Custom CSS and JavaScript snippets

Pro package only. Custom CSS & JavaScript is not part of the free plugin or the WordPress.org version. It is in the Baza Helper group Developer.

The Custom CSS & JavaScript tab (Baza Helper > Custom CSS & JavaScript) keeps small pieces of code out of your theme, so a theme update does not lose them.

Add a snippet

1. Press Add snippet.
2. Give it a Name and switch Enable snippet on. A new snippet is switched off until you do.
3. Choose the Code type: CSS or JavaScript. For JavaScript also choose the Location, Head or Footer.
4. Paste the code without script or style tags, with no HTML or PHP tags.
5. Press Save changes in the bar (or Ctrl+S, Cmd+S on a Mac). With nothing changed it says No changes to save. Edits are not saved by themselves.

Options

• Run after DOM is ready wraps the JavaScript so it starts when the page is parsed.
• Load WordPress jQuery adds jQuery as a dependency.
• Audience: Everyone, Guests or Logged-in users.
• Priority (lower runs first) sets the order between snippets.
• Notes are for you and are never printed on the site.

The editor is the WordPress code editor, with highlighting and line numbers. If you turned syntax highlighting off in your profile, a plain text box remains. CSS goes into the head. JavaScript goes into the head or the footer.

Display rules

Open Display on to choose where a snippet loads: Entire website, Front page, Posts and pages, or Selected page/post IDs with an include list or an exclude list. A selected-page snippet needs at least one ID.

Limits and safety

• At most 50 snippets, 64 KB per snippet and 512 KB in total.
• Saving needs the manage_options and unfiltered_html permissions. Code is never executed in the editor.
• If a snippet was changed in another session, you are asked to reload before saving.
• Enabled JavaScript runs with access to the public page, so use trusted code only. Snippets are not a replacement for consent-aware analytics, use Analytics & verification for that.
• Deleting a snippet takes effect after you save.

To recover from broken code, set BAZA_HELPER_DISABLE_CUSTOM_CODE to true in wp-config.php. The editor stays available. The action baza_helper_code_snippets_saved runs after a save.

What the editor refuses

The editor refuses code that hides itself (obfuscated code, or code built from text with eval or Function), code that pulls in other scripts, frames or files, crypto miners, redirects to another site, and code that reads cookies, storage, keys or passwords and sends data out. In CSS it refuses @import, expression() and javascript: addresses. A refused snippet is not saved, and the message names what was found.

Saved snippets are signed. If something changes them in the database without this editor, none of them runs and the tab shows a red note until an administrator saves again. There is no PHP, and nothing runs in the admin. Page caches are cleared on save. An outside CDN may need its own purge. Keep tracking in the Analytics tool, which respects consent.

On multisite, WordPress restricts unfiltered HTML, so only users who have both manage_options and unfiltered_html can read or change snippets.