Come together with the global Drupal community in Rotterdam, 28 Sept – 1 Oct 2026. Sessions, contribution, connection, and Early Bird savings until 8 June.This is the code my Piwik installations tells me to add to my pages:
<!-- Piwik -->
<script type="text/javascript">
var pkBaseURL = (("https:" == document.location.protocol) ? "https://example.com/piwik/" : "http://example.com/piwik/");
document.write(unescape("%3Cscript src='" + pkBaseURL + "piwik.js' type='text/javascript'%3E%3C/script%3E"));
</script><script type="text/javascript">
try {
var piwikTracker = Piwik.getTracker(pkBaseURL + "piwik.php", 1);
piwikTracker.trackPageView();
piwikTracker.enableLinkTracking();
} catch( err ) {}
</script><noscript><p><img src="http://example.com/piwik/piwik.php?idsite=1" style="border:0" alt=""/></p></noscript>
<!-- End Piwik Tag -->
This is the output from the Piwik module (with JS caching):
<script type="text/javascript">
<!--//--><![CDATA[//><!--
var pkBaseURL = (("https:" == document.location.protocol) ? "" : "http://example.com/piwik");
//--><!]]>
</script>
<script type="text/javascript">
<!--//--><![CDATA[//><!--
try {var piwikTracker = Piwik.getTracker(pkBaseURL + "/piwik.php", "1");piwikTracker.trackPageView();piwikTracker.enableLinkTracking();} catch(err) {}
//--><!]]>
</script>
1) Importantly, the Piwik module is not adding the inline <noscript> image, which is used to track users without javascript enabled.
2) There is also a minor error in that the value of the side-id should be an integer and not a string.
On a final point, when you do not have https assigned, this line could be improved:
var pkBaseURL = (("https:" == document.location.protocol) ? "" : "http://example.com/piwik");
To simply:
var pkBaseURL = "http://example.com/piwik";
| Comment | File | Size | Author |
|---|---|---|---|
| #6 | piwik-noscript-tag.688598-2.txt | 1.52 KB | bengtan |
| #2 | piwik-noscript-tag.688598-1.txt | 557 bytes | bengtan |
Comments
Comment #1
hass commentedThe noscript code have added piwik advertisements to you page in past. If this hasn't been removed I will not addit to the module. This is why it was removed. GA also don't have a noscript part as it is very useless to track spiders accessing you images. Users are important.
The rest is nothing to worry about. Everythingworks as it should.
Comment #2
bengtan commentedHi,
Any chance on making the <noscript> tag configurable?
Then users can decide whether to:
1. Track non-javascript visitors and spiders (by having <noscript>), or
2. Not track non-javascript visitors and not track spiders.
Some people may decide that tracking non-javascript visitors is important enough that they don't mind also tracking spiders.
Anyway, here is a patch (against 6.x-1.1) I prepared before I found this ticket. Needs work though - not sure if it will work if the output of piwik.module is not placed in the footer.
Comment #3
hass commentedNeeds check_url() and maybe $id validation or XSS may be possible.
Comment #4
bengtan commentedThanks for the feedback and yes, I agree the patch needs work.
The question is ... are you okay with the idea of making <noscript> configurable?
If so, I can redo the patch properly with configurability. If not, there's no point for me to pursue this any further.
Comment #5
hass commentedYes, config option is ok, but it need to be disabled by default.
Comment #6
bengtan commentedHi,
Patch attached. Please review and comment. Feel free to change any of the title and description strings.
Also, this patch doesn't handle relative urls, so if you accept #751466: Allow relative Piwik http urls, then either that patch or this patch needs to be modified to resolve conflicts.
Thank you.
Comment #7
hass commentedNow after a review of your patch I remember why I refused to implement this feature in past. The reason is very simple $_SERVER['HTTPS'] is not available behind Loadbalancers that do SSL offloading on the Loadbalancer and connect via HTTP to the webserver. I tend to say BY DESIGN.
Comment #8
bengtan commentedI wasn't aware of this limitation with load balancers, but it sounds logical. If there's no other way at the server-side to detect the use of SSL besides $_SERVER['HTTPS'], then I've pushed this patch as far as I want to for now.
Thank you.
Comment #9
hass commented