Install on a plain HTML site

This is the baseline. Every other install page is a variation on it.

The tag

Copy this from your site's install page in the app, where your real site key is already filled in.

<script
  defer
  data-website-id="ts_a1b2c3d4e5f6"
  data-domain="example.com"
  src="https://truestat.io/js/t.js"
></script>

Where it goes

Inside <head>, on every page:

<!doctype html>
<html lang="en">
  <head>
    <meta charset="utf-8" />
    <title>Example</title>

    <script
      defer
      data-website-id="ts_a1b2c3d4e5f6"
      data-domain="example.com"
      src="https://truestat.io/js/t.js"
    ></script>
  </head>
  <body>
    …
  </body>
</html>

If your pages share a header include or a template, put it there once. If they do not, you have to paste it into each page — and a page without the tag records nothing, silently.

The two required attributes

Everything else is optional. See Script options for the full list.

Verify

Load a page, then check the install page in the app — it flips to Recording visits within seconds of the first view.

To check yourself: open DevTools → Network, reload, and look for a POST to /api/events returning 202. See Verifying it works.

Things that will catch you out

Testing on localhost sends nothing. Tracking is off on localhost and 127.0.0.1 unless you add data-allow-localhost="true". Read Localhost and development first — the events you generate that way land in your real numbers.

Opening the file directly does nothing. A page loaded over file:// is not tracked unless you add data-allow-file-protocol="true". Serve over HTTP instead if you can; it is closer to what your visitors will do.

A Content Security Policy will block it silently. If your server sends a Content-Security-Policy header, you need to allow both the script and the POST:

Content-Security-Policy: script-src 'self' https://truestat.io; connect-src 'self' https://truestat.io;

connect-src is the one people miss — the script loads fine, no error appears, and every event is blocked. Full detail in Content Security Policy.

Ad blockers. Some visitors will not be counted. See The script is blocked by an ad blocker.

What the tag cannot see

The tag runs in a browser. AI crawlers — GPTBot, ClaudeBot, PerplexityBot — fetch your HTML and never run JavaScript, so none of their visits reach it.

Catching them needs a few lines wherever your site is served from, which for a plain HTML site means your web server, your framework, or the CDN in front of it. There is a copy-paste snippet for each on Server-side tracking, including a plain HTTP version for anything not listed.

If your site is pure static files with nothing running in front of them, there is no server to report from and this step does not apply.