Skip to content

Journal

·5 min read

Count the visitors who never execute JavaScript

Crawlers, agents, and no-JS browsers share one property: your script did not run. A small middleware in the request path is how they still appear in the data.

MiddlewareNo-JS

Close-up of a black network switch and a faintly glowing cable
If the script never ran, the request is the only evidence.

The privacy-first script is the right collector for people who load a page in a normal browser. It is the wrong collector for everything else. Models fetching documentation, Playwright running a checkout, curl hitting a status page — none of them evaluate your tag. Treating “no beacon” as “no visit” is how Direct swells and crawler reports stay empty.

Vector 5’s middleware lives in your app, not in a third-party edge you cannot read. It classifies the user agent, forwards the path and referrer host, and stops. You can read the package in one sitting. It is MIT, so embedding it does not AGPL your product.

What gets forwarded

  • Path and referrer host — never a full referrer URL with query junk.
  • User agent, used for actor classification and then discarded from identity.
  • No cookies set. No fingerprint. No stored IP after geo + hash on the server.

Human browsers still go through v5.js so you get screen width, UTM, and a consistent daily hash. The middleware is the net for traffic that will never call that script. Together they are the three kinds of visibility the product is built around: people, people sent by models, and the models themselves.