Analytics

What Analytics sees about this visit

The verdict below fuses your browser's runtime signals with the server-side IP / ASN / header / TLS-fingerprint (JA3) analysis, and counts the visit against your site.

Add Analytics to your site

One tag, no account, cookieless by default. We generate an unguessable siteId (a UUID) for your site — it is your private read key, so keep it. Copy the snippet below; your dashboard reads it back.

Off is Privacy mode — the zero-config, cookieless default: no banner, no consent needed, every visitor counted anonymously. On is Loyalty mode: Analytics adds one first-party, same-site cookie behind its own consent banner to tell new visitors from returning ones, writing the cookie only after the visitor clicks Accept. Restyle the banner with the CSS variables --loxal-analytics-bg, --loxal-analytics-fg and --loxal-analytics-accent; or, if you run your own consent platform, swap &banner=true for &cmp=external and call window.loxalAnalytics.consent('granted') yourself. You are responsible for obtaining visitor consent — see the Privacy Policy and Terms § 9.4.

Off (the default) keeps the tag performance-metric-free — no PerformanceObserver, no extra beacon, zero measurement overhead on your visitors' page loads. On adds a small in-page collector that reports Google's Core Web Vitals (Largest Contentful Paint, Interaction to Next Paint, Cumulative Layout Shift, Time to First Byte) on visibilitychange via navigator.sendBeacon. The dashboard then shows a P75 field-metric row so you see the 75^th-percentile experience your real users get, not just a lab number. Vitals never affect the bot verdict and never carry personal data.

Off (the default) keeps the tag attention-tracking-free — no scroll or click listeners, no visible-time accounting, one beacon per visit. On adds three shape-of-visit counters — visible time on page (capped at 30 min), deepest scroll depth as a percentage of document height, and a small integer interaction count (click / keydown / pointerdown, each counted once per visit). The dashboard shows the median plus an engaged-rate KPI (share of visits with ≥ 10 s visible, ≥ 50 % scroll, or ≥ 1 interaction). No DOM contents, no URLs, no personal data — only structural counters that describe the visit's shape.

Off (the default) keeps the tag navigation-blind — no delegated click listener, no anchor introspection. On adds a single capture-phase click handler that classifies each anchor click as external (destination host differs from your site) and/or download (path ends in .pdf, .zip, .csv, .xlsx, .docx, .mp4, and other common file types). The dashboard shows two TOP-N panels: top outbound hosts and top downloads. Only the destination host and/or the lowercased file extension leave the browser — never the raw href, path, query, or fragment. Same-host non-download navigations are ignored (already counted as page views).

  Your siteSecret is the write key for changing settings (e.g. data retention) from the dashboard. The siteId is public (it ships in the snippet); the siteSecret must stay private. Both are generated in your browser and kept in localStorage only — clearing browser data or switching device/browser loses them with no recovery, so save the siteId + siteSecret pair somewhere safe.

One tag counts JS and non-JS clients alike: the browser fetches it (recorded server-side from IP / JA3 / TLS / User-Agent), and JavaScript clients also enrich the visit with runtime signals — cookieless by default, no separate tag, no double-counting.