Install, verify, and understand Counter.

Installation

Install the browser collector

1. Create a site and add every allowed domain.
2. Paste the dashboard’s deferred script immediately before </body>.
3. Open the site in a normal browser, then check collection diagnostics.

If your Content Security Policy blocks the script, add Webcounter.ca to script-src and connect-src.

Framework recipes

WordPress, site builders, and SPAs

WordPress and site builders: place the snippet in the global footer or approved custom-code area.

React, Vue, Svelte, and other SPAs: install the snippet once. Counter observes history navigation; call counter('pageview') only when a route changes without updating the URL.

Server-rendered frameworks: put the snippet in the shared root layout so it appears once on every page.

Consent and privacy

Cookieless by default

The default identity mode sets no visitor cookie. If you select cookie_on_consent, call counter('consent', true) only after affirmative consent and counter('consent', false) when it is withdrawn.

Do Not Track and Global Privacy Control are respected by default. Raw visitor IP addresses are not stored in the analytics event stream.

What exactly counts as a visitor, a session, a bounce, or a returning visitor?

Traffic quality

Exclude your own browser

Use the one-day, 30-day, or one-year controls in the site’s Settings tab. The choice is stored on the tracked domain, scoped to one site, and confirmed on that page.

For custom controls, use counter('ignore', 30), inspect counter('ignored'), and restore collection with counter('include').

Automatic events

Outbound links and downloads

Add data-track-outbound="true" or data-track-downloads="true" to the snippet. Downloads use a conservative default extension list, customizable with data-download-extensions="pdf,csv,zip".

The emitted taxonomy is outbound_click and file_download. Payloads contain only destination host/path or file path/extension—never query strings or fragments.

Troubleshooting

No events are arriving

1. Confirm the snippet’s data-site matches the dashboard slug.
2. Confirm the current hostname is in the allowed-domain list.
3. Check the browser network panel for /c.js and /api/collect.
4. Check CSP, privacy extensions, DNT/GPC, and own-browser exclusion.

The collection endpoint does not explain why it accepted or rejected a hit. Check Collection diagnostics in the dashboard for details.

Customer API

Read and manage programmatically

Two kinds of bearer credential: a read-only API key and a read/write secret key. Send either in the Authorization header—never a query string. Responses use one stable {ok,data,error} envelope.

Visitor feeds use opaque cursor pagination. Keep the returned cursor unchanged and stop when has_more is false.

Read the full API docs · Download the OpenAPI 3.1 contract · Giving a key to an automated agent? Start with /llms.txt.

Uptime monitoring (beta)

Know when an HTTPS site is down

Monitoring checks whether an HTTPS URL responds; it does not confirm that Counter is receiving analytics. Check Collection health first when traffic stops. Add a registered HTTPS URL in the site's Monitoring tab. Two failures confirm downtime and two successes confirm recovery.

Enable browser notifications per device in Account settings. Alerts can also use the owner's verified email. Checks run from one Canadian region, and a complete Webcounter.ca outage can delay alerts.

Still stuck?

Get support

Include the site slug, approximate UTC time, browser, and the failing step. Do not send passwords, API keys, recovery codes, or raw visitor data.

Email support · Service status