Site settings reference

Settings at the end of a site's section in the sidebar opens the site's settings, split into 16 tabs. Opening them needs the sites.manage permission (Owner, Admin and Editor). Most settings are also API operations with the same permission.

General#

The site's identity and the defaults its reports use. One Save button stores the whole tab.

Hits are accepted only from the primary domain, the additional domains and any of their subdomains (www., shop. and so on). Hits from other hostnames are dropped. Cross-domain and subdomains explains when to combine domains and when to create separate sites.

Through the API, these are fields of PATCH /sites/<site id> (MCP: sites_update).

Tracking#

Everything needed to get data in: the snippet, install help, a check that it works, the key for server-side events and Web Vitals sampling.

Snippet generator#

Choose options and the snippet below them updates. Paste it into the <head> of every page. Each option becomes one attribute of the script tag:

The last four are covered in Exclusions and masking, and Script attributes lists every attribute.

Platform guides#

Short steps and ready code (already holding your site id) for HTML, WordPress, Shopify, Webflow, Next.js, Nuxt, Google Tag Manager, Ghost, Squarespace, Wix and Framer. The install guides cover these and more platforms in detail.

Verify installation#

Enter a page URL (the homepage is filled in) and click Verify. We fetch the page and report whether the script is there, whether it carries this site's id, and whether a Content-Security-Policy or Referrer-Policy header gets in the way. The URL must be on the site's primary or additional domains. The section shows when the site was last verified. See Verify your installation.

Server ingest key#

The key for sending events from your servers to POST /api/events.

• Create key shows the key once, with a ready curl example. We store only a hash of it, and afterward the tab shows just the key's prefix.
• Rotate key replaces it. The old key stops working immediately.
• Revoke removes it.

See Ingest keys.

Web Vitals sampling#

Sample rate (%) is the share of page loads that report Core Web Vitals when the vitals module is on. Free: up to 10%. Paid plans: any rate up to 100%. If the workspace moves to a plan with a lower maximum, that maximum applies without editing the site. Web Vitals don't count toward your event allowance. See Performance.

Through the API: GET /sites/<site id>/tracking/snippet (tracking_snippet), POST /sites/<site id>/tracking/verify (tracking_verify), POST and DELETE /sites/<site id>/tracking/ingest_key (tracking_ingest_key_rotate, tracking_ingest_key_revoke), and the vitals_sample_rate field of sites_update.

Privacy#

What is dropped, shortened or redacted before anything is stored, and how long data is kept. The first four sections are one form with a single Save button. Signals, URL rules and the scrubber apply to hits received after you save. Stored data is not rewritten.

Visitor signals#

See DNT and GPC.

URLs#

• Allowed query parameters: comma separated, for example page, lang. Query strings are removed before storage, except UTM tags, ref and the parameters you allow here. The tracker also removes other parameters in the browser, so list the same names in the snippet's data-params.
• Path masks: rows of a pattern and a replacement. A * matches exactly one path segment, so the pattern /u/*/settings with the replacement /u/:id/settings stores every user's settings page as one path. The first mask that matches a path is used. Add mask adds a row.

Path masks are applied on our servers. The snippet's data-mask does the same in the browser, before the path is sent.

PII scrubber#

Scrub personal data (on by default) redacts personal data from paths, referrers and event properties before storage. The tab lists the built-in rules, which PII scrubbing describes one by one.

Custom redaction rules add your own: a rule name and a regular expression per row, for example order_id and ORD-\d{6}. Matches are replaced with [redacted]. A pattern that is not a valid regular expression is refused when you save.

Data retention#

Data older than the chosen age is deleted automatically, once a day.

Only ages within the plan's limit are offered. Free: up to 6 months. Paid plans keep data without a limit, so every choice is available. The age in force is always the shorter of this setting and the plan's limit.

Redaction log#

How often each scrubber rule redacted something in the last 30 days. The redacted values themselves are never stored.

Through the API, the privacy settings are the honor_gpc, honor_dnt, allowed_params, path_masks, pii_scrubber, redaction_rules and retention_months fields of sites_update.

Integrations#

This tab has nothing to save. It shows what the site is connected to and links to the tools that work with it.

Search Console and Bing lists Google Search Console and Bing Webmaster Tools, each with the connected property or "Not connected". Connect (or Open) goes to the site's Search page for that provider. See Search Console and Bing.

More integrations links to:

The first four open workspace pages, which need their own permissions. The last two open pages of this site. Plugins for WordPress, Shopify, Cloudflare, Google Tag Manager and more are in the install guides.

Access#

Who can see this site, member by member. Using it needs the members.manage permission (Owner and Admin). Without it, the tab shows a message instead of the list.

• Owners and admins see every site. Their access can't be removed here.
• Other members see either all sites or only the sites granted to them.
• Ticking or clearing a checkbox saves at once.
• Clearing it for a member with "all sites" switches them to a list of the workspace's other sites. From then on, new sites are not added to their list automatically.
• You can't change a member who holds permissions you don't have.

A member without access to a site can't see it anywhere, including in lists, exports and the API. See Roles and permissions and Teams.

Through the API: GET and PATCH /sites/<site id>/access (MCP: sites_access_list, sites_access_update).

Danger zone#

• Transfer: send the site to another workspace. Someone with permission there accepts. The site id, data and settings move with it, so the snippet doesn't change.
• Reset data deletes events for a date range. It can't be undone.
• Delete site: confirm by typing the domain. The site is soft-deleted for 7 days (collection stops), then permanently deleted.