# Install the tracker > Add the Attrifast snippet to your site — one script tag, ~2.4 KB over the wire, no cookies by default — and see your first pageview, usually within a minute. Last updated: 2026-07-17 Canonical: https://attrifast.com/docs/install Attrifast tracks your site with a single script tag. The tracker is about 5 KB (~2.4 KB over the wire), uses no cookies by default (it keeps a first-party identifier in `localStorage`), and skips known bots automatically. Event collection requires an active subscription or trial — start the 7-day free trial during onboarding (no charge today, cancel anytime). The Pro plan includes 100,000 events per month; pageviews and custom events count toward the quota, engagement heartbeats don't. ## Add the snippet Paste this in the `` of your site, replacing the tracking ID with the one shown in your onboarding or **Dashboard → Settings**: ```html ``` Platform notes: - **Shopify** — skip the snippet entirely: [connect your store](/docs/shopify) and the tracker is injected automatically. - **WordPress** — paste the same snippet via the WPCode plugin or your theme's header; the [WordPress guide](/docs/wordpress) walks through both routes. - **Single-page apps** — route changes are tracked automatically; no extra setup for Next.js, React, Vue, or SvelteKit routers. Events are only accepted from your website's registered domain — the one you entered when adding the site — including its subdomains (Shopify domains are added automatically on connect). If you serve the same site from a different domain, [contact us](/contact) and we'll add it to your allow-list. ## Cross-subdomain tracking By default the visitor ID lives in `localStorage`, which browsers scope per subdomain — a visitor who reads your blog on `example.com` and signs up on `app.example.com` would count as two visitors, breaking attribution across the boundary. To share one identity across all subdomains, opt in: ```html ``` With this flag the tracker keeps the visitor ID in a **first-party cookie on your root domain** instead (this is the one case where Attrifast sets a cookie — a random ID, no personal data). Install the same snippet on every subdomain; an existing visitor's ID is migrated to the cookie, not reset. Events from subdomains of your registered domain are accepted automatically. One honest caveat: Safari caps script-set cookies at about 7 days, so cross-subdomain identity for returning Safari visitors can reset weekly — an inherent limit of client-set cookies that affects every analytics tool using them. ## Verify it works Open your site in a normal browser tab, then either: - use **Verify installation** in onboarding — it flips to *"Script verified! Events are being received."* once the first pageview lands, or - check your dashboard: the visit usually appears within a minute. In DevTools you should see `af.js` load and a request to `/api/collect`. ## What gets tracked - **Pageviews** — automatic, including SPA route changes. - **Sessions and channels** — every session is classified from its referrer and UTM parameters into a channel: Organic Search, Paid Search, Social, Paid Social, Email, AI, Referral, Affiliate, Display, or Direct. AI visits are additionally tagged with the engine (ChatGPT, Perplexity, Claude, Gemini, and more). - **Engagement** — time-engaged heartbeats, so you get real dwell time instead of bounce guesses. - **UTM parameters** — captured on landing and used for channel and campaign attribution. ## Custom events Track anything beyond pageviews with the global API: ```js window.attrifast.track('signup', { plan: 'pro' }); ``` See [custom events](/docs/custom-events) for the full API, and turn event names into [goals](/docs/goals) to measure conversion rate per event.