WordPress powers over 40% of the web, and nearly every site on it needs a cookie consent banner. The typical path is installing a plugin, but that comes with trade-offs most site owners don't think about until their PageSpeed score drops.

A cookie consent plugin adds its own JavaScript bundle (often 200-400 KB), fires extra database queries on every page load, and introduces another surface for security vulnerabilities. The alternative is a single <script> tag that loads asynchronously and weighs under 30 KB. It doesn't touch your WordPress database, doesn't need updates through the plugin manager, and doesn't conflict with your caching setup.

This guide covers three ways to add a lightweight cookie consent banner to WordPress without installing a plugin. Pick the one that matches your comfort level with code.

Why skip the plugin?

WordPress cookie consent plugins are convenient, but they carry real costs:

Performance. A popular cookie plugin adds 3-5 additional HTTP requests and 200-400 KB of JavaScript. On a site already running a page builder, WooCommerce, and a few other plugins, that's the difference between a 2-second and a 3-second load time.
Caching conflicts. Plugins that check visitor location server-side (to show different banners per region) bypass page caching entirely. Your carefully configured WP Super Cache or LiteSpeed setup serves a cached page to everyone except the cookie plugin's PHP, which runs on every request.
Update fatigue. Another plugin means another thing that can break on a WordPress core update. Cookie consent is a legal requirement; you don't want it disappearing because a plugin update conflicted with your theme.
Database bloat. Some plugins store consent records in custom WordPress tables. That's fine for small sites, but it turns into a performance problem once you're logging thousands of consent events per day.

A script-based approach avoids all of these. The banner JavaScript loads from a CDN, consent records are stored externally, and your WordPress installation stays exactly as it was.

Method 1: Add the script to header.php

This is the simplest approach. You're adding one line to your theme's header file.

In your WordPress admin, go to Appearance → Theme File Editor.
Select header.php from the file list on the right.
Find the closing </head> tag.
Paste this line directly above it:

<script src="https://cdn.cookiebeam.com/banner/YOUR_BANNER_ID/default/loader.js" async></script>

Replace YOUR_BANNER_ID with your actual banner ID from the CookieBeam dashboard.

Pros: Dead simple. One line, works immediately.

Cons: Theme updates overwrite header.php. If you're using a theme that updates frequently, use Method 2 instead.

Method 2: Add via functions.php (recommended)

This is the recommended approach for most WordPress sites. It survives theme updates if you're using a child theme, and it's the standard WordPress way to add scripts.

Add this to your child theme's functions.php:

function cookiebeam_consent_script() {
    wp_enqueue_script(
        'cookiebeam-consent',
        'https://cdn.cookiebeam.com/banner/YOUR_BANNER_ID/default/loader.js',
        array(),
        null,
        false
    );
}
add_action('wp_head', 'cookiebeam_consent_script', 1);

The priority of 1 ensures the consent script loads before your other scripts. The false for the last parameter puts it in the <head> rather than the footer, which is important because the banner needs to be ready before any tracking scripts fire.

Why wp_enqueue_script instead of a raw echo? WordPress's script queue handles deduplication, dependency ordering, and plays nicely with caching plugins. A raw echo in wp_head works but bypasses all of that.

Method 3: Google Tag Manager

If you're already running GTM on your WordPress site, you can load the consent banner through it. This is especially useful if you want to manage all your tags from a single place.

In Google Tag Manager, search the Template Gallery for "CookieBeam".
Add the CookieBeam Consent Mode v2 template to your workspace.
Create a new tag using the template. Enter your Banner ID.
Set the trigger to Consent Initialization - All Pages.
Publish your container.

The GTM template automatically configures Google Consent Mode v2 default states, so your GA4 and Google Ads tags respect the visitor's consent choice without any extra configuration.

When to use GTM instead of direct script: When your site already runs GTM and you want consent management integrated with your tag governance workflow. Otherwise, Method 2 is simpler.

WooCommerce considerations

WooCommerce sites have a few extra things to think about:

Checkout pages. Consent must be collected before any tracking fires on checkout. If you're using a payment gateway that drops cookies (Stripe, PayPal), those cookies fall under the "necessary" category and don't need consent. But your Google Ads conversion tracking and Facebook Pixel on the thank-you page do.
Geotargeting. WooCommerce stores often serve customers in multiple countries. CookieBeam's regional consent rules automatically show the right banner type (GDPR opt-in for EU, CCPA opt-out for California, no banner where it's not required) based on the visitor's location. No server-side PHP geolocation needed.
Cart fragments. WooCommerce's AJAX cart fragments (wc-ajax=get_refreshed_fragments) don't need consent because they're functional, not tracking. Make sure your consent setup doesn't block them.
Mini-cart and session cookies. WooCommerce session cookies (woocommerce_cart_hash, woocommerce_items_in_cart) are strictly necessary. They should be categorized as "necessary" in your cookie scanner results and never blocked.

Performance comparison

Here's what the numbers look like on a typical WordPress site (starter theme, WooCommerce, 3 other plugins):

Metric	Popular Cookie Plugin	CookieBeam Script
JavaScript size	280 KB (gzipped)	28 KB (gzipped)
HTTP requests	4-5 (JS + CSS + API calls)	1 (single async script)
Database queries	3-8 per page load	0
Time to interactive impact	+400-800ms	+50-100ms
Caching compatible	Partial (bypasses for geo)	Full (CDN-served, no PHP)
WordPress updates	Plugin updates required	None (external CDN)

The biggest difference is the database queries. Every page load with a cookie plugin triggers PHP execution and database queries, even on cached pages. A CDN-served script doesn't touch your server at all after the initial HTML is served.

Adding the async attribute

WordPress's wp_enqueue_script doesn't natively support the async attribute in older versions. If you're on WordPress 6.3+, you can use the wp_script_add_data function:

function cookiebeam_async_script($tag, $handle) {
    if ('cookiebeam-consent' === $handle) {
        return str_replace(' src', ' async src', $tag);
    }
    return $tag;
}
add_filter('script_loader_tag', 'cookiebeam_async_script', 10, 2);

This filter adds async to the script tag so it doesn't block page rendering. The consent banner loads in parallel with the rest of your page and appears as soon as it's ready.

Testing your setup

After adding the script, verify it works:

Clear all caches. Your page cache (WP Super Cache, LiteSpeed, Cloudflare), your browser cache, and your CDN cache if you have one.
Open the site in an incognito window. The banner should appear on the first page load.
Check the browser console. Open DevTools (F12) and look for any JavaScript errors. There shouldn't be any.
Verify consent persistence. Accept cookies, refresh the page. The banner shouldn't reappear.
Test the floating button. After accepting, a small settings button should appear (if configured) letting visitors change their preferences.
Check Google Tag Assistant. If you're using Google Consent Mode, verify that consent states are being sent correctly.

Common questions

Does this work with page builders like Elementor or Divi?

Yes. The script loads in the <head> before any page builder content renders, so it works regardless of which builder you use.

What about multisite installations?

Add the script to the network-activated theme's functions.php, or use a must-use plugin (wp-content/mu-plugins/) to ensure it loads on every site in the network.

Will this conflict with my existing cookie plugin?

You should remove your existing cookie plugin before adding the script. Running two consent banners simultaneously confuses visitors and creates conflicting consent states.

Do I need to change anything for CCPA?

No. CookieBeam automatically detects California visitors and shows the appropriate opt-out banner instead of the GDPR opt-in banner. No code changes needed on your side.

What if I want to customize the banner design?

All customization happens in the CookieBeam dashboard: colors, text, position, button labels, regional rules. The script you embed on your site automatically picks up any design changes you make in the dashboard without needing a code update.