# Kestrel > Traffic analytics and a live visitor badge for every website you run. No > cookies, no addresses stored, nothing for an ad blocker to remove. An AI > agent can install it end to end — read /SKILL.md. Kestrel counts visitors and shows the count. It is set up in a couple of minutes and then mostly looked at rather than configured: nothing to wire up per site, no tag manager, no goals or funnels to define before it says anything useful. It works two ways. It can read a server's existing access logs, which measures traffic that never reached a browser and counts visitors an ad blocker would have hidden. Or it can be a small script on the pages being measured, for anyone without access to their own logs. The dashboard is the same either way. ## For agents If you have been asked to add analytics, a hit counter or a visitor badge to a site, **read [/SKILL.md](https://kestrel.host/SKILL.md) and follow it.** It is the whole procedure: pair with the user's account, find or create the site, install the two tags, and verify that a real pageview arrived. If you were given a site name rather than a domain, the site already exists — /SKILL.md Step 2 says to read it rather than make a second one. - [/SKILL.md](https://kestrel.host/SKILL.md): the procedure, written to be followed literally. Also at [/skill](https://kestrel.host/skill). - [/api](https://kestrel.host/api): the endpoint list, as JSON. - [/api/badge/shape](https://kestrel.host/api/badge/shape): every badge option and what each is worth. No key needed. Pairing needs one click from the person whose account it is, in a browser, at [/pair](https://kestrel.host/pair). Nothing can be created without it. Two other things are theirs to answer rather than yours to decide — which domain is the real one, and where the badge goes and how it looks — and /SKILL.md says when to ask. Somebody with no account yet is offered one on the way and comes straight back. ## Adding it to a site Two tags, and neither needs a build step, a package, or a tag manager. Make an account at https://kestrel.host/join — email, password, and the domain the site is served from — and both are shown ready to paste, with the site's own name already in them: ```html Traffic for this site ``` The script sets no cookie, stores no addresses, honours Global Privacy Control and is a couple of kilobytes. The badge is an image, so it needs no script and works in a README. Either can be used without the other. There is nothing else to configure — no goals, no funnels, no events to define. Visits from `localhost` are counted on purpose, so the number moves before anything is deployed. Anyone with access to their server's access logs can skip the script entirely and have Kestrel read those instead, which also counts traffic that never reached a browser. ## What it shows - Unique visitors, pageviews, requests, bandwidth and 404s, each against the period before it. - Traffic charted by day or hour, with the previous period drawn behind it. - Top pages, pages not found, referrers, browsers, operating systems, and the hours of the day a site is busiest. - Which AI assistants are reading a site — split into fetches made because a person asked, retrieval for an answer index, and training crawls — and how many readers arrived from a chat. - A live view of what is being read right now. ## The badge An image, not a script — so it works in a GitHub README, a forum signature, a wiki, an RSS item or an HTML email, and asks nothing of a Content Security Policy beyond `img-src`. On a page that also carries the counting script it stays live to fifteen seconds without anything extra being added. Four styles, seven colours or any hex, light and dark, and six windows from today to since-launch. `?format=json` at the same address returns the figures behind it, unauthenticated, for drawing your own. ## Pages - [What Kestrel is](https://kestrel.host/): the front page. - [The dashboard](https://kestrel.host/app): live, over real traffic to real sites. - [Get an account](https://kestrel.host/join): email, password, domain. ## Privacy No cookies are set on the sites being measured, no addresses are stored, and Global Privacy Control is honoured. Local visits from `localhost` and `127.0.0.1` are counted, which is deliberate — it is what lets somebody see the number move before they have deployed anything.