[adriaandotcom]

Summary

Fixes #97

Prepare public script v12:

• Fix invalid bot detection with window.phantom.solana
• Always expose sa_pageview for ignore-pages integrations
• Include the changes tracked in Only compare non-www with non-www domains for uniques #41 and Illegal invocation with sendBeacon and URL has an error #42
• Handle the Cloudflare under-attack parameter
• Collect only the names of non-empty query parameters in the compact k payload field, never their values
• Let sites opt out with ignoreMetrics: querykeys or data-ignore-metrics="querykeys"

Before merging, update beta.js as well or inform customer team 13489e0b-295c-476b-b955-46389fe10895.

Security implications

Has security impact - described as: - [ ] No security impact - [x] Has security impact - described as: - Query parameter values are never collected by this addition. - Name collection is limited to parameters with non-empty values and can be disabled.

Testing

• Frozen pnpm install passed with Node.js 24.18.0
• Rebuilt all distribution files
• Full unit suite passed: 16 tests
• Focused pageview query suite passed: 4 tests
• Prettier check passed for the edited source and unit test
• BrowserStack workflow passed

Checklist

• Linked to an issue
• Tested
• Asked for a review

Summary by CodeRabbit

• New Features
  • Added automatic tracking for phone links, custom click and form-submission events, and optional 404 page detection.
  • Manual pageviews support paths, callbacks, and metadata. Query parameters can be collected according to configured rules, and repeated pageviews for the same path and query are suppressed.
  • Eligible requests can use fetch or beacon delivery, with image-request fallback when needed.
• Bug Fixes
  • Improved phone-link tracking when navigation is cancelled and pageview handling when paths differ only by query string.
  • Script headers now accept both “Privacy friendly” and “Privacy-first” labels.
• Documentation
  • Removed the Cloudflare app from the listed destinations for compiled scripts.

---

Open workspace in Conductor

[github-actions]

Documentation update

_docs/20_script-settings/06_pings.md

Location: New page in the script-settings category, alongside 05_allow-url-parameters.md

Copy and paste this into the documentation repository:

---
title: Pings
category: script-settings
permalink: /pings
created_at: 2026-10-20
last_modified_at: 2026-10-20
---

We send [time on page](/explained/time-on-page) when a visitor leaves or hides a page. On mobile browsers that page view can be discarded before that moment, and then no time on page is recorded at all.

With the `pings` setting you can send the time on page at fixed moments during a visit, so you always keep a lower bound for that page view. Each ping replaces the previously sent value for the same page view, so your stats never count the same seconds twice.

## Script setting `data-pings`

Specify the thresholds in seconds, separated by a comma:

```html
<script
  data-pings="5,30,60"
  src="https://scripts.simpleanalyticscdn.com/latest.js"
></script>

With the embed above we send the time on page after 5, 30 and 60 seconds of visible time, on top of the request we already send when the visitor leaves or hides the page.

Only visible time counts. When a visitor switches to another tab, the timer pauses and the remaining pings move along with it.

Using the settings object

You can also set it via the settings object:

<script>
  window.sa_settings = { pings: "5,30,60" };
</script>

Defaults

By default there are no pings and we only send the time on page when the page is hidden or the visitor navigates away. Adding pings sends an extra request per threshold, so pick the thresholds that matter to you rather than a long list.

Pings do nothing when timeonpage is disabled via ignore metrics.

Need any help? We love to help you set up your script. Don't hesitate to contact us. Silly questions don't exist.

[github-actions]

Documentation update

_docs/33_explained/05_uniques.md

Location: ## How we detect unique pageviews, replacing the "A pageview is NOT counted as unique when:" list and adding a new subsection after the two example paragraphs that follow it

Copy and paste this into the documentation repository:

**A pageview is NOT counted as unique when:**

- The referrer's hostname matches your website's hostname (internal navigation), unless the referrer is a Cloudflare challenge page (see below)
- The user navigates using browser history (back/forward buttons)
- The user reloads the page
- The referrer's hostname is in your [non-unique hostnames](/non-unique-hostnames) list, for example a payment provider

### Cloudflare challenge pages

If your site runs behind Cloudflare with a managed challenge or "I'm Under Attack" mode, visitors first pass a challenge page on your own domain. The browser then loads your page with that challenge page as the referrer, which would normally make the arrival look like internal navigation.

To avoid losing those visitors, we treat the very first pageview of a page load as unique when the referrer is on your own hostname and contains a Cloudflare challenge marker (`?__cf_` or `&__cf_`). We store no referrer for that pageview, so it appears as direct traffic: the visitor's original referrer was already replaced by the challenge page, and the challenge URL itself is never stored.

Only that first pageview can be counted this way. Later pageviews, page reloads, and back/forward navigation stay non-unique, and a challenge referrer coming from a [non-unique hostname](/non-unique-hostnames) other than your own also stays non-unique.

[adriaandotcom]

Why this change? Shouldn't it be on window anymore?

[adriaandotcom]

This is basically double then, no?

[adriaandotcom]

Wouldn't it make sense to keep the saAutomatedLink function just internally only? Why expose to window?

[adriaandotcom]

Why is there no /** if skipnonwindow **/ because it was there before, no?