How to Add Code to a WordPress Page or Site

Match the code to the place:

Never paste PHP into a page or a Custom HTML block. It is stored as text, displayed to visitors, and does nothing useful.

HTML inside a page

Add a Custom HTML block and paste the markup. Use the Preview tab in the block to check it renders before publishing.

If the markup comes back changed or stripped after saving:

• Scripts are removed for good reason — put them in the header or footer instead, as below.
• Users below administrator cannot publish unfiltered HTML. That is a security feature; an editor pasting an iframe will see it disappear.
• A security plugin may filter markup more aggressively than core.

For a simple embed — video, map, form — try pasting the plain URL into a paragraph first. WordPress auto-embeds many providers and produces cleaner, responsive markup than a hand-pasted iframe.

Scripts in the header or footer

Analytics tags, site verification meta tags and chat widgets belong in the document head or before the closing body tag, site-wide.

With a plugin. A header-and-footer scripts plugin is the right tool. It survives theme changes and gives non-developers a safe place to work.

In code, in a site-specific plugin:

<?php
// Head, on the front end only.
add_action('wp_head', function () {
    if (is_admin()) {
        return;
    }
    ?>
    <meta name="example-verification" content="abc123">
    <?php
});

// Just before </body>.
add_action('wp_footer', function () {
    ?>
    <script>/* your script */</script>
    <?php
}, 100);

For scripts that belong to one page only, wrap them in a conditional — is_page('contact') — rather than loading them everywhere. Site-wide third-party scripts are one of the most common causes of a slow site, per how to speed up a WordPress site.

PHP that changes how the site behaves

Three options, in increasing order of safety:

1. functions.php in a child theme. Works, but the code belongs to the theme: switch themes and the functionality vanishes. Acceptable for genuinely theme-related code, wrong for anything else.

2. A snippets plugin. Gives each snippet a name, an on/off switch and, in most cases, an error guard that deactivates a snippet that would fatal the site. Good for people who do not want to manage files.

3. A site-specific plugin. The cleanest option. Create wp-content/plugins/my-site/my-site.php:

<?php
/**
 * Plugin Name: My Site Customisations
 * Description: Site-specific snippets kept out of the theme.
 * Version: 1.0.0
 */

defined('ABSPATH') || exit;

add_filter('excerpt_length', fn () => 30);

add_action('init', function () {
    // Your code.
});

Activate it under Plugins. It survives theme changes, can be version controlled, and can be deactivated from the admin when something goes wrong.

Must-use plugins, for code that must always run

A file in wp-content/mu-plugins/ loads automatically and cannot be deactivated from the admin. Useful for infrastructure code — a mail configuration, an environment guard — and dangerous for experiments, because the only off switch is deleting the file.

Before you paste anything

1. Take a backup, per how to back up a WordPress site.
2. Test on staging if the site matters.
3. Read the snippet. Code from a random forum post runs with full site privileges.
4. Know how you will remove it without the admin — SFTP access, ready.
5. Add one snippet at a time, and check the site between each.

When code breaks the site

A PHP fatal error produces a white screen or a 500. Recovery:

• Snippets plugin: rename its folder over SFTP to disable everything it holds.
• Site-specific plugin: rename that plugin's folder.
• functions.php: restore the file, or delete the lines you added.
• Must-use plugin: delete the file.

The general technique is in disabling plugins without admin access, and the diagnosis path is in how to fix the WordPress white screen. Turn on debug mode first — the fatal error names the exact file and line, which usually ends the investigation immediately.

Keeping code manageable

• One snippet, one purpose, with a comment explaining why it exists.
• Prefix your functions so they never collide with a plugin's.
• Remove snippets that solved a problem you no longer have.
• Keep CSS in the CSS place — see how to add custom CSS to WordPress — rather than injecting it through PHP.