WebmasterID: Understanding Website Traffic, Conversions and AI Discovery

Finding out how many visits a website had last month is the easy part. The harder questions come after that: which visits led to something that mattered, where those visitors came from, and whether AI assistants are sending anyone at all, or only reading the pages.

WebmasterID is an analytics product from the HELPERG ecosystem, operated by HELPERG LLC, that describes itself as “a lightweight, first-party analytics and AI visibility platform”. This guide explains what it records, how to set it up to measure actions rather than just page views, and what each of its signals can and cannot tell you, including where its published code goes further than its privacy documentation says.

What it is made of

WebmasterID has three parts: a browser tracker that a site loads with a single script tag carrying a public site id and an ingest address, an ingest service that receives and classifies events, and a dashboard where the operator reads them. Its architecture page also describes a server-to-server events path for backends that need to record events a browser never sees, protected by a secret key that must stay on the server, although the events reference describes that path as being “for future server-to-server ingestion”.

What the tracker records

According to the events reference, three events are recorded automatically:

• page_view, with the page URL and path, the referrer when the browser provides one, five standard UTM campaign parameters, the page title, the browser’s language and the screen width;
• outbound_click, with the destination of a link to another site;
• download, with the address of a downloadable file such as a PDF or ZIP.

The documentation says the visitor’s IP address is anonymised before storage, with the last part of an IPv4 address set to zero and an IPv6 address shortened, and that raw IP addresses never reach the database.

Measure actions, not just visits

Page views say that someone arrived. The events the documentation describes for measuring whether a page did its job are the ones you tag yourself:

• cta_click for a button or link marked with a data-wmid-cta id;
• form_submit for a form marked with a data-wmid-form id, which records the form’s id and, according to the documentation, never the values typed into it;
• signup and purchase for elements marked with data-wmid-event, where a purchase can also carry a value, currency, product and plan.

The tracker file served on 4 October 2026 goes further than that description: it also records a form_submit for untagged forms, named from the form’s id or name attribute or the path it submits to, and a generic click event, with the element type and destination path, for clicks on untagged buttons and links.

The documentation asks operators to use stable, descriptive ids and never to put personal data in an id or in a campaign parameter, because both appear in reports and exports.

An illustrative example. The business and its numbers are invented.

A small guesthouse tags its “Check availability” button and its booking-enquiry form. In a month, the dashboard shows 400 clicks on the button and 36 form submissions. Those 36 are enquiries submitted, not stays booked and not payments received; the guesthouse’s own booking records answer that. What the tagged events do answer, together with the attribution reports the pricing page lists on paid plans, is which pages and sources produce enquiries, which is the part a page-view count cannot show.

Three signals that are easy to confuse

AI referrals are click-throughs. When someone clicks a link in an AI assistant’s answer and lands on your site, the visit can carry the assistant’s address as its referrer. WebmasterID matches that referrer against a closed list of AI services, including ChatGPT, Claude, Perplexity, Gemini and Google’s AI Overviews, and labels the visit as an AI referral, counting it with human traffic rather than with bots. The label rests on the referrer; it does not prove that a person made the click. If the assistant strips the referrer, the visit cannot be attributed and is counted as direct or organic traffic instead.

Crawler visits are machines. The events reference describes bot visits as “NOT a browser event”: the ingest service classifies the user-agent string of the requests that reach it and files recognised bots separately, in categories that run from AI crawlers to uptime monitors and security scanners. Two cautions apply. WebmasterID’s own explainer calls the user agent “the most common signal — and the weakest on its own”, because automated clients can copy a real browser’s, and says that identity on the web “is declared, not guaranteed”. And the classification covers requests that reach WebmasterID’s ingest service; the documentation does not claim to see every request your web server receives, so your server logs remain the fuller record of crawler activity.

Mentions in AI answers are neither. An assistant can describe or cite your site without anyone clicking through. WebmasterID’s own FAQ makes the point that a site with no AI referrals “may still be crawled by AI bots” and “may appear in AI answers without sending a referrer”. Referral counts and crawler visits are evidence about traffic, not a measurement of how often AI answers mention you.

Privacy: read the tracker, not only the summary

WebmasterID’s pages describe a privacy posture with several parts: no cookies, no fingerprinting, anonymised IP addresses, and an early exit for browsers that send a Do Not Track or Global Privacy Control signal. The privacy page, the events reference and the operator guide also say there is no “localStorage tracking” and no persistent visitor identifier, and the cookie policy says there are “no localStorage or sessionStorage tracking identifiers”.

The tracker file that webmasterid.com served on 4 October 2026 matches part of that description. It does not set cookies, and it checks for Do Not Track and Global Privacy Control before starting. But it also writes a randomly generated identifier to the browser’s localStorage under the key wmid:av:v1, reuses it on later visits, and sends it with each event as an “anonymous_visitor_id”. It keeps a separate session identifier in the browser’s sessionStorage, replaced after 30 minutes without activity, and it sends the browser’s user-agent string with each event. The pricing page, for its part, lists filtering the event stream by “session id, visitor id”, and Global City Intelligence’s own privacy page, which describes its use of WebmasterID, says the tool “stores a random identifier in your browser — in local storage, not a cookie”.

The identifier is a random value, not derived from anything about the visitor, and because browsers keep this storage separately for each website, it identifies a browser on one site rather than across sites. It is still a persistent identifier stored in the visitor’s browser, and the same file lets a site attach its own user id to every later event through an identify() function.

The file also does two things none of the documentation pages checked for this guide mentions. Unless the script tag sets data-wmid-conversions=“off”, it wraps the page’s fetch, XMLHttpRequest and sendBeacon functions, watches outgoing requests for sign-up endpoints and sign-up event names, and reports a detected sign-up as a conversion carrying the visitor and session identifiers. And on every load it asks WebmasterID for the site’s settings, which can switch on features that are off by default: collecting conversions from the page’s dataLayer or gtag calls, recording conversions from rules such as a visitor reaching a given page or a marked element appearing on it, and adding a random reference to Stripe payment links, which the tracker reports to WebmasterID together with the visitor and session identifiers. Setting data-wmid-conversions=“off” does not switch off the Stripe references or the rules.

The operator guide’s suggested privacy-notice wording, which says the product collects “no persistent visitor IDs”, does not describe the tracker as published. If you install WebmasterID, describe the version you actually load, and read the file again whenever it changes: it is served from one unversioned address.

Consent is your responsibility, not the product’s. The terms of service say that WebmasterID “does not provide consent management as part of the tracker” and that implementing consent, where your jurisdiction requires it, is the operator’s responsibility. The operator guide recommends loading the tracker only after a visitor opts in to analytics wherever consent is required, and says that it is “not legal advice”.

Plans and retention

The pricing page lists a Free plan at $0 for one site, with basic AI crawler visibility and 7-day event retention; Pro at $499 a month for up to three sites, with full AI visibility, basic attribution and 12-month retention; Agency at $1,199 a month; and a custom Business plan. The privacy policy and the operator guide both give 90 days as the current default retention. Check the figure for your plan before you write a retention period into a privacy notice.

The pricing page also lists Cash Workspace, HELPERG’s finance workspace, as included with the paid plans; our guide to Cash Workspace covers what it does.

The Agent recommends; it does not deploy

The WebmasterID Agent reads a workspace’s analytics, groups recommendations into work packages, surfaces the top items in a daily brief and prepares prompts that a developer can use with Claude to draft a code change. The Agent page says operator approval is required for every change and that “the Agent never deploys on its own”. The pricing page says the Agent layer “is included on Agency and Business”, while the Agent page describes the Agent as bundled with Pro and above, so confirm which plan includes it before buying for it.

What it will not tell you

WebmasterID will not tell you why a page ranks where it does, and nothing in the pages checked for this guide promises better rankings or more revenue. It cannot prove that a given visitor was human. Its purchase and sign-up events record what your site tags, what rules in the site’s settings define or, for sign-ups only, what the tracker infers from your page’s own network requests; they are not a substitute for your payment records. Its documentation index covers a browser tracker and a server-to-server events path, and lists no software kit for measuring native mobile apps.

Who it suits

WebmasterID suits an operator, publisher or founder who wants first-party website analytics, is willing to tag the actions that matter, and wants AI referrals and crawler activity reported separately from human visits. It suits them best if they are prepared to own the parts the product leaves to them: consent, an accurate privacy notice, and the judgement about what the numbers mean.