Getting started with CortIQ

What you install

CortIQ is one JavaScript file, spa-tracking.js (about 52 KB, 13 KB gzipped). It runs in two layers:

• Security layer, without consent: AI bot and automation detection, a canary and a honeypot link. It sends data only when the visitor looks like a bot or automated browser.
• Analytics layer, after analytics consent: page views, sessions, AI referrals, clicks, scroll depth, heatmaps, form analytics and conversions.

If you would rather not run JavaScript for bot detection, the Cloudflare Worker classifies AI crawlers server-side, including crawlers that never execute JavaScript.

Install the script

1. Create an account and add your site with a name and its domain.
2. Open Install tracking in the dashboard. It shows the snippet with your Site ID and tracking key filled in.
3. Paste the snippet into the <head> of every page, or into your site template.

<script>
  window.cortiqConfig = {
    apiUrl: 'https://cxmkdtgfocgbfizawlwa.supabase.co/functions/v1',
    siteId: 'YOUR_SITE_ID',        // required, a UUID
    apiKey: 'YOUR_TRACKING_KEY',   // starts with tk_
    cookieless: true               // optional, see below
  };
</script>
<script src="https://cortiq.se/spa-tracking.js" defer></script>

The script reads its settings from window.cortiqConfig only, so the config block must come before the script tag. Without a siteId it logs an error to the console and does nothing.

On WordPress, use the WordPress plugin instead. It adds the script, a consent banner and Google Consent Mode v2.

Single-page apps

The script hooks into history.pushState, history.replaceState and the popstate event, and records a page view whenever the path changes. This covers React Router, Vue Router, Next.js client navigation and similar routers without extra code.

A change to only the query string or the #hash is not counted as a new page view.

How consent reaches the script

Analytics starts only once the visitor has given analytics (statistics) consent. The script looks for consent in this order:

1. A siteConsentUpdated event dispatched on the current page.
2. Cookiebot: Cookiebot.consent.statistics and Cookiebot.consent.marketing are read automatically, and the script listens for Cookiebot's consent events.
3. A choice stored by the CortIQ consent banner (the WordPress plugin banner or the CortIQ CMP).
4. Google Consent Mode v2, used when none of the above exists: the script reads analytics_storage, ad_storage and ad_user_data from window.dataLayer and follows later consent updates. CMPs set up for Consent Mode, such as OneTrust, Usercentrics and CookieYes, work without extra code.

Consent Mode defaults limited to certain regions are ignored, because the script cannot know the visitor's region. If your CMP does not use Consent Mode, dispatch this event from its callback on every page load, after the visitor's choice is known:

window.dispatchEvent(new CustomEvent('siteConsentUpdated', {
  detail: { analytics: true, marketing: false }
}));

A withdrawal (analytics: false) stops analytics on the page immediately.

Marketing consent is needed on top of analytics consent for: ad click IDs (gclid, fbclid, msclkid, ttclid, li_fat_id), a SHA-256 hash of the email on conversions, and browser fingerprinting (which you must also switch on with fingerprintConsent: true).

Cookieless mode

With cookieless: true the script keeps the session ID in memory instead of browser storage, skips visitor identification and switches off all marketing features (click IDs, email hashing, fingerprinting).

Conversions are not recorded in cookieless mode, and each full page load starts a new session.

Check that it works

There is no automatic installation check yet. To check by hand:

1. Open your site in a normal browser window and accept analytics in the consent banner.
2. In the browser's developer tools, under Network, look for requests to track-event on supabase.co. A successful request returns status 200.
3. Open the CortIQ dashboard and check that the page view appears.

No requests at all usually means analytics consent was not detected. Check the consent section above.

Google Tag Manager

1. In GTM, create a Custom HTML tag and paste the whole snippet: the window.cortiqConfig block and the script tag.
2. Trigger it on All Pages.
3. Publish the container.

The tag needs no consent settings of its own. The script runs its security layer at once and waits for analytics consent before any visitor analytics, reading the choice from your CMP or from Google Consent Mode as described above.

Consent Mode support needs tracking script 5.4.3 or later. There is no GTM Community Template yet.