Support

The monitoring script: what it does and where to find it

The monitoring script is the small piece of JavaScript that Tapper Block runs on your website. Each protected entity has its own script with the entity's key already filled in.

What the script does

Block decides whether an ad click is invalid partly from what the visitor does once they land on your site. The monitoring script is how Tapper sees that. It runs on every page and records how each visitor behaves and which device and browser they use. Several settings on the Web detection rules tab work only with it:

Detection settingWhat it needs from the script
Behavior analysisThe recorded behavior of each visitor, to judge whether a click came from a valid or an invalid source.
Suspicious Ad ClicksWhether a click was followed by any events on the page.
Minimum Seconds on SiteHow long the visitor stayed on your site.
Block JavaScript-disabled browsersThe fallback image in the script, which loads only when JavaScript is off.
Device blockingThe device ID, to spot one device clicking your ads from several IPs.
Aborted ad clicksWhether your page loaded and recorded any events after the ad click.

Conversions and web click tracking links rely on the script too. Without it, these settings have nothing to work with.

The script does not record video replays of visitor sessions or build click and scroll heatmaps. The app has neither.

Where to find it

  1. In the sidebar, under Protection, click Protected Entities.
  2. Open the entity.
  3. In the left rail, under Website, click Monitoring. The tab is titled Website monitoring.
  4. Scroll past Cookie policy and Recognise visitors without cookies to the Monitoring script section.

The entity page with Monitoring selected in the left rail

The tab starts only "once a Google, Meta, TikTok or Microsoft Ads account is connected to this entity." Connect an ad account first if you see that message.

The same script appears during setup, at the step Install website monitoring. If you installed it then, you do not need to install it again.

The snippet

It goes right after the opening <body> tag. The snippet looks like this:

<!-- Tapper Monitoring Script -->
<script>
  var script = document.createElement("script");
  script.src = "https://monitor.tapper.ai/bundle.js";
  script.async = true;
  script.onload = function () {
    window.tapper.init("{public key}");
  };
  (document.head || document.body || document.documentElement).appendChild(script);
</script>
<noscript>
  <img src="https://protect.tapper.ai?pk={public key}" alt="Tapper"/>
</noscript>
<!-- Tapper Monitoring Script -->

In the app, {public key} is already replaced with your entity's key, so always copy the script from the app rather than from this page. The script loads https://monitor.tapper.ai/bundle.js without holding up your page, then calls window.tapper.init with your key. The noscript part loads a small image from protect.tapper.ai only in browsers that have JavaScript turned off.

The section has three controls:

  • The copy button in the top-right corner of the code box copies the snippet with your key.
  • Google Tag Manager opens tagmanager.google.com.
  • Open the install guide, under "Need help installing the monitoring script?", opens the Monitoring Script guide on docs.tapper.ai.

Between the snippet and the install guide link, a Content Security Policy box lists the sources your site must allow if it sends that header.

The Monitoring script section with Copy monitoring script and Google Tag Manager

Where it goes on your site

Install the script once on every page of the site, using one of these routes:

Tapper has no WordPress guide. On WordPress or another site builder, use Google Tag Manager or the builder's option for adding code right after the opening <body> tag.

After you install it

Still need help?

Chat with our team and mention this article.