WooCommerce and WordPress

The plugin is the first-party path: it prints the tag and relays the heartbeat on this site, so a privacy browser does not treat the heartbeat as a third-party tracker. You can instead print the snippet from the theme functions file — that is the third-party head snippet, and privacy browsers and filter lists can drop it. Do not install only through Tag Manager, and do not run both.

pk_live_…

Or print it from the theme functions file

add_action('wp_head', static function (): void {
  echo '<script type="application/json" id="tagnovo-cfg">{"k":"pk_live_…"}</script>
<script src="https://m.tagnovo.com/m.js" data-key="pk_live_…" async></script>';
}, 1);

Child theme, so a parent update does not wipe it. This is not the plugin relay. Exclude m.tagnovo.com in optimizers.

Download the pluginInstall notesfunctions.phpWordPress guideCopy functions.php

Shopify

The App Store install is not available yet. A storefront snippet watches the storefront only — not Shopify-hosted checkout. Hosted checkout is usually a lighter questionnaire; whether 6.4.3 and 11.6.1 apply to pages you still serve is a question for your acquirer.

Shopify guideSAQ A or A-EPInstall from the App Store

BigCommerce

A Scripts API app that injects the tag is not built. Paste the snippet into the theme head. Default checkout is hosted by BigCommerce, so reduced scope is likely. The tag can watch checkout you host yourself. The scanner still cannot load an empty checkout.

BigCommerce guide

Magento

A Magento module is not built. Paste the snippet into the theme head. Checkout on your own site is typically full scope, and only the tag sees it — from a visitor who already has a cart.

Magento guide

Headless, PrestaShop, Squarespace, custom

There is no installer. Paste the snippet into the document head, before the closing head tag. PrestaShop and Squarespace are recognised by a scan; they still use this path. Tag Manager is not an install.

Manual install guide

Not through Google Tag Manager

Tag Manager is one of the things we watch. If you only added this in Tag Manager, a blocked container silences the monitor. Install the plugin or the head snippet. GTM may be added as a duplicate; it is not the install.

Optimizer exclusions

The plugin marks same-origin ingest uncacheable and asks LiteSpeed, WP Rocket, W3TC, and Autoptimize to leave the tag alone. A functions.php print has no handle — exclude m.tagnovo.com if a combiner still rewrites it. Purge the page cache after a key rotate.

When the tag will not see

We do not certify your SAQ. These are the cases the dashboard cannot pretend to cover.

• Tag Manager only. Filter lists block googletagmanager.com. The monitor must not depend on the thing it watches. GTM may be a duplicate; it is not the install.
• Third-party head snippet, no first-party path. Privacy browsers and filter lists can drop a cross-site script or beacon. The WordPress plugin is the first-party path that exists. Waiting or a quiet-tag alert is the signal.
• Shopify hosted checkout. The storefront tag does not run on checkout.shopify.com.
• Payment iframes (Stripe Elements, hosted fields). Cross-origin iframe scripts are invisible.
• A CSP missing script-src / connect-src for the script host and the beacon host.
• A consent banner set to block essentials. The plugin default is essential; a merchant can still override it.
• No payment-page patterns. Sampling stays at 5% and the PCI queue looks empty.
• Unverified store. The snippet is not issued until the store is verified.
• First 14 days. Absence alerts are off while the model learns. “Receiving (learning)” is not a clean bill of health.
• A rotated key still in a page cache. Purge the cache.
• A custom or preview origin that is not allowlisted. Beacons return 204; add the origin.
• AMP, in-app webviews, email HTML. Not a storefront.