What Is Squarespace Code Injection, and Which Plan Has It?
Squarespace Code Injection is a feature for adding custom HTML or scripts to specific parts of a site - the site-wide header and footer, individual pages, blog posts, the password lock screen, and the order confirmation or order status pages - and it's available on the Core, Plus, Advanced, and some legacy plans, not Basic. It's not a general-purpose code editor: checkout pages don't support it, and Squarespace's support team won't troubleshoot anything that breaks because of it. Here's where each field actually injects code, sourced from Squarespace's own help center (checked September 2026).
Where can I add code with Code Injection?
Code Injection isn't one text box - it's a panel with several separate fields, and each one injects into a different part of the site. Per Squarespace's own help article (Squarespace, "Customize parts of your site with code injection", checked September 2026):
| Field | Where the code lands |
|---|---|
| Header | "injected into the <head> tag on every page in your site" |
| Footer | "injected before the closing </body> tag on every page in your site" |
| Page Header Code Injection | the <head> tag of that one specific page only |
| Post Blog Item Code Injection | added to every blog post |
| Lock page | "displays above the lock screen's password field" of a password-protected site or page |
| Order confirmation page | runs after checkout for gift cards, memberships, and subscriptions |
| Order status page | runs after checkout for physical products, download products, and service products |
That last split matters if you're running analytics or a tracking pixel on purchase confirmation: which field fires depends on what the customer bought, not on a single "thank you page" every store has. Squarespace also provides six merge tags for the order pages - {orderId}, {orderSubtotal}, {orderSubtotalCents}, {orderGrandTotal}, {orderGrandTotalCents}, and {customerEmailAddress} - so a tracking script can reference the actual order without you hand-editing it per sale.
Which Squarespace plan includes Code Injection?
Squarespace states plainly: "Code injection is available in the Core, Plus, Advanced, and some legacy billing plans" (same source, checked September 2026). Basic isn't on that list. If you're comparing what each current plan unlocks beyond this one feature, our Squarespace pricing guide covers the full Basic-through-Advanced breakdown.
What can't Code Injection do?
Three real boundaries, all stated directly in Squarespace's help center:
- Checkout pages are off-limits. Squarespace's help page asks and answers this directly: "Can I add code to checkout pages? No. You can't add custom code to checkout pages." If your plan is to track add-to-cart or checkout-start events with a custom script, this isn't where it goes - you'd need a solution that fires earlier or later in the funnel.
- CSS has a better home. Code Injection technically accepts CSS wrapped in
<style>tags, but Squarespace recommends against it: "Yes, but we recommend using the Custom CSS Editor instead of code injection." On version 7.0 sites specifically, the help page also warns that "Ajax loading may prevent CSS added to code injection from loading correctly." - The Lock page has a trial restriction. You "can't inject code to the lock screen during your site's trial period," so testing a password-page customization has to wait until the site is on a paid plan.
What does "outside the scope of Squarespace support" actually mean?
This phrase gets used loosely online, so it's worth quoting Squarespace's own scope statement rather than guessing at it. Squarespace's help center states: "We don't provide support for code-based modifications, unless otherwise specified. This means that we're unable to help further with setup or troubleshooting" (Squarespace, "Code-based customizations", checked September 2026). It adds: "Since these are code-based solutions, we can't guarantee their functionality or full compatibility with Squarespace," including "their appearance on mobile devices," and concludes that "unlike our official integrations, all code-based customizations fall outside of the scope of Squarespace support."
In plain terms: the feature works, but if a script breaks your mobile layout or conflicts with a template update, that's on you (or whoever wrote the code) to fix - not a support ticket Squarespace will pick up. The Code Injection page itself repeats this narrower warning too: "Custom code might break your site's appearance or behavior, especially on mobile devices. Our support team can't help you add custom code to your site or troubleshoot issues that arise from using it." For actual troubleshooting help, Squarespace points you to the Squarespace Forum or a paid Squarespace Expert, not its own support team.
How do I add code to my site?
The site-wide fields are the simplest starting point:
- Open the Code Injection panel (Website → Website Tools → Code Injection on most current plans).
- Paste valid HTML or scripts into the Header or Footer field. Wrap any JavaScript in
<script></script>tags. - Click Save.
For a single page instead of the whole site: hover over that page in the Pages panel, click the settings icon, then Advanced, and add code to that page's own header field. For a script that should run on every blog post rather than every page, use the Post Blog Item Code Injection field in the blog's own page settings instead.
Example (hypothetical): A site owner wants a heat-mapping script to load sitewide but only fire tracking after a visitor accepts cookies. They'd add the script to the sitewide Footer field, enable the cookie banner under Cookies & Visitor Data, and wrap the tracking call so it only runs after consent - this is an illustrative pattern, not a test Figment ran.
What do I do if injected code breaks my site editor?
This is the recovery path, and Squarespace builds a specific escape hatch for it. If a script interferes with editing, a banner appears at the bottom of your site reading "We detected an error loading your site preview. This is usually caused by injected code." From there:
- Click Disable Scripts in Preview to turn off your injected code while you keep editing. This doesn't change what visitors see on the live site - only your own preview.
- If the banner isn't showing but the editor still won't load properly, type
/safedirectly after/configat the end of your secure editing URL and press Enter to force scripts off. - To see the site exactly as a visitor would, with your code still running, open the live URL in a private or incognito browser window rather than your logged-in editor.
- When you're ready to turn the script back on, click Enable Scripts in Preview from the same banner.
Because this toggle only affects your editing session, it's a safe way to isolate whether a layout problem is coming from your theme, a template change, or the code you added - without deleting the code and losing your work.
Where does Figment fit in?
Nowhere directly - Figment publishes a website from a Figma design through its Figma plugin, and it has no header/footer code-injection panel or checkout flow to compare against Squarespace's. If your reason for wanting custom code is to sell memberships or gated content rather than to add a tracking script, our Squarespace ecommerce guide covers the commerce tools that don't require code at all.
Bottom line: Code Injection can reach the site header, footer, individual pages, blog posts, the lock screen, and the two post-checkout pages - but not checkout itself, and not with any promise that Squarespace will help when it breaks. Check the current plan requirement on Squarespace's pricing page before you plan a build around it, since plan lineups do change.
