← Cases Integration 21 Oct 2026 · PageBrick 1.11.0
A field that accepts one script and nothing else
Path Ranker, a site-diagnostics tool from the same maker, needed its behaviour collector on sites that run PageBrick. The answer was one field in Settings that accepts that script and nothing else, built, tested and released the same day.
- 1script accepted: one tag, one address, one key
- 11new tests for the field, in a suite of 413
- 28checks in a real browser: public pages, panel, editor and preview
- 34 / 34checks updating from 1.10.0 against the real catalog
The problem
The collector is a <script> that measures clicks, scrolling, forms and JavaScript errors of real visitors. To reach every page it has to be put into every public page, which turns the field that receives it into an injection point: whatever is pasted there would be printed on the whole site, for every visitor.
The decision
A box for free code was the easy way and was rejected. The field accepts exactly one <script> tag, with nothing before, after or inside it. The address must be https (http only for localhost) and end in /pr-collect.js; the only attributes are src, data-key, data-site, defer and async. PageBrick takes the three values out, checks them and writes the tag again with every attribute escaped. What was typed is never printed back, and the stored values are checked again each time the tag is written, so a value changed behind the panel’s back prints nothing.
The tag goes in the <head> of the public pages of a live site, for people who are not signed in; never in the panel, the editor or a preview. It does not wait for the cookie notice because Path Ranker states that the collector uses no cookies and respects Do Not Track and Global Privacy Control; the Settings screen says so and credits the claim to Path Ranker.
The proof
The tests try the ways it could go wrong: a second script next to the first, an onload attribute, a type, another address, //host, javascript:, a query string, a user and password in the address, a key with quotes, text around the tag, and a stored value changed in the database. In a real browser the tag appears once, in <head>, deferred and with four attributes, for a visitor; and it does not appear for a signed-in person, in the panel, in the editor’s live preview or in the preview of a draft. Path Ranker confirmed that its keys are 32 lowercase hexadecimal characters, inside what the field accepts.
The result
Released as PageBrick 1.11.0 on 21 October 2026, the same day as the request. The update from 1.10.0 was checked once more against the real catalog: 34 of 34. The same screen already held Google Analytics and the Meta pixel, so a site can now measure traffic and behaviour without touching its theme.
What stayed
A field that puts code into every page should accept the least that works and give back only what it wrote itself.