# Quickstart

Clicktag is free and sets no cookies. Sign in with Google, register up to 50 hostnames, and paste one async `latest.js` tag: the first pageview verifies the site and shows up in your dashboard.

## 1. Register your site

Register your hostname before sending traffic. The collector drops traffic for unregistered hostnames without returning an error.

1. Sign in at [/login](https://clicktag.app/login) with your Google account.
2. Navigate to [/app](https://clicktag.app/app) and click **Add site**.
3. Enter your website address, such as `example.com` or `https://www.example.com/blog`.

Full URLs are reduced to their hostname; non-default ports are not supported. Each account can register up to 50 sites. All sites are private by default.

You can also register sites programmatically using `POST /api/sites`. See the [Sites API Reference](/docs/sites) for request schemas.

## 2. Add the tracking script

Copy the Tracking script from your site settings. It includes the hostname and a site-specific verification challenge. Place it in your shared layout, document head, or before the closing body tag. This example needs your actual `verify_token` in place of `YOUR_SITE_VERIFY_TOKEN`:

```html
<script
  async
  src="https://clicktag.io/latest.js"
  data-hostname="example.com"
  data-verify="YOUR_SITE_VERIFY_TOKEN"
></script>
```

To capture visits from users with JavaScript disabled, add an optional noscript pixel inside the HTML `<body>`:

```html
<noscript>
  <img
    loading="lazy"
    src="https://clicktag.io/noscript.gif?hostname=example.com"
    alt=""
    referrerpolicy="no-referrer-when-downgrade"
    style="position:fixed;top:0;left:0"
  />
</noscript>
```

Keep `loading="lazy"` before `src`: it stops the pixel from loading when JavaScript renders it, which would count the pageview twice.

Keep `data-verify` in the served homepage HTML: when the first beacon arrives, Clicktag fetches `https://<hostname>/`, looks for a `latest.js` tag carrying this challenge and verifies the site automatically. A generic tag without it needs [DNS or file verification](/docs/sites#verify-ownership). Existing verified sites keep collecting unchanged.

Always specify `data-hostname` to avoid domain detection mismatches. Subdomains and `www` prefixes are separate hostnames and are not combined automatically. Set `data-hostname` to the exact value you registered.

## 3. Verify incoming traffic

Open your site in a standard desktop or mobile web browser to verify the installation:

1. Open your browser Developer Tools and select the **Network** tab.
2. Filter requests by `clicktag`: the new tag loads from `clicktag.io`, and its beacons go to `clicktag.io`. Existing Totallytics tags keep their original hosts; filter by `totallytics` for those.
3. Verify that `latest.js` loads with HTTP 200.
4. Find the request to `simple.gif`. Check that its query includes `hostname=example.com` and `type=pageview`, and that the response is HTTP 200 with content type `image/gif`.
5. Navigate away or close the tab. The tracker may send an `/append` engagement beacon, or a `simple.gif` request with `type=append` after a single-page navigation; it is not a second pageview.

A collector HTTP 200 is not proof that a row was saved: writes are asynchronous, and requests can be ignored. Check the exact page in [/app](https://clicktag.app/app), or query your site's [pages breakdown](/docs/stats). An earlier missing-registration lookup can take up to 15 seconds to expire at another edge location. Failed automatic-verification probes pause for 30 seconds before a new visit retries; use **Check verification** under **Verify another way** in Site settings > Installation to check immediately.

When testing, keep these checks in mind:

- Use a real browser. Headless browsers with `navigator.webdriver` enabled are marked as automated traffic; bot-marked rows do not count toward normal visitor and pageview totals.
- Check browser extensions. Ad blockers and privacy tools can block analytics endpoints.
- Check Do Not Track. The script honors `navigator.doNotTrack === "1"` by default and will not record visits.

## 4. Explore the API

You can query public stats directly without an account using our public demo domain:

```bash
curl --fail-with-body -sS --max-time 30 \
  'https://clicktag.io/api/sites/demo.bitgate.dev/overview?tz=UTC'
```

This endpoint returns JSON with `totals`, `previous`, `previous_range`, `series`, `forecast`, `live` and `granularity` fields. Note that demo traffic is synthetically generated.

Public-site metadata and statistics allow unauthenticated reads. Private reports require the site owner's Firebase ID token, or a management key with the `read` scope, in the Authorization header. Import jobs remain owner-only even for public sites. Read the [Stats API Reference](/docs/stats) for detailed parameter options and the [Authentication Guide](/docs/authentication) for bearer token usage.