Install Tagnovo Manifest on WordPress
The WooCommerce installer for Manifest. Download the plugin, paste your store key, and keep it out of optimizers and optional-consent lists.
WordPress 6.4 or later, PHP 8.1 or later, GPLv2 or later. A key is issued only after Manifest is on a verified store. Priced per store — amounts are on /pricing.
What it does
Puts the Manifest tag on your WordPress store as a file from your own site, and sends a heartbeat so Tagnovo can see which scripts ran on payment pages. It never reads form fields, card numbers, names or addresses. Defaults cover /checkout*,/cart* and /order-pay*.
Install
- Get a store key. Add Manifest on a verified store. Copy the key from Tagnovo → Manifest → Install. The key starts with pk_live_.
- Install the plugin. Download the plugin zip, then in WordPress open Plugins → Add New → Upload Plugin. Activate Tagnovo Manifest.
- Paste the key. Settings → Tagnovo Manifest. Paste the key. Keep the payment-path globs, which include /*/checkout* and /*/basket* so /jp/checkout and /jp/basket are payment pages. On a WordPress network, paste the key once under Network Admin → Settings; a site can override payment paths if its checkout URLs differ. Save.
- Save and leave combiners alone. Save. The plugin prints the tag and relays heartbeats on this site. It marks ingest uncacheable and asks LiteSpeed, WP Rocket, W3TC, and Autoptimize to leave the tag alone.
- Mark it essential. In Complianz, CookieYes, or similar, mark the tag essential. A banner that blocks essentials silences the heartbeat.
The dashboard waits for the first beacon, then learns for fourteen days before absence alerts. A rotated key still sitting in a page cache looks like the old install.
Or print it from functions.php
The plugin is the first-party path. You can instead print the issued snippet from the child theme functions.php on wp_head at priority 1. That is the third-party head snippet, not this plugin — no same-origin ingest. Privacy browsers and filter lists can drop it. Do not run both. A parent-theme edit is wiped on update.
Copy the filled PHP from Manifest → Install. The steps are also onthe install guide. Exclude the Manifest script in optimizers — there is notagnovo-manifest handle on this path — and mark the tag essential in the consent banner.
When it will not see
- Tag Manager only — filter lists block the container, and the monitor must not depend on the thing it watches.
- A head snippet with no plugin — a third-party script and beacon; privacy browsers and filter lists can drop it.
- Shopify hosted checkout, or scripts inside a payment iframe.
- A content-security-policy that omits the script or the beacon host.
- A consent banner that blocks essentials.
- No payment-page patterns (the plugin ships Woo checkout, cart, order-pay, and the same paths under a language prefix).
- An unverified store — the dashboard will not issue a key.
- A preview origin that is not allowlisted.
Questions people actually ask
Does the plugin read card numbers or form fields?
No. It never reads the payment form, card numbers, names or addresses. It reports which scripts ran on the page.
Can I install it only through Google Tag Manager?
No. Tag Manager is one of the things Manifest watches. If the container is blocked, the monitor goes quiet. GTM may be a duplicate; it is not the install.
Can I add it in the theme functions file instead?
Yes. Print the issued snippet from the child theme functions.php on wp_head. That is the third-party head snippet, not this plugin: no same-origin ingest. Privacy browsers and filter lists can drop it. Do not run both. Copy the filled PHP from Manifest → Install.
How do I set this on a WordPress network?
Network-activate the plugin. Paste the key once under Network Admin → Settings → Tagnovo Manifest. That key applies to every site. Default payment paths include /*/checkout* and /*/basket* so a language prefix is still a payment page. On a site, override those paths when checkout URLs differ.
What do I exclude in a caching plugin?
Nothing extra for ingest — the plugin marks the same-origin route uncacheable and tells LiteSpeed, WP Rocket, and W3TC. If a combiner still rewrites the tag, exclude the tagnovo-manifest handle. Purge the page cache after a key rotate.
Why does a consent plugin stop it?
Many banners treat any third-party file as optional. Mark Tagnovo essential so the banner does not silence it.
Privacy of the heartbeat is on the privacy notice. Why the tag cannot live only in Tag Manager is in the terms and onInstall the tag once you have a store.