Global Code Setup

The DATA Reshape tracking script is a lightweight JavaScript snippet that enables server-side tracking across all pages of your website. It collects event data, manages user sessions, and forwards information to your configured destinations.

The script operates under your own domain (first-party), avoiding ad blockers and third-party cookie restrictions.

Prerequisites

Required Before Implementation

Only implement after receiving confirmation from the DATA Reshape team that your custom domain and SSL certificate are active.

You will need:

• Custom tracking subdomain (e.g. dre2.YOUR_DOMAIN.TLD)
• Script ID provided by the DATA Reshape team

Install

Fill in your domain and tick what runs on your account — the snippet is built as you type.

Your domainRoot domain, without www.Tracking subdomain

.YOUR_DOMAIN.TLD

Agreed with our team, together with the SSL certificate.

Enter your domain and everything below is written with it.

DNS records for dre2.YOUR_DOMAIN.TLD

Type	Name	Target	TTL
CNAME	dre2	app.datareshape.net	Auto
CNAME	_acme-challenge.dre2	dre2.YOUR_DOMAIN.TLD.5c7e7c9aba529dca.dcv.cloudflare.com	Auto

The first record routes the tracking requests. The second one lets the SSL certificate issue and renew on its own. Some providers want the full name instead of the short one — dre2.YOUR_DOMAIN.TLD rather than dre2; try the short form first.

Full walkthrough, per provider, in Custom Domain Setup.

Content Security Policy

Most sites do not send one. If you are not sure, leave this alone — nothing below changes.

My site sends a Content-Security-Policy header or meta tag

Replace YOUR_SCRIPT_ID with the Script ID provided by the DATA Reshape team, then add this to the <head> of every page.

Global code

<script>
(function(R,e,s,h,a,p,E){
  var b=R.Reshape=R.Reshape||{};
  b.setCookie=function(n,v,t,d){try{e.cookie=n+'='+v+';max-age='+t+';domain='+d+';path=/;SameSite=None;Secure';}catch(e){}};
  b.id=a;b.cdn=h;b.sts=new Date().getTime();
  E=e.getElementsByTagName(s)[0];p=e.createElement(s);p.async=true;p.src="https://"+h+"/main.js?id="+a;E.parentNode.insertBefore(p,E);
})(window,document,"script","dre2.YOUR_DOMAIN.TLD","YOUR_SCRIPT_ID");
</script>

Add the result to the <head> of every page, as early as possible.

Example

The snippet goes in <head>, before your own scripts:

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>Your Website</title>
    
    <!-- DATA Reshape Tracking Code -->
    <script>
    (function(R,e,s,h,a,p,E){
      var b=R.Reshape=R.Reshape||{};
      b.setCookie=function(n,v,t,d){try{e.cookie=n+'='+v+';max-age='+t+';domain='+d+';path=/;SameSite=None;Secure';}catch(e){}};
      b.id=a;b.cdn=h;b.sts=new Date().getTime();
      E=e.getElementsByTagName(s)[0];p=e.createElement(s);p.async=true;p.src="https://"+h+"/main.js?id="+a;E.parentNode.insertBefore(p,E);
    })(window,document,"script","dre2.YOUR_DOMAIN.TLD","YOUR_SCRIPT_ID");
    </script>
</head>
<body>
    <!-- Your website content -->
</body>
</html>

Platform-Specific Guides

Platform	Guide
WordPress	WordPress Setup
Shopify	Shopify Setup

Multiple Script IDs

A single website can use different Script IDs based on subdomain or pathname — useful for multi-store setups (e.g. Magento), multi-market configurations, or the PLUS plan with separate tracking configs.

<script>
var getScriptConfig = function() {
  var path = window.location.pathname;
  var hostname = window.location.hostname;
  
  if (hostname.indexOf('store-b.') > -1) return { subdomain: 'dre2.store-b.com', id: 'STOREB_ID' };
  if (path.indexOf('/shop/') === 0) return { subdomain: 'dre2.YOUR_DOMAIN.TLD', id: 'SHOP_SCRIPT_ID' };
  
  return { subdomain: 'dre2.YOUR_DOMAIN.TLD', id: 'MAIN_SCRIPT_ID' };
};

var config = getScriptConfig();

(function(R,e,s,h,a,p,E){
  var b=R.Reshape=R.Reshape||{};
  b.setCookie=function(n,v,t,d){try{e.cookie=n+'='+v+';max-age='+t+';domain='+d+';path=/;SameSite=None;Secure';}catch(e){}};
  b.id=a;b.cdn=h;b.sts=new Date().getTime();
  E=e.getElementsByTagName(s)[0];p=e.createElement(s);p.async=true;p.src="https://"+h+"/main.js?id="+a;E.parentNode.insertBefore(p,E);
})(window,document,"script",config.subdomain,config.id);
</script>

Content Security Policy (CSP)

Only if your website sends a Content-Security-Policy header or meta tag. Most sites do not. If yours does not, skip this section — nothing needs to change.

If it does, tick the CSP box in the generator above and it writes the directives for you. This section explains what they are and why, for when you have to merge them into a policy by hand.

A restrictive policy fails silently

CSP does not break your site and does not stop the snippet from appearing in the page. It blocks individual requests, so tracking looks installed while parts of it never run. Missing img-src costs you remarketing signals, missing style-src shows the consent banner unstyled, and a missing destination host disables that destination entirely — all without a single visible error for your visitors.

Merge the directives below into your existing policy. Do not replace it — CSP directives are not additive across headers, and the last one wins.

In every policy

Replace YOUR_DOMAIN with your root domain (for example example.com).

script-src  'self' 'unsafe-inline' https://*.YOUR_DOMAIN;
connect-src 'self' https://*.YOUR_DOMAIN;

The wildcard covers any subdomain we serve from, so your policy keeps working if the tracking subdomain or the CDN host changes later. Note that https://*.YOUR_DOMAIN does not include the bare YOUR_DOMAIN — add it separately if your site serves assets from the apex.

'unsafe-inline' is needed because the global code is an inline script. If your policy uses nonces, drop 'unsafe-inline' and add your nonce attribute to the <script> tag instead — that is the stronger option.

If you use our consent banner

The banner loads its own stylesheet from your tracking subdomain:

style-src 'self' 'unsafe-inline' https://*.YOUR_DOMAIN;

If you have Google (Analytics 4 / Ads)

script-src  'self' 'unsafe-inline' https://*.YOUR_DOMAIN https://www.googletagmanager.com;
img-src     'self' data: https://www.googletagmanager.com https://*.google-analytics.com https://*.analytics.google.com https://*.g.doubleclick.net https://*.google.com;
connect-src 'self' https://*.YOUR_DOMAIN https://www.googletagmanager.com https://*.google-analytics.com https://*.analytics.google.com https://*.g.doubleclick.net https://*.google.com;

www.googletagmanager.com is required even though your tag is served from your own subdomain: the Google tag reports its own telemetry there regardless of where it was downloaded from, and it is also where a Tag Manager container loads from.

Each Google country domain must be listed separately

Remarketing pixels are sent to the Google domain of the visitor's country — google.de for a visitor in Germany, google.hu in Hungary, and so on. CSP does not allow wildcards on the right side of a hostname, so *.google.* is not valid and every top level domain you serve has to be added on its own:

img-src ... https://*.google.ro https://*.google.hu https://*.google.bg;

If you skip this, tracking and reporting still work — only remarketing audiences lose those visitors, which is easy to miss.

If you have other destinations

Every destination that loads something in the visitor's browser needs its hosts in the policy. Add only the ones enabled on your account.

Destination	script-src	img-src and connect-src
Meta (Facebook, Instagram)	https://connect.facebook.net	https://www.facebook.com
TikTok	https://analytics.tiktok.com	https://analytics.tiktok.com
Microsoft Advertising (Bing)	https://bat.bing.com	https://bat.bing.com
OpenAI Ads	https://bzrcdn.openai.com	https://bzr.openai.com, plus https://bzrcdn.openai.com on connect-src
Criteo	https://dynamic.criteo.com https://static.criteo.net	https://dynamic.criteo.com https://sslwidget.criteo.com
RTB House	https://tags.creativecdn.com	https://tags.creativecdn.com
2Performant	https://attr-2p.com	https://event.2performant.com
theMarketer	https://t.themarketer.com	https://t.themarketer.com
Microsoft Clarity	https://www.clarity.ms	https://*.clarity.ms

FAVI and Biano are country-scoped and cannot be listed in full, because the host follows your market:

	script-src	img-src and connect-src
FAVI	https://partner-events.favicdn.net	your country backend, e.g. https://partner-events.favi.ro
Biano	your market, e.g. https://pixel.biano.ro	https://p.biano.ro for your market, plus https://*.bianopixel.com

FAVI's script host is the same everywhere; the SDK then picks its data backend from your Tracking ID. Biano switches between p.biano.<tld> and the cookieless *.bianopixel.com depending on the visitor's consent, so both are needed.

Server-side destinations need nothing here

CSP only governs what the browser loads. Conversions APIs, deliveries to your own endpoint, and every other server-to-server call leave from our infrastructure, never from the visitor's page, so they never appear in a policy.

OpenAI Ads is the case worth knowing: it runs on both sides. The browser pixel needs the hosts in the table above; the Conversions API half does not, and adding it would change nothing.

Listing one host too many is free

An unused host in a policy costs you nothing. A missing one disables that destination with no visible error. When in doubt, add it.

Checking your policy

Open your site with the browser console visible and reload. Any line mentioning Content Security Policy names both the blocked URL and the directive that blocked it — add that host to that directive. Check a page with the consent banner visible and, if you run an online store, a product and a checkout page: destinations that only fire on those pages fail nowhere else.

Verification

End-to-end verification is performed by the DATA Reshape team. Reach out at [email protected] once the tracking code is installed, and we will run the confirmation tests, validate the data flowing to each connected destination, and confirm the configuration is correct.

Troubleshooting

A few install-time issues are visible directly in the browser and can be fixed without help:

Symptom	Cause	Fix
ERR_NAME_NOT_RESOLVED for the tracking subdomain	DNS not configured or still propagating	Verify the subdomain DNS records; allow 24–48h for global propagation.
Mixed Content warning for the tracking subdomain	Page served over HTTPS but the subdomain is reached via HTTP	Make sure the tracking subdomain has a valid SSL certificate and is reachable over HTTPS.

For anything beyond install-time visibility — events that don't seem to arrive, deduplication concerns, destination-side discrepancies, or any other doubt about data quality — please contact [email protected]. By design, the only reliable view into event flow and destination delivery is the internal one; we'll confirm the state, identify the cause, and guide the fix.

Next Steps

Once the script loads correctly:

1. Implement events — see Events documentation
2. Add user data — include User object for better attribution
3. Configure destinations — connect your analytics and advertising platforms