Tracking scripts

VitalSentinel has two tracking scripts: the RUM script for RUM Monitoring and the Web Analytics script for Web Analytics. You paste one snippet on every page of your site, and both modules start to fill in from real visits.

The two scriptsCopy Anchor Link

You can install one script or both. In the setup screens, the RUM script is RUM Monitoring, and the Web Analytics script is Web Analytics.

For every option of each script, see RUM Script and Web Analytics Script.

One tracking ID for both scriptsCopy Anchor Link

Each domain in VitalSentinel has one tracking ID. Both tracking scripts use the same tracking ID in their data-key attribute. The Tracking ID field in domain Settings > Tracking says "One ID for both scripts."

A tracking ID belongs to one domain. To measure a subdomain, such as shop.example.com, add it as its own domain and install the tracking ID that it gets. See Add a Domain.

Before you startCopy Anchor Link

• You need a domain in VitalSentinel. See Add a Domain.
• You need access to the HTML template of your site, or to its Google Tag Manager container.
• Only workspace owners and admins can install the scripts and change the snippet options. Domain Settings is for owners and admins only: VitalSentinel sends a member to the domain Overview. On a module page, a member sees Ask a workspace admin in place of the install button.

Where to find the snippetCopy Anchor Link

The snippet with your real tracking ID is in three places in the app. All three show the same snippet.

The Tracking step of onboardingCopy Anchor Link

When you add a domain, the second onboarding step is Install tracking (marked Optional). The step says "Paste one snippet on your site and RUM Monitoring and Web Analytics start filling in."

1. In What to measure, select RUM Monitoring, Web Analytics or both. Both are selected by default, and at least one stays selected.
2. In Paste it on every page, select HTML or Google Tag Manager.
3. Click Copy on the Tracking snippet.
4. Paste the snippet on your site.
5. Click Continue.

If you are not ready, click Skip for now. You can install the scripts later from domain Settings > Tracking.

Domain Settings > TrackingCopy Anchor Link

In the sidebar, select Domain > Settings, then select the Tracking tab. The page has the Tracking ID field, a Real User Monitoring (RUM) card and a Web Analytics card. Each card has its own Install snippet, a status chip and an Options section.

The options are "Saved for everyone": they apply to every person on the domain. A change to an option takes effect only when you copy the snippet again and put it on your site. The options do not change the snippet that is live on your site now.

The setup side panel on a module pageCopy Anchor Link

If RUM Monitoring or Web Analytics is not installed, its pages show the chip Not installed yet and the button Install the script. The button opens a side panel, Install RUM Monitoring or Install Web Analytics, with the snippet for that one script.

The panel has a checkbox to add the other script to the same snippet: Also measure real-user performance with RUM Monitoring (same script) or Also add Web Analytics (same script). The other script uses the same tracking ID.

Install the snippetCopy Anchor Link

Install with HTMLCopy Anchor Link

The HTML snippet is one <script> tag for each script. The app says "Paste it just before the closing </head> tag in your site's template."

<script src="https://rum.vitalsentinel.com/rum.js" data-key="YOUR_TRACKING_ID" async></script>
<script src="https://analytics.vitalsentinel.com/analytics.js" data-key="YOUR_TRACKING_ID" async></script>

The copied snippet has your real tracking ID in place of YOUR_TRACKING_ID. It also has the options that you set in domain Settings > Tracking. The scripts load with async, so they do not block your page.

For the steps on each CMS and framework, see Platform Guides.

Install with Google Tag ManagerCopy Anchor Link

The Google Tag Manager snippet builds the script element in code, with the tracking ID and the options inside the code. Use this form in Google Tag Manager.

1. In Google Tag Manager, create a new tag of the type Custom HTML.
2. Paste the Google Tag Manager snippet from VitalSentinel into the tag.
3. Set the tag to fire on all pages.
4. Publish the container.
5. Open your site once in a browser.

The install check cannot see scripts that Google Tag Manager adds. Thus, the status of a script from Google Tag Manager changes only when the first visit arrives. See Check the installation.

Choose a privacy modeCopy Anchor Link

The tracking scripts have two privacy modes: consent-free (the default) and with a consent banner. Whether your site needs a consent banner is your decision.

Consent-free mode (the default)Copy Anchor Link

By default, the scripts save nothing on the visitor's device: no cookies, no local storage, no session storage. You still get Core Web Vitals, JavaScript errors, visitors, traffic sources and conversions.

The scripts do check a few things in the browser, such as the window size and whether the visitor asked not to be tracked. In every mode, VitalSentinel finds the country, browser, operating system and device type on its servers. It uses the information that every browser sends with each request.

To use this mode, paste the snippet as it is. Load it first, on every page and for every visitor. The scripts store nothing, so they start to measure on the first page load.

Use the scripts with a consent bannerCopy Anchor Link

If your site has a consent banner, tick My site has a consent banner below the snippet in the Tracking step or the setup side panel. The section Have a consent banner? Call these from it then shows the calls for your banner:

// When the visitor accepts
window.VitalSentinelRUM.grantConsent('persistent');
window.VitalSentinelAnalytics.grantConsent('persistent');

// When the visitor rejects, or withdraws consent
window.VitalSentinelRUM.revokeConsent();
window.VitalSentinelAnalytics.revokeConsent();

Add the reject call too, so that a visitor can take back their consent. When a visitor accepts, the scripts add device details and keep a visitor ID in local storage. When the visitor rejects or withdraws consent, the scripts stop this and delete the IDs that they stored.

What the consent banner calls changeCopy Anchor Link

Each call changes the script that runs on the page now. You do not need to change the snippet or reload the page. The next event carries the new consent level.

For visitors who send Do Not Track or Global Privacy Control, the scripts count the visit without storage. If such a visitor accepts your banner, the grant call wins over the browser signal. A consent level that you write in the snippet does not win over the signal.

The details of each consent level are on the reference pages: RUM Script and Web Analytics Script.

"Consent is already set for this domain"Copy Anchor Link

You can also declare consent in the snippet itself, in domain Settings > Tracking > Options. Use Consent mode for RUM and Storage mode for Web Analytics.

If an option there declares consent, the snippet card in the Tracking step and in the setup side panel shows the callout Consent is already set for this domain. This means that the snippet already declares consent. Install such a snippet only on pages where your banner has the visitor's consent.

Check the installationCopy Anchor Link

The Is it working? card is next to the snippet in the onboarding step and below it in the side panel. The card says "After pasting, open any page on your domain, then check."

1. Paste the snippet on your site and publish the change.
2. Open any page of your site in a browser.
3. Click Check installation.

VitalSentinel then loads the homepage of your domain. It looks in the HTML for rum.js and analytics.js with the tracking ID of this domain. A message then shows the result, for example "Checked – RUM found, Web Analytics not found".

You do not need to wait on this screen. The status "turns green on its own once the first visit arrives."

Install check resultsCopy Anchor Link

The Is it working? card shows one status for each script that you selected.

If the check cannot load your homepage, VitalSentinel keeps the previous result. If the check fails, a message says "Couldn't check the installation".

"We found a Google Tag Manager container"Copy Anchor Link

If the script is not in the HTML but the page has a Google Tag Manager container, the card shows We found a Google Tag Manager container. The callout says: "Scripts added there can't be read from your page. Publish the container, open your site once, then check again."

Data wins over the install check. When a visit arrives from a script in Google Tag Manager, the status changes to Receiving data.

The status chip in Settings > TrackingCopy Anchor Link

In domain Settings > Tracking, the Real User Monitoring (RUM) and Web Analytics cards each show a status chip:

If a visit arrived before, the card also shows Last visit with the date and time.

When the first data arrivesCopy Anchor Link

Numbers appear within minutes of the first real visit. Until then, the RUM Monitoring and Web Analytics pages show Waiting for the first data with the line "The script is on your page. Numbers appear within minutes of a visit."

VitalSentinel marks a script as stopped when no data arrives for much longer than is usual for your site. This never happens before 48 hours without data. The module page then shows No new data from your domain, with the date in Last data. The page says: "The script may have been removed in a deploy, or the site has had no visitors."

The page also says "Your history is kept." To get the snippet again, click Reinstall the script.

TroubleshootingCopy Anchor Link

Why does the install check say "Not found on your page"?Copy Anchor Link

The install check loads the homepage of your domain (https:// and your domain) and reads its HTML. It follows a redirect only to the same host or its www form. It looks for rum.js and analytics.js with the tracking ID of this domain.

• If you changed the template but did not publish the change, publish it.
• If your site uses a cache or a CDN, clear the cache.
• If the snippet is only on some pages, add it to the homepage too.
• If a tag manager, a plugin or your framework adds the script with JavaScript, the check cannot see it. Open your site once and wait for the first visit.

Data wins over the install check. When a visit arrives, the status changes to Receiving data, whatever the check found.

Why does it say "Couldn't check the installation"?Copy Anchor Link

The install check could not read your homepage. The message then says "We could not read your page" and gives the reason:

VitalSentinel then keeps the previous result. A failed check does not mean that the script is missing.

Why does the install check not find a script that I added with Google Tag Manager?Copy Anchor Link

The install check reads the HTML of your homepage. It cannot see tags that Google Tag Manager adds in the browser. If the page has a container, the card shows We found a Google Tag Manager container. Publish the container and open your site once. The status changes to Receiving data when the first visit arrives.

Why does my Google Tag Manager tag send no data?Copy Anchor Link

• If you saved the tag but did not publish the container, click Submit and then Publish in Google Tag Manager.
• If the tag uses a trigger other than All Pages, it does not fire on every page. Use All Pages.
• If you pasted the HTML form of the snippet, replace it with the Google Tag Manager form.
• If you only tested in Preview, your real visitors do not get the tag yet. Publish the container.

To see if the tag fires, click Preview in Google Tag Manager. Tag Assistant shows the tags that fired and the tags that did not fire. See Platform Guides.

Why does it say "Found with a different tracking ID"?Copy Anchor Link

The snippet on your site has the tracking ID of another domain. This can occur when you copy a snippet from the wrong domain. Copy the snippet from this domain in domain Settings > Tracking and replace the old snippet.

Both scripts must use the same tracking ID: the one in the Tracking ID field of this domain. If the RUM script has one ID and the Web Analytics script has another, the data goes to two different domains. Replace both tags with one new copy of the snippet.

How do I allow the scripts in my Content Security Policy?Copy Anchor Link

A Content Security Policy (CSP) is a security header that tells the browser which hosts a page can load scripts from and send data to. If your site has a CSP, the browser blocks hosts that are not in it. The browser console then shows an error that says that it refused to load the script or to connect.

The scripts load from two hosts and send their data to a third host:

Which CSP directives do I add for VitalSentinel?Copy Anchor Link

Add the hosts to the directives that your policy already has. Do not replace your other hosts.

script-src 'self' https://rum.vitalsentinel.com https://analytics.vitalsentinel.com;
connect-src 'self' https://app.vitalsentinel.com;

If a script loads but no data arrives, the connect-src directive is usually the cause. If you install with the Google Tag Manager form, your policy must also allow Google Tag Manager and its Custom HTML tags.

Why does a caching, minification or JavaScript delay plugin stop the scripts?Copy Anchor Link

Each script reads the tracking ID from the data-key attribute of its own <script> tag. If a plugin combines the script into another file or rewrites the tag without the attribute, the script has no tracking ID and does nothing. The Web Analytics script then writes [VitalSentinel Analytics] Missing data-key attribute in the browser console.

Some plugins delay all JavaScript until the visitor moves the mouse, scrolls or touches the screen. Then a visitor who leaves without an interaction sends no data. To prevent these problems, exclude rum.vitalsentinel.com and analytics.vitalsentinel.com from these plugin settings:

• Combine, merge or concatenate JavaScript
• Defer or delay JavaScript
• Minify inline or external JavaScript

In WP Rocket, the Delay JavaScript execution setting is on the File Optimization tab. Add the two host names to the Excluded JavaScript Files field. After each change, clear the cache of the plugin.

Does Cloudflare Rocket Loader change the scripts?Copy Anchor Link

Rocket Loader is a Cloudflare setting that delays the JavaScript of a page until the page shows. It changes how your script tags load. To keep Rocket Loader away from the VitalSentinel scripts, add data-cfasync="false" to each tag, before src:

<script data-cfasync="false" src="https://rum.vitalsentinel.com/rum.js" data-key="YOUR_TRACKING_ID" async></script>
<script data-cfasync="false" src="https://analytics.vitalsentinel.com/analytics.js" data-key="YOUR_TRACKING_ID" async></script>

Cloudflare reads this attribute only when it comes before src. The other scripts on your page still use Rocket Loader. You can also turn off Rocket Loader in your Cloudflare dashboard.

Why does my consent banner block the scripts?Copy Anchor Link

Some consent tools block every script until the visitor accepts. If your tool blocks the VitalSentinel scripts, VitalSentinel counts only the visitors who accept. Your numbers are then lower than your real traffic.

By default, the scripts save nothing on the visitor's device: no cookies, no local storage, no session storage. Whether they can load before consent is your decision. If you allow them, paste the snippet as it is and load it first. If your banner must control them, use the consent calls in Use the scripts with a consent banner.

What do ad blockers and privacy extensions block?Copy Anchor Link

Some ad blockers and privacy extensions block third-party scripts or the requests that they send. For a visitor with such a tool, VitalSentinel gets no RUM and no Web Analytics data. This affects only the visitors who use the tool.

Ad blockers do not change the parts of VitalSentinel that do not use the tracking scripts. Examples are Google Search Console data, Server Log Monitoring, Uptime Monitoring, CrUX Monitoring, Synthetic Monitoring and Site Health. To test your own install, turn off your ad blocker for your site.

Do Not Track and Global Privacy Control do not block the scripts. VitalSentinel still counts these visits, without storage.

What happens if the script is installed twice?Copy Anchor Link

Each script starts only once on a page. If a page has two copies, the copy that starts first measures the visit, and the second copy does nothing. Thus, two copies do not count a visit twice. The RUM script can write [VitalSentinel] Already initialized, ignoring duplicate init call in the browser console.

If the two copies have different tracking IDs, the data can go to the wrong domain. Remove the extra copy. A common cause is a snippet in the theme and a second one in a plugin or in Google Tag Manager.

Do the scripts work on a single page app?Copy Anchor Link

A single page app (SPA) changes the page in the browser without a full page load. React, Vue, Next.js, Nuxt and Wix sites often work like this.

• The RUM script finds these page changes on its own.
• The Web Analytics script records only the first page load by default. Set Single page app (SPA) mode to Enabled in domain Settings > Tracking > Web Analytics > Options. Then copy the snippet again and replace it on your site.

In SPA mode, links to an anchor on the same page do not count as a new page view. See Web Analytics Script.

Why are visits from my staging site or another host not counted?Copy Anchor Link

The two scripts use different host rules.

• Web Analytics accepts hits only from the exact host of the domain and its www form. It discards staging.example.com or shop.example.com under the tracking ID of example.com.
• RUM Monitoring skips localhost, private addresses, test domains and hosts such as staging.example.com or dev.example.com. It keeps other public hosts.

To measure a subdomain, add it as its own domain and install its tracking ID. See Add a Domain.

Why do some pages have no data?Copy Anchor Link

The scripts measure only the pages where the snippet runs. If your site has more than one template, layout or page builder, add the snippet to each one. The install check reads only the homepage, so a green status does not prove that every page has the snippet.

Also, the RUM script measures only the share of visitors in its Sample rate. A low sample rate on a page with few visits can give no data for some time.

Why do I see no data after I installed the scripts?Copy Anchor Link

If the status is Script found, waiting for the first visit, open a page of your site and wait a few minutes. If you test from localhost or a staging host, the scripts can skip your visit. If an ad blocker runs in your browser, turn it off for the test. Automated browsers, such as Selenium, Puppeteer or Playwright, send no data. For more causes, see RUM Script and Web Analytics Script.

What do I do for each "Is it working?" status?Copy Anchor Link

• Not detected yet: click Check installation.
• Not found on your page: publish the snippet, clear your cache, and add the snippet to the homepage.
• Found with a different tracking ID: copy the snippet from this domain and replace the old one.
• Script found, waiting for the first visit: open a page of your site. If the status stays after a visit, look for a CSP, an ad blocker or a delay plugin.
• Stopped receiving data: make sure that a deploy, a theme change or a plugin did not remove the snippet.
• Monthly limit reached: see Billing.

Why does Web Analytics show fewer page views than RUM Monitoring?Copy Anchor Link

The two scripts use different host rules. Web Analytics accepts hits only from the exact host of the domain (and its www form). RUM Monitoring also accepts other public hosts, such as *.translate.goog. Ad blockers, consent tools and the RUM Sample rate can also change each count. See the "Tracking IDs and hostnames" sections of the two reference pages.

RelatedCopy Anchor Link

• RUM Script - all options of the RUM script
• Web Analytics Script - all options of the Web Analytics script
• Platform Guides - install steps for each CMS and framework
• RUM Monitoring - what the RUM data shows
• Web Analytics - what the Web Analytics data shows
• Data Privacy - how VitalSentinel handles visitor data