WebmasterID logoWebmasterID

Docs

Verify install

What the Verify Install probe checks, every status it can return, and exactly what to do for each one.

Last updated: v1.5.2 · 2026-05-10

On /sites, every site row has a Verify install button. Clicking it runs an owner-scoped, SSRF-safe probe of your homepage and combines that with a last event seen check from the database. The result is one of six statuses below.

What it checks

  • Tracker source URL — src="https://webmasterid.com/tracker.iife.min.js".
  • Per-site marker — data-wmid="wm_…" matching this row's site_id. This is the only signal that flips the status to "installed".
  • Ingest endpoint — data-endpoint="…/api/events".
  • Tracker id — the optional id="webmasterid-tracker" attribute.
  • Recent event — whether events.last_event_at for this site fired in the last 24 hours.

Probe behaviour (SSRF-safe)

  • Public-host gating BEFORE the request and AFTER each redirect.
  • 5-second timeout per probe.
  • 256 KB response cap; reader cancelled on overflow.
  • 2 redirects max.
  • http(s) only; rejects localhost / RFC1918 / .local / .test / .example.
  • Probes BOTH the apex and the www variant automatically; if neither has the marker but a recent event exists, makes one extra probe of the most-recent event's path.
  • Custom User-Agent: WebmasterID-InstallCheck/1.0 (+https://webmasterid.com) so site owners can identify the probe in their logs.
  • The raw HTML is NEVER returned to the operator.

Status reference

StatusMeaningOperator action
installed_and_receiving_eventsThe per-site marker (data-wmid for this row's site_id) is on the page AND a real event arrived in the last 24 hours.Healthy — nothing to do.
snippet_found_no_events_yetThe per-site marker is on the page but no event has landed in the last 24 hours.Visit the site once in a real browser. Re-verify. If still empty, check ad-blockers, consent banner state, and DNT/GPC.
events_received_snippet_not_visibleEvents ARE arriving but the homepage probe didn't find the snippet markup.Tracker is likely installed via a framework wrapper (Next.js RSC, etc.) or only on certain routes. Open page source manually to confirm; consider moving the tag to the site-wide layout.
installed_with_different_site_idA WebmasterID snippet IS on the page, but the data-wmid belongs to a different site_id than this row.Either edit the deployed snippet to use this row's site_id, or click Verify Install on the row whosesite_id actually matches. The amber Duplicate domain in your account badge on /sites flags these clusters.
snippet_missingProbe fetched the homepage successfully but found no per-site marker (no events recently either).Confirm the deploy actually shipped, the snippet is in the SHARED layout (not just one page), and any CDN caching has been busted.
fetch_failedThe probe couldn't reach the homepage at all (private host, non-HTML response, redirect loop, response too large, network error).Make sure the site is publicly reachable. Verify Install only follows public http(s) URLs. Check whether a WAF is challenging the WebmasterID-InstallCheck/1.0 User-Agent.

What the UI shows

  • Status pill (emerald / amber / red / ink, depending on status).
  • Per-attribute checklist: tracker src, data-wmid, data-endpoint, id=webmasterid-tracker, recent event.
  • Each attempted URL with a coarse reason (so you can see if apex, www, or the event-path probe was the one that succeeded).
  • The last event at timestamp.
  • A plain-English recommendation tied to the status.

Related