# [The Rebilder Tag](https://rebilder.com/docs/tag)

> One pasted script that counts AI-referred visitors and browser-driving agents on your own site. What it reports, what it refuses to collect, and what it can never see.

- **Updated:** 2026-08-20
- **Publisher:** Rebilder

## The whole install

The Rebilder Tag is a first-party script you paste into your own site. It is dependency-free, it is served from rebilder.com, and the install is complete when this one line is in your HTML:

Anywhere in your page HTML

```
<script defer src="https://rebilder.com/tag.js" data-rebilder-store="STORE_ID"></script>
```

Replace `STORE_ID` with the store id shown on [Console install](/console/install). The tag works on any platform that lets you add a script tag; there is no build step and no package to keep current.

The tag is the measurement half for traffic that runs JavaScript. The [gateway](/docs/quickstart) is the serving half, and the only instrument that sees agent fetches. The two install independently and meet in the same Console.

## What it reports

One beacon per initial pageview, sent with `navigator.sendBeacon` to the endpoint below, and nothing else. The payload is three fields:

| Field | What it carries |
| --- | --- |
| `path` | `location.pathname` only. A query string never leaves the page, and the stored column refuses a value containing `?`. |
| `ref` | The referrer, only when it comes from another origin. A same-origin referrer is dropped at the endpoint and never stored. |
| `wd` | `navigator.webdriver`, verbatim. `true` means an automated browser declared itself; `false` or absent means nothing. |

The server supplies the timestamp from its own clock, because the tag sends none, and classifies the cross-origin referrer into a platform (`chatgpt`, `perplexity` and the rest) with the same classifier the gateway events path uses. A route change in a single-page app does not fire another beacon; the count is initial pageviews.

## What it deliberately does not collect

> **The absences are the contract** Each item below is enforced by the endpoint and the database schema rather than by intention, and the commitments on this page are pinned by tests, so a build that softens one fails.

- **No query strings, ever.** The beacon sends `location.pathname` only, the endpoint strips any query that reaches it anyway, and the database refuses a path that carries one. Search terms, tokens and tracking parameters never reach the table.
- **No IP address stored.** A pageview row carries no IP and no IP hash. Rate limiting for the public endpoint hashes the caller with a salt that rotates daily, in a separate table whose rows expire within days, and nothing joins a pageview to a network address.
- **No raw User-Agent.** The endpoint classifies server-side, and only the classification lands.
- **No cookies, no storage, no identifiers, no fingerprinting.** The tag sets nothing and reads nothing beyond the three fields above. Rows are pageviews, not people, so any visitor count derived from them is an estimate and is labelled as one wherever it renders.
- **Honors Do Not Track and Global Privacy Control.** When `navigator.doNotTrack` is `1` or `globalPrivacyControl` is set, the tag sends nothing at all.
- **Never runs on rebilder.com.** The script checks its own hostname and exits, so the [privacy policy](/legal/privacy) statement that rebilder.com carries no analytics tag stays true.
- **One hardcoded endpoint.** Beacons go to `https://api.rebilder.com/v1/client-events`: no filter, no constant, no override. Another script on the page cannot redirect your events anywhere else.

## What it can and cannot see

The tag sees traffic that executes JavaScript in a browser: human visitors, including the ones AI assistants refer, and browser-driving agents that declare themselves through `navigator.webdriver`. It also gives WordPress-sourced and self-hosted stores the human-pageview denominator their agent numbers were missing.

> **Fetch-based agents never execute the tag** Most agent traffic is an HTTP fetch that runs no JavaScript and fires no beacon, so it never appears in tag data. That traffic is visible only server-side, through the [gateway](/docs/quickstart) and its [events](/docs/events). Console surfaces keep the two counts separate, and any report built on them should too.

Read the two instruments together: the tag carries the human-pageview denominator and the AI-referred half, and the gateway carries agent fetches, the answer rate and the miss log.