Everything you need to get started and master the platform.
Learn what nTrackr is and its core capabilities
nTrackr is a comprehensive analysis and tracking platform for websites and mobile applications. It provides advanced tools to understand visitor behavior, increase conversion rates, and improve user experience.
nTrackr can be used across a wide range of platforms — from e-commerce sites to corporate websites, from blogs to mobile apps. It's ideal for anyone who wants to understand visitor behavior and take action accordingly.
Add and manage your domains
You can add domains you want to track in nTrackr and manage your existing domain settings.
Install the tracking code on your website
To integrate nTrackr with your website, first get the tracking code. You can find this code on the domain settings page.
<script src="https://cdn.ntrackr.com/js/ntrackr.js" defer></script>Add the tracking code to all pages of your website. This is typically placed between the <head> tags.
After adding the tracking code, verify your setup from the nTrackr dashboard.
Origin validation, rate limiting & HMAC signing
nTrackr protects your tracking data with multiple security layers. Regular tracking (page views, events, clicks) works automatically without any configuration. The identify command requires an additional HMAC signature generated from your backend to prevent unauthorized user identity manipulation.
Every API request is validated against the registered domain. The Origin or Referer header must match the domain configured in your nTrackr dashboard. Cross-origin abuse is automatically blocked.
API requests are rate-limited per IP address: 120 requests/minute for general tracking and 10 requests/minute for identify calls. This prevents abuse and ensures service stability.
The identify command requires a server-side HMAC-SHA256 signature. Your backend generates it using the user ID and your API Secret. This ensures only your server can authorize identity calls.
Follow these three steps to secure your identify calls with HMAC verification:
Step 1: Get your API Secret
Find your API Secret in the domain settings page of your nTrackr dashboard. Keep this secret safe — never expose it in client-side code.
Step 2: Generate HMAC on your backend
// PHP
$hmac = hash_hmac('sha256', $userId, $apiSecret);
// Node.js
const crypto = require('crypto');
const hmac = crypto.createHmac('sha256', apiSecret)
.update(userId).digest('hex');
// Python
import hmac, hashlib
signature = hmac.new(
api_secret.encode(), user_id.encode(),
hashlib.sha256
).hexdigest()Step 3: Pass the HMAC to the frontend
ntrack('identify', {
userId: 'usr_12345',
hmac: hmacFromBackend, // Generated by your backend
email: '[email protected]',
name: 'John Doe'
});The SDK automatically sends the hmac value as an X-NTrack-Signature header. The server looks up your domain's API Secret, computes the expected HMAC using the userId, and validates the signature. If the signature doesn't match, the request is rejected with a 403 error.
Never expose your API Secret in client-side JavaScript. The HMAC must always be generated on your backend server. If you suspect your secret has been compromised, rotate it immediately from the domain settings page.
Understand your visitors and assess risks
nTrackr deeply analyzes every visitor to your site, helping you understand not only who they are but also how trustworthy they are.
Detects VPN, Proxy, Tor usage and hosting IPs. Analyzes geographic location, country, city, and ISP information. Anonymous connections indicate higher risk levels.
Browser fingerprinting with dozens of parameters, consistency scoring across sessions, and detection of advanced masking techniques like WebRTC leaks and Canvas fingerprinting.
Analyzes mouse movements, clicks, scroll depth, and interaction patterns. Detects abnormally fast form filling, unusual navigation paths, and bot-like behavior.
You received a high-value order but the system flagged it with a Risk Score of 85.
If a visitor from Google or Facebook ads (identified by gclid or utm_source parameters) has a high risk score, bot-like behavior (instant bounce, zero interaction), and a data center IP — this is strong evidence of a fake click. Use the risk analysis reports and session recordings as evidence to claim refunds for invalid click costs from ad platforms. This is one of the most concrete examples of how nTrackr can directly increase your marketing ROI.
Watch session replays and analyze heatmaps
Session replay allows you to watch your visitors' behavior in a video-like format. It records mouse movements, clicks, scrolling, and form interactions, giving you first-hand observation of user experience.
Shows where users click most. Red areas are most clicked, blue areas least clicked.
Shows where users hover their mouse. Helps understand attention areas that catch the eye but aren't clicked.
Shows how far users scroll down the page. Helps determine where to place your most important content.
You think your "Get Started" button isn't getting enough clicks.
Track and optimize form interactions
Forms are one of the most important ways to interact with users and collect data. nTrackr's Form Analytics lets you track in detail how visitors interact with your forms. This helps you optimize forms, increase conversion rates, and improve user experience.
You noticed users start filling out the registration form but don't complete it.
Form Analytics clearly reveals which steps users struggle with, which fields are confusing, and overall form performance with concrete data. This data is invaluable for improving UX and increasing conversions.
Automate actions based on visitor behavior
Rules & Actions let you create automated workflows triggered by visitor behavior. Configure conditions and actions to respond to events in real-time. Each rule can have multiple condition groups (OR logic between groups, AND logic within groups) and multiple ordered actions.
Use these attributes in your rule conditions to target specific visitors:
landing_page
Landing Page URL
current_url
Current Page URL
referrer
Referrer URL
country
customer.attr_country
city
customer.attr_city
browser_language
Browser Language
visit_count
Total Visit Count
session_count
Total Session Count
page_view_count
Page Views (Current Session)
time_on_page
Time on Page (seconds)
risk_score
Risk Score
trust_score
Trust Score
device_type
customer.attr_device_type
browser
customer.attr_browser
os
customer.attr_os
is_bot
customer.attr_is_bot
connection_type
Connection Type
is_identified
Is Identified
identified_user_id
Identified User ID
identified_email
Identified Email
has_tag
Has Tag
not_has_tag
Does Not Have Tag
Actions are executed in order when all conditions match:
show_message
Display a custom message, modal, or HTML content to the visitor.
redirect
Redirect the visitor to a specified URL.
block
Block the visitor from accessing the site.
trigger_custom_event
Trigger a custom JavaScript event on the page.
send_webhook
Send an HTTP POST request to your webhook URL with visitor data.
add_tag
Add a tag to the visitor for segmentation and future targeting.
remove_tag
Remove a previously added tag from the visitor.
add_css_class
Add a CSS class to an element on the page.
set_cookie
Set a cookie on the visitor's browser.
modify_content
Modify HTML content of an element on the page.
Show a feedback form to visitors who stay on your cart page for too long, collect abandonment reasons, and tag them for retargeting.
landing_page contains /cart
AND
time_on_page > 30
Target repeat visitors browsing specific product categories with personalized on-site promotions and notify your CRM.
landing_page contains /electronics
AND
visit_count >= 3
Automatically detect and block visitors with abnormal browsing patterns that indicate bot or scraping activity.
page_view_count > 100
AND
browser_language != tr
Show a retention modal with a discount code to visitors who have been on the cart page long enough, encouraging them to complete their purchase.
landing_page contains /cart
AND
time_on_page > 15
AND
not_has_tag = exit_intent_shown
Request phone numbers from engaged potential customers who have been tagged but haven't left their contact info yet.
has_tag = potansiyel_musteri
AND
visit_count >= 5
AND
not_has_tag = telefon_birakti
Detect bot traffic from paid ad campaigns to protect your advertising budget and collect evidence for refund claims.
landing_page contains utm_source
AND
risk_score > 70
AND
connection_type = hosting
Offer personalized first-purchase discounts to loyal visitors who keep coming back but haven't converted yet.
has_tag = sadik_ziyaretci
AND
session_count >= 3
AND
landing_page contains /cart
AND
not_has_tag = indirim_teklifi_gordu
Integrate with third-party services
Webhooks automatically send instant notifications (HTTP POST requests) to your specified URL when certain events occur in nTrackr. This lets you integrate nTrackr with your other applications and automate your workflows.
View all your created webhooks in a table on the Webhook Management page. The table shows each webhook's name, target URL, trigger events, and active/inactive status. You can edit or delete any webhook from this table.
Block unwanted traffic proactively
Blacklist management is a powerful security feature that lets you proactively block unwanted or malicious traffic to your website. nTrackr supports flexible blacklist rules based on various criteria, allowing you to easily block bot traffic, spammers, unwanted visitors from specific countries, and more.
Block all traffic from a specific IP address or IP range. Ideal for known attack or spam source IPs.
Block all visitors from a specific country using ISO 3166-1 alpha-2 country codes (e.g., "US" for United States, "CN" for China).
Block browsers or bots containing specific User-Agent text. Useful for targeting malicious bots or legacy browsers.
Block by browser fingerprint hash — the unique ID created from browser and device characteristics. Most effective way to block a specific user/bot even when IP changes.
Adding a new rule is simple. Click "Add New Rule" and fill in the form:
All created rules are listed in the main table. You can view each rule's type, value, action, and expiry date, and easily remove rules you no longer need with the "Delete" button.
Comprehensive risk assessment tools
nTrackr analyzes visitor behavior and technical characteristics to identify potential risks. This section details the "Risk Analysis" tab on the visitor detail page and the reports it contains.
Shows how risky the visitor is on a 0-100 scale. High score indicates a potential threat. Calculated based on IP reputation, device anomalies, and behavioral patterns.
Shows how trustworthy the visitor is on a 0-100 scale. High score indicates a legitimate user.
Detects when a visitor uses multiple IPs, which may indicate identity concealment. Shows IP change timeline with all IPs used, time ranges, and geographic locations.
Detailed analysis of the current IP including risk score, anonymity detection (VPN/Proxy/Tor), hosting provider check, and known threat type listings (spam, botnet, etc.).
Fingerprint uniqueness score, browser security level, device consistency across sessions, WebRTC leak detection, advanced device info (CPU cores, memory, screen resolution).
Session count, average duration, interaction and anomaly scores. Bounce rate, pages/session, scroll depth. Status info (blocked, whitelisted, rule-based). Form & event analysis (filled forms, triggered events, error rates).
Based on analysis results, nTrackr recommends specific security actions like "Immediate Block", "Close Monitoring", or "Request Additional Verification" based on risk score. Also suggests network-level measures like geo-blocking and rate limiting based on IP analysis. A summary table shows all main scores (Overall Risk, IP Risk, Fingerprint, Trust) at a glance.
Match your logged-in users with nTrackr visitors
The Visitor Identify feature allows you to associate your own application's user data (user ID, email, name, and unlimited custom metadata) with nTrackr visitor records. This creates a bridge between your application's users and nTrackr's analytics data.
When a visitor logs in to your website, you can send their user information to nTrackr using the identify command. This data is stored as a JSON object on the visitor record and is visible in the dashboard, searchable, and usable in rule conditions.
Minimal — just a user ID:
ntrack('identify', {
userId: 'usr_12345',
hmac: 'your_hmac_signature'
});Full — with all fields and custom metadata:
ntrack('identify', {
userId: 'usr_12345',
hmac: 'your_hmac_signature',
email: '[email protected]',
name: 'John Doe',
meta: {
plan: 'premium',
company: 'Acme Inc.',
role: 'admin',
signup_date: '2025-01-15'
}
});Update only metadata (merges with existing data):
ntrack('identify', {
hmac: 'your_hmac_signature',
meta: { last_order: '#1234', vip: true }
});Each identify call deep-merges with existing data. Previously sent fields are preserved, new fields are added, and updated fields are overwritten. Meta keys are also merged individually.
// First call
ntrack('identify', {
userId: 'usr_12345',
hmac: 'your_hmac_signature',
meta: { plan: 'free' }
});
// Second call — adds email, updates plan
ntrack('identify', {
hmac: 'your_hmac_signature',
email: '[email protected]',
meta: { plan: 'premium', company: 'Acme' }
});
// Result: all data merged
// { userId: 'usr_12345', email: '[email protected]',
// meta: { plan: 'premium', company: 'Acme' } }To remove a previously set meta key, send it with a null value:
ntrack('identify', {
hmac: 'your_hmac_signature',
meta: { old_key: null } // This key will be removed
});Identified visitors show a verification badge in the visitor list. In the visitor detail page, a dedicated "Identified User" card displays all sent data including custom meta key-value pairs. You can also search visitors by user ID, email, or name.
You can use identification status in your automation rules. Available conditions: "is_identified" (boolean), "identified_user_id" (matches user ID), and "identified_email" (matches email). Combine these with other conditions to create powerful targeting rules.
You are responsible for ensuring that any personal data sent via the identify command complies with applicable privacy regulations (GDPR, CCPA, etc.). Only send data that you have consent to process. nTrackr stores this data securely alongside the visitor record.
Get help when you need it
If you encounter any issues or need assistance, you can easily reach our support team through the Support section in your customer panel.
[email protected]
Create a support ticket
Available during business hours