Setting up CookieOfficer on Drupal

In Drupal you can choose between two paths: a module for inserting code, or a theme template. The first doesn't require access to the theme files, and the second gives you full control over the order of scripts. Whichever you choose, remember to clear the cache, because otherwise Drupal will keep serving the page without the CookieOfficer code.

Before you start

Copy the CookieOfficer code from the Installation page in the panel. In the “Deployment method” section, choose “Code on the site”, then in the “Paste the code at the top of <head>” card click “Copy” next to the “CookieOfficer script” block.

You need an account with Drupal administrator permissions. In these instructions the names of the individual places are given in English, as they appear in Drupal, because in many installations Drupal is left untranslated.

Method 1: a module for inserting code in <head>

This is the simplest method, and the only one that doesn't require access to the theme files.

1. Go to Extend and install a module that lets you add your own code to the page header.
2. Enable the module and open its settings.
3. Paste the CookieOfficer code into the field that corresponds to the <head> section, at the very beginning, before any other scripts.
4. Save the configuration.
5. Clear the Drupal cache.

If the module lets you choose the order or weight of the inserted code, set it so that our code comes before the other tracking tools.

Method 2: a theme template

This method requires access to the files and a child theme. Changes to the parent theme will be overwritten when it is updated.

1. Open the page template file in your child theme, that is, html.html.twig.
2. Paste the CookieOfficer code right after the opening <head> tag, before the other scripts and before the place where Drupal inserts its own resources.
3. Save the file.
4. Clear the Drupal cache.

Why do I need to clear the cache?

Drupal caches the pages and templates it generates. Until the cache is cleared, visitors get the version of the page from before the change, without our code, and the setup test will fail.

You can clear the cache in Configuration > Development > Performance, or with the drush cr command if you work from the command line.

How do I check the setup?

Go back to the Installation page in the CookieOfficer panel and click “Verify now”. If it succeeds, you'll see the heading “Script detected and active”.

Then, in the panel, run a scan of your site and go to the Cookies page. There should be no message above the list of detected items about trackers running after the visitor has rejected consent.

Always check the banner on the site as a logged-out visitor, in incognito mode. Drupal serves pages to logged-in administrators while bypassing part of the cache, so the result may differ from what the visitors to your site see.

Common mistakes to avoid

• Don't skip clearing the cache. This is the most common cause of failed setups in Drupal. The code is set up correctly, but the site keeps serving the old version.
• Don't edit the parent theme. When the theme is updated, the changes will disappear along with the banner.
• Don't paste the code after the resources added by Drupal. Anything that runs before our code stays out of reach of automatic blocking.
• Don't manually mark scripts added by modules. They reach the page through Drupal's own mechanisms, so you can't change them in the template. Holding back such a script requires a change on the module or theme side, and a double change at that: type must be set to text/plain, and data-co-cat has to be added next to it. The attribute alone won't hold anything back.