CMS, website platforms and mobile apps

What you will learn #

This chapter is for anyone who already has a Hitsteps account (or is about to create one) and wants to attach Hitsteps to the platform their website runs on: WordPress or WooCommerce, a Shopify store, Joomla, Ghost, a HighLevel funnel, Wix, PrestaShop, Drupal, a plain HTML site, a forum or blog, or a browser and a phone or desktop app. After reading it you can install Hitsteps on your platform, confirm the first real visit, remove it again when you need to, and find the right troubleshooting step when nothing shows up.

This chapter is the "where do I paste what" part of the manual. It intentionally does not repeat the marketing copy from the platform pages; it links to them and concentrates on the exact steps, the fields, the limits and the fixes.

Before you begin #

Before you start any install path you need:

• A Hitsteps account. Create one at https://www.hitsteps.com/register.php. New accounts start with a 7 day Pro trial and no credit card is required.
• A website profile inside that account for the site you want to track. You add one from the dashboard: account home / "Add a website", then enter the website name and URL. Hitsteps creates the profile and gives it an API key.
• The right access on your own platform. Each section below lists its own requirement, for example WordPress administrator access, Shopify app-install permission, Ghost Code Injection access, or FTP access to your template files.
• Admin or editor access to Hitsteps itself. There is no extra role gate for installing tracking: the owner of the account can do it; team users who have a login can use the same site settings if the account's site access allows it. Multi-site access is covered in chapter "Sites, teams, account security and billing" (/guide/account-security-and-billing/).

There are two things you copy from Hitsteps, and they are not the same:

• API key (the site's API code): a short key used by plugins and apps that can act on your behalf.
• Full tracking code: the complete JavaScript snippet, including script and noscript parts, used for manual installs into HTML, a CMS footer, a tag manager or an embed.

Which one you need is stated in every section below. When in doubt, the two buttons on the settings page are "Find your API key and tracking code" (in the account) and the "Tracking code" tab of the website settings, where "Paste the tracking code" then "Copy code" copies the whole snippet.

Where to find it #

Most installs in this chapter do not need a report screen, but the verification step does. Plan the clicks you will make after pasting anything:

• Plugins and apps hub: https://www.hitsteps.com/plugin/ ("All integrations").
• Platform specific guides: https://www.hitsteps.com/plugin/?type=wordpress (and the same type value with shopify, joomla, googletagmanager, wix, prestashop, blogger, tumblr, zencart, phpbb, drupal, html, browser, win, api, mcp and others).
• Finding the key and code: from the signed-in dashboard, open the website's settings (account area), then the "Tracking code" tab / "Find your API key and tracking code" entry.
• Verifying a visit: left menu, then "Recent visitors" on your site, or the live dashboard. URL pattern used in this manual: /stats/<your-site-id>/visitors/recent/ (do not enter a real site id, yours is shown in the dashboard).
• In-app help: the support FAQ at https://www.hitsteps.com/support.php covers general questions and has a search box.

Step by step #

The universal first step is getting the key or code ready, so it is written once here and referenced from each platform section.

4.0 First, get your key and tracking code

1. Log in to Hitsteps.
2. Open your website's settings for the site you want to track.
3. Copy the API key if the section below says "API key", or open the "Tracking code" tab, choose "Paste the tracking code" and "Copy code" if the section says "full tracking code".
4. Install on the platform, then verify. Verification is the same everywhere: open the public site in a normal browser tab, then look at Recent visitors in Hitsteps and confirm your own visit appears. Do not verify from a CMS editor or preview; use the published site.

4.1 WordPress (recommended path with the official plugin)

The official plugin is published on WordPress.org as "Hitsteps Web Analytics" (slug hitsteps-visitor-manager), current version 6.0.1, last updated 5 November 2026, tested against WordPress 7.1.4 and requiring PHP 5.3 or newer.

1. Log in to your WordPress admin and open Plugins, then Add New.
2. Search for "Hitsteps" and find the Hitsteps visitor manager / web analytics plugin.
3. Install Now, confirm, then Activate.
4. Open the Hitsteps plugin settings (from WordPress.org plugin flow: Settings, then Hitsteps, or the plugin's own menu item after activation).
5. Paste the API key for this website and save. Do not add spaces before or after the key.
6. Open your public site in a new browser tab, then open the Hitsteps live dashboard. Your own visit should appear within a few seconds. The WordPress dashboard also shows a Hitsteps summary widget.

Notes for WordPress:

• WordPress.com only works if your plan allows custom code. If it does not, this plugin path is not available; use the how-to guide link in section 4.12 for the general HTML route if the plan allows any code injection.
• The plugin handles WooCommerce order data and supported form submissions on top of page tracking. Ecommerce reporting is covered in the ecommerce chapter (/guide/ecommerce-and-shopify/) and on https://www.hitsteps.com/woocommerce-analytics/.
• One copy of the code per page. Do not also paste the manual snippet if the plugin is active.
• Uninstall: in WordPress admin open Plugins, Deactivate Hitsteps, then Delete. Your Hitsteps data stays in your Hitsteps account; only the plugin leaves the site.

Supporting pages: https://www.hitsteps.com/wordpress-analytics/, https://www.hitsteps.com/wordpress-heatmap-plugin/, https://wordpress.org/plugins/hitsteps-visitor-manager/.

4.2 WooCommerce (store extension of the WordPress plugin)

WooCommerce has no separate install: it is the same WordPress plugin, which detects WooCommerce on the site and records store events. Run the WordPress install above, then confirm in the dashboard that cart and checkout actions appear for your store's visits.

Real-time visitors are available from the Free plan. Ecommerce reports and funnels were included in your 7 day Pro trial; after the trial they follow the plan gate shown under pricing at https://www.hitsteps.com/features.php#price. Full store coverage lives in the ecommerce chapter.

4.3 Shopify (install from the Shopify App Store)

1. Open the app listing at https://apps.shopify.com/hitsteps-analytics and start installation.
2. Review and approve the requested permissions for the store you want to track.
3. Follow the short setup inside the app. The app installs its tracking setup for you. Do not paste code into your theme; the app does that itself.
4. Open your storefront in a new browser tab, then your Hitsteps live dashboard. Your own visit should appear.
5. Uninstall: from your Shopify admin, remove the Hitsteps app. Shopify handles the uninstall event; Hitsteps deactivates its local store records instead of failing repeatedly.

Notes: do not manually paste extra tracking snippets into the theme while the app is installed; duplicate scripts cause double events. Details of the storefront data, click heatmaps and commerce reports are in the ecommerce chapter and on https://www.hitsteps.com/shopify-analytics-app/. The store app page states a 5.0 rating from 12 reviews on the Shopify App Store and that the app has been listed since 2015.

4.4 Joomla 5 and 6 (native package v3.0.0)

1. Download the package from https://www.hitsteps.com/plugin/?type=joomla (package pkg_hitstepsanalytics_v3.0.0.zip, updated 3 August 2026, built for Joomla 5 and 6).
2. In Joomla administrator open System, then Install, then Extensions, and upload the package.
3. Go back to System and open Plugins under Manage. Find the Hitsteps plugin, paste your API key, enable the plugin and save.
4. Open Components, then Hitsteps Analytics, to see the four widgets (analytics summary, Online Visual, recent visitors, visitor map). The same four widgets can appear on the administrator dashboard.
5. Open your public site in another tab and confirm your visit in the Hitsteps live dashboard.
6. Upgrade from legacy v2.08: back up Joomla first, then install the new package over the old one without uninstalling first. Confirm the API key, language, privacy choices and module assignments survived, then disable Joomla compatibility plugins and test before removing the backup.
7. Uninstall: open System, then Extensions under Manage, find the Hitsteps Analytics Package, select it and click Uninstall. Joomla removes the component, plugin, modules, media and update site records together.

Legacy Joomla 2.x to 4.x: the archived v2.08 package is at https://www.hitsteps.com/plugin/?type=joomla-legacy (installed from Extension Manager, then Plugin Manager, API key under Basic Options; uninstall via Extensions, then Manage). The Joomla landing page https://www.hitsteps.com/joomla-analytics/ states Hitsteps is listed on the Joomla Extensions Directory.

4.5 Ghost (manual, via Ghost Code Injection)

Ghost is covered by a dedicated public guide: https://www.hitsteps.com/ghost-analytics/. The steps:

1. Create your Hitsteps account and add your Ghost blog URL as a website.
2. Open that website's "Tracking code" tab, choose "Paste the tracking code", then "Copy code". Copy the entire snippet including script and noscript. Do not use the plugin API code.
3. In Ghost open Settings, then Advanced, then Code Injection. Paste the full snippet into "Site Footer" and save. Keep any existing footer code.
4. Open a published post in a normal browser window (not the editor or a preview) and check Recent visitors in Hitsteps.

Requirement and caveats (from the public guide): you need sitewide Code Injection. If Settings, Advanced, Code Injection is missing in your Ghost admin, your Ghost plan or host does not include it; the guide does not assume every hosted plan has it. Site Footer places the code before the closing body tag, which matches where Hitsteps expects the snippet. Add it once sitewide, not on each post.

4.6 HighLevel (funnels and websites, head tracking code)

HighLevel is covered by a dedicated public guide: https://www.hitsteps.com/highlevel-analytics/. The steps follow HighLevel's own support article "Add Tracking Code/Script to Funnels and Websites":

1. Create your Hitsteps account and add the public URL of the client site as a website.
2. Open its "Tracking code" tab and copy the whole snippet, script and noscript. Use the snippet for that website, not an API key.
3. In HighLevel go to Sites, then Funnels or Websites, and open the one to track. Open the Settings tab, find "Head tracking code", paste the snippet and save. This covers every step or page of that funnel or website, so it is done once.
4. Page level alternative: open the page in the builder, click Tracking Code, paste into Header Tracking and save. Use this only when the script should run on one page only.
5. Verify on the live, published page in a normal browser window and look for the visit under Recent visitors. Check the published site on its real domain, not the HighLevel editor or a preview.

Three facts worth knowing (from the public guide, which cites HighLevel's help articles read on 6 November 2026): HighLevel injects the code client side, so View Source will not show it; cloned pages do not carry page level tracking code, so re add it on every copy; and do not paste the same script in both the funnel and the page level field, because a duplicate install is the usual reason the same event fires twice. Plan gates on that page: funnels are Pro and above, goals start on Starter, heatmaps are Growth and above.

4.7 Wix (HTML embed; no Wix App Market listing)

1. Copy your API key from Hitsteps.
2. In the Wix App Market add the HTML embed app (search for HTML and add the HTML iFrame / Embed app to your site).
3. In the Wix editor add the HTML iframe from the More section and enable "Show on all pages".
4. Paste the Wix snippet from the guide at https://www.hitsteps.com/plugin/?type=wix into the embed code area and replace YOURAPICODE with your real API key.
5. Save, publish the site, then verify your visit in the live dashboard.

Notes: Hitsteps does not have a Wix App Market listing, so the embed is the supported route. The snippet includes a navigation watcher so single page transitions are counted. Place only one copy of the code on each page.

4.8 PrestaShop (module)

1. Download the module ZIP (v1.1.0) from https://www.hitsteps.com/plugin/?type=prestashop.
2. In the PrestaShop back office open Modules and upload the ZIP package.
3. Paste your Hitsteps API key on the configuration page and save.
4. Open your shop storefront and confirm the visitor appears in Hitsteps.

There is no long-form marketing page for PrestaShop; the plugin guide is the authoritative source. (There is no /prestashop-analytics/ page today.)

4.9 Drupal, Tumblr, Blogger, Zen Cart, phpBB (manual code routes)

These platforms use the full tracking code in a shared theme or gadget spot. The plugin guides at https://www.hitsteps.com/plugin/?type=<name> hold the exact steps; the essentials:

• Drupal: paste the full tracking code into a site-wide block, a global footer region, or the active theme template so it renders on all public pages, then clear the Drupal cache. If the site has strict Content Security Policy rules, allow the Hitsteps tracking domain before testing.
• Tumblr: open the blog, go to Customize Appearance and paste the full tracking code into the Description field or the custom HTML area, then save.
• Blogger: Layout, then Add a Gadget, choose HTML/JavaScript, paste the full tracking code into the gadget content and save.
• Zen Cart: open the active template footer, usually includes/templates/custom/common/tpl_footer.php, back it up first, paste the code near the end before the closing body tag, upload and clear template cache.
• phpBB: open styles/YOUR_THEME/template/overall_footer.html for the active theme, paste the code before the closing body tag, then clear phpBB cache from the ACP.

In every case the verification step is the same: open a public page and confirm the visit in Hitsteps.

4.10 Google Tag Manager (tag template)

1. Copy your Hitsteps API Code for the website from your site settings.
2. Download the template from https://www.hitsteps.com/plugin/googletagmanager/template/template.tpl.
3. In Google Tag Manager open Templates, create a new tag template, and import the downloaded file.
4. Open Tag Configuration, choose the Hitsteps Analytics template, name the tag "Hitsteps", and paste your API Code into the Hitsteps API Code field.
5. Set the trigger to All Pages.
6. Save, submit and publish the container. Then open the public site and watch the live dashboard.

Facts from the guide: the template only injects the official tracking script from edgecdnplus.com. Only the first 32 characters of the API Code are sent to the website; the final 5 authentication characters are omitted. The template is currently imported from the file; the guide notes that after Community Template Gallery approval it will also be addable directly from GTM's template gallery. To test, use GTM preview mode and confirm the tag fires on page view before publishing.

4.11 Browser extensions (Chrome, Firefox, Edge, Opera)

Browser extensions are for the team, not for site tracking. They add quick dashboard access, chat and Segment notifications, and live chat availability while you work.

• Chrome: "Hitsteps Visitor Manager" in the Chrome Web Store, https://chromewebstore.google.com/detail/hitsteps-visitor-manager/faidpebiglhmilmbidibmepbhpojkkoc.
• Firefox: "Hitsteps Analytics" on Firefox Add-ons, https://addons.mozilla.org/en-US/firefox/addon/hitsteps-analytics/.
• Edge and Opera: installed from the same Chrome Web Store listing; see the grid on https://www.hitsteps.com/plugin/?type=browser.
• Safari: extension support has changed over time. The plugin guide redirects the Safari entry to the browser extensions page and notes the legacy extension may be unavailable; read https://www.hitsteps.com/plugin/?type=browser for the currently supported set.

After installing, sign in with your Hitsteps account in the extension. Uninstall from the browser's manage extensions page.

4.12 Windows and macOS desktop apps

• Windows: download the MSI for your processor from https://www.hitsteps.com/plugin/?type=win (x64 for most computers, ARM64 only for ARM devices). Install, open the app settings, paste your API key, then drag the overview widget where you want it, or hide it to keep only notifications.
• macOS: download the universal DMG (v1.1, works on Intel and Apple Silicon) from https://www.hitsteps.com/plugin/?type=mac, copy Hitsteps to Applications, launch it, open Settings from the menu bar item, and paste your API key. There is also a Mac App Store build "Hitsteps Menubar Overview" and a dedicated setup page at https://www.hitsteps.com/mac-menubar-setup/.

What these apps need: a Hitsteps API key, permission to install apps on the machine, and access to the app settings to save the key. They show live activity, chat and Segment notifications; the full reports stay in the web dashboard.

4.13 Mobile apps (iOS and Android)

• The mobile app page is https://www.hitsteps.com/mobile-app (also reached from /mobile-app/).
• iPhone and iPad: "Hitsteps Web Analytics" in the App Store, https://apps.apple.com/us/app/hitsteps-web-analytics/id6780132209.
• Android: the same app on Google Play, https://play.google.com/store/apps/details?id=com.hitsteps.mobile.

What the app does, per the public page: live visitor awareness (active visitors, recent activity, visitor profiles, the websites connected to your account), Segments notifications, and Messages so you stay close to chat and support activity. The page states the app is designed for quick monitoring and response, and that full reporting, setup, integrations, heatmaps and account controls remain in the web dashboard. A Hitsteps account is required; the service starts free.

Sign in with the same account you use on the web. Uninstall is the normal App Store / Google Play app removal; your Hitsteps data is untouched.

4.14 Agencies and MainWP (multi-site connectors)

• MainWP connector: Hitsteps ships a MainWP add-on (parent plugin "Hitsteps for MainWP" v0.1.0, requiring WordPress 6.0 or newer and PHP 7.4 or newer) plus a child site sync module that is loaded by the Hitsteps WordPress plugin on each child site. The child module stores only the site code and, on a MainWP sync, returns the last 30 days of visitors, page views and top pages for that child site; the agency's account secret and token never reach the child site. There is no dedicated public plugin page today, so availability is through Hitsteps support: if you run a MainWP network, ask support about the currently distributed add-on. The general multi-site account model is in the account chapter.
• Multi-site management generally: one Hitsteps account can hold many websites, which is how agencies run client properties. See the features page /features/multi-site-user-management/ and the account chapter.

4.15 Other connectors on one line (details live in the API chapter)

• Grafana: connect through the Infinity data source with a Bearer token and import the dashboard JSON. Full steps at https://www.hitsteps.com/grafana-integration/.
• AI MCP server: a remote Model Context Protocol endpoint at https://www.hitsteps.com/mcp/ lets MCP-compatible assistants read analytics with scoped OAuth. The guide is at /plugin/?type=mcp and the concept page at /ai-integration/. The MCP guide states Claude users can install "Hitsteps Web Analytics" from the Claude Connector Directory and that a ChatGPT directory listing is coming soon; until then ChatGPT users add the https://www.hitsteps.com/mcp/ URL manually in ChatGPT with Hitsteps OAuth. Full API and connector coverage is in chapter 21, "/guide/api-and-connectors/".
• Looker Studio: use the public connector guide and the API and connectors chapter. Data access requires an eligible Business plan or active trial. Follow the current guide for the deployment link and available report types.
• White-label: partner-arranged deployments only. They are set up by Hitsteps with approved partners, not through a self-serve install in this manual. If you are a partner, your launch package already describes the app path; otherwise this manual is not the route.

Worked example #

Imagine you run a WordPress shop called "your-store.example" which also has WooCommerce active.

1. You create the Hitsteps account and add "your-store.example" as a website. The account assigns it an API key.
2. In WordPress admin you install the Hitsteps plugin, activate it, and paste that API key into the Hitsteps settings. You save.
3. You open your-store.example in a separate incognito window. It loads normally, nothing breaks.
4. Back in Hitsteps you open Recent visitors for your-store.example. A new row appears within a few seconds: the visit from your incognito window, from your network's approximate location, on the page /shop/, source "Direct / None" (because you typed the address), device "Desktop".
5. You then open the live dashboard and the traffic sources report; the visit is there. This same pattern repeats for every platform in this chapter: paste the right thing once, open the public site, confirm the visit.

Expected result: the visit you just made is visible in the live dashboard and Recent visitors under the correct page, source and device columns.

Controls and metrics #

Plan gates verified from the public pages on 8 November 2026: live visitors are on the Free plan; heatmaps are on Growth and above and included in the 7 day Pro trial; chat is on paid plans; funnels are Pro and above; goals start on Starter; uptime monitoring is Pro and above; the AI MCP server is available on every plan. Free plan facts from the Ghost guide: one website, under 2,000 monthly pageviews, 14 days of history, including live visitors, traffic sources and top pages.

Problems and fixes #

Access, privacy and limits #

• What is stored: the visitor events collected by the tracking code (pages, referrers, devices, approximate locations, actions, and where you enabled it, commerce and form events). The manual install paths store the same data as the plugin paths; the install method does not change the dataset in the dashboard.
• What is not sent: for plugins, the account secret for the MainWP child never leaves the main Hitsteps side; the child site stores only a site code. For GTM, the final 5 authentication characters of the API Code are never sent to the website.
• Privacy features: see "GDPR privacy controls" at /features/gdpr-privacy-controls/, the opt out page at https://www.hitsteps.com/optout.php, and the Privacy and data controls chapter for data retention, deletion and consent handling. Site Footer and Head tracking code placements are considered standard analytics placements; review your consent banner obligations with your own policy. The HighLevel guide explicitly does not advise whether HighLevel's Cookie Consent Banner is needed for your audience.
• Plan gates: Free covers one website, under 2,000 monthly pageviews and 14 days of history with live visitors, traffic sources and top pages. Heatmaps, live chat, goals, funnels, uptime and the paid report features follow the limits shown for the selected plan. These are product availability statements from 8 November 2026; recheck /features.php#price before quoting them to a customer.
• Who can install: anyone with account access to the site's settings. Team access follows the account's multi-user settings.
• The dashboard always keeps its full reporting; the mobile and desktop apps are companion views, as explicitly stated on the mobile app page.

Webflow, Duda and Plesk

This manual does not provide a verified marketplace app or extension installation for Webflow, Duda or Plesk. Do not assume an unofficial package is supported. Where your platform permits site-wide JavaScript, follow the manual HTML installation instead, or ask support about current integration availability.

For AI integrations, use the MCP setup guide and AI integration overview. The MCP server URL is a protocol endpoint, not a webpage to browse.

Related help #

• Plugins and apps hub: https://www.hitsteps.com/plugin/
• Platform landing pages: /wordpress-analytics/, /woocommerce-analytics/, /shopify-analytics-app/, /joomla-analytics/, /ghost-analytics/, /highlevel-analytics/, /wordpress-heatmap-plugin/, /mac-menubar-setup/.
• Feature pages: /features/wordpress-email-integration/ (WordPress site identity to journey context, consent aware), /features/multi-site-user-management/, /features/gdpr-privacy-controls/, /features/shopify-commerce-tracking/.
• General guides: https://www.hitsteps.com/how-to-track-website-visitors/ (the platform neutral setup guide), /what-is-web-analytics/ and the what-is guide family.
• Other manual chapters: "Getting started and installation" (/guide/getting-started/) for account and first data; "Ecommerce and Shopify analytics" (/guide/ecommerce-and-shopify/) for store data; "Live chat, notifications and visitor communication" (/guide/live-chat-and-messages/) for chat; "Heatmaps" (/guide/heatmaps/) for click maps; "Developer APIs and reporting connectors" (/guide/api-and-connectors/) for Grafana, MCP, reports APIs and Looker Studio; "Sites, teams, account security and billing" (/guide/account-security-and-billing/) for accounts and multi-site access.

• Support FAQ: https://www.hitsteps.com/support.php. Changelog: https://www.hitsteps.com/changelog.php.

• All guide topics

• Frequently asked questions
• Contact support
• Dashboard, real-time and visitor reports
• Privacy, data controls and tracking exclusions

Last checked #

Checked 8 November 2026 using product documentation and source, with public pages and safe sample screens where available. Account-specific access, provider controls and effective limits can differ; use the current message shown for your website. Examples are illustrative.