All platforms

Showing the steps for a site behind Cloudflare. Not behind Cloudflare?

1. 1.Route /_tc on Cloudflare

   Your site is behind Cloudflare, so a small Worker can serve /_tc from your own domain and pass on the visitor's country. The choice is then stored on your domain (Safari keeps it for its full lifetime).

   // Cloudflare → Workers & Pages → Create → Worker. Paste this, deploy, then add the route
   // yourdomain.com/_tc/* (and www.yourdomain.com/_tc/*) under the Worker's Settings → Domains & Routes.
   export default {
     async fetch(request) {
       const url = new URL(request.url);
       const headers = new Headers(request.headers);
       headers.set("x-forwarded-host", url.host);
       headers.set("x-forwarded-proto", "https");
       headers.set("x-tc-client-ip", request.headers.get("cf-connecting-ip") || "");
       headers.set("x-tc-country", request.headers.get("cf-ipcountry") || "");
       headers.delete("cookie");
       headers.set("accept-encoding", "identity");
       return fetch(new URL(url.pathname + url.search, "https://cmp.trackable.digital"), {
         method: request.method, headers, body: request.body, redirect: "manual",
       });
     },
   };

   Copy

2. 2.Add the banner as the first code in <head>

   Add this to your child theme's functions.php, or as a PHP snippet in a code-snippets plugin (WPCode: Add snippet → PHP, run everywhere). The early priority puts it before every other script, Google Tag Manager plugins such as GTM4WP and Site Kit included. If the check says the banner is not the first script, a plugin is printing its code earlier: change that plugin's placement setting.

   add_action('wp_head', function () {
     echo '<script src="/_tc/l/YOUR_SITE_KEY.js"></script>' . "\n";
   }, -10000);

   Copy

3. 3.Remove the other cookie banner, keep GTM

   Remove any other cookie banner or consent plugin. Keep Google Tag Manager, but make sure the banner script comes before it in <head>, including GTM added by a plugin, a module or a component.

4. 4.Optional: signed-in customers (WooCommerce), with consent

   Optional. Sends the signed-in customer's ID to Google Analytics (User-ID) once they allow analytics, and their email, hashed, for Google Ads enhanced conversions once they allow marketing. Before that it stays in the page only: nothing is stored or sent. In GTM, use the user_id variable in your GA4 tag and user_data.sha256_email_address for enhanced conversions. Add it next to the banner snippet.

   add_action('wp_head', function () {
     if (!is_user_logged_in()) return;
     $u = wp_get_current_user();
     printf("<script>(window.TrackableConsent = window.TrackableConsent || []).push(['identify', %s, { emailSha256: %s }]);</script>\n",
       wp_json_encode((string) $u->ID), wp_json_encode(hash('sha256', strtolower(trim($u->user_email)))));
   }, -9999);

   Copy

5. 5.Clear the cache and check

   Purge your caching plugin and host cache (WP Rocket, LiteSpeed, Hostinger…), open the site in a private window, then press Check the site now on the site's Install page in the dashboard, and Scan now on the Cookies page to list its cookies.

Next: Google Tag Manager