Bonsai Code Injector WP Registry grade A. No security issues foundWP RegistryNo security issues foundOpen the reportA

A minimal WordPress plugin for pasting tracking and verification code into a site's <head> and immediately after <body> — without editing theme files.

Features

• Settings page under Settings → Code Injector
• Header Code field — printed as early as possible inside <head> on every front-end page (wp_head, priority 1). Use for the GA4 gtag.js snippet, the Google Tag Manager `` install snippet into Header Code.
• Paste the `` install snippet into Body Code.

GA4 (gtag.js, no GTM)

• Paste the full gtag.js snippet into Header Code. No Body Code entry is needed.

Security Note

This plugin intentionally outputs the saved code unescaped on the front end — that is its purpose. Access is restricted to users who can manage_options (site administrators). Do not lower this capability without understanding that anyone who can edit these fields can run arbitrary JavaScript on every page of the site.

Data Structure

Two options are stored:

• bci_header_code (string)
• bci_body_code (string)

Both are deleted when the plugin is uninstalled.

Updates

Ships with YahnisElsts/plugin-update-checker (installed via Composer, vendor/ committed) pointed at github.com/The-Bonsai-Digital-Collective/bonsai-code-injector. Sites with the plugin installed will see updates in Plugins in wp-admin, same as bonsai-maintenance.

To ship a new version:

1. Bump the Version: header in bonsai-code-injector.php and add a CHANGELOG.md entry.
2. Commit and push to main.
3. Publish a GitHub Release tagged with the new version (release-assets mode is enabled, so attach a zip of the plugin folder — plain source-archive tags won't be picked up).

Sites check for updates every 6 hours ($checkPeriod argument to buildUpdateChecker()), or immediately if an admin clicks "Check again" on the Plugins screen.