Install the browser snippet

For sites that can't run server code or sit behind Cloudflare: Squarespace, Wix, and any builder that lets you paste code into the page header.

Where you can, use an edge install as well (Next.js package or Cloudflare Worker). The snippet only sees visitors that run JavaScript, so on its own it misses most crawlers, fetchers and coding agents, and the dashboard marks the site as a browser-only view whose agent numbers are a floor. With both installed, Punchline merges them: page loads aren't counted twice, and the snippet adds in-page navigations and in-browser agent signals.

1. Get your install code

Dashboard → Site settings. Copy the line under Browser snippet:

<script async src="https://<collector>/s.js?site=<your-site-id>"></script>

Under Allowed hostnames, list every hostname the site is served from, one per line (for example example.com and www.example.com). The collector ignores reports from any other host. Save.

2. Paste it into your site

Squarespace

Settings → Advanced → Code Injection → Header. Paste, then Save. (Code Injection needs a Business plan or higher.)

Wix

Settings → Custom Code (under Development & integrations) → + Add Custom Code. Paste; Add Code to Pages: All pages, Load code once; Place Code in: Head. Apply. (Needs a premium plan with a connected domain.)

Webflow

Site settings → Custom code → Head code. Paste, Save, then Publish. Webflow can also use the Cloudflare Worker for the full picture.

WordPress

Use a header-code plugin (for example WPCode: Code Snippets → Header & Footer → Header), or add the line to your theme's header.php before </head>.

Anything else

Paste the line inside <head> on every page.

3. Check it

Open your site in a normal browser and click around. Within about ten minutes the dashboard shows the visits (reports refresh every 10 minutes).

What it does and doesn't do

• Sets no cookies and uses no browser storage. Its requests carry no cookies.
• Sends the page path (no query string), utm_* values, the referring site's hostname and the visitor's Global Privacy Control setting.
• Agent signals (optional, Site settings): checks for automation tools and counts clicks, key presses and pointer moves, plus whether input was made by script. Never which keys, any text, form contents or pointer positions. Off for EU/EEA/UK/Swiss visitors unless you turn it on (see the note on that setting).
• Loads asynchronously, about 1.3 KB compressed, and never blocks the page.
• Ad blockers may block it for some visitors. An edge install isn't affected.