Web analytics without the script

The analytics snippet (<script defer data-site="KEY" src="https://seolyticize.com/a.js">) is the easy way in. Under it is one endpoint, which a framework, an edge function or a server can call directly.

The request

curl -X POST https://seolyticize.com/api/collect \
  -H "Content-Type: text/plain" \
  -d '{"k":"<site key>","n":"pageview","u":"https://example.com/pricing","r":"https://www.google.com/"}'

The body is JSON, at most 4 KB. Send it as text/plain from a browser so no CORS preflight is needed; application/json works from a server. Every accepted event answers 202 with no body.

What is kept

• The path only. The query string and fragment are dropped, after the utm_* tags are read out of it. Send the URL without other parameters anyway: a reset token or an OAuth code should not travel at all.

• The referrer's domain, as the visit's source.

• No cookies, no stored identifier: a visitor is a hash of the site key, the address and the user agent with a salt that changes daily. The address is never stored.

• Paths the setup excludes are dropped on arrival: set_up_web_analytics {clientId, excludePaths: ["/app/*", "/verify", "/reset"]}, or includePaths to record only those.

From a server

The visitor hash uses the address the request comes from. Sent from your own server, every event shares the server's address and counts as one visitor, so pass each visitor's real address the way your platform's proxy does, or send events from the browser. Requests from bots are accepted and quietly dropped; one visitor sending too fast is answered 429.

Answers