Usage, limits & troubleshooting

Settings › Data collection & privacy › Last 24 hours of a website is the first place to look: it shows what reached the website in the last hours — events that were stored, events that were dropped and why, whole batches the server refused, the counted events per category, and the last 200 events as they arrived.

Usage is counted in page views and your own events: every stored page view counts once, and so does every event you send yourself. Everything the SDK measures by itself is included in the page view — up to 10 automatic events per page view on average over an hour; above that, each further automatic event counts once.

Settings › Data collection & privacy › Last 24 hours › Events by category shows the events per category, so you can see what drives them and switch a group off under Collection and consent, or narrow categories with rules. Cost brakes that are built in: heatmap sampling, the per-page limits of the SDK below, and at most one stored occurrence of an error per session and 50 per error group and hour.

How many page views and events are included depends on your plan.

Single events that are not allowed are dropped and counted per reason; the rest of the batch is stored.

Refused batches — the whole batch is rejected, nothing is stored. They appear under Dropped or refused as well:

• 404 pages are recognised only through trustanalytics.notFound() or <meta name="ta:404"> — the browser cannot see a page’s HTTP status.
• Downloads are the click on a file link, not a finished download.
• Attribution is first touch per session; there is no multi-touch attribution across sessions and no cross-device recognition without a user id.
• Visitors without a cookie are recognised only within the window of the website; several people behind one address with the same browser can count as one visitor.
• Retention cohorts start at the first visit in the selected range, not the first visit ever.
• Experiments check the sample ratio against an equal split; deliberate unequal splits show a warning.
• Replays load images, fonts and unreadable stylesheets live from your site; nothing is archived. Canvas and cross-origin iframes are not recorded.
• Media in iframes (YouTube, Vimeo) is not captured automatically — use trustanalytics.trackMedia().
• Blocking time and blocking scripts are measured in Chromium-based browsers only.
• Safari and other WebKit browsers (Intelligent Tracking Prevention) keep cookies set by a script for at most 7 days, so the visitor cookie trustanalytics recognises a Safari visitor only while they return within a week. Your user id from identify() is not affected.

Ad blockers often block third-party analytics hosts. Serving the script and the API through a path on your own domain keeps the data flowing. Forward the visitor’s address in X-Forwarded-For and keep the Origin header — without them every visitor gets your server’s address and location, and browser events are refused as Origin missing. Example for nginx:

location /ta/sdk/ {
    proxy_pass https://cdn.trustcomponent.com/trustanalytics/;
    proxy_set_header Host cdn.trustcomponent.com;
    proxy_ssl_server_name on;
}
location /ta/api/ {
    proxy_pass https://api.trustcomponent.com/analytics/v1/;
    proxy_set_header Host api.trustcomponent.com;
    proxy_ssl_server_name on;
    proxy_set_header X-Forwarded-For $remote_addr;
}

Then load /ta/sdk/0.1.x/trustanalytics.min.js and set data-api="/ta/api" (apiBaseUrl in npm). Replays load their module from the same path.

Turn on debug mode first. data-debug="true" / debug: true logs every decision of the SDK to the browser console — the policy it received, consent changes, events it sent and events it ignored and why.

No events at all

• The browser console shows [TrustAnalytics] data-site-key missing → the attribute is missing on the script tag.
• Settings › Data collection & privacy › Last 24 hours shows Hostname not allowed → add the hostname (with and without www if both are used) under Settings › General.
• Unknown site key → the key in the snippet is wrong or was rotated; copy the current snippet from Settings.
• Your Content Security Policy blocks the script or its requests → allow https://cdn.trustcomponent.com in script-src and https://api.trustcomponent.com in connect-src.
• With autoStart: false, nothing happens until trustanalytics.start().
• A browser extension blocks the request → check in a clean browser profile, or serve the SDK through your own domain.

Only pageviews arrive

• The visitor has not consented yet, or your banner does not call trustanalytics.setConsent() — Last 24 hours then shows CONSENT.
• The data is switched off for the website or not included in your plan — Last 24 hours shows PLAN.
• Do Not Track or GPC is active in your test browser and the website collects less for it — Last 24 hours shows PRIVACY_SIGNAL.

Sessions look wrong

• Every reload is a new session: not expected — the server groups the pages of one address and browser. If the address changes during the visit (mobile networks, VPN), the visit splits.
• Two tabs are one session: expected for the same address and browser within 30 minutes.
• The same person counts as a new visitor every day: the default window is one day. Choose a longer window, or collect Recognition and cookie (the visitor cookie and identify) — see Visitors.

Server events are not linked to the visit

• Send the pageViewId from trustanalytics.getPageViewId(); without it the event joins only a session of the same userId within 30 minutes. See Link to visits.

A 404, a download or a click is missing

• 404 needs the meta tag or trustanalytics.notFound(); downloads need a file ending, download or data-ta-download; all three belong to Automatic interactions and follow its mode.

No replays, or empty replays

• Check the mode of Session replay under Collection and consent (it waits for consent on a new website), Session replay › Recorded visits and your plan.
• A visit shorter than Session replay › Minimum duration leaves no replay; its recordings are deleted once the visit is over.
• trustanalytics-replay.min.js must load from the same place as trustanalytics.min.js — check the network tab and your CSP.
• Text shows as **** → the Strict masking preset; mark headings with data-ta-unmask or switch to Balanced.
• A heatmap without a page in the background → the page has no replay of that viewport class yet.

Revenue looks too high or too low

• Amounts are in the minor unit: 4900 is 49.00 EUR.
• Refunds are server events and need the order to be known — Last 24 hours shows UNKNOWN_ORDER otherwise.