Docs · Reference

Script configuration

The one-line snippet works with no options. Everything below is optional — set it with a data-* attribute on the <script> tag. Installing from npm instead? The JavaScript SDK exposes every option here as a camel-cased initStatlark() field.

Subdomain tracking

By default Statlark scopes the visitor cookie to your registrable domain (e.g. .example.com), so a visitor who lands on your marketing site and later signs up on app.example.com stays the sameperson and keeps their original attribution. It works out of the box — no configuration — and falls back to the current host if a domain can’t be resolved.

<!-- Default: the visitor cookie is scoped to your registrable domain, so a
     visitor who moves from www.example.com to app.example.com stays one person. -->
<script defer src="https://statlark.com/script.js" data-website-id="sl_xxxx"></script>

<!-- Force an explicit cookie domain, or "none" to opt out (host-only). -->
<script defer src="…" data-website-id="sl_xxxx" data-cookie-domain=".example.com"></script>

Set data-cookie-domain to pin an explicit domain, or to none to opt out and keep the cookie host-only. Once you track across subdomains, a Subdomains breakdown appears on the Locations card of your Overview.

All options

Attribute	Values	Default	What it does
`data-website-id`	`sl_…`	Required	Your site id, from Settings → Install.
`data-api`	a URL or path	hosted collector	Send events to a custom endpoint — used for a first-party proxy.
`data-cookie-domain`	a domain, or `none`	auto	Cookie scope. Auto uses your registrable domain; `none` keeps the cookie host-only.
`data-allow-localhost`	`true`	off	Count visits from `localhost` and private hosts.
`data-honor-dnt`	`true`	off	Respect the browser’s Do Not Track signal and skip those visitors entirely.
`data-outbound`	`false`	on	Turn off automatic outbound-link tracking.
`data-disable-payments`	`true`	off	Make `statlark.payment()` a no-op.
`data-debug`	`true`	off	Log every tracked hit to the console. `data-disable-console` silences all output instead.
`data-cookieless`	`true`	off	Set no cookies or device storage at all — see cookieless mode.

Cookieless / GDPR mode

Cookieless modeis analytics that stores nothing on the visitor’s device: no cookies, no localStorage, no sessionStorage. Set data-cookieless="true" and the hosted collector derives a visitor id server-side instead, by hashing the request with a random salt that rotates and is discarded daily. Statlark keeps no copy of the salt or the IP once the day rolls over, so it can’t re-link a visitor from one day to the next.

The reason that matters legally: the consent requirement in ePrivacy Directive Article 5(3) is triggered by storing information on, or gaining access to information already stored in,a user’s device — not by analytics as such. Store nothing and read nothing, and the trigger doesn’t apply, which is why this mode can run without a cookie-consent banner. It is not legal advice — confirm it fits your situation with your DPO before relying on it.

Want to keep full cookie-mode attribution in the EU/UK instead? Show a consent banner — it holds the analytics cookie until the visitor accepts, so returning-visitor paths and multi-day attribution survive for everyone who opts in.

A few trade-offs to know:

No long-horizon attribution. Because the salt rotates daily, a visitor who returns on a later day counts as new — you keep same-day visitor and conversion counts, not multi-day returning-visitor paths.
Sessions on multi-page sites.With no device storage the tracker can’t stitch a visit across full page loads, so on a traditional multi-page site each page view counts as its own session (single-page apps are unaffected). Visitor and conversion counts stay accurate; session counts run high.
Hosted collector only.The id is derived in Statlark’s edge collector, so cookieless mode needs the default install — it cannot be combined with a first-party proxy.
Sign-out isn’t an identity boundary. With nothing stored on the device there is no id to clear, so reset() starts a new session but the same browser keeps the same visitor id until the salt rotates at UTC midnight. On a shared device, two people who sign in one after the other count as one visitor for the rest of that day. Cookie mode is the option that separates them.
No self-exclusion. ?statlark_ignore=1 stores a flag in localStorage, which cookieless mode can’t use — so the link is a no-op and your own visits to the live site are counted. Visits from localhost are still skipped automatically, and path, hostname and country exclusion rules are unaffected (they run server-side).

The visitor ID

Statlark stores a first-party visitor id in the _slk_vid cookie. Read it with getVisitorId() — handy for tying a server-side goal or payment to the same visitor.

// The current visitor id (the _slk_vid cookie), or null when the tracker isn't
// running (Do Not Track / localhost / self-excluded). Use it to key a
// server-side goal or payment to the same visitor.
const id = window.statlark?.getVisitorId();

Resetting on sign-out

On sign-out, call reset()so the next person on that browser starts as a fresh anonymous visitor rather than inheriting the previous user’s id and first-touch attribution. It takes effect immediately, with no page reload. Call it from wherever your app handles an auth state change, so every open tab resets — not just the one that signed out.

// On sign-out: forget the visitor + session so the next person on this
// browser starts fresh. ?. on the method too — an older cached tracker
// won't have reset() yet.
window.statlark?.reset?.();

In cookieless mode this starts a new session only — there is no id on the device to clear, so the same browser keeps the same visitor id until UTC midnight.

Nothing showing up?

If a site has never recorded a single event — not “quiet this week”, but nothing, ever — it is almost always one of three things.

The snippet isn’t on the page. Open your site, view source, and search for script.js. If it isn’t there, it may be sitting in a draft template or behind a caching layer that hasn’t been purged.
The site ID doesn’t match. Compare the data-website-id in your snippet against the sl_… ID shown for that site in Settings. Statlark files a hit under whichever ID the snippet names, so a mismatch means the data is landing on a different site.
The domain is tracked twice. If the same domain was added more than once, only the copy whose ID is in your snippet will ever receive data — the other stays at zero forever. Remove the unused one; see Your account and your data.

Also worth ruling out: an exclusion rule that happens to match all of your traffic, and the Do Not Track and localhost options, which skip hits by design.

Last reviewed 2 August 2026