Install the SiteLine tracker

Q: Does the script set a cookie?

No. Collect uses fetch with keepalive and credentials: 'omit'. Unique visitors are hashed on the server. There is no persistent first-party analytics cookie in this version.

Q: Will ad blockers stop this snippet?

Some will. A first-party proxy for /js/script.js and /api/analytics/event reduces loss. It does not eliminate it. SiteLine does not manage CNAMEs for you.

SiteLine tracking is one deferred script tag. It records pageviews. It does not set a first-party analytics cookie. Custom events, outbound clicks, and file downloads stay off until you ask for them.

If you skip the absolute collect URL, the script will guess /api/analytics/event from its own src origin. Guessing is how events silently post to the wrong host. Set data-endpoint yourself.

The React path is a different article. This one is HTML.

Before you paste anything

You need three values from SiteLine, not from this page.

A public site id (data-site-id). Docs write it as YOUR_SITE_ID.
Your SiteLine origin, or a first-party proxy origin you already control.
An allowlist of hostnames the collect endpoint will accept.

Enable analytics on the domain from the Sites list: Enable analytics on an existing row, or Add analytics with the domain field. SiteLine then sends you to the Install page, which shows the public id and a copyable snippet. Add every hostname you actually serve — apex, www, staging, preview — before you go live. Events from a host that is not on the allowlist are rejected. A leaked public id on an unrelated domain should not fill your charts.

1. Copy the snippet

Replace the placeholders. data-endpoint must be an absolute URL.

<script
    defer
    data-site-id="YOUR_SITE_ID"
    data-endpoint="https://YOUR_SITELINE_ORIGIN/api/analytics/event"
    src="https://YOUR_SITELINE_ORIGIN/js/script.js"
></script>

That is the whole install. Full attribute list: script install.

The collect route is POST /api/analytics/event. There is also POST /js/event for the same ingest. You do not need both in the snippet. Keep data-endpoint on /api/analytics/event unless you have a reason not to.

2. Paste it before `</head>`

Put the tag on every page you care about: marketing, app shell, thank-you, error pages you want in the path report. One tag per page. The script is deferred, so it should not block first paint.

Do not put it behind a cookie banner for this tracker. SiteLine does not set an analytics cookie. If you already have a banner for ads or other vendors, leave this tag out of that gate unless your counsel says otherwise. The product model is cookieless; the legal policy is /privacy.

3. Confirm the hostname allowlist

On Install, the allowlist is a comma-separated field. Save example.com, www.example.com if that is what visitors type. Preview URLs (*.vercel.app, *.netlify.app) need their own entries or they will never ingest.

The payload hostname has to match. Serving the site on www while allowlisting only the apex is a common empty-chart bug.

4. Load a page and watch Live

Open the site in a normal browser, then open SiteLine Live. It polls roughly every 15 seconds and shows visitors and pageviews for about the last 30 minutes, plus top pages. If Live is empty, check in this order:

The public id in the tag matches Install.
data-endpoint is absolute and reachable (no mixed content, no 404).
The page hostname is on the allowlist.
You are not filtering yourself out by looking at a different analytics site.

Bots and obvious crawler user agents are dropped before they hit quota or charts. A curl of the page will not prove the tracker works.

Optional attributes

Leave these off unless you need them. They emit custom events, and custom events are billable 1:1 with pageviews.

data-track-outbound-links="true" — clicks to other hosts.
data-track-file-downloads="true" — common download extensions.
data-file-download-extensions="pdf,zip" — override the default list.

Those auto events use the names Outbound Link and File Download. Named product actions you send yourself should stay lowercase and stable (signup_completed). See custom events.

SPA navigations

The script listens for popstate and patches history.pushState / replaceState, so client-side route changes usually send pageviews. Some routers — Next.js App Router in edge cases — bypass that. If in-app navigations do not show up, use the React SDK and call trackPageview() on route change instead of fighting the script.

What you should see after a real visit

Overview totals for visitors and pageviews, top pages, top referrers. Breakdowns exist for countries, devices, browsers, OS, UTMs, and event names. Device, browser, and OS are parsed on ingest from the user agent; the script does not send them. Country comes from request geography when the edge provides it.

Unique visitors are a daily hash of truncated IP + user agent + a rotating salt. The same person tomorrow is a different visitor. That is the model, not a bug. Goals and funnels are defined later in the dashboard; they do not require a second snippet.

FAQ

No. Collect uses fetch with keepalive and credentials: 'omit'. Unique visitors are hashed on the server. There is no persistent first-party analytics cookie in this version.

Can I omit data-endpoint?

Yes, and you usually should not. If you omit it, the script derives /api/analytics/event from the script src origin. That is correct when src is SiteLine or your proxy. It is wrong if you self-host a copied script.js on your site without a matching collect route. Set the absolute URL.

Will ad blockers stop this snippet?

Some will. A first-party proxy for /js/script.js and /api/analytics/event reduces loss. It does not eliminate it. SiteLine does not manage CNAMEs for you.