Add your first site

A site in TrueStat is one tracked website. It has its own script tag, its own dashboard, its own exclusion rules and its own share links. Nothing is shared between two sites except your billing.

Steps

1. Open Sites in the sidebar and click Add a site.

2. Enter the domain — just the hostname, no scheme and no path: example.com, not https://example.com/ and not www.example.com.

3. Give it a name. This is only a label in your own sidebar, so call it whatever you will recognise. Between 1 and 120 characters.

4. Save. TrueStat generates your site key and opens the setup — four short steps on one screen at a time: whether to serve the tag from your own domain, the tag itself with the key already in it, whether to report AI crawlers, and the wait for your first visit. Every step can be skipped and finished later from the site's settings.

There is no timezone to pick. Every chart and every "Today" preset follows the clock of whoever is looking — see Which timezone.

What the domain field is for

The domain is not decoration. Two things check against it:

• Cross-origin responses. When a page on your domain sends an event, the collector echoes the browser's Origin header back only if that hostname matches your domain or one of your extra allowed hostnames. Subdomains of your domain match automatically — a site registered as example.com running the tag on blog.example.com is fine with no extra configuration.

• www is ignored. www.example.com and example.com are treated as the same host, in both directions.

If the hostname does not match, the event is still recorded. Only the response becomes unreadable to the browser, which is a diagnostic, not data loss. You will not lose traffic because you forgot to list a subdomain.

To track a hostname that is not a subdomain of your registered domain — say example.com and example.org on one dashboard — add it under Allowed hostnames in the site's settings.

Your site key

The key looks like this:

ts_a1b2c3d4e5f6

It always starts with ts_ followed by 12 to 32 lowercase letters and digits.

It is not a secret. It ships inside every visitor's HTML, so anyone who views the source of your page can read it. That is by design — it is an address, not a credential. What stops someone else writing to your site is the origin check, the per-site rate limit, and the fact that a forged event is a forged event: nobody gains anything by inflating your view count.

Your API key is a different thing entirely and is a secret. See Getting an API key.

Site limits per plan

How many sites you can add is set by your tier, not by your traffic:

If you try to add one more than your tier allows, the save is refused with an upgrade prompt rather than partially succeeding. See Plans compared.