Home Modules Changelog Get it for free
Code Snippets

Custom HTML, CSS and JS code in your WordPress head, body and footer

Code Snippets lets you insert custom HTML, CSS or JS code in three places — the <head>, right after <body> opens, and the footer — without touching your theme files. The module deliberately leaves the code unfiltered, so analytics scripts, tracking pixels and third-party embeds all pass through untouched.

Key features

  • Three separate fields: head (<head>), start of <body>, footer
  • Body injection runs on the wp_body_open hook, with a fallback for themes that never call it
  • Code is never passed through wp_kses — deliberately, so <script> tags for analytics and tracking survive intact
  • Saving requires both the manage_options capability and unfiltered_html at the same time
  • The module can’t be delegated to the Editor role — by design, because of the risk of a saved malicious script
  • No extra database table — the code is stored as regular plugin settings

How it works

The head field is echoed on the wp_head hook, the body field on wp_body_open — and for themes that don’t call that relatively new hook, the module adds a fallback output near the end of the page so the script still runs. The footer field is echoed on wp_footer.

Saving settings deliberately requires two capabilities at once — manage_options and unfiltered_html — because, unlike the rest of the plugin, this module never runs the field content through wp_kses. That’s exactly why it’s excluded from the module-delegation feature for the Editor role: letting an Editor save raw <script> tags would be a stored-XSS and privilege-escalation risk against Administrators, so the module simply won’t let this be delegated to non-admins by design.

Compared to alternatives

An alternative to WPCode (formerly Insert Headers and Footers), Simple Custom CSS and JS, or Header Footer Code Manager — not to be confused with the separate, identically named plugin "Code Snippets", which is a different tool focused on PHP snippets.

Frequently asked questions

Will a <script> tag for Google Analytics or a Facebook Pixel actually work?
Yes — the module deliberately doesn’t filter the code through wp_kses, since that exact use case is the main reason the module exists.
Can an Editor-role user add code too?
No. Unlike other modules, Code Snippets can’t be delegated to the Editor role — saving requires the unfiltered_html capability, which by default only Administrators have.
Where exactly does the "body" field get inserted?
Right after <body> opens, via the wp_body_open hook. If the theme never calls that hook, the module falls back to printing the code near the end of the page.