Consentl

Consentl on Ghost

Add Consentl to a Ghost publication with code injection, or in the theme for a loader that is truly first in <head>, and see which Ghost features Consentl does not hold.

Loader first in <head>
Depends on the method
Method First in <head>? Plan
A. Code injection No: near the end of <head> (inside {{ghost_head}}) All plans and self-hosted
B. Theme default.hbs Yes Ghost(Pro) Publisher or higher (custom themes), or self-hosted

Why method A is usually enough. Ghost renders the site header code injection at the end of {{ghost_head}}. Almost every script Ghost outputs before it is deferred (Portal, search, announcement bar, card assets, comment counts, member attribution, Ghost web analytics), so a synchronous Consentl loader still runs before them. Running first does not mean Consentl holds them: these are Ghost's own scripts, and Consentl does not block them (see Limitations). The exceptions are Stripe.js (only when paid memberships are on) and any <script> your theme places above {{ghost_head}}.

Your Consentl site key is on your site's Setup page in the dashboard. Add the publication's hostname in the Domains field; www. and the bare domain count as the same site, so there is no need to add www. separately.

What your Consentl plan covers

  • Free: banner, consent log and manual blocking only.
  • Pro: adds Google Consent Mode v2.
  • Business: adds automatic blocking of known trackers and the blocking rules you add in the dashboard.

On Free and Pro, only tags you mark manually are held back.

A. Code injection

  1. Ghost Admin → Settings → Code injection (in Ghost 5 and 6 under Advanced; click Open).

  2. In Site header, paste the loader as the first line:

    <script src="https://api.consentl.com/v1/loader.js?k=SITE_KEY&l=en"></script>

    If the site also uses the Consentl GTM template, add &gcm=ext to the URL so that only the template sends Consent Mode commands.

  3. Save.

  4. Check whether your theme has <script> tags above {{ghost_head}} in default.hbs. If they load trackers, use method B.

B. Theme (truly first)

  1. Download your theme: Settings → Site → Theme → Change theme → Installed, then download the active theme from its menu.

  2. In default.hbs, paste the loader right after <meta charset="utf-8">:

    <head>
    <meta charset="utf-8">
    <script src="https://api.consentl.com/v1/loader.js?k=SITE_KEY&l={{@site.locale}}"></script>

  3. Zip and upload the theme. Remove the code injection version if you added it.

Extras

  • Cookie settings link: add a navigation item (Settings → Site → Navigation, secondary navigation) with the URL #consentl. Links whose URL ends in #consentl or #consentl-preferences, and any element with the attribute data-consentl-open, open the preferences.

  • Cookie declaration: add an HTML card to your cookie policy page:

    <div data-consentl-declaration data-api="https://api.consentl.com" data-key="SITE_KEY" data-locale="en"></div>
<script src="https://api.consentl.com/v1/blocks.js" defer></script>

    Use data-consentl-request or data-consentl-withdrawal instead for the privacy request form or the EU withdrawal form. The withdrawal form needs the Pro plan or higher and must be switched on in the dashboard; otherwise it stays empty.

  • Per-post or per-tag code injection runs after the site header; nothing is needed there.

Check that it works

Open the publication in a private window: the banner appears. View the source to see where the loader is.

The visitor's region comes from their IP address: Consentl looks up the country in memory on each page view (nothing is stored) and applies your dashboard rule for it. US states are not told apart: US visitors get your rule for the whole US or, without one, your first US-state rule. An unknown country gets your rule for unknown regions (opt-in by default).

Limitations

  • Member attribution stores browsing history before consent. When Ghost's member source tracking is on, member-attribution.min.js keeps the pages a visitor viewed in sessionStorage (ghost-history) from the first page view, so that a later sign-up can be attributed. Consentl does not hold it. Either switch member source tracking off (in Ghost Admin's analytics settings; the setting is labelled along the lines of "Member sources" / "track member sources", check the current label in your Ghost version), or treat it as your own legal decision and describe it in your cookie policy.

  • Ghost web analytics (Tinybird, ghost-stats) is cookieless and loaded by Ghost itself; Consentl's automatic blocking does not cover it. Disable it under Settings → Analytics if your legal assessment requires consent.

  • Stripe.js is needed for paid memberships and is strictly necessary for payments; it is not blocked.

  • Portal (member sign-up and sign-in) is not blocked. We could not confirm from Ghost's documentation which cookies or storage it uses. Check in DevTools → Application (Cookies, Local Storage, Session Storage) on a fresh visit and after signing in, and list what you find in your cookie declaration.

  • Hard-coded tags. A <script src>, <img> pixel or <iframe> written in code injection, the theme or an HTML card is fetched by the browser before any script can stop it, even when Consentl prevents it from running. Mark such tags manually and remove <noscript> pixels:

    <script type="text/plain" data-consentl="marketing" src="https://ads.example.com/tag.js"></script>
<iframe data-consentl="marketing" data-src="https://www.youtube-nocookie.com/embed/ID" title="Video"></iframe>
<img data-consentl="marketing" data-src="https://tracker.example.com/pixel.gif" alt="" width="1" height="1">

    Tags loaded by code (GTM, a pixel's JavaScript loader) are held without a request when automatic blocking is on (Business plan and higher).

  • Ghost(Pro) Starter cannot upload custom themes, so only method A is available.

Stuck? Write to [email protected] — we answer in English on business days.