What It Does
Records which pages someone views on your website. While they are browsing, they are anonymous — just a random identifier in a cookie. The moment they identify themselves, by submitting a form, placing an order or clicking a link in an email you sent, everything they already viewed is attached to their contact record.
That backwards reach is the point. You do not just see that someone enquired; you see that they read your pricing page three times over two days first.
What It Cannot Do
Worth knowing before you set it up, because people expect more than is possible:
- It cannot tell you who an anonymous visitor is. Nobody can. If they never identify themselves, they stay anonymous and are deleted after 30 days.
- It does not follow people between devices. Someone who browses on their phone and enquires on a laptop looks like two different visitors until they identify on each.
- It does not identify the company from an IP address. That is a different kind of product, it works at company rather than person level, and it is unreliable for home and mobile connections.
Setting It Up
- Go to Customers → CRM Settings → Connected sources and choose Connect a source → Website visitor tracking.
- Give it a name and enter your website address.
- Copy the snippet and paste it just before
</body>on every page, or add it once through your tag manager. - Add every domain your site is served from. Anything reported from a domain not on that list is ignored — which is why it does not matter if someone copies your snippet. Add all of them. A Shopify store is usually reachable on both
yourstore.myshopify.comand your own domain, and plenty of sites answer on ashop.orwww.subdomain too. Traffic on a domain you left out is silently ignored, which looks exactly like the feature not working. - Turn tracking on. Nothing is recorded until you do.
That is the whole installation for most websites. The one snippet covers every page and every form on your site — contact, enquiry, quote, newsletter — with nothing to configure per form. Online stores need one extra step for checkout, covered further down.
Consent Is Yours to Obtain
This is the part to read properly. You are the one collecting this information about your visitors; Dinopix stores it on your behalf. That means obtaining any consent required where your visitors live is your responsibility, and your own privacy policy should describe it.
The snippet we give you waits for consent before it records anything. Your cookie banner tells it when consent has been given:
// when the visitor accepts
window.dinopix.consent(true)
// when they decline, or withdraw later
window.dinopix.consent(false)
Declining also clears the identifier, so the next visit starts clean rather than resuming an existing profile.
If your site handles consent some other way and you want tracking to start immediately, remove data-require-consent="1" from the snippet. Only do that if you are confident consent is genuinely covered.
If you are on Shopify
Shopify has its own privacy banner and Customer Privacy API, so you do not need a second banner — you need to tell ours what Shopify's already decided. Add this alongside the snippet:
document.addEventListener('visitorConsentCollected', function (e) {
window.dinopix.consent(e.detail.analyticsAllowed === true)
})
// and on load, in case they decided on an earlier visit
if (window.Shopify && window.Shopify.customerPrivacy) {
window.dinopix.consent(window.Shopify.customerPrivacy.analyticsProcessingAllowed())
}
If you do not connect the two, our snippet keeps waiting and records nothing — which is the safe direction to fail, but it does mean the feature looks broken until you wire it up.
Regardless of how you configure it, the script honours Global Privacy Control and Do Not Track. If a visitor's browser sends either signal, nothing is recorded.
How Someone Becomes Identified
Any one of these is enough. After the first, every future visit on that browser is attributed straight away.
- A form submission. Automatic — the snippet adds a hidden field to every form on the page, so contact, enquiry, quote and newsletter forms all work with no extra setup.
- A link in an automated email. Automatic once tracking is on: your logo in the review and NPS emails links back to your site carrying a one-time token.
- An order at checkout. Needs one small addition to your store — see below.
Only the first identification counts. If two people use the same computer, the second one filling in a form does not take over the first one's history.
Identifying People at Checkout
This is not a second tracking script. You still only ever install the one snippet above, on every page. What follows is a few lines of PHP that tell WooCommerce to keep something the snippet has already done.
Here is what happens at checkout. The snippet adds a hidden field to every form on the page, and the WooCommerce checkout is a form like any other — so the identifier is already being sent with the order. The problem is on Woo's side: it saves the fields it recognises and silently discards the rest, so the identifier arrives and is thrown away.
WooCommerce
This tells it to keep it. Add it to your theme's functions.php or a snippets plugin — it is PHP, not JavaScript, so it does not go anywhere near the page itself:
add_action('woocommerce_checkout_update_order_meta', function ($order_id) {
if (!empty($_POST['dpx_vid'])) {
update_post_meta($order_id, 'dpx_vid', sanitize_text_field($_POST['dpx_vid']));
}
});
Shopify
Nothing to do. Shopify hosts its own checkout, so our snippet is not running by the time someone reaches it and cannot add a hidden field — but it can attach the identifier to the cart beforehand, and Shopify carries cart attributes through onto the order. The snippet does that for you automatically.
The only situation where it will not work is a heavily customised storefront that does not expose Shopify's standard cart endpoint. Nothing breaks if so; you simply will not get checkout identification.
If you skip this
Everything else still works. You just will not identify someone whose only interaction is buying — no form, no emailed link. For most businesses that is a small gap; for a shop it may be the main one, which is why it is worth the few lines.
Where the History Appears
On the contact's record, in the activity timeline, grouped into visits. Each entry shows the pages viewed and when. Use the Website filter to see only those.
How Long It Is Kept
- Visitors who never identify themselves are deleted after 30 days of no activity.
- Page view records are deleted after 12 months.
- Deleting a contact deletes their browsing history with them.
Turning It Off
Open the source in Connected sources and choose Turn tracking off. Recording stops immediately. History already collected is kept, so you can turn it back on without losing anything.