Squarespace's help page says that code entered in its header injection field is placed in the head element "on every page in your site."1 Ghost's help page says that scripts added to the Site Header "will appear on every single page of your site."2 Webflow's page says that code in the Head code section "applies to your entire site."3 Each vendor answers in one sentence the question a publisher asks first: where a script goes so that it runs everywhere. WordPress answers the same question in two places, because a WordPress theme can be built from blocks or from code.
Each hosted platform limits the site-wide field by plan, not by skill
On Squarespace the field is the header box of the Code Injection panel.1 The same page says code injection "is available in the Core, Plus, Advanced, and some legacy billing plans."1 Ghost keeps its version under Settings, then Advanced, then Code Injection, with a Site Header box for the head and a Site Footer box for the end of the body.2 Webflow keeps its version on the Custom code tab of Site settings, with Head code and Footer code sections of up to 50,000 characters each.3 Webflow's page adds that custom code requires a Core, Growth, Agency, or Freelancer Workspace, or a site with an active Site plan.3
The obstacle on a hosted platform, where one exists, is the billing plan rather than the code. A publisher on a plan that includes the field can paste a script element without opening a template. A publisher on a plan that excludes it cannot.
WordPress documents two places, and the account's role decides whether the first one works
WordPress's own documentation describes the Site Editor as the tool for designing "the entire site including the header, footer, and everything in between, with blocks."4 The same page says the Site Editor is available only when a block theme is active, and defines a template part as a block "for managing the repeating global areas of the site."4 A Custom HTML block placed in the footer template part appears wherever that part is used. The block itself is added from the block inserter, or by typing /html in a new paragraph block.5
The Custom HTML page carries a detail that decides whether the pasted script is kept. Starting in WordPress 7.0, the block has separate panels for HTML, CSS, and JavaScript, and the CSS and JavaScript panels "are only available to users with the unfiltered_html capability."5 For a user without it (the page's example is a Contributor), WordPress sanitizes the block with wp_kses and strips disallowed tags, the script tag among them.5 The role of the account doing the pasting is therefore part of the setup.
A theme's own code is the remaining place. The Theme Handbook says themes and plugins should load scripts "using the standard WordPress method": an enqueue function called on the wp_enqueue_scripts action.6 The same page shows a 'strategy' => 'defer' key in the function's arguments, which loads the script deferred, with an 'async' option beside it.6 An AdBubbles plugin for WordPress is planned; until it exists, these two places are the ones WordPress documents.
How the script loads matters more than which field holds it
The HTML standard describes three behaviors for a classic script element. A script with neither the defer nor the async attribute is, in the standard's words, "fetched and evaluated immediately, blocking parsing until these are both complete."7 With defer, the script "will be fetched in parallel and evaluated when the page has finished parsing."7 An async script is fetched in parallel and "evaluated as soon as it is available (potentially before parsing completes)."7 The field decides where the browser reaches the element; the attribute decides what the browser does there.
The embed, adbubbles.js, is one static file, written in plain JavaScript with no dependencies, served through Cloudflare's cache, and it loads after the page's DOM is ready. Opening a publisher account costs nothing, and so does the embed. A publisher who has added a site can request a crawl that shows which of its words are currently sellable before pasting anything. The installation page gives the exact script element to paste.
The scope is the decision that takes thought
With the script on every page, one decision remains that no vendor's help page can make. The scope is the part of a page the embed is allowed to scan, for example the article element or the entry-content container. Even within the scope, the embed leaves headings, links, code, preformatted text, form controls, navigation, header, and footer untouched, along with anything the publisher marks data-noads. It underlines the first occurrence of each bought word. One bubble per word is the limit, and two never share a paragraph.
Suppose a WordPress theme wraps each post in a container with the class entry-content and shows a short author biography in a sidebar. A scope of entry-content means the biography is never scanned, although it is on the page and may contain bought words. A scope of the whole main element means the biography is scanned too, and a bubble may open there rather than in the article. Neither choice is wrong, but they sell different words.
Beside the scope, the account holds the maximum bubbles per page, the advertiser categories to exclude, and the site's verification. Verification takes one of three forms: a DNS TXT record, a meta tag, or an uploaded file. Ghost's page lists meta tags among the things its Site Header field is for, so the field that holds the script also holds the tag.2 A publisher who controls DNS can add the record instead.
The bubble's link is labeled for search engines, and the reader is not tracked
Every link inside a bubble carries rel="sponsored noopener". Google Search Central says to mark "links that are advertisements or paid placements" with the sponsored value, and allows several rel values in one space-separated list.8 The publisher adds nothing, because the embed renders the link with the attribute in place. The bubble is rendered inside a Shadow DOM, so the site's CSS and the bubble's CSS cannot affect each other.
What leaves the page is three beacons: one view per page load, one open when a bubble has stayed visible for one second, and one click when a link is followed. AdBubbles sets no cookie, stores no identifier, and collects no personal data from readers. The matching is between words on the page and an advertiser who bought them. We do not choose which readers see a bubble, do not follow a reader between pages or sites, and do not promise a result.
The practical point for a site with several templates is the difference between a site-wide field and a page-level one. Squarespace, Ghost, and Webflow each name one field that reaches every page, and Webflow also offers a field whose code "will only apply to that page."3 Earnings are shared among the sites a campaign ran on in proportion to bubble opens, and a bubble can open only where the embed ran. A script pasted into a page-level field can produce opens on that one page, and the site-wide field is the one that puts the embed on every page.