Install ClickStream Analytics on Squarespace via Code Injection

Squarespace gives you a polished site and a solid built-in traffic panel. What it doesn't give you is person-level visitor intelligence: who is on your site right now, how likely they are to convert, whether they're getting frustrated, and whether they're human at all. ClickStream adds that layer — and because Squarespace exposes both site-wide Code Injection and a full DNS panel for domains it manages, this Squarespace analytics install is a copy-paste job with no template edits.

This guide walks the exact path: the CNAME in the Squarespace domains panel, the tag in Code Injection, then verification in the ClickStream dashboard. For the platform-agnostic version, see the main install page; if you'd rather manage all your tags in one container, the Google Tag Manager install guide covers that route.

Before You Start

• A ClickStream account at einstein.clickstream.com with a site created. The free Hobby tier works for this entire guide — see plans for what each tier adds.
• Your API key (cs_live_…), shown in the dashboard when you create the site.
• A Squarespace plan that includes Code Injection. Squarespace gates site-wide code injection to its Business plans and above at the time of writing — check your plan's feature list if you're unsure.
• Access to your domain's DNS. If your domain is registered with Squarespace — including domains migrated over from Google Domains — that's the Squarespace domains panel. If the domain is registered elsewhere and merely connected to Squarespace, you'll add the DNS record at your registrar instead; everything else in this guide is identical.

One design decision drives the whole install: every ClickStream tenant runs through its own first-party tracking domain, like t.yourdomain.com. The analytics script and every event ride on a subdomain you control, not a shared third-party collector hostname. That's why step one is DNS, not JavaScript.

Step 1 — Add a CNAME in the Squarespace Domains Panel

You're creating one new subdomain that points at ClickStream's edge:

In Squarespace:

1. From your account dashboard, open Domains (inside a site, it's under Settings → Domains).
2. Select your domain, then open its DNS settings.
3. Under Custom records, add the record above: Host t, Type CNAME, Data feynman.clickstream.com.
4. Save.

Two reassurances. First, this touches nothing about your live site: Squarespace's own records for your apex domain and www stay exactly as they are — you're adding a brand-new subdomain, not editing an existing one. Second, the ClickStream dashboard shows you the same target value during setup; if the dashboard ever displays a different target than this page, copy the dashboard value.

Why bother with DNS at all? Because a tracking domain you own is what lets the visitor cookie be set first-party from your own hostname. Safari's ITP doesn't clamp that cookie to 7 days the way it does script-set cookies — identity persists at the browser's long-term maximum, roughly 400 days. The full reasoning lives in our first-party cookie persistence deep dive.

Step 2 — Verify the Tracking Domain in ClickStream

1. Open einstein.clickstream.com → Sites → Your Site → Tracking Domain.
2. Enter the subdomain you just created, e.g. t.yourdomain.com.
3. The dashboard polls DNS every 10 seconds for up to 5 minutes. When the CNAME resolves, the status flips to CNAME verified and SSL provisioning starts automatically.
4. SSL typically completes within 60 seconds. When the hostname shows the green Active badge, you're ready for the tag.

If Verification Stalls

CNAME records can take anywhere from 1 to 60 minutes to propagate across resolvers, so a stall usually just means "wait." You can check propagation yourself from a terminal:

dig +short t.yourdomain.com
# expected answer:
# feynman.clickstream.com.

If that returns nothing after an hour, re-open the Squarespace DNS settings and confirm the record saved with the exact host and target — a trailing typo in feynman.clickstream.com is the most common culprit.

Step 3 — Paste the Tag into Code Injection

In your Squarespace dashboard, open Settings → Developer Tools → Code Injection. On older Squarespace navigation the same panel lives at Settings → Advanced → Code Injection — identical fields either way. Paste this into the Header box:

<script
  src="https://t.yourdomain.com/sdk.js"
  data-key="cs_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
  async
></script>

Replace t.yourdomain.com with the tracking domain you verified in step 2, and the data-key value with your real API key. Save.

Three things worth knowing about this paste:

• Header injection covers the whole site. Blog posts, store pages, event pages, member areas — one paste, every page. The SDK handles internal navigation on its own, so there's nothing template-specific to wire up.
• Yes, the key is visible in your page source — by design. Website keys are domain-gated: the collector checks the request's origin against the domains registered to your key and rejects mismatches, so a copied key is useless on anyone else's site. The mechanics are covered in Why a Stolen Analytics Key Is Useless.
• It's light. What ships to each page is a 344-byte loader plus a ~56.5 KB gzipped bundle, served from your own subdomain. The full breakdown is in The 344-Byte Pixel.

Prefer to trial on a single page first? Squarespace also offers per-page header injection (open the page's settings gear → Advanced) on plans that include it. That's fine for a test, but site-wide header injection is the recommended end state — behavioral scoring works best when it sees the whole journey, not one page of it.

Step 4 — Verify the Install

1. In the ClickStream dashboard, pick your site and watch the Live Sessions panel.
2. Load any page of your live Squarespace site in an incognito tab. A session should appear within 1–2 seconds.

If nothing shows up after 30 seconds:

• Open DevTools → Network and filter for your tracking domain. You want 200 responses on /sdk.js and /v1/events. A 403 means the page's origin doesn't match the domains configured for your key.
• Confirm your custom domain — and its www variant — is listed in the site's Allowed Domains. Wildcards like *.yourdomain.com are supported.
• Verify on your live custom domain, not inside the Squarespace editor. Squarespace also serves your site on a built-in yoursite.squarespace.com address; traffic from that origin is only accepted if you add it to Allowed Domains too.
• Confirm the data-key value matches the key shown in the dashboard, and re-run the dig check from step 2.

What You Get Once Data Flows

From the first pageview, ClickStream runs its 26 behavioral scoring models over each event — intent across four behavioral stages, frustration, engagement, and more — at under 3 ms per event at p95, a benchmark enforced in CI rather than a marketing estimate. Bot filtering classifies traffic across 11 categories, drawing on 158 named bots and 38 AI agents, which matters twice on Squarespace: your reports stop counting scraper noise as audience, and your bill does too, because billing counts human pageviews only. If you're curious what all that non-human traffic actually is, The Crawlers Your Pixel Cannot See is the companion read.

Optional: Read the Visitor Back with Signals

The tag above is write-only — it collects. If you also want your pages to react — say, reveal a booking banner only for high-intent humans — that's the Signals API. Fair warning for Squarespace users: the @clickstreamhq/signals package is a developer preview (0.1.0-alpha) distributed on npm, so it's aimed at sites with a build step; on Squarespace you'd bundle your own script and inject the built file. The read itself is small:

import { configure, getVisitorOrNull } from '@clickstreamhq/signals';

configure({
  apiKey: 'cs_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx',
  endpoint: 'https://t.yourdomain.com',
});

const visitor = await getVisitorOrNull();
if (visitor && !visitor.bot.isBot && visitor.scores.intent >= 70) {
  // e.g. reveal a "book a consult" banner for high-intent humans
}

Getting Started with the Signals API is the full tutorial if you want to go down that road. For the analytics install itself, you're done: one CNAME, one tag, verified live.