Website Visitor Identification WordPress Setup: A Practical Guide

Website visitor identification on WordPress does not need a special plugin. Every identification tool, Scout included, runs from a small script that loads in the page's <head>, so the job is simply to get that script onto every page, and to respect your consent banner if your data-protection review says it should. This website visitor identification WordPress guide covers the three ways to do it, the consent step, and how to check it is working.

Do you need a plugin to identify visitors on WordPress?

No. A visitor identification tool is a script, not a WordPress feature. Once the script is on your pages, the tool does the rest on its own servers: it reads the visit's network information, works out which organisation the visit probably came from, and shows it in the tool's dashboard.

That means you have three routes onto the page:

1. A header-scripts plugin, such as WPCode, which adds code to every page's header without touching your theme.
2. Google Tag Manager, if the site already uses it.
3. Your theme's header template (header.php), if you are comfortable editing theme files.

Some vendors offer their own WordPress plugin. Lead Forensics, for example, lists an official plugin on WordPress.org: "Paste your tracking code into the settings page and the plugin handles placement automatically."¹ That can be convenient, but a plugin is not required for a script-based tool to work. Scout does not have a WordPress plugin; it uses one script line that works with any of the three routes above.

Which method should you use?

Pick the route that matches how your site is already run:

Whichever you choose, use one route only. Loading the same script twice, once in the header and once in Tag Manager, can record the same visit twice.

Step by step: adding the script with a header plugin

WPCode, listed on WordPress.org under the name Insert Headers and Footers + Custom Code Snippets, is a widely used choice, showing 3+ million active installations when we checked on 27 September 2026.² It describes its purpose plainly: it lets you "insert code like Google Analytics, custom CSS, Facebook Pixel, and more to your WordPress site's header and footer".²

1. Copy your snippet. In Scout, open the Install page after adding your domain. Your snippet is a single line of the form <script async src="…/snippet/your-site-key"></script>, with one snippet per site.
2. Install the plugin. In WordPress, go to Plugins, add a new plugin, search for WPCode, then install and activate it.
3. Paste into the header box. Open the plugin's header and footer settings and paste the line into the header field, which places it in every page's <head>.
4. Save. The script now loads on every page that uses your theme's standard header.

The async attribute matters for speed. For a classic script, MDN explains, it means the script is "fetched in parallel to parsing and evaluated as soon as it is available",³ so the browser keeps building the page while the script downloads.

If someone else looks after your site, Scout's Install page has a "Copy instructions for your developer" button that produces a short brief with the snippet and where to put it.

Step by step: adding the script with Google Tag Manager

If the site already runs Tag Manager, add the script there rather than in WordPress.

1. Create the tag. In Tag Manager, click Tags, then New, then Tag Configuration, and choose Custom HTML. Google's help says to "copy the tag code provided by the vendor and paste it into the HTML field".⁴
2. Paste the snippet. Paste the complete line, including the <script> tags.
3. Add a trigger. Scout's install guide says to fire the tag on All Pages, so every page view is seen.
4. Set consent requirements if needed (next section).
5. Preview, then publish. Use Tag Manager's preview to confirm the tag fires, then publish the container.

Why "All Pages" plus consent initialisation matters

"All Pages" makes sure every page view is captured, not only the home page or a campaign landing page. Consent initialisation matters because of ordering. Every web container includes a "Consent Initialization - All Pages" trigger, which fires before all other tags and is intended for tags that set up consent.⁵ Your consent banner's defaults should load there, so that by the time your identification tag is considered, Tag Manager already knows the visitor's choice.

How do you keep it PECR-compliant on WordPress?

Whether a visitor identification script needs consent under PECR and UK GDPR is a question for your own data-protection review, not a plugin setting. Scout's privacy notice sets out what its snippet stores and states that the website owner is responsible for getting any consent their visitors need before the snippet loads. Our guide to visitor identification and UK GDPR covers the legal questions. This is general information, not legal advice.

If your review concludes the script should wait for consent, the mechanics are straightforward.

In Tag Manager. Open the tag's consent settings and choose "Require additional consent for tag to fire". Google's help explains that the tag "will only fire if the status of all specified consent types are 'granted' when the tag is triggered."⁵ Your banner must update the consent state when the visitor chooses. Google's consent mode guide says to "update the consent status as soon as a user interacts with your consent management solution".⁶

In WordPress without Tag Manager. The WP Consent API plugin "standardizes the communication of accepted consent categories between plugins", with categories including statistics, preferences and marketing.⁷ Developers can check a category with a function such as wp_has_consent('marketing') before adding a script.⁷ Check whether your consent banner plugin can hold back a script until a chosen category is accepted. Assign the identification script to whichever category your review decides on.

In either case, do not paste the script directly into the header as well. A script in the header runs regardless of the banner.

How do you check it's working?

1. Open your site in a normal browser window. Ideally, use an office connection rather than home broadband or a phone, because home and mobile networks resolve to the internet provider rather than the business.
2. Watch the Install page. Scout detects the snippet on the first page view, usually within a minute, and the status next to your domain changes from "Listening for the first hit" to "Live" with the time it was last seen.
3. Check the page source. If the status does not change, view the page source and search for "snippet". If it is missing, the plugin or tag is not publishing it, or a consent rule is holding it back.
4. Look at your first companies. Identified companies appear with a confidence score and a reason, as explained on how Scout scores matches.

Does it work with caching plugins?

Usually without changes: the script tag is part of the cached HTML, and it runs in the visitor's browser on every page view. The exception is performance features that defer JavaScript. WP Rocket's "Delay JavaScript execution", for example, "delays the loading of all JavaScript files and inline scripts until there is a user interaction", and supports exclusions by file URL, keyword or a nowprocket attribute.⁸ If visits are missing, add the identification script to your caching plugin's exclusions.

WooCommerce and multisite notes

• WooCommerce. Shop, product, basket and checkout pages are ordinary WordPress pages, so a site-wide header snippet covers them. If your store sells to businesses, the product and pricing pages are often where the strongest buying signals appear.
• Multisite. Each site in a network is its own website, usually on its own domain. In Scout, add each domain separately; each one gets its own snippet. Install the right snippet on the right site, rather than one snippet network-wide.

For what you can do with the data once it is flowing, see our guide to seeing which companies visit your website.

Paste one line and start seeing companies within the hour. Scout's 14-day free trial needs no card, includes unlimited users, and works on any WordPress site. Plans are sized by identified visits per month; see pricing.

Frequently asked questions

Will a visitor identification script slow my WordPress site down?

A script loaded with the async attribute is fetched in parallel while the browser continues building the page, so it does not block the page from loading. Scout's snippet uses async. As with any third-party script, check your page speed before and after installing.

Does it work with caching plugins?

Generally yes, because the script tag is part of the cached HTML and runs in each visitor's browser. Features that delay JavaScript until user interaction, such as WP Rocket's Delay JavaScript execution, can hold it back, so add the script to the plugin's exclusions if visits are missing.

Is there a Lead Forensics WordPress plugin?

Yes. WordPress.org lists an official Lead Forensics plugin, described as letting you paste your tracking code into a settings page while the plugin handles placement. At the time of checking (27 September 2026) it showed 5,000+ active installations. Other tools, including Scout, are installed with a header plugin or Tag Manager instead.

Where exactly should the script go?

In the head of every page, just before the closing head tag. A header-scripts plugin or a Tag Manager tag firing on All Pages achieves this without editing theme files.

Sources

1. WordPress.org: Lead Forensics plugin wordpress.org
2. WordPress.org: WPCode, Insert Headers and Footers + Custom Code Snippets wordpress.org
3. MDN Web Docs: The script element developer.mozilla.org
4. Tag Manager Help: Custom tags support.google.com
5. Tag Manager Help: Tag Manager consent mode support support.google.com
6. Google for Developers: Set up consent mode on websites developers.google.com
7. WordPress.org: WP Consent API wordpress.org
8. WP Rocket: Delay JavaScript execution docs.wp-rocket.me