How to connect GTM and lat,lon within WordPress

CMS & WordPress
1

As I understand, we have GTM credentials and connects website using the default scripts.

When I try to connect the API and GTM, how to put credentials into WordPress to show weather conditions?

<script> ! function(e, t, a, n) { e[n] = e[n] || [], e[n].push({ "gtm.start": (new Date).getTime(), event: "gtm.js" }), n = t.getElementsByTagName(a)[0], (a = t.createElement(a)).async = !0, a.src = "https://www.googletagmanager.com/gtm.js?id=GTM-XYZ", n.parentNode.insertBefore(a, n) }(window, document, "script", "dataLayer"); </script>

and PHP within WordPress:

$lat = ‘’;
$lon = ‘’;
$apiKey = ‘XYZ’;

Should we read IP and set it up lat, lon, APIKey within GTM, or should it be WordPress managed?

As I understand, APIKey is exposed to the public if this is managed within GTM.

2

Well ideally do you want the user to specify the values (accurate for them and they can set it to whatever they want) or do you want to try and make it automatic and be less accurate? I would go with the route of having the user specify the values (they could maybe click a map or something) and have those save as Options/Settings in WordPress through the Options API. Then it will just be a matter of reading from the Options/Settings and injecting it into the JavaScript as needed.

I found that trying to guess things like lat/long or anything off a person’s IP is wrong half the time. You could even read the lat/long from PHP.ini (I believe there is that setting a user can specify in there).

  1. Read the php.ini to see if lat/long specified… put it into WP options
  2. If not, guess off of IP… put it into WP Options
  3. But let the user override the guess in their settings… put what they specify in WP Options
  4. Whatever the value is at the end, inject it into the JS from their WP Options

That would be a nice complete solution and give the user the ability to be as accurate as they want.

3

Hey! Great question, and you’re spot on about the API key exposure issue. Let me break this down in a practical way.

Definitely NOT in GTM/client-side.

You’re 100% right - if you put that API key in GTM or frontend JavaScript, anyone can right-click > View Source and grab it. I’ve seen people rack up huge bills because of exposed API keys. Not fun.

Here’s what I’d recommend instead:

Think of GTM as your marketing tag manager, not your backend logic handler. Weather data is dynamic content, not a marketing pixel.

Simple WordPress approach:

  1. Store your API key in wp-config.php or use a proper options framework

  2. Create a small custom plugin or add to functions.php that:

    • Gets user IP via $_SERVER['REMOTE_ADDR']

    • Calls the weather API from the server side

    • Returns clean HTML or JSON data

For GTM integration (if you really need it):
Once your PHP gets the weather data, you can push it to the dataLayer:

javascript

<script>
window.dataLayer = window.dataLayer || [];
window.dataLayer.push({
  'event': 'weatherData',
  'temperature': '<?php echo $temp; ?>',
  'condition': '<?php echo $condition; ?>'
});
</script>

Then GTM can read that safely. No API key exposed.

Alternative quick fix:
If you’re not comfortable with custom PHP, look at plugins like WP Meteor or even a simple transients-based caching solution. They handle the server-side part for you.

Keep secrets on the server. Always. Your future self (and wallet) will thank you.

4

Thank you for the messages.

6

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.