Build for Dunea
Site scripts and consent
Add a script to the owner's published site, and how visitor consent decides when it loads.
siteScripts adds up to three <script> tags to the owner's published site. Use it for a chat widget, a review badge, a conversion pixel or anything else that has to run in the visitor's browser.
{
"permissions": ["site:scripts"],
"siteScripts": [
{ "src": "https://cdn.example.com/widget.js", "consent": "marketing", "placement": "body" }
]
}| Field | Values | Meaning |
|---|---|---|
src | https:// URL | Where the script is loaded from. You host it. |
consent | necessary, analytics, marketing | The consent category a visitor has to accept before the script loads. |
placement | head, body (default) | Where the tag goes in the page. |
Site scripts need the site:scripts permission. The owner sees it at install as "Add scripts to the published site (shown to visitors only after consent)".
Consent
A script loads only once the visitor has consented to its category. Pick the category that honestly describes what the script does:
| Category | Use for |
|---|---|
necessary | Scripts the site cannot work without for the feature the owner installed, such as a booking or checkout widget. Not for tracking. |
analytics | Measuring visits and behaviour: page views, heatmaps, session recording. |
marketing | Advertising and retargeting: pixels, conversion tags, audience building. |
If a visitor declines a category, scripts in it do not load. Your script must cope with not being there. For example, do not make the site's own buttons depend on it.
Reviewers check what each script does against its consent category. A tracking script marked necessary will not pass review.
Review
Every site script gets a manual review in addition to the usual checks, because it runs on the owner's site in front of their visitors. To get through review quickly:
- Serve the script from a stable
https://URL on a domain you control. - Keep it small, and load anything heavy lazily.
- Do not load further third-party scripts the manifest does not mention, without saying so in your listing description and to the reviewer.
- Do not read form fields, cookies or storage that belong to the site.
- Do not change the site's layout or content beyond the widget the owner installed.
Because the script at src can change after review, changes to what it does should go through a new version with a changelog, not a silent update. A new version that changes a script's URL or consent category always goes to a person, never the fast track. See Publishing, review and guidelines.
When scripts stop loading
The published site checks with Dunea which plugin scripts are still allowed before it loads any. When the owner uninstalls your plugin, or Dunea suspends the listing, its scripts stop loading within about a minute, without the owner republishing. If the check can't reach Dunea, no plugin scripts load on that page view.