On this page
  1. What we don't do
  2. If your site sends a Content Security Policy
  3. Confirming it's the CSP
  4. Ad blockers
  5. Hosting the script yourself
  6. Do Not Track and Global Privacy Control

What we don't do

The script doesn't work around browser blocking and doesn't ignore a visitor's Do Not Track setting. A blocked visit stays invisible; we don't fingerprint or rotate domains to collect it anyway. That's one reason your numbers will usually be a bit lower than server logs.

If your site sends a Content Security Policy

If your responses include a Content-Security-Policy header, allow these two domains. Otherwise the script can't load or can't send — and nothing shows up as an error on the page:

script-src  https://static.pathclue.com
connect-src https://api.pathclue.com
  • script-src controls whether the script can load. Extensions for autocapture, error monitoring and identity load on demand from the same domain, so allowing only the full URL of client.js isn't enough — allow the domain.
  • connect-src controls whether data can be sent. Without it the browser silently blocks the collection request.

If the project also runs the live chat widget, its domains need allowing separately; the chat installation page in the console lists them. For analytics alone, the two lines above are enough.

Confirming it's the CSP

Open the browser's developer tools on the Console tab and reload. A CSP block prints a warning mentioning Content Security Policy, the blocked address and the directive that blocked it.

Ad blockers

Some ad-blocking lists block analytics scripts. When that happens the Network panel shows no client.js request, or no collection request to api.pathclue.com, and the visit never reaches Real-time.

How many visits are blocked depends heavily on your audience. Sites for developers and other technical readers lose a noticeably larger share of desktop visits than consumer sites, and mobile is usually much lower. We can't estimate that share for you precisely. If you need to reconcile with your order system, send orders and payments through the server-side events API — it never passes through the browser, so blocking doesn't affect it.

Hosting the script yourself

Some teams serve client.js from their own domain and point data-api at the collector. Your CSP then lists your own domain. This doesn't guarantee blockers will let it through; it only means the request no longer goes to another host name. You also have to keep the script version in sync yourself, so we generally don't recommend it.

Do Not Track and Global Privacy Control

When a visitor's browser sends Do Not Track (DNT) or Global Privacy Control (GPC), the script doesn't run at all, and that visitor appears in no report. That's our default position. There is an attribute to change it, and we advise against using it — see Do Not Track and visitor opt-out.