# Install the browser snippet

For sites that can't run server code or sit behind Cloudflare: Squarespace,
Wix, and any builder that lets you paste code into the page header.

**Where you can, use an edge install as well** ([Next.js package](https://www.punchlineanalytics.com/docs/install-nextjs) or [Cloudflare
Worker](https://www.punchlineanalytics.com/docs/install-cloudflare)). The snippet only sees visitors that run JavaScript, so on its own it
misses most crawlers, fetchers and coding agents, and the dashboard marks the
site as a *browser-only view* whose agent numbers are a floor. With both
installed, Punchline merges them: page loads aren't counted twice, and the
snippet adds in-page navigations and in-browser agent signals.

## 1. Get your install code

Dashboard → **Site settings**. Copy the line under *Browser snippet*:

```html
<script async src="https://<collector>/s.js?site=<your-site-id>"></script>
```

Under *Allowed hostnames*, list every hostname the site is served from, one
per line (for example `example.com` and `www.example.com`). The collector
ignores reports from any other host. Save.

## 2. Paste it into your site

### Squarespace
Settings → Advanced → **Code Injection** → *Header*. Paste, then Save.
(Code Injection needs a Business plan or higher.)

### Wix
Settings → **Custom Code** (under *Development & integrations*) → *+ Add Custom Code*.
Paste; *Add Code to Pages*: **All pages**, *Load code once*; *Place Code in*: **Head**. Apply.
(Needs a premium plan with a connected domain.)

### Webflow
Site settings → **Custom code** → *Head code*. Paste, Save, then **Publish**.
Webflow can also use the Cloudflare Worker for the full picture.

### WordPress
Use a header-code plugin (for example *WPCode*: Code Snippets → Header & Footer → Header),
or add the line to your theme's `header.php` before `</head>`.

### Anything else
Paste the line inside `<head>` on every page.

## 3. Check it

Open your site in a normal browser and click around. Within about ten minutes
the dashboard shows the visits (reports refresh every 10 minutes).

## What it does and doesn't do

- Sets **no cookies** and uses **no browser storage**. Its requests carry no cookies.
- Sends the page path (no query string), `utm_*` values, the referring site's
  hostname and the visitor's Global Privacy Control setting.
- **Agent signals** (optional, Site settings): checks for automation tools and
  counts clicks, key presses and pointer moves, plus whether input was made by
  script. Never which keys, any text, form contents or pointer positions. Off for
  EU/EEA/UK/Swiss visitors unless you turn it on (see the note on that setting).
- Loads asynchronously, about 1.3 KB compressed, and never blocks the page.
- Ad blockers may block it for some visitors. An edge install isn't affected.