Hosting checklist

Every address is listed on the site

Recordings and heatmaps are only accepted from addresses listed on your site in OpL Insights. If your site is reachable on more than one hostname, such as www. and without, or a live domain and a master node, every one must be listed.

Check an address from any terminal; replace the host and site ID:

curl -s -H 'Origin: https://www.example.com' 'https://insights.opl-web.com/plugins/OplReplay/replay.php?c=1&s=129'

"on":true means recordings from that address are accepted. {"on":false,"hm":0} means the address isn't on the site.

Fonts can be loaded from OpL Insights

The recording player runs on the OpL Insights server and loads your fonts from your site. Browsers only allow that when your server sends Access-Control-Allow-Origin on font files. Without it, icon fonts show as words like keyboard_arrow_down.

Apache, for files Apache serves itself:

<FilesMatch "\.(woff2?|ttf|otf|eot)$">
    Header set Access-Control-Allow-Origin "*"
</FilesMatch>

Apache in front of an application server (proxied URLs):

<LocationMatch "\.(woff2?|ttf|otf|eot)$">
    Header always set Access-Control-Allow-Origin "*"
</LocationMatch>

Nginx:

location ~* \.(woff2?|ttf|otf|eot)$ {
    add_header Access-Control-Allow-Origin "*";
}

Content-Security-Policy

If your site sends a Content-Security-Policy header, allow the OpL Insights server for scripts and connections:

script-src  'self' https://insights.opl-web.com;
connect-src 'self' https://insights.opl-web.com;

Caching after upgrades

Browsers cache the script. To make every browser pick up a new version immediately, add a version to the script address and change it when you upgrade:

<script async src="https://insights.opl-web.com/plugins/OplReplay/javascripts/opl-insights.js?v=1.5.0"></script>