Install AI crawler tracking

This page walks through each install path click by click. For what crawler tracking measures and how verification works, see AI Crawlers.

Pick the guide that matches where your site runs:

Before you start: generate a site key

Every install needs a site key, whichever platform you use:

1. In the app, go to AI Crawlers → Install tracking.
2. Click Generate site key. Give the key a name and, ideally, the domain it will report for; the domain also strengthens signed-crawler verification for that site.
3. Copy both values from the confirmation dialog: the key ID and the signing secret (it starts with ctk_). The secret is shown once; if you lose it, use Rotate on the key to generate a replacement.

Keep the signing secret private: anyone who has it can submit forged traffic reports for your site. Don't commit it to a public repository or paste it into client-side code.

Cloudflare Worker

Use this when your DNS is on Cloudflare and the site is proxied (the orange-cloud toggle). It is the most complete option: it sees every request at the edge, reports real HTTP status codes, and works no matter what runs behind Cloudflare.

1. On AI Crawlers → Install tracking, open the Cloudflare tab and copy the snippet.
2. Replace SITE_KEY_ID and ctk_SITE_KEY_SECRET in the snippet with your key ID and signing secret.
3. In the Cloudflare dashboard, go to Workers & Pages → Create → Create Worker. Give it a name (for example ai-crawler-tracker) and click Deploy to create the empty worker.
4. Click Edit code, replace the generated example with your snippet, and click Deploy again.
5. Connect the worker to your site: open the worker's Settings → Domains & Routes → Add → Route, pick your zone, and add the route example.com/*. If your site is also served on www.example.com, add a second route for www.example.com/*.
6. Done: no code changes on your site. The worker passes every request through to your origin unchanged and reports matching visits in the background.

Two things to check:

• The route must cover all paths (/*), otherwise crawler visits to unrouted pages are invisible.
• If you already run a worker on those routes, Cloudflare only executes one worker per route; merge the snippet's logic into your existing worker instead of adding a second one.

Vercel / Next.js middleware

Use this for a Next.js app deployed on Vercel. The same file also works on self-hosted Next.js.

1. On AI Crawlers → Install tracking, open the Vercel / Proxy tab and copy the snippet.
2. In your Next.js repository, create middleware.ts in the project root (or in src/ if your app lives there) and paste the snippet.
3. Replace SITE_KEY_ID and ctk_SITE_KEY_SECRET with your key ID and signing secret.
4. If you already have a middleware.ts, don't add a second file; Next.js only runs one. Copy the snippet's helper block into your existing file, call its reporting logic at the start of your middleware function, and make sure your matcher config still covers all paths.
5. Commit and deploy.

Notes:

• Middleware runs before the response exists, so events report their HTTP status as unknown. That is expected; error insights need the Cloudflare or custom server install.
• On Vercel the visitor IP is taken from a platform-set header and is trustworthy. If you self-host Next.js behind your own proxy, make sure the forwarded-IP header the snippet reads is set by your proxy, not passed through from the client.

WordPress plugin

Use this for any WordPress site where you can install plugins.

1. On AI Crawlers → Install tracking, open the WordPress tab and click Download plugin.
2. In WordPress admin, go to Plugins → Add New → Upload Plugin, choose the downloaded zip, click Install Now, then Activate.
3. Go to Settings → AI Crawler Tracker and fill in all three fields:
   • Tracker base URL: https://app.citlyze.com
   • Key ID: your key ID
   • Signing secret: your ctk_... secret The plugin does not report anything until the base URL is filled in.
4. Click Send test event. You should see a "connected" confirmation; this proves your credentials and connectivity end to end.

Caveat: full-page caches and CDNs can answer requests without running WordPress at all, which undercounts crawler visits. If your site is heavily cached behind Cloudflare, prefer the Cloudflare Worker install.

Custom server / Node

Use this for custom-coded sites you host yourself: AWS, Google Cloud, Azure, a VPS, or containers. The snippet is an Express-style middleware for Node 20 or newer (it also runs on Bun and Deno).

1. On AI Crawlers → Install tracking, open the Custom server / Node tab and copy the snippet.
2. Save it as aeo-tracker.mjs next to your server entry point.
3. Replace SITE_KEY_ID and ctk_SITE_KEY_SECRET with your key ID and signing secret. If your team prefers environment variables, read them into the two constants at the top of the file; just keep the secret out of source control.
4. Register the middleware before your routes:

   import { aeoCrawlerTracker } from "./aeo-tracker.mjs";
   app.use(aeoCrawlerTracker());

5. If your server sits behind a load balancer or reverse proxy (nginx, ALB), configure Express to trust it (for example app.set("trust proxy", 1)) so the middleware reports the real client IP instead of the proxy's. Crawler identity verification checks that IP.
6. Deploy. The middleware reports after each response finishes, so it adds no latency and includes real HTTP status codes.

Not on Express? The returned handler takes plain (req, res, next) arguments and adapts to Fastify, Koa, or Node's http server. For other languages entirely (Python, Go, PHP, Ruby, ...), implement the signed-beacon protocol; it is a single signed HTTPS POST per matching request.

Webflow

Webflow's own hosting cannot run server-side code, and browser-side scripts cannot see AI training crawlers, so tracking installs at a proxy layer in front of Webflow:

1. Webflow supports self-managed reverse proxies on Enterprise plans; arrange it with your Webflow contact and route your domain through your proxy (Cloudflare, CloudFront, Fastly, or your own nginx).
2. Install the tracker at that proxy layer:
   • Proxy on Cloudflare → follow the Cloudflare Worker guide.
   • Your own Node proxy → follow the Custom server / Node guide.
   • Anything else → implement the signed-beacon protocol in your proxy.
3. Verify as described below.

Webflow Cloud apps are not a path to whole-site tracking: they only serve requests under their mount path, so they never see crawler visits to your regular pages.

Shopify

Standard Shopify storefronts cannot run this tracker: Shopify does not let merchants run server-side code on storefront requests and does not support putting a proxy (such as Cloudflare) in front of a store. Browser-side scripts are not a workaround: AI training crawlers never execute JavaScript, and a browser script would expose your signing secret.

What you can do:

• Headless storefronts built on Hydrogen and hosted on Oxygen (or any self-hosted setup) run server-side code; wire the Custom server / Node snippet's logic into your storefront's server request handler.
• For standard stores, your other Citlyze measurements (prompt tracking, citations, GEO audits) work regardless of where the store is hosted.

Verify your install

• On AI Crawlers → Install tracking, the site keys table has a Last event column. It updates once your install delivers its first accepted report; crawler visits and AI-referral clicks both count.
• WordPress users can confirm delivery immediately with Send test event (test events verify credentials and connectivity but do not update Last event).
• Give it time: on low-traffic sites the first real crawler visit can take hours or a few days. Once events arrive, AI Crawlers → Analytics fills in.
• If nothing arrives after a couple of days, re-check that the key ID and signing secret in your install match an active (non-revoked) key, and that your route or middleware covers all paths.