Do I have to change the snippet to enable recording?

No. The standard path is toggling recording in the Settings tab — the existing snippet (with data-site) is enough. Only if you want HTML pinning, add data-record="1" to the script tag.

Does URL exclusion also apply to recording?

Excluded paths are honoured for analytics capture: the server drops pageviews of excluded paths right at ingest (including the first hit), and the tracker skips them client-side on subsequent (SPA) navigations. Session recording is a separate opt-in and only active after consent.

Can I enable recording only for logged-in users?

Yes — either via URL exclusion of all public paths plus server recording=ON, or by triggering xictraq.consent("granted") only after login.

Does sample rate also affect the cookie banner check?

No. The sample rate only controls analytics capture (percent of sessions) and is enforced server-side per session at ingest, deterministically; the tracker also honours it client-side. Synthetic checks (cookie banner, Lighthouse, axe-core) run server-side and are independent of it in any case.

Tracker settings

Q: What happens to a recording in progress when settings change?

The recording ID lives in the tab sessionStorage. A recording runs until session end (tab close) or ends after 30 minutes without a recorded event (changes to the page count as well) or with the first page load after midnight (UTC), both from tracker version 61; after that, a new recording begins. The next session pulls the current config at its first page view.

All tracker features are configured centrally in the dashboard under Analytics → Settings — per website, no re-embed, no deploy. The tracker reads its config from the server on every page view (5-minute HTTP cache); the embedded snippet only carries the site ID. This page explains every toggle, consent, sample rate, mask selector and URL exclusion.

Where do I find the settings?

In the dashboard: Analytics → pick a website top-right → Settings tab. All toggles, sample rate, mask selectors and URL exclusion regex live here. The tracker snippet shown in the same card carries only data-site — everything else is read live from this server config.

# Tracker features (5 toggles)

When a toggle takes effect

Form analytics, video and audio tracking, click heatmaps and Core Web Vitals are enforced at ingest: the server drops the data of a disabled feature regardless of which tracker version a visitor has cached. Switching a feature off therefore takes effect immediately; switching it on applies at the next page view once the config cache (5 minutes) expires. Session recording follows its own rule — there, data-record on the script tag overrides the server setting.

Form analytics

Captures views, focus, drop-off and submit per form and field (tracker field f). The dashboard tab Analytics → Conversions shows in its Forms section the funnel and field-level abandonment; the report itself is unlocked from the Business plan. The toggle sits in the Settings tab from the Starter plan. Default: ON.

Video & audio tracking

Play, pause, progress (25/50/75 %) and ended for native <video> and <audio> (tracker field m). Dashboard tab Analytics → Recordings & Tests, Media section (report from Business plan), toggle in the Settings tab from Starter. Default: ON.

Click heatmaps

Collects, per click, the coordinates, the element type and the visible text of the element (email addresses masked) per URL as a heatmap overlay, pseudonymous per session (tracker field h). Dashboard tab Analytics → Heatmap (report from Business plan), toggle in the Settings tab from Starter. Default: ON.

Core Web Vitals

LCP, CLS and INP per page — straight from the visitor's browser via the PerformanceObserver API, no synthetic lab test (tracker field v). Dashboard tab Analytics → Performance. Default: ON.

Session recording

Records DOM mutations + mouse events as an rrweb stream (tracker field r). Default: OFF — capture only starts once the page signals xictraq.consent('granted'), and legally requires explicit consent in DE/EU. Dashboard tab Analytics → Recordings & Tests; the report is unlocked from the Business plan, the toggle sits in the Settings tab from Starter.

# Sample rate

1–100 % of all visitors

Slider from 1 to 100 (tracker field s). The value is clamped server-side to 1–100 and stored in tracker_config.sample_rate; the endpoint serves it in the config field s. The rate is enforced at ingest: the server derives a stable bucket from 0 to 99 out of the session value and drops sessions above the configured rate. The selection therefore applies per session, not per page view — a captured session is captured completely, a dropped one is dropped completely, including its clicks, form, media and recording data.

What the sample rate governs

The sample rate decides whether a session enters the reporting — uniformly across all channels, so the numbers stay consistent with each other. Synthetic checks (cookie banner, Lighthouse, axe-core) run server-side and are unaffected.

# Mask selectors

Mask additional CSS selectors

<input> and <textarea> are masked automatically (maskAllInputs=true in the rrweb recorder). Here you can mask additional regions via CSS selector — e.g. customer IDs, amounts, personal notes, avatars. Examples: .credit-card, #email, [data-private], .invoice-amount.

Shortcut via attribute

To mark individual elements directly in HTML, add the attribute data-xictraq-mask — works without an entry in the selector list.

# URL exclusion (regex)

Don't track these paths at all

Regular expressions (tracker field xu, up to 500 characters each) against the URL path (location.pathname). They are stored server-side and served in the config field xu. Exclusion is enforced at ingest: the server drops matching page views — including the first one — and likewise their click, form, media, recording and e-commerce data. The tracker additionally skips excluded paths client-side once the config has loaded (subsequent navigations in single-page apps). Typical entries: ^/admin (admin backend), ^/checkout/(success|cancel), ^/account, ^/preview. Multiple entries allowed, one per line.

# Live propagation & cache

Config per page view, 5-minute HTTP cache

The tracker requests the public config endpoint GET /api/c/{site-id} on every page view. Its response carries Cache-Control: public, max-age=300, stale-while-revalidate=600 — so the browser cache holds the config for up to 5 minutes. After saving, a change therefore applies at the next page view once the cache expires, with no hard reload, cache buster or re-embed.

HTML override (fallback)

If you prefer to pin recording or consent behaviour in HTML (e.g. multiple sub-domains with the same site ID but different recording status), use data-* attributes on the script tag:

<script defer src="https://api.xictraq.com/t.js"
        data-site="YOUR_SITE_ID"
        data-record="1"></script>
<noscript><img src="https://api.xictraq.com/api/px?s=YOUR_SITE_ID" alt="" width="1" height="1" style="position:absolute;left:-9999px" referrerpolicy="no-referrer-when-downgrade"></noscript>

Besides data-site (required) and data-api (custom API base), the tracker only consumes data-record as a data-* attribute. data-record="1" forces recording on, data-record="0" forces it off (overriding the server config). No consent attribute is needed: recording waits for xictraq.consent("granted") in every mode. Forms, media, heatmap, web vitals, sample rate, mask selectors and URL exclude rules are configured server-side in the Settings tab; the server enforces them at ingest immediately, the in-browser tracker follows at the next page view once the cache expires.

The optional <noscript> line below is a pixel fallback: it only fires when no JavaScript runs (visitors with JS disabled, simple bots) and requests a 1×1 pixel. These hits are captured separately as the “Pixel” source and classified as machine traffic — they do not count towards your human analytics figures and only show up under the “Incl. bots” filter. Use the same site ID as in the tracker data-site attribute.

# Config contract (for developers)

The public endpoint GET /api/c/{site-id} returns the stored settings as compact JSON with short keys (CORS open, no authentication). Unknown or not-yet-verified site IDs receive the defaults so the tracker always works.

{
  "f":  1,        // forms        — Formular-Analyse
  "m":  1,        // media        — Video-/Audio-Tracking
  "r":  0,        // record       — Session-Recording (Opt-in)
  "h":  1,        // heatmap      — Click-Heatmaps
  "v":  1,        // web_vitals   — LCP / CLS / INP
  "c":  0,        // consent      — 1 = "Consent erforderlich"
  "ms": [],       // mask_selectors — CSS-Selektoren
  "xu": [],       // exclude_urls   — Pfad-Regex
  "s":  100       // sample_rate    — 1..100
}

Server-validated values

On save the server validates every value: forms/media/record/heatmap/web_vitals are booleans, consent is only 'none' or 'required', mask_selectors and exclude_urls are string lists (selector up to 200, regex up to 500 chars), sample_rate is an integer from 1 to 100. Unknown keys are dropped, missing fields fall back to the defaults. A selector with unbalanced brackets and an expression that does not compile are rejected rather than stored — a rule that can never match should not sit in the list looking like an effective one.

# Consent API & CMP integration

Session recording always waits for an explicit signal from your CMP. Call the global JS API as soon as the visitor accepts or declines:

xictraq.consent('granted');   // Aufnahme startet
xictraq.consent('denied');    // Aufnahme stoppt / startet nicht

When recording actually starts

Recording only starts once both conditions are met: the feature is enabled (server toggle r or data-record="1") AND xictraq.consent('granted') has been called. There is no auto-start on page load. With 'denied' the tracker calls stopRecording internally. A recording ID is held per tab in sessionStorage. A recording ends with the session (closing the tab), after 30 minutes without a recorded event (changes to the page count as well) or with the first page load after midnight (UTC); after that, a new recording begins with a new recording ID. The last two cases apply from tracker version 61; a pinned older copy keeps recording until the tab is closed. Page changes within a single-page app do not load a page and therefore do not start a new recording. The next session picks up the current configuration.

Consent auto-bridge — adopt consent automatically

In most cases you do not need the manual JS call at all: the tracker auto-detects 16 common consent-management platforms (CMPs) plus the IAB TCF v2.2 and Consent Mode v2 standards and adopts their statistics or analytics consent. When the visitor grants consent, the consent-required functions start (currently session recording); when they revoke it, they stop immediately. Ordinary cookieless tracking always runs independently of this. You can still use the manual xictraq.consent() call for uncovered or custom banners — it takes precedence.

# Update your privacy policy

Even without a cookie requirement you must mention the use of XICTRAQ in your privacy policy (Art. 13/14 GDPR). Copy the matching text block and adjust it to your situation.

Base template (cookieless analytics)

Audience measurement with XICTRAQ This website uses XICTRAQ for audience measurement, a cookie-free analytics system provided by XICTRON, 31185 Söhlde, Germany. On each page view the following data is processed: the page visited and the referring page (referrer), campaign parameters, the approximate time on page, screen and window size, the device class derived from them, browser and operating-system category including version, and — where the browser states them on its own — form factor, device family and manufacturer, the approximate location (country, region, city, postal code and coordinates, derived from the IP address), the internet provider including its network number (ASN), the selected language, and the date and time of the visit. If a JavaScript error occurs on the page, its message and location in the code are also processed; email addresses in it and access values in contained URLs (such as token= or key=) are made unrecognisable. For audience measurement no cookies are set and no information is stored on or read from users' browsers; consent under § 25(1) TDDDG is therefore not required for this. To distinguish visits, a pseudonymous daily identifier is formed from the IP address and a daily key (salt). The daily key is a random value generated anew each day and deleted once the day is over; after that, the daily identifier can no longer be attributed to an IP address. The IP address is used only to form this identifier, for approximate geographic classification, to determine the internet provider, to detect automated access and, for at most one minute, to limit the number of requests, and is not stored. Processing is based on your legitimate interests (Art. 6(1)(f) GDPR). A data processing agreement pursuant to Art. 28 GDPR is in place with XICTRON. The data is processed on servers controlled by XICTRON within the European Union and is not passed on to any further third parties.

Add-on: Heatmaps & form analytics

In addition to base web analytics, XICTRAQ captures clicks (heatmaps) and form interactions (field focus, drop-off, submissions). For each click, the position on the page, the type of the clicked element and its visible text are stored; email addresses in it are made unrecognisable, except addresses of this website's own domain. This data is pseudonymous: it carries the same daily identifier as the page views of the visit; the identifier itself contains neither a name nor an IP address. The captured visible text may contain information that the page itself displays, such as the name of a signed-in customer, unless the area is masked. The analysis combines the clicks on a page into a heatmap and serves to improve the user experience. Input content of form fields is not stored.

Add-on: Session recording (consent required)

With your explicit consent, XICTRAQ records your browsing session pseudonymously as a session recording: the recording carries a daily identifier; the identifier itself contains neither your name nor your IP address. The recording may contain information that the page itself displays, such as your name if you are signed in, unless the area is masked. Mouse movements, clicks, scroll behavior and page changes (DOM mutations) are captured. Form contents, passwords and areas marked as sensitive are automatically masked. Recording only begins after your consent via our cookie banner and can be revoked at any time. For the duration of the session an identifier for the recording is stored in your browser (sessionStorage); it is deleted when the tab is closed and is covered by your consent under § 25(1) TDDDG. Legal basis: Art. 6(1)(a) GDPR (consent). Retention: 90 days, then automatically deleted.

Replays stay correct — even after a relaunch

When recording, XICTRAQ embeds your page stylesheets directly into the capture. The replay is therefore self-contained and shows the correct layout even if you later redeploy the site and file URLs (e.g. hashed CSS assets) change. Requirement: the stylesheets are served from your own domain — CSS from third-party CDNs and CORS-protected fonts may differ in the replay.

Add-on: Customer recognition (Business plan and up)

From the Business plan, the tracker automatically assigns visits of signed-in customers to their customer account; the same applies to calls of xictraq.identify(). If your website has customer accounts or you call identify(), this block belongs in your privacy policy. If you pass further attributes, extend the list.

Customer recognition Unlike the audience measurement described above, XICTRAQ assigns your visits to your customer account when you are signed in to a customer account on this website. For this purpose your customer number and, where this website provides them, your name, your company and your customer group or type are processed and linked to the page views, events and orders of your visits, including across several days. No cookies are set and no information is stored in your browser for this. A daily deletion run removes assignments that have not been confirmed by a new visit for twelve months. Legal basis: [please complete – determine with your data protection adviser]

Template in the dashboard

You can also find the same template directly in the dashboard under Analytics → Settings as copyable text, automatically adapted to your active features.

Frequently asked questions

At most 5 minutes — that is how long the browser of a visitor may cache the configuration (HTTP cache, max-age 300). The tracker itself stores nothing. New visitors get the change immediately.

Availability

The Settings tab with all tracker settings is available from the Starter plan (EUR 12/month). The corresponding reports — forms, media, heatmap and session recording — are plan-gated server-side and unlocked from the Business plan (EUR 29/month); also included in the Agency plan. Core Web Vitals are available from Starter, like base analytics.