SITEPULSE INSTALLATION GUIDE · UPDATED 13 OCTOBER 2026
How to install SitePulse website analytics.
Add real-time traffic measurement to public pages without putting your private dashboard key in your website code.
Get the free app & Cloudflare setup steps ↗
WordPress: use a shared header.
Back up your site, then use an existing trusted header-insertion tool or your child theme’s shared header template. Paste your public tracking snippet before the closing head tag. Avoid changing a parent theme directly because updates can remove the change. Use an analytics consent category if your consent manager provides one. Clear the site cache and check both the homepage and a normal content page.
StackCP and static HTML websites.
Back up the affected files. Add the snippet once to your shared header or build template so future pages inherit it. If your site has separate HTML files, include it in every public page you want to measure. Rebuild and upload the changed files, then clear the hosting/CDN cache. Cloudflare DNS and StackCP hosting do not insert the tracker automatically.
Custom websites and page builders.
Add the snippet to the shared public layout or permitted global header-code setting. SitePulse watches normal page-path changes from the History API. Hash-only app screens and query-only changes are not reported as separate pages. Checkout, account, order, admin, sign-in and API paths are excluded in this free edition. Confirm your platform allows custom scripts; closed marketplace storefronts cannot be tracked this way.
Private keys stay private.
Use a randomly generated key of at least 32 characters. Save it as DASHBOARD_KEY in Cloudflare’s Secret field and in your password manager. The website script needs only your collector address and domain. Never add your key to the script or distribute your Cloudflare API credentials. Reports require the key even though the dashboard HTML is publicly accessible.
Check your privacy settings.
Explain the measurements and 30-day retention in your privacy notice. Avoid collecting paths that contain email addresses, private order references or other personal information. Do Not Track and Global Privacy Control stop the tracker. Existing analytics consent choices must still be respected; test both acceptance and refusal. Cookie-free does not mean every privacy obligation disappears.
Nothing appearing in the dashboard?
- Check that the Worker’s /health page reports database true and key_configured true. Health does not expose the key.
- Check your D1 binding is named DB and that setup.sql ran on the correct database.
- Check the website domain is in the generated Worker, including its root/www equivalent.
- View your page source and check the tracker appears once and uses your HTTPS Worker address.
- Clear page/CDN caches and visit a public page in a normal browser. Browser blockers, privacy signals and declined analytics consent can correctly prevent collection.
- If reports say invalid dashboard key, reconnect with the value saved in your password manager. Do not put it in the URL.
- Check Cloudflare usage and Worker logs. Free-tier quota limits may prevent collection or reports until reset.
Update without losing your traffic.
Generate a new Worker with your complete domain list and replace its code. Keep the existing DB database binding, DASHBOARD_KEY secret and daily Cron Trigger. Do not delete your database or rerun setup on unrelated tables. Downloaded code never contains your secret. Keep a copy of the working Worker before replacing it.
Protect your account and costs.
Keep Cloudflare account access restricted and enable its account security protections. Watch account-wide usage, especially on busy sites. The collector checks approved browser origins, but origin checks are not proof of ownership and cannot prevent every forged event or automated request. Add suitable Cloudflare protection for your traffic level. This free starter has not undergone an independent security audit.