Install guide

Getting the tracking snippet onto your site

One async script tag carrying your domain’s public key, hostname and consent mode. It has no dependencies, blocks nothing, and is wrapped so that an internal error disables the tracker rather than throwing into your page.

Roughly three minutes if you have access to your site’s layout — longer if you have to ask someone for it, which step four covers.

Copy your domain’s snippet

Every domain gets its own tag. Find yours under Domains → your domain → Settings, where there is a copy button and ready-made variants for the platforms below. Yours will carry a real pk_live_ key and your own hostname:

<script async src="https://cdn.novexapilot.com/np.js"
        data-nk="pk_live_YOUR_PUBLIC_KEY"
        data-np-host="yourdomain.com"
        data-np-consent="respect_dnt"></script>

The public key is write-only — it can send events for its own domain and nothing else, which is why it is safe in public HTML.

Place it in the <head>

Paste the tag into the <head> of your site’s shared layout or template — not page by page. The tracker picks up SPA route changes on its own through history and hash events, so a single-page app needs the tag once and nothing else.

WordPressShow

Use your theme’s or a header-scripts plugin’s custom head field and paste the tag there. Avoid editing header.php directly — a theme update will overwrite it and the domain will quietly stop reporting.

Google Tag ManagerShow

Create a Custom HTML tag containing the snippet and fire it on All Pages. If GTM itself is gated behind consent in your setup, use respect_dnt here rather than strict_consent, or the two gates will fight each other.

ShopifyShow

Edit theme.liquid and place the tag just before the closing </head>. Duplicate the theme first so you have something to roll back to.

Next.jsShow

Use next/script in the root layout with the afterInteractive strategy:

// app/layout.tsx
import Script from 'next/script';

export default function RootLayout({ children }: { children: React.ReactNode }) {
  return (
    <html lang="en">
      <body>
        {children}
        <Script
          src="https://cdn.novexapilot.com/np.js"
          strategy="afterInteractive"
          data-nk="pk_live_YOUR_PUBLIC_KEY"
          data-np-host="yourdomain.com"
          data-np-consent="respect_dnt"
        />
      </body>
    </html>
  );
}

Publish, then verify

The snippet only reports once the page carrying it is live and publicly reachable — a draft or a staging-only deploy will not verify. Back on the domain’s settings page, select Verify installation.

We fetch your homepage and look for the tag in the returned HTML.
We separately check whether a signed beacon has arrived for that domain recently.
Either check passing flips the domain to active. You do not have to generate traffic first.

Nothing counts before verification

Events for an unverified domain are not written into your figures, so a mistyped hostname during setup never contaminates a real domain’s numbers.

Excluding a field or a whole section

Input values are never sent — for any field, in any mode. The tracker records only that a field was interacted with. When you want even that suppressed, or want a region ignored entirely, mark it:

<input type="text" name="coupon" data-np-private />

<section data-np-ignore>
  <!-- nothing inside here is tracked at all -->
</section>

Password fields are excluded automatically, and anything matching an email, phone or card pattern is redacted server-side before an event is written — including inside custom properties you send yourself.

When it does not work

Symptom	Usual cause	What to do
Verification says the snippet was not found	The tag is on staging, or a cache is still serving the previous HTML.	View source on the live homepage and search for np.js. If it is not in the source, it is not deployed — purge the cache and re-check before pressing verify again.
The tag is in the page but nothing arrives	A consent gate is blocking it, or a content security policy is refusing the script.	Open the page with ?npdebug=1 — every event is logged to the console and nothing is sent. A CSP block shows in the console as a refused script; add the CDN host to script-src and the collection host to connect-src.
Numbers look far too low	The tag is on one template only, or subdomain tracking is off.	Confirm the tag is in the shared layout every page renders, and check the www handling and subdomain settings on the domain.
Events are being rejected	A rate limit, a malformed custom event name, or a monthly quota that has run out.	Settings → Tracking health shows accepted and rejected counts for today with a reason breakdown, plus the last raw payloads, redacted.

Handing it to a developer

If someone else looks after the site, domain settings has a send to a teammate action that emails the snippet and these instructions straight to them, so nobody has to copy a script tag through a chat window and hope it survives.

Once it is live, the metric glossary explains what every resulting figure means.