Install on a plain HTML site | TrueStat

This is the baseline. Every other install page is a variation on it.

The tag

Copy this from your site's install page in the app, where your real site key is already filled in.

<script
  defer
  data-website-id="ts_a1b2c3d4e5f6"
  data-domain="example.com"
  src="https://truestat.io/js/t.js"
></script>

screenshot coming

The install page with the "Plain HTML" platform tab selected, snippet rendered with a real site key, copy button visible. Light theme, desktop 1440px.

Where it goes

Inside <head>, on every page:

<!doctype html>
<html lang="en">
  <head>
    <meta charset="utf-8" />
    <title>Example</title>

    <script
      defer
      data-website-id="ts_a1b2c3d4e5f6"
      data-domain="example.com"
      src="https://truestat.io/js/t.js"
    ></script>
  </head>
  <body>
    …
  </body>
</html>

If your pages share a header include or a template, put it there once. If they do not, you have to paste it into each page — and a page without the tag records nothing, silently.

The two required attributes

Attribute	Value
`data-website-id`	Your site key, `ts_` followed by 12–32 lowercase letters and digits
`data-domain`	Your root domain, no scheme and no path: `example.com`

Everything else is optional. See Script options for the full list.

Verify

Load a page, then check the install page in the app — it flips to Connected within seconds of the first view.

To check yourself: open DevTools → Network, reload, and look for a POST to /api/events returning 202. See Verifying it works.

Things that will catch you out

Testing on localhost sends nothing. Tracking is off on localhost and 127.0.0.1 unless you add data-allow-localhost="true". Read Localhost and development first — the events you generate that way land in your real numbers.

Opening the file directly does nothing. A page loaded over file:// is not tracked unless you add data-allow-file-protocol="true". Serve over HTTP instead if you can; it is closer to what your visitors will do.

A Content Security Policy will block it silently. If your server sends a Content-Security-Policy header, you need to allow both the script and the POST:

Content-Security-Policy: script-src 'self' https://truestat.io; connect-src 'self' https://truestat.io;

connect-src is the one people miss — the script loads fine, no error appears, and every event is blocked. Full detail in Content Security Policy.

Ad blockers. Some visitors will not be counted. See The script is blocked by an ad blocker.