Embeddable widgets

Badge — small pill (e.g. in your footer showing All systems operational or Incident detected). Banner — full width with status and number of sites. Card — vertical widget with one row per site, hostname and 30-day uptime (uptime_percent_30d) per entry. Pick the style via data-style; without it the card style is rendered.

data-token (public token of your status page, required), data-style=badge|banner|card, data-theme=light|dark|auto (auto follows the visitor system dark mode; light when omitted), data-lang=de|en (the browser language when omitted) plus data-api and data-link for custom hosts. Without data-token the widget renders nothing.

On first render the widget fetches the public status endpoint of your page (GET /api/public/status?token=...) once and renders it locally. After that it refreshes every 5 minutes (300 seconds) asynchronously, without any page reload. If a website or an API endpoint of the status page is down, the status dot turns red (“Incident detected”); if a website is in maintenance mode, amber (“Maintenance in progress”), likewise for an endpoint that is only degraded (“Partially degraded”); if some websites or endpoints lack a measurement, it stays grey (“Status partly not determined”). Open reported incidents count as well: impact “Critical” or “Major” turns it red, “Minor” amber (“Partially degraded”). The widget thus follows the same rule as the status page. The status token only returns the websites released for that page — no user ID, no full portfolio.

In card style the widget picks up your white-label automatically from the status response: the primary colour (whitelabel.primary_color) as CSS variables, the logo (whitelabel.logo_base64) in the header and the company name (whitelabel.company_name) in the footer. Once a company name is set, your brand copyright note replaces the Powered-by-XICTRAQ footer.

data-title (heading above the input field), data-button (label of the check button), data-placeholder (placeholder in the URL field) and data-lang=de|en (language of the widget interface, browser language when omitted). All customisation attributes are optional — sensible defaults apply when omitted.

Logo, primary colour, accent colour and company name come automatically from your white-label settings. The widget reads the branding via GET /api/public/widget-brand?ref=YOUR_USER_ID and renders the quick-check field, result and PDF in your brand. The response contains white_label, company_name, primary_color, accent_color, logo_url (embedded as a safe data URI) and powered_by_visible. Without an Agency plan the endpoint returns the XICTRAQ default colours (primary #004d43, accent #006b5a) so the widget keeps working.

On submit the widget calls POST /api/public/scan with url, ref and a bot-challenge token and shows the result compactly: status (Online/Offline; on a connect timeout it reads Unreachable instead of Offline, since many targets block datacenter IPs), response time in ms, SSL validity and a security score from 0–100. The result comes from the same quick check as the public scan and is cached server-side for 10 minutes.

From the result the visitor downloads a white-label report (your agency logo, colours and company name). Generation runs via POST /api/public/scan/pdf with url, ref and _challenge and returns the PDF directly as a download; the filename carries your brand name. Once a company name is set, the Powered-by-XICTRAQ note is dropped.

Every successful quick check and every PDF download carrying your ref (user ID) is captured as a lead for your agency in the widget_leads table — deduplicated per hour per checked URL and visitor so repeat checks do not inflate the same lead. Only calls coming from an embedded page count: the origin of the embedding domain is stored alongside the lead and shown in the list, while calls without an embedding and our own preview pages are ignored. The visitor IP is never stored in clear text, only as a salted SHA-256 hash (for the dedup); the country of origin is derived via GeoIP. While logged in you retrieve the latest leads via GET /api/widget/leads (checked URL, country, source domain, timestamp — never the IP hash). The list holds the newest 100 leads; with ?with_counts=1 it comes back as an object with leads and counts; counts gives the total, the last 7 days and the 7 days before.

The quick check is hardened against automation: a time-based challenge token (must be 2–120 seconds old) and a minimum dwell time of 2 seconds on the page before the first check. Rate limits are 10 requests per minute and 60 per hour per IP, shared between scan and PDF; URLs to be scanned are validated against internal/private IP ranges (SSRF protection).

On Agency both widgets pick up the logo, primary and accent colour and company name automatically from your white-label config — no XICTRAQ branding. The Powered-by-XICTRAQ footer is dropped once you set a company name. Free, Starter and Business use the default XICTRAQ branding.