WordPress

This page adds Double Agent to a WordPress site, including WooCommerce stores. You either add a few lines to your child theme or paste the snippet into a header-code plugin.

Add the snippet

The easy way: install a header and footer code plugin such as WPCode (listed as "WPCode – Insert Headers and Footers"). Go to Code Snippets › Header & Footer, paste these two lines into the Header box and choose Save Changes:

<script>window.doubleagent=window.doubleagent||{q:[],push(){this.q.push(arguments)}};</script>
<script async src="https://cdn.doubleagent.so/v1/doubleagent.js" data-profile="auto"></script>

Or, if you edit code, add this to your child theme's functions.php (or a code-snippets plugin). It prints the snippet early in <head> on every page:

add_action('wp_head', function () { ?>
<script>window.doubleagent=window.doubleagent||{q:[],push(){this.q.push(arguments)}};</script>
<script async src="https://cdn.doubleagent.so/v1/doubleagent.js" data-profile="auto"></script>
<?php }, 1);

Use a child theme, not the main theme, or a theme update will remove it.

On WordPress.com, adding header code with the WPCode plugin needs a paid plan (Personal or higher). The free plan can't take the snippet.

For a WooCommerce store, change data-profile="auto" to data-profile="ecommerce".

If you use a caching plugin, clear the cache so visitors get the new page.

Check it worked

Run:

npx @doubleagent-so/cli verify https://your-site.example

It should end with Installed correctly. You can also open the browser console on your site and run await doubleagent.ready() to see a verdict.

Threats on WordPress

Scanners try paths like /.env or /phpmyadmin/ on every site, and the portal shows them under Threats. On a WordPress site, WordPress's own paths (/wp-admin, /wp-login.php, /xmlrpc.php, /wp-content/…) are normal, so they never count as probing. See Intent.

Next: claim your domain to see your visitors, and ecommerce for WooCommerce.