How to add custom code to your ecommerce website
Where scripts go, which ones quietly ruin your page speed, and the two things you should never paste into a live store.
Most third-party tools give you a script tag for the head of your site, and a good store builder gives you somewhere to put it. The things to get right are: load scripts asynchronously so they do not block your page, keep the list short because each one costs speed, and never paste anything containing a secret key.
TL;DR
- • Head is the right place for analytics and verification tags.
- • Every script costs page speed, which costs conversions and rankings.
- • Use async or defer. A blocking script delays your whole page.
- • Never paste anything with a secret key in it — head code is public.
- • Verify with the tool's own real-time view, not by assuming.
Where code goes, and why head
Analytics and verification tags belong in the head, because they need to run before the page finishes rendering to record the visit correctly. Most tools will tell you this in their own setup instructions, and following them is the right instinct.
On a store builder you paste it once into a settings field and it appears on every page of your site. You do not get to place it per page — which is a limitation you will not notice, because these tags are meant to be site-wide anyway.
The speed cost, stated honestly
Every third-party script you add is another request, another file to download and another chunk of JavaScript to execute — on a phone, on mobile data, before your product images appear.
This is not a theoretical concern. Page speed affects both conversion rate and search ranking, and the usual pattern is that a store adds five tools over six months and nobody notices the site is now slow because it happened gradually.
- • Use `async` or `defer` so a script cannot block your page from rendering. Most vendors already include it — check.
- • Audit twice a year. Remove the analytics tool you stopped opening and the chat widget you never answer.
- • Be suspicious of anything heavy. A tool that adds hundreds of kilobytes should be earning its place.
- • Measure with PageSpeed Insights before and after adding anything substantial.
Two things never to paste
Anything containing a secret key. Head code is served to every visitor and readable by right-clicking View Source. A server-side API key pasted here is a published API key. If a snippet contains a value labelled secret, private or server, it does not go here — it goes in a proper integration that keeps it server-side.
Code from a forum post you do not understand. A script tag on your site can read your pages, rewrite your checkout and see what your customers type. Paste from the vendor's own dashboard, not from a copy someone pasted into a comment thread.
Publishable keys are fine. Google Analytics measurement IDs, Meta pixel IDs and Stripe publishable keys are designed to be public and appear in page source by design. The distinction is not 'does it look like a key' but 'is it the secret half of a pair'.
Verify it actually works
Do not assume. Every serious tool has a real-time view — Google Analytics has Realtime, Clarity shows sessions within minutes, Meta has Test Events.
Open your live store in a private window, click around, and watch yourself appear. If nothing shows up after a few minutes, the usual causes are that you pasted into the wrong field, you did not publish after saving, or an ad blocker in your own browser is stopping the tag from firing on your own visit.
When to use an integration instead
If the tool has a proper integration on your platform, use that rather than pasting a tag. The difference is real for anything that needs to be trustworthy.
The clearest case is Meta Pixel and the Conversions API: a pasted pixel fires in the browser only, so ad blockers and iOS limits eat a share of your conversions. A real integration also reports from the server after payment clears, deduplicated, which is a materially better number to optimise your ad spend against.
If you do not have the website yet
Everything above assumes you already have a store to put custom code on.
A SitesPlaced store is free to build and publish, with 0% commission on every sale, on every plan, and 21 integrations included rather than sold as add-ons.
Custom head code is on the ₹499/month Ecommerce plan. The 21 built-in integrations — payments, shipping, print-on-demand, WhatsApp, Meta — are the things worth doing properly rather than pasting.
Frequently asked questions
Where should tracking code go on my website?
In the head, because analytics and verification tags need to run before the page finishes rendering. Most vendors say so in their own instructions.
Does adding scripts slow my store down?
Yes, every one of them. Each is a request, a download and JavaScript to execute on a phone before your images appear. Use async or defer, keep the list short, and audit it twice a year.
What should I never paste into head code?
Anything containing a secret key — head code is public and readable in View Source. And anything from a forum post you do not understand, because a script on your site can read your pages and see what customers type.
Are pixel IDs and measurement IDs safe to paste?
Yes. Google Analytics measurement IDs, Meta pixel IDs and Stripe publishable keys are designed to be public. The distinction is whether it is the secret half of a pair, not whether it looks like a key.
Should I paste my Meta Pixel or use the integration?
Use the integration. A pasted pixel is browser-only, so ad blockers and iOS limits cost you conversions. The integration also sends Purchase from the server after payment clears, deduplicated by order ID.
Run whatever tools you want
Build the store free, then add custom head code on the ₹499/month Ecommerce plan. 0% commission on sales, always.
