#JS and PHP Tracker by Token

Status: Available.

Purpose: the minimal way to count visits on any site without a module: one <script> tag, or a server-side send from PHP. The path, source, and UTM are sent; only the server variant sees bots.

#Contents

1. When to use it
2. Access
3. JS tag
4. Server variant (PHP)
5. The POST /api/v1/track/visit request
6. Responses
7. Limits
8. What is recorded
9. What the tracker does not do
10. Verification
11. Open questions

#When to use it

#Access

#JS tag

<script async src="https://formula-cream.pro/api/v1/track/js?t=0123456789abcdef0123456789abcdef"></script>

Replace the domain with your cell's address: RU https://formula-cream.pro, EN https://wfacademy.org, ID https://wfacademy.id. The token is issued by the dashboard.

#Parameters of GET /api/v1/track/js

#Response

Whether the token exists in the database is not checked when the script is served: the hit receiver checks it.

#What the script sends

One request per page load through navigator.sendBeacon (a text/plain Blob), with a fallback of fetch in no-cors mode with keepalive.

{
  "t": "0123456789abcdef0123456789abcdef",
  "kind": "js",
  "path": "/blog/emulsions",
  "host": "example.ru",
  "ref": "https://www.google.com/",
  "utm": { "source": "newsletter", "medium": "email", "campaign": "october" }
}

#Server variant (PHP)

It is inserted into Bitrix init.php (or the start of any PHP application). The source is served by GET /api/v1/track/php?t=<token>.

What the snippet does: after the request is processed, it sends a hit with the parameters without delaying the page, using a non-blocking curl_multi with a 150 ms connect timeout and a 200 ms total timeout.

The hit is not sent if:

• the script is run from the CLI;
• the path starts with /bitrix, upload, or local/templates;
• the request is for a static file (by extension);
• the request is ajax (X-Requested-With);
• the method is not GET;
• Accept contains neither text/html nor */*.

To disable it temporarily, add define('SAPPORT_TRACKER_DISABLED', true); above the inserted block.

The visitor's IP is taken from the first element of X-Forwarded-For (if the header is present), otherwise from REMOTE_ADDR. If the site is reachable directly, a visitor can forge the header: put the server behind a trusted proxy.

#The POST /api/v1/track/visit request

The receiver is shared by the JS tag, the PHP code, and the modules' signed beacon. The signature for modules is described in the connector protocol; no signature is needed for a token.

Headers: Content-Type: application/json (text/plain is also accepted, as sent by sendBeacon). CORS: *.

#Request body

The body is at most 8192 bytes; anything larger gets a 204 response without recording.

curl -i -X POST 'https://formula-cream.pro/api/v1/track/visit' \
  -H 'Content-Type: application/json' \
  -d '{"t":"0123456789abcdef0123456789abcdef","kind":"js","path":"/blog/emulsions","host":"example.ru","ref":"","utm":{"source":"newsletter"}}'

#Responses

Successful receipt and most rejections look the same, 204 with no body, so that tokens cannot be guessed.

Errors do not return application/problem+json: this is a separate counter receiver, not part of the public API (see API conventions for the server API).

#Limits

The quota and limits are counted in process memory: with several processes, the effective limit is softer than the nominal one.

Hits are retained for 180 days.

#What is recorded

#Classification

• A bot is identified by User-Agent against a closed list of families. An unknown bot is treated as a human.
• An AI assistant is identified by the suffix of the referrer host. For bots, the AI referrer is not taken into account.

Plain ya.ru is not Alice: a visit from it is not labeled as AI.

#What the tracker does not do

• SPA: the page load is counted, not an address change through the History API.
• Events: there is no track('purchase'), no buttons or forms. The Events API (Planned) is intended for that.
• Sessions and visitors: there is no session identifier, cookies, or localStorage. "Unique visitors" are estimated by the cloud from IP and User-Agent hashes over a day.
• UTM: only source, medium, campaign. The utm_content and utm_term fields are not sent.
• Bots via the JS tag: bots do not execute JS; only the server variant sees them.
• Consent: the JS tag does not wait for consent and is not controlled by window.sapport.consent. If your jurisdiction requires consent, load the tag after it, or use the loader.

#Verification

1. Open a page; in the "Network" tab find the track/js?t=… request (200) and then track/visit.
2. A 204 response does not mean the hit was recorded (see the response table); check the counter in the dashboard under "Promotion → Overview".
3. For PHP: curl -A "Googlebot" https://your-site/ makes a bot visit appear under "AI assistants and bots".

#Open questions

1. Technical. The receiver's code comments say "the response is always 204" and give limits of "~60/min per address and ~600/min per token"; the actual values differ (token buckets, 429/403/500 codes). This page describes the actual behavior; the code comments should be corrected.
2. Technical. The quota and limits live in process memory: is a shared (Redis) quota needed for public guarantees?
3. Technical. The "visitor" unit is impossible in the server beacon's anonymous mode: in the public API, visitors is null in this mode (Reading analytics).