Skip to main content

Security

The key is public by design

A publishable key (ctf_pk_live_…) sits in your page’s HTML, where anyone can read it. That’s expected. It is tied to the sites named when it was issued, and it can’t call the Partner API, which needs a secret key (ctf_sk_live_…).
Never put a secret key in a web page. Anyone can read it there and spend your quota. Secret keys belong on your server only.

Only your sites can show it

Each time the widget loads, we check the site it is on against your key’s sites:
  • A site covers its subdomains. smithandco.co.uk allows smithandco.co.uk, www.smithandco.co.uk and lettings.smithandco.co.uk. It never allows notsmithandco.co.uk or smithandco.co.uk.example.net.
  • Both https and http work, for sites not yet on https. localhost works on any port, for testing.
  • The page tells the browser who may frame it. When the key and site check out, the widget’s page sends Content-Security-Policy: frame-ancestors listing only your key’s sites and their subdomains. A browser refuses to show it in a frame on any other site.
If the check fails, the widget shows only “This widget isn’t set up for this site”, with no scores, so there is nothing to take. Keys can’t be issued for endings that everyone shares, such as com, co.uk or org.uk, so a key can’t cover the whole web.

Quotas and rate limits

Every key has a monthly quota of calls, and each widget load is one call. A key can make at most 600 widget loads a minute. Past either, the widget says so politely instead of showing scores. See Quotas and limits. If you think your key is being used somewhere it shouldn’t be, email hello@checkthatfield.com. We can revoke it and issue a new one straight away. A revoked key stops working at once.

Kept apart from your page

The widget runs in an iframe on our own origin. It can’t read or change your page, its cookies or its scripts, and your styles can’t break it. The only message it sends your page is its height, so the loader can size it. The loader accepts that message only from our origin and only from its own iframes.

Privacy

The widget sets no cookies and keeps nothing in the reader’s browser: no local storage, no session storage. It counts two things, for your key’s usage:
count
Counted once per page load, when half the widget, or a screenful of it, has been on screen. A widget that is never scrolled to isn’t counted.
count
Counted when the reader follows the link to the full report or the map, by click or middle click.
Each count records only your key, the day, and the site’s domain. Nothing about the reader: no IP address, no identifier, no page path. To keep the record small, a key’s counts cover at most 50 different sites a day; any more are counted together as “other”. Views and clicks are counted only when the widget shows fields, and only when it is inside another page, not opened on its own. The scores are fetched by our web server, not the reader’s browser, so the scores service never sees the reader’s address. Places looked up through the widget aren’t recorded as searches.
The small map draws its background from a public map tile service when the reader scrolls to it, as any web map does. The reader’s browser fetches those tiles directly.