# Add the script > Paste odo’s script into every page: the tag and its options, leaving out your own visits, cookieless mode, the early snippet, and ad blockers. odo measures your website with one small script of its own: no other company’s code, and no tag manager needed. ## Add your website In odo, open **Settings → Websites** and add your site’s domain. odo gives the site an id and shows its tag. Paste the tag into the `` of every page: ```html ``` The tag in odo has your site’s id in place of `SITE_ID`. Subdomains count as the same site, so `www.` and `app.` need nothing more. Other hosts that should count too (a second domain, a staging host) and paths to leave out (`/admin/*`) are set per site, in the same place. The script is deferred, so it never holds up your page, and it sends what it measures with `sendBeacon`, so a visitor leaving doesn’t lose their last page. ## Options on the tag | Attribute | What it does | | --- | --- | | `data-site` | Required. The site’s id. | | `data-api` | Where hits go, when you [serve odo from your own domain](https://odo.gg/docs/add-the-script#ad-blockers): `/odo/api/event`. The rest of what the script asks odo for comes from the same path. | | `data-hash` | Counts `#/routes` as separate pages, for apps that route with the hash. | | `data-local` | Also measures on `localhost`, `127.0.0.1` and `.local` hosts. Off by default, so development doesn’t count. | | `data-cookieless` | Never stores an id in the browser. See below. | | `data-capture` | Which of `clicks`, `forms`, `errors`, `sections`, `vitals` (page speed) and `heat` ([heatmaps](https://odo.gg/docs/heatmaps)) to record, or `none`. All of them without it. See [clicks, forms and errors](https://odo.gg/docs/interactions). | ## Leave out your own visits Open your site once with `?odo=ignore` on the address: `https://example.com/?odo=ignore`. That browser stops being counted on that site, and its console says so. `?odo=track` counts it again. Automated browsers aren’t counted either: headless Chrome, Lighthouse, Cypress, PhantomJS and any browser that says a program is driving it. A page the browser prerenders counts only once someone actually sees it. ## Cookieless, and Global Privacy Control By default the script keeps one first-party id, `odo_vid`, in a cookie and in local storage on your own domain. It’s how odo recognizes a returning visitor, keeps each one on the same version of an [experiment](https://odo.gg/docs/experiments), and lets a checkout pass the visitor to your payment platform, so the sale is [traced to the visit](https://odo.gg/docs/sales-to-visits). A cookieless site stores nothing in the browser. Turn on **Cookieless** in the website’s settings and add `data-cookieless` to the tag (only the tag stops a browser that already has the script from storing the id): ```html ``` Visitors are then counted by a hash of the site, their IP address and their browser, salted with a secret that’s replaced every day and then deleted, so one day’s visits can’t be linked to the next. A returning visitor is recognized within a day only, sales can’t be traced to visits, and experiments don’t run. Browsers that send Global Privacy Control are treated that way on every site, whatever its setting. More in [privacy and data](https://odo.gg/docs/privacy). ## The early snippet Because the script is deferred, your own code can run before it. If that code calls `odo()` or `odo.experiment()`, paste the early snippet right after odo’s tag and before your own scripts. It answers `odo.experiment()` at once, with the variant odo.js will give, queues events until the script arrives, and keeps working where the script is blocked. ```html ``` It also keeps the elements that [experiments odo runs](https://odo.gg/docs/experiments#without-flicker) change out of sight until odo has changed them, for 800 ms at most, so returning visitors don’t see the original flash first. Without experiments, you don’t need it. It’s in **Settings → Websites** in odo too. If your site sends a Content Security Policy, allow this inline script by its hash. ## Calling odo before it loads Without the early snippet, this one line queues calls until the script arrives: ```html ``` Once the script has run, `window` hears an `odo:ready` event. ## Ad blockers Some blockers stop analytics scripts that load from another domain. Serve odo from your own domain instead: forward everything under one path of your site, such as `/odo/`, to `https://odo.gg/`, so `/odo/js/odo.js` reaches `https://odo.gg/js/odo.js` and `/odo/api/event` reaches `https://odo.gg/api/event`. odo answers under `https://odo.gg/odo/` too, so a proxy that keeps the `/odo` works as well. With Next.js, in `next.config.js` (`vercel.json` takes the same `rewrites`): ```js module.exports = { async rewrites() { return [{ source: '/odo/:path*', destination: 'https://odo.gg/:path*' }]; }, }; ``` With Netlify, in `_redirects`: ``` /odo/* https://odo.gg/:splat 200 ``` With nginx: ```nginx location /odo/ { proxy_pass https://odo.gg/; proxy_ssl_server_name on; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; } ``` Then load the script from there: ```html ``` Everything else the script asks odo for comes from the same path, read from `data-api` (what comes before `api/event`), or from where the script was loaded: the [heatmap](https://odo.gg/docs/heatmaps) overlay and the heatmap it draws (`/odo/js/heatmap.js`, `/odo/api/heatmap`), and what [experiments odo runs](https://odo.gg/docs/experiments#experiments-odo-runs) need (`/odo/js/odo-x.js`, `/odo/js/x/…`). Forwarding the whole path covers whatever odo adds later too. A proxy that forwards only `/odo/js/odo.js` and `/odo/api/event` works too. Visits and events still go through your domain, and heatmaps and experiments odo runs load from `https://odo.gg` itself, so ad blockers and a Content-Security-Policy can stop those. ## Next [Connect your sales](https://odo.gg/docs/connect-your-sales), then [check it’s working](https://odo.gg/docs/check-its-working).