Docs/Install the tracker
Install the tracker
One script tag, no cookies, no consent banner. Here is exactly what it does and what it records.
The snippet
<script defer src="https://kipstats.com/tracker.js" data-site="kp_xxxxxxxx"></script>defer keeps it out of the critical path. The file weighs 11.5 KB, about 4.2 KB gzipped, and is cached for five minutes so a fix reaches your visitors quickly.
Single-page apps
Route changes are picked up automatically: the tracker wraps history.pushState and history.replaceState and listens to popstate. React Router, Vue Router, Next.js, Nuxt, SvelteKit and Astro all go through those, so there is nothing to call by hand.
What is collected
| Field | Where it comes from |
|---|---|
| Page path and query | location.href |
| Referrer domain and path | document.referrer |
| UTM parameters | the URL |
| Browser, OS, device | User-Agent, parsed server-side |
| Screen size, language | screen, navigator.language |
| Country, city, approximate coordinates | IP address, resolved at collection time |
| Scroll depth, engaged seconds, exit element | a heartbeat every 10 seconds |
How a visitor is counted without a cookie
Each session carries an anonymous fingerprint: sha256(daily salt + IP + User-Agent + domain). The salt changes every day, so the same person on two consecutive days is two different hashes — there is no way to follow anyone across time. The IP address itself is never stored; it is used to compute that hash and to resolve the country, then dropped.
No cookie is set. The only thing written to the browser is a localStorage flag, and only if you explicitly ask to be excluded (below). This is what makes a consent banner unnecessary for Kipstats itself — your own legal counsel remains the judge for your site as a whole.
Events captured without any code
Beyond pageviews, the tracker records the moments where a visit goes wrong. These names start with $ and are reserved:
| Event | What it means |
|---|---|
$click | A click on a link, button or form control — where people actually click. |
$rageclick | Three or more fast clicks in the same spot: something is not responding. |
$deadclick | A click on something that looks clickable (cursor: pointer) but isn't. |
$form_abandon | A field was focused, the form was never submitted. |
$jserror | A JavaScript error or rejected promise (deduplicated, 5 per page at most). |
Only the element's tag, a short CSS selector and its visible label are recorded — never the value of a field.
Excluding yourself
Open any page of your site with ?kp_ignore=1: that browser stops being counted on that site. ?kp_ignore=0 puts it back. The flag lives in localStorage, so it applies per browser and per site.
Development hosts are muted automatically: localhost, 127.0.0.1, ::1, private ranges (10.x, 192.168.x, 172.16–31.x), .local and file://. window.kipstats.event() still exists there and does nothing, so your code never breaks locally.
Checking that it works
- Open your site in a normal browser window (not localhost).
- Open your dashboard: the visitor appears in Live activity within a few seconds.
- If nothing shows up, check the page source for
tracker.jsand make suredata-sitematches the tracking ID in your site settings.
A frequent cause: a site cloned from another one keeps the tracking ID of the original, and its traffic lands in the wrong dashboard.
Next
Record your own events — a signup, a checkout, a purchase.