Documentation

Everything you need to get started and get the most out of Web-Tracking.eu.

Getting started

Web-Tracking.eu is privacy-first web analytics without cookies. Three steps:

  1. Create an account — magic link via email or Google sign-in.
  2. Add your site — enter the hostname and a name.
  3. Paste the script — one line of HTML on your site. Done.

You need no consent banner. We store nothing on your visitors' devices. No cookies, no localStorage, no fingerprinting.

Installation

The basic script:

<script src="https://web-tracking.eu/t.js?site=YOUR_SITE_ID" defer></script>

Replace YOUR_SITE_ID with the site ID from your dashboard. The script is under 3 KB and loads asynchronously.

Custom domain (recommended)

For first-party tracking (which ad blockers can't block): add a custom domain in the site settings. Point a CNAME such as track.yourdomain.com to web-tracking.eu. We issue the TLS certificate automatically.

We detect your DNS provider automatically and show provider-specific instructions (Cloudflare, GoDaddy, Namecheap, Route 53, IONOS, Simply.com and more).

Cloudflare one-click: if your domain is on Cloudflare, we can create the CNAME for you: create an API token (Zone → DNS → Edit, scoped to your zone), paste it into the setup flow, and we create the record. The token is not stored.

AI help during onboarding

When you add a new site, step 3 offers two AI helpers:

  • Suggest a guide: describe your website in one sentence ("WordPress with WooCommerce") → we recognise the stack and link to the right guide.
  • Check installation: enter your URL → we fetch the page, check whether the script is installed correctly, whether it loads synchronously or with defer/async, whether a CSP blocks it, and report concrete problems with links to the documentation.

Custom events

Track specific actions:

window.wt('signup_completed', { plan: 'starter' });

window.wt only exists once the script has loaded. The script loads with defer, so call it from a click or submit handler — not at the top of another file that runs earlier. If you want to use the event as a goal, the name must be at most 40 characters and contain no spaces. Never send personal data (name, email) as properties.

Platforms

We have step-by-step guides for 20+ platforms (WordPress, Shopify, Wix, Webflow, GTM, Cloudflare, Next.js and more).

Dashboard

For each site you get:

  • KPIs: Pageviews, visitors, sessions, average duration, bounce rate, pages per session — all with the trend against the previous period.
  • Time ranges: Today, 7 days, 30 days, 90 days, or custom.
  • Chart: Timeline, day of week, or by hour. Choose the metric (pageviews, visitors, duration, bounce).
  • Top pages, referrers, countries, browsers, operating systems, devices.
  • Landing pages with bounce rate per page.
  • Compare with previous period — toggle it on the timeline. If the comparison period lies (partly) before we had data for your site, no percentage is shown — just a note saying when tracking started — so you never see a "+900 %" against nothing.
  • Day, week or month: group the charts by week (ranges of 14 days or more) or month (90 days or more). Incomplete weeks or months at the edges are marked, so a 3-day week doesn't look like a drop.
  • Long visits: besides the median you get Top 25 % stay (how long the most engaged quarter stays), Engaged visits (sessions rated engaged or gold) and Total attention (active reading time in total, max 30 minutes per page per visit). The median shows a typical visit; these show whether you're getting more good ones — the median can stay flat while long visits grow.
  • Active time only: time counts while the tab is visible and the visitor has scrolled, moved the mouse, typed or touched the screen within the last 2 minutes.

Click a page in the top lists to zoom in on that page's history — see Page detail.

Page detail and change markers

Click a page in the dashboard's top lists to open its detail view. For the chosen period you get pageviews, visitors, entry rate (how often the page is where the visit starts), average and median time on the page, and gold rate (the share of sessions with the page that scored gold) — plus a chart, the pages visitors came from and went to, and referrers, devices and countries for that page alone.

Mark a change

Rewrote the intro, new design, new CTA? Click + Mark change under "Page changes", pick the date and describe what you changed (title up to 100 characters, optional notes). The marker appears as a line on the chart. Adding and deleting markers requires the admin role on the site.

Before and after

For each marker we compare the 14 days before the change with the days after it (up to 14): pageviews, visitors, bounce rate and average time on page. The numbers are per day, so a short after-period can be compared fairly. The comparison is shown once at least 7 days have passed — until then the marker says it is waiting for more data.

Markers from your sitemap

In the site settings under Sitemap-based change markers you enter your sitemap URL. We check it once a day, and you can click Sync now to check right away. Pages whose lastmod has moved since the last sync get a marker automatically. To avoid false alarms we also compare the page's title and meta description — if they're unchanged, the bump is ignored. A page seen for the first time is only recorded, not marked.

You can also set markers from an AI assistant via the MCP server (mark_page_change).

Sessions

Sessions in the sidebar lists the 50 most recent visits from the last 30 days: time, landing page, where they came from, pages, duration, device and country — and the visit's quality: gold, engaged, skim or bounce (the same scoring as the dashboard, see Goals).

  • Filter by quality with the buttons above the list, e.g. only gold visits.
  • Narrow the list by text (page or referrer), country, device, or "engaged only" (20 seconds or more).
  • Click a row to see the page journey: each page in order and the time spent on it.

A single session

View full session opens everything we know about that one visit:

  • Where they came from — channel, source, referrer URL, landing URL and any UTM parameters.
  • Visitor — country and city, browser, operating system, screen and window size, segment, and a flag if the request came from a data centre (possibly a bot, VPN or proxy).
  • Page journey with time and scroll depth per page.
  • Events — clicks, goals and custom events.
  • Other sessions from the same visitor — only within the same day, since the anonymous ID rotates daily.

No IP addresses or cookies are stored; location is looked up when the request arrives, and only country and city are kept.

Page categories

Group your pages by purpose: Blog, Product, Cases, Legal and so on. Set up in the site settings.

Why

An example: your privacy page gets a burst of traffic every time you send a newsletter (people check what they signed up for). That skews the top lists and makes product pages harder to judge. With categories you can:

  • Filter the dashboard to just "Blog" or just "Product"
  • See a separate bounce rate per category
  • Mark "expected high bounce" pages (legal, FAQ) so they are excluded from the intent analysis

Patterns

  • /blog/* — every page under /blog/
  • /privacy* — starts with /privacy (matches /privacy, /privacy/, /privacy-policy)
  • /about — exact match only

The first pattern that matches wins. Use the arrows to change the order.

Auto-suggestions

We automatically suggest categories based on your top 30 pages over the last 30 days. Click a suggestion to add it.

Goals and conversions

Under Engagement scoring in the site settings you define what counts as a success. There are three lists:

  • Conversions — the purchase is complete, the signup confirmed, someone called. Counts as a conversion and makes the session gold.
  • Micro goals — a smaller step, such as viewing the pricing page or starting checkout. Counted separately; affects neither gold nor conversions.
  • Auto-gold pages — pages that signal strong interest without being a conversion.

Three kinds of goals

  • A page — starts with /. /thank-you matches exactly that page, /checkout/success* anything that starts that way.
  • A click on a phone number or email — tel:+4512345678 or mailto:info@company.com. Counted automatically when someone clicks a link with exactly that number or address, on any page. Spaces in the number and upper/lower case in the address don't matter.
  • An event your site sends — event:name, e.g. event:signup for window.wt('signup'). For actions with no page to land on: a form submitted without a page change, or a button that leads off the site. Can be narrowed to a single property: event:cta_click?target=email.

Use a page when there is one — a thank-you page after the purchase is more robust than an event. Write the pattern without a leading slash before tel:, mailto: and event:.

Visitor segments

If your site has users who log in, you'll often want to see those who are not logged in on their own — they're the ones your sales pages need to convince. Mark it on the site's <html> element:

<html data-wt-segment="guest">      <!-- not logged in -->
<html data-wt-segment="member">     <!-- logged in -->

The dashboard then gets a Visitors selector next to the categories, and every number — visits, sources, landing pages, goals — can be viewed for one segment at a time.

  • A visit belongs to the segment of its first pageview. A guest who signs up along the way still counts as a guest — and that's exactly the visit the sale should be judged on.
  • The value is your own label for a group, never an identity: at most 40 characters, and it is only sent with pageviews. Never use an email, user ID or name.
  • The attribute is read on every pageview, so a single-page app can change it without reloading the script.

Insights

Insights in the sidebar compares the last 28 days with the 28 days before and lists what stands out, in three groups:

  • What went well — e.g. traffic up more than 30%, or a higher share of gold sessions.
  • Keep an eye on — e.g. traffic down more than 30%, or a lower share of gold sessions.
  • Opportunities — each with a suggested action. E.g. a referrer whose visitors almost all bounce, a landing page with lots of traffic but few gold sessions, or a page people read properly and then leave from without going further.

The findings are calculated directly from your data with fixed rules — no AI involved — and only appear when there's enough data to say something. If nothing stands out, the page says so.

With Search Console connected you also get search findings: queries that have climbed or dropped in the rankings, pages in the top 10 with many impressions but a low click-through rate, and queries ranking 11–20 that are close to page 1.

Optimize (add-on)

Optimize is a paid add-on, bought per site on top of your subscription. Without it, the page shows how many pages on your site have potential — the list itself and the tools need the add-on, which you can enable directly from the page (VAT is calculated at checkout, cancel any time).

Pages with potential

We score your pages on two axes over the last 28 days (widened automatically if there's too little data):

  • Search potential — people see the page in Google but don't click. Requires Search Console. Fix: the snippet.
  • Page potential — people arrive but leave quickly. Fix: the page itself.

Pages with little data are labelled "Thin data" — treat them as a lead, not a conclusion.

Why do they leave?

Runs a simulation of the page with synthetic visitors built from the page's real search queries (you can remove irrelevant queries with ×). It takes 1–5 minutes, and only one simulation runs at a time. The result is a report with the findings. Remember: it's a prediction, not measured behaviour — use it to decide what to test. A few days after a simulation, the page shows how CTR, position and bounce rate have moved since.

The simulation is run by our sub-processor ThinkAloud (EU), which receives the page URL and aggregated search queries — never visitor data. See the DPA.

Improve snippet

AI suggestion (Mistral, EU) for a better search-result title and description, based on the page's current title and meta description. If the snippet isn't the real problem, it says so instead of forcing a rewrite. Each suggestion counts toward your monthly AI quota.

SERP health

A sub-page under Optimize that analyses 90 days of Search Console data for structural problems:

  • URL variants — the same page appearing under several URLs (http/https, www, trailing slash, parameters), which splits its authority. Fix: a canonical tag or 301.
  • Cannibalisation — queries where two or more of your pages rank. Split between actionable cases and natural overlap, with a recommendation for each.

The report can be downloaded.

Team access

Two levels:

Account level

Go to Team in the sidebar. Invite a colleague to the whole account — they automatically get access to all your existing sites AND any future sites you create. Roles: admin (can change settings) or viewer (read-only).

Site level

In the site settings under "Team": invite a user to that single site only. Roles: admin, viewer.

The two levels are independent — you can have people at account level AND extra people on individual sites.

No-cookies badge

Enabled per site in the settings. Shows a small floating "No cookies" pill in the bottom-left corner of your site. When visitors click it, a small overlay explains:

  • That no cookies, localStorage or fingerprinting are used
  • That traffic is counted anonymously via a daily-rotating hash
  • That data is stored in the EU (Germany)
  • A link to our legal page on why you don't need a cookie banner

Good for building trust — and a free marketing channel for us.

Google Analytics: import and forwarding

Both are set up in the site settings under GA4 Forwarding and require the admin role on the site.

Connect

  • Connect with Google — we find the GA4 web data stream that matches your site's hostname, create a Measurement Protocol secret, and also get read access for import.
  • Manually — enter the Measurement ID (G-XXXXXXXXXX) and an API secret from GA4 Admin → Data Streams → Measurement Protocol. This gives forwarding only, not import.

Google may show an "unverified app" warning during sign-in; the connect screen explains how to continue.

Forwarding

Events are sent server-side to your GA4 property in real time, as well as being stored with us. Events GA4 reserves for itself are skipped. Optionally, turn on Send gold sessions to GA4: the first time a session becomes gold, a gold_session event is sent once on that session, so you can mark it as a key event in GA4 or read it per keyword in Google Ads.

Forwarding sends your visitors' events to Google. It's off until you turn it on — consider it in your own privacy policy. You can pause or remove it again at any time.

Import historical data

Under Import in the sidebar, choose a period (default: the last 90 days, at most one year per import) and click Import GA4 data. We fetch daily totals from GA4: pageviews, visitors, sessions, bounce rate, average duration, and top pages, devices and countries. Days we already have our own tracking data for are skipped — your own numbers are never overwritten. Re-importing a period updates the days imported earlier.

Imported days show up in the dashboard's chart (in orange) and in the totals for pageviews, visitors, sessions, bounce rate and average duration — only for days without our own tracking, and not when a category or segment filter is active. Top pages, sources, sessions, goals and the other panels show our own tracking only. GA4 defines bounce rate and session duration differently from us, so averages that mix imported and own days are approximate.

If you only want the import, you can remove forwarding afterwards — the import access is kept. If Import says it needs reconnecting, connect with Google again; your forwarding keeps working.

AI analysis

We use Mistral AI — a European LLM provider (France). Your analytics data is not sent to Google or any other US provider.

Ask questions about your data in plain language — e.g. "which page grew the most over the last 7 days?" or "where does my most engaged traffic come from?".

AI is optional. You can switch it off completely per site in the site settings.

Plans and billing

There is a free plan and three paid plans. They differ in events per month, number of sites, how long data is kept, and AI questions per month — see pricing for current prices and limits.

  • Events are counted per month across all the sites you own. When the limit is reached, new events are not recorded for the rest of the month — your site keeps working as normal.
  • Sites: you can't create more sites than your plan allows. Sites you've been invited to don't count.
  • Retention follows the plan of the site's owner. Older events are deleted automatically.
  • Team members (on a site or for the whole account), new API keys and custom tracking domains require a paid plan. Existing API keys and team members keep working if you move to Free.
  • Traffic you exclude with an IP filter (see Account) doesn't count.

Billing

Go to Billing in the sidebar to see your current plan, this month's usage, and your latest invoices (view or download as PDF). Upgrade or switch plan from there. Payment runs through Stripe, and VAT is calculated at checkout. Manage subscription opens Stripe's portal, where you change payment method, downgrade or cancel. A cancelled subscription runs until the end of the period. The Optimize add-on is bought separately per site.

Account: data export and deletion

Under Account (bottom of the sidebar) you change your name and email preferences — and you'll find:

Filter your own traffic

Add IP addresses or ranges (CIDR) whose traffic is excluded across all your sites. The filtering happens before anything is stored.

Export your data

Export my data (JSON) gives you what we store about your account (GDPR Art. 20): profile, sites and your role on them, subscription, and the latest 1,000 events per site. For full analytics data, use Export on the site's dashboard: daily summary or raw events, as CSV or JSON, for the period you've chosen.

Delete your account

In the Danger Zone, type your email to confirm. We don't delete immediately: you are signed out, and the account is permanently deleted after 30 days. Tracking on your sites stops straight away, and any paid subscription and add-ons are set to end at the close of the current period, so you won't be charged again. Sign back in before the 30 days are up to cancel the deletion — your subscription then continues as before. After 30 days, your account and every site you're the only owner of are deleted with all their data; sites you share with another owner are kept for them.

Read more in our privacy policy and DPA.

GDPR & cookies

Web-Tracking.eu is built to be compliant out of the box:

  • No cookies — we set no tracking cookies. A hash-based client ID is generated server-side and rotates daily.
  • No localStorage or any other storage on the device.
  • No IP storage — we do GeoIP lookups on the fly and only store country + city.
  • No Schrems II issues — everything is processed and stored in Germany.
  • No cookie banner needed under Article 5(3) of the ePrivacy Directive. Read the legal basis.
  • DPA available — see our standard data processing agreement.
  • 14-day right of withdrawal on all subscriptions.

API

Programmatic access to your data:

Stats API

GET /api/stats/{siteId}?range=7d
Authorization: Bearer YOUR_API_KEY

Events API

GET /api/events/{siteId}?range=7d&event=page_view&path=/blog

Create API keys in the site settings. Each key has a scope (stats:read or events:read).

MCP server (AI agents)

We run a Model Context Protocol (MCP) server that lets AI assistants such as Claude Desktop, Cursor and Continue talk directly to Web-Tracking.eu — so you can get help with setup and ask about your analytics in plain language.

1. Connect Claude Desktop (anonymous)

Free and no login required. Open claude_desktop_config.json (Windows: %APPDATA%\Claude\, macOS: ~/Library/Application Support/Claude/) and add:

{
  "mcpServers": {
    "web-tracking": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://web-tracking.eu/api/mcp"]
    }
  }
}

Restart Claude Desktop. You can now ask:

  • "Help me install Web-Tracking on my Shopify store"
  • "Check whether the script is installed correctly on my-site.com"
  • "Where is the DNS for example.com hosted?"

Anonymous tools:

  • suggest_install_method — describe your website, get the right guide
  • check_install — check whether the script is installed correctly on a URL
  • detect_dns_provider — find out where a domain's DNS is hosted
  • get_install_guide — link to a platform-specific guide

2. Connect your own data (authenticated)

Create an API key in the site settings with the scope "All + MCP server access". Add it to the same config file:

{
  "mcpServers": {
    "web-tracking": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://web-tracking.eu/api/mcp",
        "--header",
        "Authorization: Bearer wt_YOUR_API_KEY"
      ]
    }
  }
}

Other clients (Cursor, Continue, etc.) that support HTTP MCP directly can use the URL format:

{
  "mcpServers": {
    "web-tracking": {
      "url": "https://web-tracking.eu/api/mcp",
      "headers": { "Authorization": "Bearer wt_YOUR_API_KEY" }
    }
  }
}

Extra tools (only for the site the key belongs to):

  • list_my_sites
  • get_site_stats(range) — pageviews, visitors, top pages, top referrers, countries
  • get_insights — auto-detected opportunities, warnings and wins
  • get_intent_mismatches — Search Console + bounce rate
  • mark_page_change(path, title) — mark a page change so we can measure before/after
  • get_change_impact(annotationId) — see the 14-day before/after for a marker

Examples you can ask your AI

  • "Help me install Web-Tracking on my Shopify store"
  • "Check whether the script is installed correctly on my-site.com"
  • "How has my traffic developed over the last 30 days?"
  • "Which keywords do I have an intent mismatch on?"
  • "Mark that I rewrote the intro on /products/course today"
  • "Did my change on /home (annotation ID 12345) work?"

Security

The API key is site-scoped: a key issued for site A can only read/write data for site A. You can delete keys again in the site settings.