Installing the tracking script

The tracking script is one line of JavaScript that goes in your site's <head>. WordPress has a plugin. Shopify currently uses manual setup. Other supported platforms offer a site-wide header setting. Use the instructions in your dashboard for the selected website. The standard browser tag has no site key. It resolves the website from its hostname.

On this page

Find the installation instructions in Settings → Install code for the selected website. The standard browser tag resolves the website from its hostname. WordPress and other keyed integrations have separate setup requirements, so use the instructions for your platform.

Copy the snippet from your dashboard

The tag below is what a standard install looks like, but always copy the real one from Settings → Install code. Some platforms get a variant, and your dashboard always has the current form.

Place immediately before the closing </head> tag

<script src="https://cdn.adprotektor.app/track.js"></script>

No key in the tag

The script resolves your website from the hostname it runs on, so the standard snippet carries no site key. Nothing in the tag is specific to your account, which is why it is safe to keep in a shared theme or template.

WordPress

Install the AdProtektor plugin, then click Open my WordPress plugin settings in your dashboard (your site → Install Code): it opens the plugin settings with your tracking code filled in, and you click Save Settings. With ConversionOS, paste your site key on the same screen and the plugin also captures server-side WooCommerce purchases and form submissions from WPForms, Gravity Forms, Contact Form 7 and Elementor Pro. That is worth having even if you only use the fraud protection today.

Shopify

The ConversionOS by AdProtektor app is awaiting Shopify App Store review as of October 8, 2026. It is not yet available for public App Store installation. Use the manual setup below while review is pending.

Storefront visit tracking: copy the tracking script from your dashboard into the theme header. This does not capture Shopify checkout events.
Checkout conversions: with ConversionOS enabled for the website, open Settings → Integrations → ConversionOS, copy the Shopify Custom Pixel snippet, then add and connect it in Shopify Admin → Settings → Customer events.
Server-side events: use the Shopify webhook card in the same dashboard section for the webhook URL and signing-secret setup. Confirm actual events arrive before considering installation complete.

Bot checkouts: a Shopify checkout that arrives with no browser visit behind it is linked to the visitor it came from where the evidence allows, and takes that visitor's verdict. One that links to no one but carries attack evidence, such as a checkout started straight from the cart API or a burst that outnumbers your real sessions, is recorded as Bot traffic in your dashboard, counted with the rest of your fraud.

Wix, Squarespace, Webflow and BigCommerce

All four have a site-wide custom-code or header-injection setting. Paste the snippet there and make sure it applies to all pages, not just the home page. Fraud lands on your ad landing pages, which are often not the home page.

Wix: Settings → Custom Code → Add Custom Code, placed in the Head, applied to All pages.
Squarespace: Settings → Advanced → Code Injection → Header.
Webflow: Project Settings → Custom Code → Head Code, then publish.
BigCommerce: Storefront → Script Manager → Create a script, placed in the Header on All pages.

Google Tag Manager

Create a Custom HTML tag containing the snippet and fire it on All Pages (the Initialization trigger is better still, because it runs earlier). Remember to publish the container. An unpublished GTM change is the single most common reason verification fails.

GTM adds a small delay

Tag Manager loads the script slightly later than a direct tag does, which means very short visits can be missed. If you are chasing maximum coverage, install directly in the page head instead.

Custom HTML sites

Add the snippet to whatever renders the <head> on every page, such as your shared layout, template or partial, rather than to individual pages. If your site is a single-page app, the script tracks route changes on its own, so you do not need to re-fire it manually.

Server-to-server

For conversions that never touch a browser, ConversionOS accepts direct server-to-server ingestion through a custom API. See Setting up ConversionOS.

Frequently asked questions

Where exactly should the script go?

In the <head>, as early as practical, on every page. Putting it in the footer or firing it late means short visits can end before the script has collected anything. Short visits are exactly what bot traffic looks like.

Can I install it on more than one website?

Yes, up to your plan's limit. Each website is a separate asset with its own site key, settings and ad-platform connections.

Does it work on a staging site?

It will run anywhere the snippet loads, but the data will be mixed in with production. Use a separate asset for staging if you want to keep them apart.