Https

asset.js is served only over HTTPS. The beacon is sent only over HTTPS. Pages loaded over HTTP do not fire a beacon.

The script URL is HTTPS-only

The canonical script URL is https://statelessid.com/asset.js. There is no HTTP fallback at http://statelessid.com/asset.js. This is consistent with how browsers handle mixed content: a browser loading an HTTPS page and encountering an HTTP script src would block the script as mixed content anyway.

Using the full https:// prefix in the src attribute is the correct and only supported form. Protocol-relative URLs (//statelessid.com/asset.js) instruct the browser to match the page's protocol. On an HTTPS page, that resolves to HTTPS correctly. On an HTTP page, it resolves to HTTP, which is not a supported environment. Use the full https:// prefix to be unambiguous.

The beacon endpoint is HTTPS

The visit count request goes to a statelessid.com endpoint over HTTPS. The connection is encrypted in transit from the browser to the server. The beacon payload — path, source host, screen class, speed band, site key — cannot be read or modified by a network observer positioned between the browser and the server.

This matters most for the referrer host field. On an HTTP connection, the Referer header is visible in plaintext to any party on the network path. HTTPS encrypts the header in transit. The beacon sends the referrer host over an encrypted connection.

HTTP pages do not fire a beacon

If your site is served over plain HTTP (no TLS), asset.js detects this and suppresses the beacon. No count is recorded for page loads served over HTTP. This is intentional. HTTP pages expose connection-level data including headers in plaintext, and they are not a supported environment for the script.

Moving your site to HTTPS resolves this. HTTPS is available for free through services like Let's Encrypt and is supported by all major hosting platforms. If your site still runs on HTTP for any pages, those pages will show zero visits in the board regardless of traffic volume.

Mixed content on HTTPS pages

If your page is HTTPS but you include the asset.js script tag with an http:// prefix, the browser classifies the script as mixed content and blocks it. The script will not load and no beacon will fire. Modern browsers block mixed active content by default and show a warning in the console.

The fix is to use the canonical https://statelessid.com/asset.js URL. Copy the snippet from your dashboard Settings → Script tab, which always includes the correct prefix. Do not modify the src attribute URL.

Troubleshooting

If visits are not appearing and your site is served over HTTP, that is the cause. The script suppresses the beacon on HTTP pages. There is no workaround within the script. Move the page to HTTPS. Most hosting providers support HTTPS through automated certificate provisioning.

If your HTTPS page shows a mixed-content warning in the browser console related to statelessid.com, check the src attribute in your script tag. If it starts with http:// instead of https://, that is the problem. Replace the tag with the one from your dashboard Settings → Script tab, which always uses https://.