Quickstart

# 1. Registration

Registration is free and requires no credit card. You start automatically on the Free plan (1 website, 5-min interval). When subscribing to a paid plan (Starter/Business/Agency), Stripe applies a 14-day trial — cancellable before expiry with no charge. Sign-up takes under a minute — classic email + password (min. 10 characters) or OAuth with Google. Apple and Microsoft are implemented but not yet enabled.

# 2. Onboarding wizard

The “Getting started” card on the dashboard opens the wizard, which walks you through four steps of initial setup — every step is skippable.

1. 1
   Enter your website URL

   For example https://www.example.com (name optional). The website is created immediately; redirects are resolved to the final canonical URL.
2. 2
   Verify the domain, then the first scan

   The wizard shows the three ways to verify the domain (DNS TXT record, meta tag or HTML file). After “Check now” it runs a live scan and shows four results: reachability with response time, SSL certificate with remaining validity, security score and performance score (each 0–100). “Verify later” moves on without a scan; the instructions then stay on the website page. If part of the scan fails, the website stays added — the next automatic scan refreshes the values.
3. 3
   Choose notification channels

   Email is the default; without a separate address alerts go to the account address. Slack, Microsoft Teams, Discord, Telegram and webhook are set up under Settings › Notifications.
4. 4
   Invite your team (optional)

   Enter colleague email addresses — they receive an invitation with access to the same account. Invitations are sent only via “Send invitations”; “Go to dashboard without inviting” discards the entered addresses. Continuous monitoring starts once the domain is verified.

# 3. Add your first website

After onboarding, use the “+ Website” button to add more domains. Once the domain is verified, all modules start with their first scan.

# 4. Domain verification

To make sure you only monitor your own domains, XICTRAQ verifies ownership. Three methods are available — you only need one. Token and instructions are shown by the yellow notice at the top of the website page as long as the domain is not confirmed. Click “Verify now” to run an immediate verification.

# 5. Install the tracker (for analytics)

To use analytics, form/media events or session recording, add a single script tag to the <head>. The snippet is under 30 KB compressed, loads asynchronously (defer) and works without cookies — so usually no cookie-banner requirement (assess case by case). Forms/media/recording/consent-gate are configured server-side (Analytics → Website → Settings).

<script defer src="https://api.xictraq.com/t.js" data-site="019d7cb5-aea5-71d4-b5a7-26d014cdb08a"></script>
<noscript><img src="https://api.xictraq.com/api/px?s=019d7cb5-aea5-71d4-b5a7-26d014cdb08a" alt="" width="1" height="1" style="position:absolute;left:-9999px" referrerpolicy="no-referrer-when-downgrade"></noscript>

# Tracker script (exact location, no regex rule intercepts it)
location = /t.js {
    proxy_pass            https://api.xictraq.com/t.js;
    proxy_set_header      Host api.xictraq.com;
    proxy_ssl_server_name on;
    proxy_ssl_name        api.xictraq.com;
    proxy_http_version    1.1;
    proxy_set_header      Connection "";
    proxy_connect_timeout 5s;
    proxy_read_timeout    10s;
    # otherwise the HSTS policy of api.xictraq.com would apply to your host and its subdomains
    proxy_hide_header     Strict-Transport-Security;
}
# Data collection /a/p … and pixel fallback /a/px; the slash after /a is required
location ^~ /a/ {
    proxy_pass            https://api.xictraq.com/api/;
    proxy_set_header      Host api.xictraq.com;
    # overwrite instead of append: exactly the address your server sees
    proxy_set_header      X-Forwarded-For $remote_addr;
    proxy_set_header      X-Real-IP $remote_addr;
    proxy_set_header      X-Forwarded-Proto $scheme;
    proxy_ssl_server_name on;
    proxy_ssl_name        api.xictraq.com;
    proxy_http_version    1.1;
    proxy_set_header      Connection "";
    # session recording packets can exceed 1 MB
    client_max_body_size  20m;
    proxy_connect_timeout 5s;
    proxy_read_timeout    30s;
    proxy_hide_header     Strict-Transport-Security;
}
# Recording library, only needed with session recording
location = /rx.js {
    proxy_pass            https://api.xictraq.com/rx.js;
    proxy_set_header      Host api.xictraq.com;
    proxy_ssl_server_name on;
    proxy_ssl_name        api.xictraq.com;
    proxy_http_version    1.1;
    proxy_set_header      Connection "";
    proxy_connect_timeout 5s;
    proxy_read_timeout    10s;
    # otherwise the HSTS policy of api.xictraq.com would apply to your host and its subdomains
    proxy_hide_header     Strict-Transport-Security;
}

• proxy_ssl_server_name and proxy_ssl_name: nginx sends the name api.xictraq.com in the TLS handshake. Without it the other side answers with a certificate for a different name.
• proxy_hide_header Strict-Transport-Security: api.xictraq.com sends HSTS with includeSubDomains and preload. Through the proxy that policy would reach the host of your shop, and browsers would enforce HTTPS for a year on it and all its subdomains, including ones without a certificate. Your own HSTS policy is not affected.
• X-Forwarded-For $remote_addr: the header is overwritten instead of extended. XICTRAQ receives exactly the address your server sees and nothing a browser sends on its own. If another proxy (CDN, load balancer) sits in front of your nginx, $remote_addr must already hold the visitor address there (nginx realip module). Otherwise XICTRAQ sees the address of that front server on every visit, and location and visitor counts are wrong.
• client_max_body_size 20m: without this line nginx accepts at most 1 MB per request. Session recording packets can be larger and would then receive HTTP 413.
• Timeouts of 5 s for connecting, 10 s for scripts and 30 s for data collection instead of the nginx default of 60 s: a deferred script holds back DOMContentLoaded while it loads. During a disruption no visitor waits a full minute.
• location ^~ /a/ with trailing slash: ^~ keeps regex rules such as image serving for .gif away, and the slash separates the measurement endpoints from paths such as /account or /agb.
• If your server sets its own security headers via add_header at server level, nginx inherits them into these blocks; headers of the same name from api.xictraq.com (such as X-Content-Type-Options or Cross-Origin-Resource-Policy) then arrive twice. In that case hide them with proxy_hide_header as well.

The snippet then points at your own domain — data-api="/a" routes data collection there as well:

<script defer src="/t.js"
        data-site="019d7cb5-aea5-71d4-b5a7-26d014cdb08a"
        data-api="/a"></script>
<noscript><img src="/a/px?s=019d7cb5-aea5-71d4-b5a7-26d014cdb08a" alt="" width="1" height="1" style="position:absolute;left:-9999px" referrerpolicy="no-referrer-when-downgrade"></noscript>

Embed the pixel extensionless as /a/px, not as /a/p.gif — the .gif extension is intercepted by static image serving before the proxy (404). In this mode the snippet carries no integrity attribute: the proxy maps /t.js, the continuously updated file whose checksum changes with every tracker release; SRI belongs to the versioned t.v{N}.js. In the dashboard you switch between both variants under Analytics → Website → Snippet. What the proxy does against adblockers and for the pixel fallback is covered in the analytics documentation.

# 6. Your first dashboard tour

After the first scans you see a traffic-light overview of all websites. Clicking a website opens the detail view with every module as a tab.

# Website groups

Groups organise your websites, for example by client, project or location. The website selection in analytics, in card settings and when assigning websites is structured by group, and a group combines the values of its websites. A website can be in several groups. Groups do not grant access: team members see all websites of the account, client and agency access is limited per website.

1. 1
   Create a group

   In the websites overview via “New group”, or in analytics in the website selection via “+ New group”. Enter a name, tick websites, save. Without a website you get an empty group that you can fill later.
2. 2
   Edit a group

   The pencil on the group header in the websites overview, or next to the group in the analytics selection, opens “Edit group”: change the name, tick or untick websites.
3. 3
   Assign websites to groups

   Select several websites in the overview and choose “Assign groups”, or use “Assign groups” on a website’s page. One tick per group; a partial tick means only some of the selected websites are in it, and it stays unchanged until you click it. In the same dialog you can create a new group with these websites.
4. 4
   Delete a group

   In “Edit group” via “Delete group”. The websites stay, only the group is removed. A dashboard card whose scope was this group then shows a notice.

# Related documentation