How to install the Manifest tag

What this is for

Tracking checks need nothing installed. Manifest does. Skimmers check whether a browser is being driven by software and stay quiet if it is. Only a script running in real customers' browsers sees what was actually delivered — including checkout, which a scanner cannot load.

The published snippet is an async script fromhttps://m.tagnovo.com/m.jswith yourpk_live_key. It enumerates the scripts on the page and nothing else. It does not read the payment form, card numbers, names, or addresses.

What is built

• WordPress / WooCommerce plugin— download, paste the key, refresh the cached copy. Steps live onthe WordPress plugin page.
• Head snippet— paste the block from Install into the theme, before the closingheadtag. On WordPress this can be afunctions.phpprint (below). This is also the path for Shopify, BigCommerce, Magento, headless, and custom stores today.

Not built: a Shopify App Store app, a Shopify theme app extension, a BigCommerce Scripts API app, and a Magento module. Those are the planned installers. Do not wait for a button that is disabled on purpose.

WooCommerce and WordPress

The plugin enqueues the tag onwp_headand serves a same-origin copy ofm.jsplus a relay. The load and the heartbeat are requests to the store, so they are not a third-party tracker. A head snippet tohttps://m.tagnovo.com/m.jsis third-party; privacy browsers and filter lists can drop it.

1. Add Manifest on a verified store. Copy the key from Install. It starts withpk_live_.
2. Download the plugin zip, then in WordPress open Plugins → Add New → Upload Plugin. Or search Tagnovo Manifest in the WordPress plugin directory. Activate Tagnovo Manifest.
3. Settings → Tagnovo Manifest. Paste the key. Keep or edit the payment-path globs. On a WordPress network, paste the key once under Network Admin → Settings; a site overrides payment paths only when its checkout URLs differ. Save.
4. Click Refresh cached script so the tag is served from your site.
5. Exclude thetagnovo-manifesthandle from WP Rocket, LiteSpeed Cache, W3 Total Cache, and Autoptimize.
6. In Complianz, CookieYes, or similar, mark the tag essential. A banner that blocks essentials silences the heartbeat.

Defaults cover/checkout*,/cart*and/order-pay*. Purge the page cache after a key rotate. A rotated key still sitting in cache looks like the old install.

WordPress without WooCommerce has no commerce funnel to walk. The plugin still installs; the scanner will not invent a checkout it cannot find.

Full installer notes, requirements, and questions.

WordPress functions.php

The plugin is the first-party path. You can instead print the issued snippet from the child themefunctions.phponwp_headat priority 1. That is the third-party head snippet: no same-origin cache, no relay. Privacy browsers and filter lists can drop it. Do not run it next to the plugin. A parent-theme edit is wiped on update.

1. Copy the filled PHP from Manifest → Install (WooCommerce and WordPress). Do not invent a second key.
2. Paste it at the bottom of the child themefunctions.php.
3. Excludem.tagnovo.comin optimizers. There is notagnovo-manifesthandle on this path.
4. Mark the tag essential in the consent banner.

The shape, with a placeholder key. Install wraps the snippet that was issued for that store.

add_action('wp_head', static function (): void {
  echo '<script type="application/json" id="tagnovo-cfg">{"k":"pk_live_…"}</script>
<script src="https://m.tagnovo.com/m.js" data-key="pk_live_…" async></script>';
}, 1);

Shopify

The planned path is a theme app extension: the merchant installs the app and flips one switch. That install is also meant to prove control of the domain. None of that is offered yet. The App Store button on Install is disabled because there is nothing behind it.

Today: copy the snippet from Install and paste it into the storefront theme, before the closingheadtag. That is the same instruction as the Install card. Do not invent a second snippet.

A storefront snippet watches the storefront only. It does not run oncheckout.shopify.com. Shopify checkout is off-domain and never observable from a scan. Purchase pixels that live only inside hosted checkout have the same limit.

Does Shopify hosted checkout need PCI script monitoring?

Usually a lighter questionnaire. Shopify hosted checkout is listed as SAQ A onSAQ A or SAQ A-EP— the customer types the card number on Shopify, not on a page you serve. That is a starting position, not a determination. Two shops with the same setup can be told different things by different acquirers.

Requirements 6.4.3 and 11.6.1 apply to payment pages you serve. Whether they apply toyour remaining pages — cart, a custom thank-you page, an app-block checkout you host — is a question for your acquiring bank, not a fact Tagnovo can certify. We are not a QSA. Subscribe already treats “hosted by the platform” as a reason not to sell Manifest on that store; the Why link on that row is this same SAQ page.

If card fields sit in an iframe you embed on a page you serve, that is often the heavier questionnaire, even when the iframe is Shopify or a gateway. A script on the parent page can replace the frame. That is how most skimming works.

BigCommerce

The clean planned path is the Scripts API: an app injects a script intoheadon all pages, with nothing for the merchant to paste. That app is not built. Later installers land in the plugins repository, not as a second snippet format.

Today: paste the Install snippet into the theme head, before the closingheadtag. There is no BigCommerce download and no “connect” button.

Default BigCommerce checkout is hosted by BigCommerce. Reduced scope is likely — same qualifier as Shopify hosted checkout, and the same acquirer conversation. Merchants who host checkout themselves (Checkout SDK) are the ones whose payment page the tag can watch. Checkout is still only observed from a real visitor who has a cart. A scanner that opens/cart.phpwith an empty cart does not see payment scripts.

Magento

The planned path is a module that prints the tag fromdefault_head_blocks.xml. It is low priority and built on request. It does not exist in the dashboard.

Today: paste the Install snippet into the theme head. Magento checkout on your own site is typically full scope — on-page fields, your hosting. The scanner still cannot load checkout (empty cart redirects or an empty-cart notice). Only the tag, from a shopper who already has a cart, sees the page the mandate is about.

Headless, PrestaShop, Squarespace, custom

Manual install: the snippet from Install, in the document head. That is the documented path for headless builds and custom stacks.

A scan can recognise PrestaShop and Squarespace. They are stored as custom. There is no installer for either. If you cannot edit the document head, you cannot install the tag.

Never through Google Tag Manager

There is no Tag Manager install method. GTM is one of the things Manifest watches. If the container fails to load, the monitor goes silent at the moment it should be shouting, and you cannot tell a dead monitor from a fine store. Direct install only. GTM may be added as a duplicate; it is not the install.

After it is in the head

• The dashboard waits for the first beacon, then learns for fourteen days before absence alerts. “Receiving (learning)” is not a clean bill of health.
• Sampling is 100% on payment-scoped URLs and 5% elsewhere. With no payment-page patterns, sampling stays at 5% and the PCI queue looks empty.
• A content-security-policy must allow the script host and the beacon host (m.tagnovo.comfor both).
• Scripts inside a payment iframe are invisible. Cross-origin frames are not readable.
• AMP, in-app webviews, and email HTML are not a storefront.
• A preview origin that is not allowlisted returns 204. Add the origin.

Checkout is the reason the tag exists. A public scan loads home, collection, product, and cart. It does not fill a cart and it does not open checkout.