⚡ How lite-hits.js Works

lite-hits.js is a wrapper around hits.sh. It adds simple client-side logic (sessions, unique users, engagement) on top of the basic hit counter.

1. Page loads trigger an image request
Each time a page loads, the script inserts an invisible <img> with a src like https://hits.sh/<currentLocation>/<pageloadKey>.svg. Loading this SVG increments the counter on hits.sh.
2. Session vs. user detection
The script uses browser storage:
  • sessionStorage → counts unique visits per browser session.
  • localStorage → counts unique visitors per browser/device.
If no record is found, it triggers a new counter request (loading a fresh SVG) and stores a flag. If already present, no new request is sent — meaning we don’t even get an SVG this time. That’s by design: it prevents duplicate hits but also means there’s nothing to display. And we can't store the image in session/local storage cause they only store strings and we can't cache it or save it in some other ways due to CORS restrictions
3. Engagement tracking
You can define an engagementDuration (in milliseconds, e.g. 10000 = 10s). Only if a visitor stays that long will the script trigger another hits.sh request, counting them as “engaged.”

⚠️ Disclaimer:
lite-hits.js itself is fully transparent — you can read exactly what it does. It only decides *when* to send a counter request. All actual counting is handled by hits.sh. The service is open-source, and its author explicitly states they do not harvest IP addresses. However, like any external service, you must ultimately **trust their backend** — we cannot independently guarantee how requests are handled. In short: the wrapper cannot track you, and you don’t need to trust it — you can verify the script yourself. Whether you trust hits.sh is your own decision.

📄 Example Usage

Drop this script into your page and configure what to count:

<!-- You can access window.hitsh = {pageloadCount, sessionCount, localCount, engagementCount} Each is an object like { img: HTMLImageElement | {}, url: string, key: string } --> <script src="./lite-hits.js" litehits-basePath="analyticsurl" litehits-globalAs="hitsh" litehits-count='{ "pageloadKey": "pageLoaded", "sessionKey": "sessionCounted", "localKey": "localCounted", "engagementDuration": 10000 }'></script>

🛡️ Protecting Privacy Further

lite-hits.js is designed to be minimal and avoid invasive tracking, but you can take extra steps to limit what information hits.sh gets:

1. Use a custom basePath
Instead of sending the real URL, define another url or randomstring. This avoids exposing your actual site url/referrer. You can hash the path (with a salt if desired) before using it as basePath, but make it look like a url (add a .) also check if the string qualifies as a url and is not use by anyone from hits.sh's website.
lite-hits.js already sets referrerPolicy="no-referrer",preventing your page’s URL from leaking in HTTP headers.
2. Remaining data
Even with a custom basePath, some data always goes to hits.sh:
What is sent What we know What it can be used for Mitigation
IP address They claim not logged Geolocation, unique visitor count use trusted VPN / Tor / proxy
Timestamp Logged by server Activity patterns consider batch/proxy requests
User-Agent They claim not logged Fingerprinting: OS, browser, device Privacy browser / UA spoofing
Accept headers Sent by browser Minor fingerprinting Privacy browsers
TLS / connection metadata Sent by browser Fingerprinting via cipher, TLS version Tor / privacy VPN
Or you can just ask user to give consent for these else don't use analytics.
3. Self-host
Even if you avoid analytics, your hosting provider can still log requests (IP, time, user-agent) since users must connect to fetch your site. If you want full control, you need to run your site on your own server. In that case you could also adapt lite-hits.js to send requests to your own endpoint instead of hits.sh - but you probably won’t even need it. The key point is: with self-hosting, you decide what to log (or not log), and you must consciously choose not to collect data.

⚠️ Disclaimer:
hits.sh explicitly claims to be "Privacy First" and they don't track any personal information. But, their landing page seems to use other analytics tools (e.g., Google Analytics), which you can confirm in your browser's network inspector. Don't take it as fact instead check it!