Every attribute the tag accepts, its default, and what it does.
Some options below describe behaviour of the tracking script, which is being built now. Where an option is not yet live, it is marked. The two required attributes and the collector's limits are shipped and enforced today.
Required
| Attribute | Value |
data-website-id | Your site key: ts_ followed by 12–32 lowercase letters and digits. Copy it from the install page; a malformed key is rejected with a 400 before any lookup happens. |
data-domain | Your root domain — hostname only, no scheme and no path. example.com, not https://example.com/. A www. prefix is ignored on both sides of the comparison. |
Optional
| Attribute | Default | What it does |
data-allowed-hostnames | (empty) | Comma-separated extra hostnames allowed to send events for this site. Subdomains of data-domain are already allowed without listing them. Mirrors the Allowed hostnames field in the site's settings. |
data-api-url | (the default collector) | Send events somewhere else — a full URL, or a path relative to the page's origin. This is what makes proxying work. See Serving the script from your own domain. |
data-allow-localhost | false | Track on localhost and 127.0.0.1. Off by default so development traffic does not silently enter your real numbers. See Localhost and development. |
data-allow-file-protocol | false | Track pages opened over file://. |
data-disable-console | false | Silence every console message the script emits. Set this in production if you would rather not surface tracking warnings to your visitors. |
data-ts-allow-iframe | false | Track when the page is inside an iframe. Off by default because an embedded page normally gets counted once by the parent already, and tracking both double-counts. |
data-ts-track-hash | false | Also record a view when only the URL fragment changes (/#/dashboard → /#/settings). Only needed for hash-based routers. See Single-page apps. |
data-ts-mode | (absent) | Present as strict when the site is set to the strictest cookieless mode. It documents which mode the tag was copied for; the server is authoritative either way. See Identity and cookieless mode. |
Attributes we deliberately do not have
data-debug does not enable debug logging. If you are migrating from
DataFast, this is the one attribute whose meaning is not what its name suggests
there — it allows tracking inside iframes. We call that data-ts-allow-iframe,
which is what it does. data-debug is accepted as a silent alias for now, but
use the new name.
Logging is controlled by data-disable-console, in the other direction: it is
on by default and you turn it off.
There is no attribute to disable payment tracking, because there is no payment or revenue tracking to disable.
A full example
<script
defer
data-website-id="ts_a1b2c3d4e5f6"
data-domain="example.com"
data-allowed-hostnames="docs.example.com,example.org"
data-allow-localhost="true"
data-disable-console="true"
src="https://truestat.io/js/t.js"
></script>Most sites need none of the optional ones.
What the script sends
Every event carries a small, fixed set of fields:
| Field | From |
| Site key | data-website-id |
| Event type | view, goal, scroll or link_click |
| Path | location.pathname, up to 500 characters |
| Referrer | document.referrer, up to 2,048 characters |
| Name | Required for goal and scroll events |
| Parameters | Your custom parameters, if any |
Everything else on your dashboard — country, region, city, browser, operating system, device, whether the request was a crawler — is derived on our servers from the request itself. The script does not read them and cannot send them. That is deliberate: a script that could name its own country or claim not to be a bot would make those numbers meaningless.
The whole request body is capped at 8 KB. In practice only a very large custom event gets near that.
Where the script's configuration comes from
The script reads its attributes from its own <script> element. If it cannot
find that — which happens with some tag managers — it falls back to the first
element in the document carrying a data-website-id attribute.
This matters in one place: do not put two TrueStat tags on the same page. See Duplicate events.