Statcounter images check published installation fields.

Advisory checks for the exact published c.statcounter.com noscript image path. Project-slot completeness and image GET transport follow the installation template. Security checking can be disabled, so security values remain optional and opaque. Other collector formats and script loaders are outside this profile.

What this pack matches

Hosts: c.statcounter.com
Paths: Full path expression: /[^/]*/0/[^/]*/1/
Vendor docs: statcounter.com/support/faq/304-how-can-i-make-statcounter-compliant-with-the-w3c-validator/

Rules

Codes are stable. A finding in CI, MCP, or the playground lands on the same id.

Field	Required	What it checks	Rule ids	Source
`project_id`	recommended	The published installation template requires replacing its project slot with the configured project ID. Completeness advice only; no identifier grammar or account existence is inferred. Presence diagnostic severity: warning.	`vendor.statcounter-noscript.param.project_id.missing` `vendor.statcounter-noscript.param.project_id.empty`	docs
`security_code`	optional	The security code is opaque, and checking can be disabled per the vendor FAQ. No unconditional presence or hash-format restriction is applied.		docs
`method`	required	The published noscript template loads an image through its src URL. GET is template advice, not a universal collector rejection rule. Complete HTTP capture contract. Presence diagnostic severity: warning.	`vendor.statcounter-noscript.http.method.missing` `vendor.statcounter-noscript.http.method.empty` `vendor.statcounter-noscript.http.method.invalid`	docs

Validate a payload

pixellint validate url "$ARTIFACT" --rulepack vendor/statcounter-noscript

Try this failing payload in the playground. An example with a validation finding.

https://c.statcounter.com//0/synthetic/1/

cargo install pixellint · npm install pixellint