Glossary · Tracking technology
What is server-side tracking?
Server-side tracking is sending analytics or conversion events from your own server to the analytics or ad platform, instead of (or in addition to) from a script running in the visitor's browser.
Also called: Server-side analytics, Server-side tagging
Updated
How does server-side tracking work?
POST /api/track Authorization: Bearer <secret key>
{ "type": "event", "visitorId": "usr_8f2a1", "name": "signup" }Your backend calls the analytics API when something happens — an account is created, a payment webhook arrives, a background job finishes — usually with an API key and an identifier that links the event to a visitor or user. Variants include server-side tag managers (a proxy that receives browser hits on your domain and forwards them) and ad platforms' conversion APIs (Meta CAPI, Google's enhanced conversions).
What server-side tracking fixes — and what it doesn't
| Fixes | Doesn't fix |
|---|---|
| Events that never touch a browser (webhooks, jobs, OAuth callbacks) | Knowing where a visitor came from — the referrer and UTMs live in the browser |
| Ad blockers stopping conversion events | Consent: sending data from the server doesn't remove the need for it |
| Events lost when a tab closes mid-request | Pageviews, clicks, scroll and engagement, which happen in the browser |
| Trusted values (amounts, plan) that clients could fake | Linking events to a visit unless you pass an identifier through |
Server-side tracking example
A visitor signs up with Google OAuth. The account is created in a server callback after a redirect, so a browser signup() call never runs and 30% of sign-ups go missing from analytics. Sending signup from the callback, with the visitor id carried through the OAuth flow, fixes it — and the sign-up is still credited to the visit's original source.
Common pitfalls
- Double counting: sending the same event from browser and server.
- Losing attribution: server events without the browser's visitor id can't be tied to a source.
- Leaking the secret key into client code.
- Treating server-side as a way around privacy law; the obligations follow the data, not the transport.
How VisitTrack does server-side tracking
VisitTrack combines both. The browser script records visits, sources and engagement; POST /api/track lets your backend send events and identify calls with a secret key, using the same visitorId the page sent (window.visitrack.visitorId()), so server events join the visitor's sessions and attribution — see send events from your server. Payments need no code at all: provider webhooks record them and write payment_completed automatically. AI crawlers, which never run JavaScript, are tracked with a few lines in your backend middleware.
Frequently asked questions
Is server-side tracking better than client-side?
Neither replaces the other. The browser is the only place that sees referrers, UTMs and on-page behavior; the server is the only place that reliably sees webhooks, OAuth sign-ups and background jobs. Most accurate setups use both with a shared visitor id.
Does server-side tracking avoid GDPR or cookie consent?
No. Moving collection to the server changes the transport, not the legal obligations. If the data is personal data or relies on device storage that needs consent, the same rules apply.
Related terms
- First-party proxyA first-party proxy is a setup where the analytics script and the endpoint it reports to are served from your own domain — through a rewrite, reverse proxy or CDN rule — so the browser treats the requests as first-party instead of calls to a third-party analytics domain.
- Ad blockers (and analytics)Ad blockers are browser extensions and built-in browser features that stop ads and tracking requests from loading; most also block popular analytics scripts, so visitors using them disappear from client-side analytics entirely.
- Event trackingEvent tracking is recording specific actions visitors take on a website or app — clicks, form submissions, sign-ups, downloads, purchases — as named events, often with properties that describe them.
- User identification (identify)User identification is linking an anonymous visitor in your analytics to a known user in your product — usually with an identify call that sends your own user id and, optionally, traits such as plan or sign-up date.
- Custom eventsCustom events are events you define and send to your analytics tool yourself — such as signup, demo_booked or plan_upgraded — to record actions that are specific to your product and can't be detected automatically.
Tools and guides
See which channels actually bring paying customers
VisitTrack is cookie-free analytics with revenue attribution built in. One script tag, no consent banner, live in two minutes. 14 days free, no card required.