Install on WordPress | TrueStat

There is no TrueStat WordPress plugin. You add the tag to your theme's header, and the important part is doing it in a way that survives a theme update.

The safe way: a child theme

Editing header.php in your active theme works, and then a theme update overwrites it. Analytics that runs for three months and then silently stops is worse than analytics that never started, because you will not notice.

If your theme is one you installed (rather than one you wrote), use a child theme.

If you already have a child theme

Appearance → Theme File Editor, with your child theme selected.
If the child theme has no header.php, copy the parent's into it.
Paste the tag immediately before </head>.
Update File.

If you do not

Creating a child theme is a few files and is documented thoroughly in the WordPress handbook. The shorter alternatives:

A head-injection plugin. Any plugin whose job is inserting code into <head> — there are several well-maintained ones — takes the snippet and survives theme updates, because the code lives in the plugin's settings rather than in a theme file.

functions.php in a child theme, hooking wp_head:

add_action('wp_head', function () {
    ?>
    <script
      defer
      data-website-id="ts_a1b2c3d4e5f6"
      data-domain="example.com"
      src="https://truestat.io/js/t.js"
    ></script>
    <?php
});

The tag

<script
  defer
  data-website-id="ts_a1b2c3d4e5f6"
  data-domain="example.com"
  src="https://truestat.io/js/t.js"
></script>

Copy it from your site's install page in the app, where the site key is already substituted.

screenshot coming

The install page with the "WordPress" platform tab selected, snippet with real site key. Light theme.

screenshot coming

The WordPress Theme File Editor with header.php open, the TrueStat snippet pasted directly above the closing <head> tag, highlighted. WordPress admin default (light) theme.

Excluding your own admin traffic

Your own visits to /wp-admin are not visitor traffic. Add a path exclusion in the site's settings:

/wp-admin/*
/wp-login.php

Note the wildcard rule: /wp-admin/* excludes everything under /wp-admin/, but not /wp-admin itself. If you want both, list both.

Excluded page views are not stored and do not count toward your monthly event limit. See Excluding your own visits.

Things specific to WordPress

Caching plugins. WP Rocket, W3 Total Cache and friends serve a cached copy of your HTML. That is fine — the tag is in the HTML, so the cached copy has it too. But after you add the tag you must purge the cache, or visitors keep getting the old page with no tag in it and the install page never flips to Connected.

Script-combining and minification. Some optimisation plugins concatenate external scripts into one bundle. That breaks the tag, because the script reads its own configuration from its data- attributes and a bundled copy has none. If your optimiser has an "exclude from combine/minify" list, add t.js to it.

Security plugins that set a CSP. Wordfence, Sucuri and WP Cerber can each add a Content-Security-Policy header. If one is active, you need both:

script-src 'self' https://truestat.io; connect-src 'self' https://truestat.io;

The connect-src half is what people miss. Without it the script loads without error and every event is blocked. See Content Security Policy.

Verify

Load your site in a logged-out browser (a private window is easiest — a logged-in admin view may hit your own exclusions), then check the install page. It flips to Connected within seconds.