the dashboard think install failed when visitors with extensions would also break—still fix CSP for mainstream users.