{
    "title": "Header Footer Code Manager",
    "seo_title": "Header Footer Code Manager: review, settings, limits",
    "h1": "Header Footer Code Manager",
    "description": "Header Footer Code Manager free or Pro: strengths, limitations, pricing, recommended settings and patched vulnerabilities, to add your scripts cleanly.",
    "lead": "Header Footer Code Manager adds your tracking codes, pixels and third-party scripts to the header, footer or content, page by page. Our take on the free and Pro versions, the settings that prevent bad surprises and the vulnerabilities already patched.",
    "language": "en",
    "locale": "en-US",
    "type": "plugin-sheet",
    "url": "https://www.wp-masquerade.com/features/camouflaged-plugins/header-footer-code-manager/",
    "canonical": "https://www.wp-masquerade.com/features/camouflaged-plugins/header-footer-code-manager/",
    "markdown": "https://www.wp-masquerade.com/features/camouflaged-plugins/header-footer-code-manager/index.md",
    "json": "https://www.wp-masquerade.com/features/camouflaged-plugins/header-footer-code-manager/index.json",
    "published": "2026-11-04T08:00:00+00:00",
    "modified": "2026-11-05T21:11:35+00:00",
    "site": {
        "name": "WP Masquerade",
        "url": "https://www.wp-masquerade.com/"
    },
    "translations": [
        {
            "language": "en",
            "hreflang": "en-US",
            "title": "Header Footer Code Manager",
            "url": "https://www.wp-masquerade.com/features/camouflaged-plugins/header-footer-code-manager/",
            "markdown": "https://www.wp-masquerade.com/features/camouflaged-plugins/header-footer-code-manager/index.md",
            "json": "https://www.wp-masquerade.com/features/camouflaged-plugins/header-footer-code-manager/index.json"
        },
        {
            "language": "fr",
            "hreflang": "fr-FR",
            "title": "Header Footer Code Manager",
            "url": "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/header-footer-code-manager/",
            "markdown": "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/header-footer-code-manager/index.md",
            "json": "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/header-footer-code-manager/index.json"
        },
        {
            "language": "es",
            "hreflang": "es-ES",
            "title": "Header Footer Code Manager",
            "url": "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/header-footer-code-manager/",
            "markdown": "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/header-footer-code-manager/index.md",
            "json": "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/header-footer-code-manager/index.json"
        },
        {
            "language": "de",
            "hreflang": "de-DE",
            "title": "Header Footer Code Manager",
            "url": "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/header-footer-code-manager/",
            "markdown": "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/header-footer-code-manager/index.md",
            "json": "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/header-footer-code-manager/index.json"
        },
        {
            "language": "it",
            "hreflang": "it-IT",
            "title": "Header Footer Code Manager",
            "url": "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/header-footer-code-manager/",
            "markdown": "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/header-footer-code-manager/index.md",
            "json": "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/header-footer-code-manager/index.json"
        },
        {
            "language": "pt",
            "hreflang": "pt-BR",
            "title": "Header Footer Code Manager",
            "url": "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/header-footer-code-manager/",
            "markdown": "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/header-footer-code-manager/index.md",
            "json": "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/header-footer-code-manager/index.json"
        },
        {
            "language": "nl",
            "hreflang": "nl-NL",
            "title": "Header Footer Code Manager",
            "url": "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/header-footer-code-manager/",
            "markdown": "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/header-footer-code-manager/index.md",
            "json": "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/header-footer-code-manager/index.json"
        }
    ],
    "headings": [
        {
            "level": 1,
            "text": "Header Footer Code Manager"
        },
        {
            "level": 2,
            "text": "What Header Footer Code Manager does on your site"
        },
        {
            "level": 2,
            "text": "Which sites Header Footer Code Manager suits"
        },
        {
            "level": 2,
            "text": "Header Footer Code Manager strengths and limitations"
        },
        {
            "level": 3,
            "text": "Strengths"
        },
        {
            "level": 3,
            "text": "Limitations"
        },
        {
            "level": 2,
            "text": "The Header Footer Code Manager settings we recommend"
        },
        {
            "level": 2,
            "text": "Header Footer Code Manager’s patched vulnerabilities"
        },
        {
            "level": 2,
            "text": "Header Footer Code Manager FAQ",
            "id": "faq"
        }
    ],
    "body": "## The essentials\n\n- Best for adding tracking codes and pixels page by page without touching the theme.\n- Main caveat: PHP snippets and the after-opening-body location require Pro.\n- Free; Pro costs $35 a year for one site, $69 for five and $139 for unlimited sites.\n\n## What Header Footer Code Manager does on your site\n\nHeader Footer Code Manager, usually shortened to HFCM, is where you paste the code that third-party services ask for: a Google Analytics or Google Tag Manager tag, a Meta pixel, a Pinterest verification code, a chat widget, a heatmap. Each piece of code becomes a named “snippet” of type HTML, CSS or Javascript, stored in its own database table rather than in your theme. One list shows what loads, where, and who last changed it.\n\nFor every snippet you pick the location (header, footer, before or after the content), the pages it runs on (site wide, specific posts, pages, categories, tags or post types, the home page, search, archives, latest posts, or a `[hfcm id=\"…\"]` shortcode you place by hand), the pages to exclude and the device: desktop, mobile or both. The HFCM admin menu holds the snippet list, the add screen and a Tools screen for import and export.\n\nThe plugin is published by DraftPress; the 99 Robots name, used in its official description, still shows up in the code it outputs. The free version handles HTML, CSS and Javascript only. HFCM Pro, sold as a yearly subscription, adds PHP snippets with code validation, a location right after the opening `body` tag, display rules for logged-in or logged-out visitors, snippet priority, grouping and duplication.\n\n![Diagram: Header Footer Code Manager works on visitors and bots, wordpress, database and files. Public traces: signed HTML comments (hidden with Pro).](https://www.wp-masquerade.com/media/wpm-sheets/hfcm/diagram-en.svg?v=8e1926cb)\n\n## Which sites Header Footer Code Manager suits\n\nHFCM is built for adding analytics and marketing scripts without touching the theme:\n\n- **Business sites and blogs with a handful of tracking codes**: analytics, domain verification, an ad pixel, each in its own named snippet you can switch off in one click.\n- **Campaigns with a conversion pixel**: page targeting loads the pixel only on the thank-you page, and page exclusions keep a site-wide script away from pages where it gets in the way.\n- **Small teams and contractors**: each snippet records who changed it last and when, which helps when several people run the site.\n\nIt is the wrong tool if you want to add PHP for free: the free version does not run any, while [WPCode](https://www.wp-masquerade.com/features/camouflaged-plugins/wpcode/) and Code Snippets do in their free versions. It is not the best fit for a full Google Tag Manager setup either, since the `noscript` part belongs right after the opening `body` tag, a Pro-only location.\n\n## Header Footer Code Manager strengths and limitations\n\n### Strengths\n\n- **Precise targeting, even for free.** Pages, posts, categories, tags, post types, exclusions and device are set per snippet.\n- **Independent of the theme.** Snippets live in the database and survive a theme switch.\n- **Accountability.** Each snippet keeps the user who created it, the user who last edited it, and the date.\n- **A minimal interface.** One list, one form, one import and export screen: there is almost nothing to learn.\n\n### Limitations\n\n- **No PHP in the free version.** PHP snippets and their validation are Pro features, while WPCode and Code Snippets include them for free.\n- **No location after the opening body tag.** That insertion point, which some services require, is Pro-only.\n- **Snippet names are public.** Each snippet is wrapped in an “HFCM by 99 Robots” HTML comment that includes its number and name.\n- **Import and export are meant for the same site.** The developer warns that moving snippets to another site can behave inconsistently when they target pages, posts, categories or tags.\n- **Uninstalling wipes everything.** Deleting the plugin drops its table, and with it every snippet.\n\n## The Header Footer Code Manager settings we recommend\n\nHFCM has almost no global settings: most decisions happen in each snippet’s form, under HFCM > Add New.\n\n| Setting | Recommended value | Why |\n| --- | --- | --- |\n| **Snippet Name**  HFCM > Add New | The service and its purpose (“Meta pixel, thank-you page”), nothing internal | The name appears in the page source of every page where the snippet loads. |\n| **Site Display**  Same form | “Site Wide” for analytics, “Specific Pages” for a conversion pixel | A script that loads only where it is needed weighs less on other pages and collects less data. |\n| **Location**  Same form | “Header” if the service requires it, otherwise “Footer” | Verification tags and tag managers want the head; a chat widget loads fine at the bottom of the page. |\n| **Device Display**  Same form | “Show on All Devices” unless you really need otherwise | Filtering happens on the server based on the browser; with a page cache that does not separate mobile and desktop, the cached version can be served to everyone. |\n| **Status**  Same form | “Inactive” while you prepare it, then “Active” | You save the code without outputting it, then switch it on once the targeted pages are checked. |\n| **Export Snippets**  HFCM > Tools | Export all snippets before uninstalling or a major change | Uninstalling drops the snippet table: the export file is your only copy outside backups. |\n| **Enforce DISALLOW_UNFILTERED_HTML**  HFCM > Settings (shown only when the constant is defined) | On, for a site whose snippets no longer change | Nobody can save or update a snippet anymore; uncheck it for the time of an edit. |\n\n- View the source of a targeted page: the `HFCM by 99 Robots - Snippet #` comment should sit right before your code, and should not appear on an excluded page.\n- Clear the page cache after every addition or edit, then confirm in the service’s own tool (Google Analytics, Meta Events Manager) that the tag reports in.\n- Delete snippets for services you no longer use: an old third-party script keeps collecting data.\n\n## Header Footer Code Manager’s patched vulnerabilities\n\nAnyone who can save a snippet can inject Javascript across the whole site, so HFCM restricts its screens to administrators (the `manage_options` capability). Every published vulnerability affects the admin area, and all were fixed years ago:\n\n- **CVE-2021-24791, fixed in 1.1.14**: SQL injection through the sorting parameters of the snippet list, exploitable with an administrator account.\n- **CVE-2022-0710, fixed in 1.1.17**: reflected XSS through the `page` parameter, triggered when a logged-in administrator opens a crafted link (CVSS 6.1).\n- **CVE-2022-0899, fixed in 1.1.24**: another reflected XSS, caused by unescaped URLs on an admin page.\n- **CVE-2023-39989, fixed in 1.1.35**: a [CSRF](https://www.wp-masquerade.com/glossary/csrf/) flaw that let an attacker activate, deactivate or delete snippets by getting an administrator to click a link (CVSS 5.4).\n\nThe real risk is a stolen administrator account: keep the number of admins low (see our article on WordPress roles and capabilities) and keep the plugin updated, with automatic plugin updates if that suits your site. If your [wp-config.php](https://www.wp-masquerade.com/wp-config-security-settings/) defines `DISALLOW_UNFILTERED_HTML`, version 1.1.45 lets you apply that ban to snippets too. The “HFCM by 99 Robots” comments flag the plugin on every page (see [HTML comments and the generator tag](https://www.wp-masquerade.com/html-comments-generator-tag-wordpress/)); WP Masquerade Pro strips them from the public code, which makes the plugin harder for bots to spot without replacing updates.\n\n## Header Footer Code Manager FAQ\n\n**Why does my script show up as text on the site?**\n\nThe code was pasted without its `<script>` and `</script>` tags: add them in the snippet and save.\n\n**Can Header Footer Code Manager run PHP?**\n\nNot in the free version, which is limited to HTML, CSS and Javascript. PHP snippets, with validation designed to prevent site crashes, are part of HFCM Pro.\n\n**How much does HFCM Pro cost?**\n\nThe official page lists $35 per year for one site, $69 for five sites and $139 for unlimited sites. Updates and support are included while the subscription is active.\n\n**What happens to my snippets if I delete the plugin?**\n\nThey are erased: uninstalling drops the table that holds them. Export them first from HFCM > Tools and keep the file.\n\n**Should I network-activate it on a multisite?**\n\nNo: the developer asks you to activate it on each subsite only, never across the whole network.\n\n## Key facts\n\n- Category: Utilities\n- Vendor: DraftPress\n- Price: Free; HFCM Pro from $35 per year for one site\n- Active installations (wordpress.org): 600 000+\n- Version: 1.1.46\n- Official page: https://wordpress.org/plugins/header-footer-code-manager/\n\n## What WP Masquerade hides\n\n- Handled by WP Masquerade Pro only\n- With Pro: signed HTML comments",
    "catalog": "hfcm",
    "essentials": [
        "Best for adding tracking codes and pixels page by page without touching the theme.",
        "Main caveat: PHP snippets and the after-opening-body location require Pro.",
        "Free; Pro costs $35 a year for one site, $69 for five and $139 for unlimited sites."
    ],
    "format": "application/json"
}