Docs
Dashboard

Clicktag docs

Quickstart

Clicktag is free and sets no cookies. Sign in with Google, register up to 50 hostnames, and paste one async latest.js tag: the first pageview verifies the site and shows up in your dashboard.

Read as Markdown

1. Register your site

Register your hostname before sending traffic. The collector drops traffic for unregistered hostnames without returning an error.

  1. Sign in at /login with your Google account.
  2. Navigate to /app and click Add site.
  3. Enter your website address, such as example.com or https://www.example.com/blog.

Full URLs are reduced to their hostname; non-default ports are not supported. Each account can register up to 50 sites. All sites are private by default.

You can also register sites programmatically using POST /api/sites. See the Sites API Reference for request schemas.

2. Add the tracking script

Copy the Tracking script from your site settings. It includes the hostname and a site-specific verification challenge. Place it in your shared layout, document head, or before the closing body tag. This example needs your actual verify_token in place of YOUR_SITE_VERIFY_TOKEN:

html
<script
  async
  src="https://clicktag.io/latest.js"
  data-hostname="example.com"
  data-verify="YOUR_SITE_VERIFY_TOKEN"
></script>

To capture visits from users with JavaScript disabled, add an optional noscript pixel inside the HTML <body>:

html
<noscript>
  <img
    loading="lazy"
    src="https://clicktag.io/noscript.gif?hostname=example.com"
    alt=""
    referrerpolicy="no-referrer-when-downgrade"
    style="position:fixed;top:0;left:0"
  />
</noscript>

Keep loading="lazy" before src: it stops the pixel from loading when JavaScript renders it, which would count the pageview twice.

Keep data-verify in the served homepage HTML: when the first beacon arrives, Clicktag fetches https://<hostname>/, looks for a latest.js tag carrying this challenge and verifies the site automatically. A generic tag without it needs DNS or file verification. Existing verified sites keep collecting unchanged.

Always specify data-hostname to avoid domain detection mismatches. Subdomains and www prefixes are separate hostnames and are not combined automatically. Set data-hostname to the exact value you registered.

3. Verify incoming traffic

Open your site in a standard desktop or mobile web browser to verify the installation:

  1. Open your browser Developer Tools and select the Network tab.
  2. Filter requests by clicktag: the new tag loads from clicktag.io, and its beacons go to clicktag.io. Existing Totallytics tags keep their original hosts; filter by totallytics for those.
  3. Verify that latest.js loads with HTTP 200.
  4. Find the request to simple.gif. Check that its query includes hostname=example.com and type=pageview, and that the response is HTTP 200 with content type image/gif.
  5. Navigate away or close the tab. The tracker may send an /append engagement beacon, or a simple.gif request with type=append after a single-page navigation; it is not a second pageview.

A collector HTTP 200 is not proof that a row was saved: writes are asynchronous, and requests can be ignored. Check the exact page in /app, or query your site's pages breakdown. An earlier missing-registration lookup can take up to 15 seconds to expire at another edge location. Failed automatic-verification probes pause for 30 seconds before a new visit retries; use Check verification under Verify another way in Site settings > Installation to check immediately.

When testing, keep these checks in mind:

  • Use a real browser. Headless browsers with navigator.webdriver enabled are marked as automated traffic; bot-marked rows do not count toward normal visitor and pageview totals.
  • Check browser extensions. Ad blockers and privacy tools can block analytics endpoints.
  • Check Do Not Track. The script honors navigator.doNotTrack === "1" by default and will not record visits.

4. Explore the API

You can query public stats directly without an account using our public demo domain:

bash
curl --fail-with-body -sS --max-time 30 \
  'https://clicktag.io/api/sites/demo.bitgate.dev/overview?tz=UTC'

This endpoint returns JSON with totals, previous, previous_range, series, forecast, live and granularity fields. Note that demo traffic is synthetically generated.

Public-site metadata and statistics allow unauthenticated reads. Private reports require the site owner's Firebase ID token, or a management key with the read scope, in the Authorization header. Import jobs remain owner-only even for public sites. Read the Stats API Reference for detailed parameter options and the Authentication Guide for bearer token usage.

Documentation