Global Code Setup
The DATA Reshape tracking script is a lightweight JavaScript snippet that enables server-side tracking across all pages of your website. It collects event data, manages user sessions, and forwards information to your configured destinations.
The script operates under your own domain (first-party), avoiding ad blockers and third-party cookie restrictions.
Prerequisites
Only implement after receiving confirmation from the DATA Reshape team that your custom domain and SSL certificate are active.
You will need:
- Custom tracking subdomain (e.g.
dre2.YOUR_DOMAIN.TLD) - Script ID provided by the DATA Reshape team
Implementation
Add this code to your website's <head> section on all pages:
<script>
(function(R,e,s,h,a,p,E){
var b=R.Reshape=R.Reshape||{};
b.setCookie=function(n,v,t,d){try{e.cookie=n+'='+v+';max-age='+t+';domain='+d+';path=/;SameSite=None;Secure';}catch(e){}};
b.id=a;b.cdn=h;b.sts=new Date().getTime();
E=e.getElementsByTagName(s)[0];p=e.createElement(s);p.async=true;p.src="https://"+h+"/main.js?id="+a;E.parentNode.insertBefore(p,E);
})(window,document,"script","YOUR_SUBDOMAIN","YOUR_SCRIPT_ID");
</script>
Replace YOUR_SUBDOMAIN with your custom subdomain and YOUR_SCRIPT_ID with your Script ID.
HTML Template Example
Here's how it should look in a complete HTML document:
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>Your Website</title>
<!-- DATA Reshape Tracking Code -->
<script>
(function(R,e,s,h,a,p,E){
var b=R.Reshape=R.Reshape||{};
b.setCookie=function(n,v,t,d){try{e.cookie=n+'='+v+';max-age='+t+';domain='+d+';path=/;SameSite=None;Secure';}catch(e){}};
b.id=a;b.cdn=h;b.sts=new Date().getTime();
E=e.getElementsByTagName(s)[0];p=e.createElement(s);p.async=true;p.src="https://"+h+"/main.js?id="+a;E.parentNode.insertBefore(p,E);
})(window,document,"script","YOUR_SUBDOMAIN","YOUR_SCRIPT_ID");
</script>
</head>
<body>
<!-- Your website content -->
</body>
</html>
Platform-Specific Guides
| Platform | Guide |
|---|---|
| WordPress | WordPress Setup |
| Shopify | Shopify Setup |
Multiple Script IDs
A single website can use different Script IDs based on subdomain or pathname — useful for multi-store setups (e.g. Magento), multi-market configurations, or the PLUS plan with separate tracking configs.
<script>
var getScriptConfig = function() {
var path = window.location.pathname;
var hostname = window.location.hostname;
if (hostname.indexOf('store-b.') > -1) return { subdomain: 'dre2.store-b.com', id: 'STOREB_ID' };
if (path.indexOf('/shop/') === 0) return { subdomain: 'dre2.YOUR_DOMAIN.TLD', id: 'SHOP_SCRIPT_ID' };
return { subdomain: 'dre2.YOUR_DOMAIN.TLD', id: 'MAIN_SCRIPT_ID' };
};
var config = getScriptConfig();
(function(R,e,s,h,a,p,E){
var b=R.Reshape=R.Reshape||{};
b.setCookie=function(n,v,t,d){try{e.cookie=n+'='+v+';max-age='+t+';domain='+d+';path=/;SameSite=None;Secure';}catch(e){}};
b.id=a;b.cdn=h;b.sts=new Date().getTime();
E=e.getElementsByTagName(s)[0];p=e.createElement(s);p.async=true;p.src="https://"+h+"/main.js?id="+a;E.parentNode.insertBefore(p,E);
})(window,document,"script",config.subdomain,config.id);
</script>
Content Security Policy (CSP)
This section applies only if your website sends a Content-Security-Policy header or meta tag. If it does not, skip it — nothing needs to change.
CSP does not break your site and does not stop the snippet from appearing in the page. It blocks individual requests, so tracking looks installed while parts of it never run. Missing img-src costs you remarketing signals, missing style-src shows the consent banner unstyled, and a missing destination host disables that destination entirely — all without a single visible error for your visitors.
Merge the directives below into your existing policy. Do not replace it — CSP directives are not additive across headers, and the last one wins.
Always required
Replace YOUR_DOMAIN with your root domain (for example example.com).
script-src 'self' 'unsafe-inline' https://*.YOUR_DOMAIN;
connect-src 'self' https://*.YOUR_DOMAIN;
The wildcard covers any subdomain we serve from, so your policy keeps working if the tracking subdomain or the CDN host changes later. Note that https://*.YOUR_DOMAIN does not include the bare YOUR_DOMAIN — add it separately if your site serves assets from the apex.
'unsafe-inline' is needed because the global code is an inline script. If your policy uses nonces, drop 'unsafe-inline' and add your nonce attribute to the <script> tag instead — that is the stronger option.
If you use our consent banner
The banner loads its own stylesheet from your tracking subdomain:
style-src 'self' 'unsafe-inline' https://*.YOUR_DOMAIN;
If you have Google (Analytics 4 / Ads)
img-src 'self' data: https://www.googletagmanager.com https://*.google-analytics.com https://*.analytics.google.com https://*.g.doubleclick.net https://*.google.com;
connect-src 'self' https://*.YOUR_DOMAIN https://www.googletagmanager.com https://*.google-analytics.com https://*.analytics.google.com https://*.g.doubleclick.net https://*.google.com;
www.googletagmanager.com is required even though your tag is served from your own subdomain: the Google tag reports its own telemetry there regardless of where it was downloaded from.
Remarketing pixels are sent to the Google domain of the visitor's country — google.de for a visitor in Germany, google.hu in Hungary, and so on. CSP does not allow wildcards on the right side of a hostname, so *.google.* is not valid and every top level domain you serve has to be added on its own:
img-src ... https://*.google.ro https://*.google.hu https://*.google.bg;
If you skip this, tracking and reporting still work — only remarketing audiences lose those visitors, which is easy to miss.
If you have other destinations
| Destination | Add to script-src | Add to img-src and connect-src |
|---|---|---|
| Meta (Facebook, Instagram) | https://connect.facebook.net | https://www.facebook.com |
| TikTok | https://analytics.tiktok.com | https://analytics.tiktok.com |
| Microsoft Advertising (Bing) | https://bat.bing.com | https://bat.bing.com |
Checking your policy
Open your site with the browser console visible and reload. Any line mentioning Content Security Policy names both the blocked URL and the directive that blocked it — add that host to that directive. Check a page with the consent banner visible and, if you run an online store, a product and a checkout page: destinations that only fire on those pages fail nowhere else.
Verification
End-to-end verification is performed by the DATA Reshape team. Reach out at support@datareshape.ro once the tracking code is installed, and we will run the confirmation tests, validate the data flowing to each connected destination, and confirm the configuration is correct.
The tracking surface is built privacy-first: payloads are obfuscated, PII is normalized and hashed before it leaves the browser, sensitive parameters are encrypted at rest, identity is partitioned per account, and destination-specific protections (such as opt-out signals, data-minimization filters, and limited-use modes) are applied server-side before any downstream call.
Because of these advanced privacy and tracking protections, the data observable from the outside is intentionally not enough to validate quality on your own. DATA Reshape is the only party with the visibility needed to confirm that events, identifiers, conversions, and destination deliveries are correct end-to-end.
Privacy by design is a feature of the platform, not an inconvenience — it's what keeps the implementation compliant out of the box and protects your customers' data regardless of which destinations you connect later.
Troubleshooting
A few install-time issues are visible directly in the browser and can be fixed without help:
| Symptom | Cause | Fix |
|---|---|---|
ERR_NAME_NOT_RESOLVED for the tracking subdomain | DNS not configured or still propagating | Verify the subdomain DNS records; allow 24–48h for global propagation. |
Mixed Content warning for the tracking subdomain | Page served over HTTPS but the subdomain is reached via HTTP | Make sure the tracking subdomain has a valid SSL certificate and is reachable over HTTPS. |
For anything beyond install-time visibility — events that don't seem to arrive, deduplication concerns, destination-side discrepancies, or any other doubt about data quality — please contact support@datareshape.ro. By design, the only reliable view into event flow and destination delivery is the internal one; we'll confirm the state, identify the cause, and guide the fix.
Next Steps
Once the script loads correctly:
- Implement events — see Events documentation
- Add user data — include User object for better attribution
- Configure destinations — connect your analytics and advertising platforms