Custom code & tracking

Add code to the top and bottom of every page, Google Analytics and Tag Manager, floating contact buttons, redirects and the security rules.

Where

Settings on Admin → Integrations apply to your site and customer panel; none of them run in the admin (so broken code can't lock you out). For CSS use Appearance → Custom CSS.

Top and bottom of page

Field	Placed	Typical use
Top of page	Right at the start of `<body>`	Verification meta tags, chat widgets, pixels
Bottom of page	End of `<body>`	Scripts that should run after the page loads

Each field holds up to 50,000 characters.
Saving asks for your 2FA code (or admin password) and is written to the audit log as "custom code changed".
Bottom-of-page code isn't loaded inside the Telegram Mini App.

Content Security Policy

Your site runs under a strict CSP. In practice:

Every <script> you add automatically gets the site's one-time security nonce, and scripts they load also run (strict-dynamic). Standard embed codes (Crisp, Tawk, Hotjar, Meta Pixel…) work as they are.
Inline event attributes such as onclick="..." and javascript: links don't run. Instead:

<button id="support">Live support</button>
<script>
  document.getElementById("support").addEventListener("click", () => {
    window.$crisp?.push(["do", "chat:open"]);
  });
</script>

Images may load from https: URLs; iframes may load https: sources.
Fonts only load from the site itself. Google Fonts CSS loads but its font files are blocked; use the built-in fonts under Appearance → Type instead.

Google Analytics and Tag Manager

Setting	Format	Note
GA4 Measurement ID	`G-XXXXXXX`	Adds Google Analytics 4 to every page
Google Tag Manager	`GTM-XXXXXX`	Adds the container script and the `<noscript>` iframe

Floating contact buttons

WhatsApp: digits only, with country code (e.g. 15551234567) → https://wa.me/15551234567
Telegram: @username or a t.me/... link → https://t.me/username

The buttons appear bottom-right and are hidden inside the Telegram Mini App.

Redirects

Send old addresses to new pages (important for SEO when moving from another panel):

Field	Rule
Source	A path like `/old-page` (max 500 chars, lowercased). System paths starting with `admin`, `api`, `dashboard`, `_next`, `media` are not allowed.
Target	`/new-page` or an `https://...` URL
Type	301 (permanent) or 302 (temporary)