Add analytics to any website with one script tag, free

To add analytics to a website, paste one async <script> tag into your shared HTML header or footer and verify ownership of the domain. In Clicktag, that tag is latest.js (about 4 KB compressed), which starts recording visitors, pageviews, referrers, UTM parameters, time on page and scroll depth as soon as your site is verified. You don't need an npm package, cookies, local storage or a credit card.

Copy the script tag and place it in your HTML

Sign in at clicktag.app with a Google account, add your site, and open Site settings > Installation, step 1. Copy the snippet and paste it once into your root document or shared layout so every page loads it. Do not mount duplicate tags in child templates or components.

<!DOCTYPE html>
<html lang="en">
  <head>
    <meta charset="utf-8" />
    <title>My App</title>
    <script
      async
      src="https://clicktag.io/latest.js"
      data-hostname="example.com"
      data-verify="YOUR_SITE_VERIFY_TOKEN"
    ></script>
  </head>
  <body>
    <main></main>
  </body>
</html>

Keep both data-hostname (the hostname you registered, such as example.com) and data-verify (that site's public verify_token, not an API key). Full configuration options are in the installation docs.

Verify your site so collection starts

Clicktag only stores hits after you verify that you control the domain. You have three ways to verify:

1. The script tag in served HTML. If the server sends your homepage HTML with the <script> tag and its data-verify attribute intact, Clicktag verifies the site automatically when the first hit arrives.
2. A DNS TXT record. Publish a TXT record at _totallytics-verify.example.com with the value totallytics-verify=YOUR_SITE_VERIFY_TOKEN.
3. A .well-known file. Serve your verify_token as the entire body of https://example.com/.well-known/totallytics-verify.txt over HTTPS with a 200 status, no redirects, at most 8 KB.

For the DNS record or the file, click Check verification under Verify another way in Site settings > Installation.

If your site injects the tag only through client-side JavaScript or a tag manager, the server's raw homepage HTML won't contain data-verify, so verify with a DNS TXT record or the /.well-known/ file instead.

In Site settings > Installation, step 3, click Run setup check to confirm your served homepage carries the tag and that your Content-Security-Policy header allows https://clicktag.io in script-src, img-src and connect-src.

Single-page apps, noscript pixel and manual mode

latest.js works out of the box with React and Vite (in index.html) and with the Next.js App Router (as a raw <script> inside the <body> of app/layout.tsx). It hooks window.history.pushState and listens to popstate events, so client-side route changes record pageviews automatically when the path changes. Consecutive identical paths are ignored, and replaceState alone doesn't fire a pageview.

If your app uses hash routing such as example.com/#/dashboard, add data-mode="hash" to the script tag.

To count visitors who have JavaScript turned off, drop the optional noscript pixel inside <body>:

<noscript>
  <img
    loading="lazy"
    src="https://clicktag.io/noscript.gif?hostname=example.com"
    alt=""
    referrerpolicy="no-referrer-when-downgrade"
    style="position:fixed;top:0;left:0"
  />
</noscript>

If you want to fire pageviews yourself instead of on load and history changes, set data-auto-collect="false" on the script tag and call window.tt_pageview(path, metadata) from your router:

<script>
  function trackInitialPage() {
    if (typeof window.tt_pageview !== "function") {
      console.warn(
        "Pageview tracking is unavailable; check DNT and script loading.",
      );
      return;
    }

    window.tt_pageview(window.location.pathname);
  }
</script>
<script
  async
  src="https://clicktag.io/latest.js"
  data-hostname="example.com"
  data-verify="YOUR_SITE_VERIFY_TOKEN"
  data-auto-collect="false"
  onload="trackInitialPage()"
></script>

Where to paste the tag on common platforms

Every website builder puts custom head code in a slightly different menu, and several lock custom code behind a paid plan. See our guides for WordPress, Shopify, Webflow and GitHub Pages for platform-specific details.

Prices and limits checked on October 29, 2026, on each vendor's official pricing or help pages.

Once the tag is live, open the Live view in your own dashboard: hits arrive within about a second. To browse filled-in reports before you install, open the live demo, which uses synthetic sample data.

FAQ

Does adding Clicktag slow down my website or need an npm package?

No npm package is needed. Clicktag loads as one async script (latest.js) that is about 4 KB compressed. It sends pageviews and events as small image requests, and the engagement update uses navigator.sendBeacon when a visitor leaves the page.

Why aren't my localhost visits showing up in reports?

When data-hostname is left off, latest.js reads location.host (such as localhost:3000), which can't be registered and is ignored by the collector. If you hardcode your production data-hostname while running on localhost, the script will send your local test hits to your live site, so test on a staging or production domain instead.

Does the script track button clicks, file downloads or outbound links automatically?

No. latest.js records pageviews (including pushState and popstate route changes in single-page apps), time on page and scroll depth, but it does not automatically record clicks, outbound links, file downloads or form submissions. To track those, call window.tt_event(name, metadata, callback) in the browser or send a JSON POST to /events from your backend.

Can I track Shopify or Squarespace checkout pages with this script?

Squarespace checkout pages don't allow custom code injection. On Shopify, layout/theme.liquid doesn't load on checkout, script tags were sunset on August 28, 2025 for Plus and August 26, 2026 for non-Plus stores, and checkout and post-purchase pages only take custom pixels that run in a "Lax sandbox". Clicktag also does not do revenue or ecommerce tracking.

What happens when a visitor has Do Not Track enabled or blocks JavaScript?

When navigator.doNotTrack is "1", latest.js sends no pageviews or events, and the collector drops hits that carry a DNT: 1 or X-Do-Not-Track: 1 header. For visitors who block JavaScript, you can add the optional <noscript> image pixel to count basic pageviews, and you can connect Cloudflare in the Crawlers tab to see AI and search crawlers that never execute JavaScript.

How many websites can I add to one Clicktag account?

You can add up to 50 websites per account for free, with up to 50 goals (including funnels) and up to 25 email report recipients per site. Sign-in requires a Google account, and Clicktag does not offer session recordings, heatmaps, bounce rate or a Google Analytics data import.