# Script reference

> Every data attribute the tracking script reads, what each one changes, and the default when you leave it out.

Section: Tracking script  
Canonical page: https://statsy.co/docs/tracking-script  
Last updated: 2026-09-15

The script is configured entirely from attributes on its own tag. There is no config object and no build step.

```html
<script defer data-website-id="ws_XXXXXXXX" data-domain="yourstartup.com" src="https://statsy.co/js/script.js"></script>
```

It reads the attributes from the tag that loaded it. If the tag is injected by a tag manager, it falls back to the first `script[data-website-id]` on the page.

## Attributes

| Attribute | Default | What it does |
| --- | --- | --- |
| `data-website-id` | required | Your public site key. It starts with ws_ and is printed on the install screen. |
| `data-domain` | current host | The site’s main domain. Links to any other host are recorded as the outbound goal. |
| `data-mode` | server decides | `full` or `lightweight`, forcing a [tracking mode](https://statsy.co/docs/tracking-script/tracking-modes) for this tag. |
| `data-proxy` | the script’s own origin | Origin to send beacons to, when it differs from where the script is served. |
| `data-cross-domain` | none | Comma-separated domains that should share one visitor cookie on their common parent. See [Subdomains and multiple domains](https://statsy.co/docs/tracking-script/subdomains-and-cross-domain). |
| `data-ignore-dnt` | `false` | When true, keeps measuring browsers that send Do Not Track or Global Privacy Control. |
| `data-track-scroll` | `true` | Records the deepest scroll percentage reached on each page. |
| `data-track-outbound` | `true` | Records clicks on links to other hosts as the outbound goal. |
| `data-track-downloads` | `true` | Records clicks on pdf, zip, dmg, exe, csv, xlsx, docx, mp3 and mp4 links as the download goal. |
| `data-hash-routing` | `false` | Treats URL hash changes as pageviews, for hash routers. See [Single-page apps](https://statsy.co/docs/tracking-script/spa). |

> **Note.** The boolean attributes are read loosely: only `false` and `0` turn a feature off. Any other value, including an empty string, counts as on.

## What it does with no configuration

- Records a pageview on load and on every client-side route change.
- Records scroll depth per page, sent when the page is hidden or closed.
- Records outbound clicks, file downloads, and clicks on hosted checkout links as the checkout_start goal.
- Asks the server which [mode](https://statsy.co/docs/tracking-script/tracking-modes) applies, and picks up click and scroll goals, widgets, heatmaps and replay settings you configured in the dashboard.

## Loading other modules

Heatmaps, session replay, web vitals and widgets are separate files that the script only loads when the dashboard says that site needs them, from the same origin as the script itself. That matters for your [Content Security Policy](https://statsy.co/docs/tracking-script/csp): allow the origin, not a single file name.

Previous: [CSV export](https://statsy.co/docs/features/export)  
Next: [JavaScript API](https://statsy.co/docs/tracking-script/javascript-api)