Install

One line. About two minutes.

No developer, no build step, no consent banner to configure. Pick where your site lives and follow the steps.

The tag 
<script defer src="https://t.rialtodata.com/sl.js" data-site="yoursite"></script>

Replace yoursite with the site id shown in Connections when you add a site. Everything else stays exactly as written.

Google Tag Manager

2 minutes
  1. Tags, then New, then Tag Configuration, then Custom HTML.
  2. Paste the tag exactly as it appears above, with your site id in place of yoursite.
  3. Leave "Support document.write" unticked. It is not needed.
  4. Triggering: All Pages.
  5. Save, then Submit to publish the container.

Works with no changes. The tag reads its own attributes, and Tag Manager keeps them when it injects the script. Tested on 14 August 2026.

Webflow

1 minute
  1. Site settings, then Custom code.
  2. Paste the tag into "Head code".
  3. Save, then publish the site.

Site-wide, no per-page work. Needs a publish for the change to reach the live site.

Framer

1 minute
  1. Project settings, then General, then Custom Code.
  2. Paste the tag into "Start of head tag".
  3. Publish.

WordPress

2 minutes
  1. Install a header scripts plugin, for example WPCode or Insert Headers and Footers.
  2. Paste the tag into the header section.
  3. Save.

Any header-scripts plugin does this. No theme file needs editing, and nothing is lost when the theme updates.

Shopify

2 minutes
  1. Online Store, then Themes, then the three dots, then Edit code.
  2. Open theme.liquid.
  3. Paste the tag directly before the closing head tag.
  4. Save.

Anything else

1 minute
  1. Paste the tag into the head of your base layout or template.
  2. Deploy as normal.

Astro, Next, Hugo, Rails, plain HTML. Anywhere you control the head.

Then check it is actually recording

This matters more here than with most tags, because the way this one fails is silence. A blocked tag loads, returns nothing and reports no error, so a site can look correctly installed for a week and hold no data at all.

  1. Open your site in a normal browser window, not a private one.
  2. Click something, scroll to the bottom, then leave the page. The tag sends in batches, so closing the tab is what flushes the first one.
  3. Open Rialto and choose your site. Live view shows the visit within a few seconds.

Nothing after a couple of minutes? It is almost always the Content-Security-Policy below, and second most often the site id.

Sites with a Content-Security-Policy

A site that sends a CSP header needs the Rialto origin in two directives. The second one is the one everybody forgets, and with only the first the tag loads and silently records nothing.

script-src  ... https://t.rialtodata.com;
connect-src ... https://t.rialtodata.com;

Not sure whether your site sends one? If nobody has ever configured it deliberately, it almost certainly does not.

If your tag manager rewrites the script

Some tag managers and CDN wrappers rebuild a script tag and drop its attributes. If that happens, set the configuration on the page instead and the tag will read it from there.

<script>window.slConfig = { site: 'yoursite' };</script>
<script defer src="https://t.rialtodata.com/sl.js"></script>

The object has to be set before the tag loads. Both forms are equivalent, and attributes win where both are present.