The line of code you paste on a page contains a public site ID. Anybody can read it in your page source, and that is by design: a visitor's browser has to send it, exactly like an analytics ID. So Pulse is built so that the ID is worth nothing to a stranger.
With your public ID, somebody can:
- Report a page view, from one of your own domains.
- Open a chat as a visitor, from one of your own domains.
- See the same anonymous dots your public globe shows.
With your public ID, nobody can:
- Record a sale or a lead. Only your own plugins and your signed webhook can.
- Read a name, an email, a lifetime value or anybody's conversation.
- Open your Chats, your Dashboard, or anything in WordPress.
Locked to your domains:
An ID used from a website that is not this site, not on your Your Sites list and not in Allowed origins is refused. When that happens, the Dashboard and Connections show it under Visits From A Domain That Is Not On Your List, so a domain of yours you forgot to add is one click away (This Is Mine, Add It). Diagnostics shows anybody who was turned away.
Rate limited:
Every browser and every address has a ceiling, so nobody can flood your numbers.
Private chats are private:
Each visitor's chat is tied to a long random ID made by their own browser. It cannot be guessed.
No secrets in a page, ever:
Your licence key, your AI keys, your webhook secret and your Commerce token stay on your server. AI keys and the Search Console key are stored encrypted.
Robots and your own visits:
Search engines, crawlers and automated browsers are never counted, and neither are you.
See it for yourself:
Open 🩺 Diagnostics. The Security card shows The ID in your page source (Safe to publish), Secrets in your pages (None), and whether the site uses a secure connection (https).
The live tests:
Under 🧪 Live Tests, press Run The Live Tests. Your browser asks Pulse the same way a visitor's browser does. Your private data is closed to the public asks for your chat inbox without being logged in: the right answer is Refused, as it must be (401). You can reach your private data checks the same request logged in as you.
A fresh ID for one of your other sites:
Connections, Your Sites, Get The Code on its row, New key. The old one stops working at once, wherever it was pasted. Paste the new line on that site.
What a script can and cannot do:
A determined person can write a script that pretends to come from your domain, as with every analytics tool ever made. The most they can do is add some page views, slowly, because of the rate limits. They still cannot touch sales, leads, names, chats or your site.
A real example:
A partner copies the tracker line from yoursite.com's sales page onto their own site. Their visits are refused, so they never reach your numbers, and the domain shows under Visits From A Domain That Is Not On Your List. The owner of yoursite.com presses Not Mine, and that is the end of it.
Tips:
- Use Settings, Privacy & Location for what Pulse stores about each visitor. See Privacy and Location.
- Run the Live Tests after changing a security or caching plugin.