Three ways to add the script
1. In the theme, via a hook. The version that survives theme updates lives in a small site-specific plugin or a child theme's functions file:
add_action('wp_head', function () {
echo '<script defer src="https://pure-analytics.com/tracking/utilities/script.js" data-ea-domain="example.com"></script>';
});2. With a header-scripts plugin. Any plugin that inserts code into the head works. One less thing to maintain by hand, one more plugin to keep updated.
3. Through a tag manager. Only if you already use one. Adding a tag manager to load a single script means loading a large script to load a small one — and most tag managers themselves set cookies, which reintroduces the consent question you were trying to remove.
Option one is the recommended default.
Verify it works, properly
Do not trust the plugin's confirmation message.
1. Load your site in a private window.
2. Open the network panel and confirm the script loads and the tracking request returns successfully.
3. Check the storage panel: for a genuinely cookieless setup, nothing should appear.
4. Confirm the visit shows in your dashboard.
Then load a second page and confirm it registers too — a common failure is a script that fires only on the homepage.
Avoid double counting
The most frequent WordPress analytics problem is the same script installed twice: once by a plugin and once in the theme, both left behind after a migration.
Search your page source for the tracking domain. It should appear once. Also check your caching plugin: some optimisation features inline or duplicate scripts in ways that surprise you.
Exclude your own traffic
On a small site, your own visits distort everything. You are the most frequent visitor to your own site and you are not a customer.
Most tools offer an exclusion mechanism — a localStorage flag set by visiting a specific URL, or an IP exclusion. If your tool has one, use it. If your address is dynamic, the flag approach is more reliable.
Also exclude staging sites: point the tracking domain attribute at the production domain only, or skip the script entirely when the site is not live.
Cookies you may still have
Removing the analytics cookie does not make WordPress cookieless. Check for:
- Comment cookies — WordPress stores the commenter's name and email locally
- Login cookies — necessary for logged-in users, and no issue for visitors
- Cache and CDN cookies
- Plugins: contact forms, chat widgets, related-posts engines, and anything with a "personalised" feature
- Embedded video and fonts loaded from third parties
The embeds are what usually keep the consent banner alive after you have carefully removed the analytics cookie.
Performance notes
Load the script with defer so it never blocks rendering. Do not lazy-load it on interaction — you will lose every visitor who reads and leaves, which on a content site is most of them. And check that your optimisation plugin is not "deferring" it into oblivion: aggressive JavaScript delay settings frequently break analytics, and the symptom is a traffic drop that looks like an SEO problem.