Real user monitoring and Web Vitals
Real user monitoring (RUM) measures how your pages perform for real visitors. A tenant administrator turns it on and records the privacy decision, a web developer makes sure the extensions script loads, and anyone with analytics access reads the results on the Client RUM page.
What it is
Availability: Controlled availability. RUM is off until it is switched on for your workspace and for a domain, and it runs when enabled for your organisation.
The browser sends small, sampled beacons to the ingest host. The beacons come from the extensions script. The core script alone never sends RUM.
| Group | What you see | Backoffice name |
|---|---|---|
| Web Vitals | Loading speed, visual stability, responsiveness and paint timing | LCP, CLS, INP, FCP |
| Navigation timings | DNS lookup, TCP connect, TLS handshake, response start and DOM processing | DNS lookup, TCP connect, TLS handshake, TTFB, DOM processing |
| Page views | Sampled page views, including route changes in single-page apps | Pageviews |
| Error counts | Uncaught errors and unhandled promise rejections, recorded under a closed set of names. Raw error message text is not used as a name. | Capped error count, Error rate |
| API latency | Mean round trip of the SDK’s own calls to Noxtica’s /client/* endpoints. It is never your page’s own requests. | API latency |
| Resource timing | Durations for third-party hosts you allow-list | Resource duration |
| SDK health | The SDK and recorder’s own counters and closed diagnostic codes, never page content | SDK health panel |
Each Web Vital is rated Good, Needs improvement or Poor against the standard Core Web Vitals boundaries. For what the browser stores on the visitor’s device and which category governs it, see Install & Browser Runtime and Privacy.
Gates
Beacons flow for a domain when all of these hold:
- Workspace switch. RUM Collection is on for the workspace. It is off by default.
- Domain sample rate. The domain’s Client RUM sample rate is above 0. A rate of 0 means nothing is sent. The default is 0.
- Privacy decision. The domain records whether visitors must consent, a legal basis if they do not, and how Do Not Track and Global Privacy Control are handled.
- Visitor signals. With the policy set to Honor, a visitor who sends Do Not Track or Global Privacy Control is excluded. The browser checks it and the collector checks it again. In consent-gated modes (
apiandcookie), theanalyticscategory must also be granted.
Because sampling decides which page views send beacons, treat the numbers as a sample, not a census.
Prerequisites
- Extensions script. It must load on the page, either through your consent flow or through Auto-load extensions. See Consent modes, GPC and Google Consent Mode.
- Roles. Switching on RUM Collection and recording the privacy decision need the Admin role and a fresh step-up verification. Reading Client RUM needs the Viewer role or higher.
- Sample rate. Today the per-domain sample rate field is editable by Noxtica operators. It is disabled for tenant roles in Backoffice, so ask your account team to set it.
- Content Security Policy. The page allows the collector host and the ingest host in
connect-src. See Content Security Policy, hosts and relay. - Flags. RUM works when enabled for your organisation.
Steps
1. Make the extensions script load
Pick one route. Both are on Backoffice → Integrations & API → Script & Consent.
- Your site loads it after its own consent. Record the visitor’s choice with
setConsent(), then load the extensions. Visitors who decline never load them and send no RUM. - Turn on Auto-load extensions. Switch on Load the extensions script automatically for the domain. No change to your site is needed.
2. Record the domain’s privacy decision
Backoffice → Web Analytics & Privacy → Consent & Privacy. The Consent & privacy decisions card puts domains that still need a decision at the top of its list.
- Choose the Legal basis. The list offers
rum_observability. Leave it at— none —when visitors must consent. - Set Requires consent.
- Set the DNT/GPC policy to Honor, or to Documented override.
- Select Save decision and complete the step-up verification.
Rules the page enforces:
- Capturing without consent needs an approved legal basis.
- Overriding Do Not Track and Global Privacy Control needs an approved legal basis and your acknowledgement: “I acknowledge this domain overrides DNT/GPC on an approved legal basis.”
- This decision covers per-domain RUM consent and Do Not Track decisions. Tenant-wide gate receipts are recorded in the Legal Basis Register.
3. Turn on RUM Collection for the workspace
Backoffice → Web Analytics & Privacy → RUM Collection. Switch Client RUM collection on and select Save. The page shows when the setting last changed.
4. Set the domain’s sample rate
Backoffice → Administration → Domains → open the domain → Configuration → Client RUM → Sample rate. The value runs from 0 (off) to 1 (every page view) and defaults to 0. Raising a rate above 0.5 from a value at or below it needs a separate risk acknowledgement.
Ask your account team to apply the value until your role can edit it.
5. Optional: report on third-party resources
Backoffice → Web Analytics & Privacy → Tracking Allowlists → RUM trace controls.
- Add hostnames under Resource-host allowlist. Use lowercase hostnames without a port or an IP address. The list holds up to 50 hosts.
- Switch on Enable Resource-Timing observation.
- Select Save trace controls.
The observer installs when the switch is on and the list is not empty. For trace origins see Custom events, session tags and request tracing.
6. Read the Client RUM page
Backoffice → Session Insights → RUM & APM → Client RUM.
- Filters. Choose Domain, Device (Desktop, Tablet, Mobile, Unknown), Browser (Chrome, Firefox, Safari, Unknown) and Time range.
- Overview tab. KPIs show Total samples, Error rate, LCP, API latency and Capped error count. The metrics table shows each metric’s samples, mean and the split across Good, Needs improvement and Poor.
- Vitals by environment. INP, LCP and CLS are broken down by connection type, device memory and CPU bucket. Browsers that do not expose connection type or device memory, such as Safari and Firefox, land in the Unknown bucket.
- SDK health. The SDK and session recorder’s own counters, such as recorder starts, events dropped, flush failures and diagnostics.
- Errors tab. It opens the Issues page. See Browser errors, console logs and source maps.
- Console logs tab. Masked console lines, when capture is on.
Verify it works
- Load a page on the domain, accept consent if your site asks, and browse for a minute.
- In your browser’s network panel, look for requests to the ingest host whose path starts with
/client/rum. - On the Client RUM page, widen Time range if needed. Total samples rises and LCP shows a value.
- If a card is empty, read its message. Each message names the missing switch.
Troubleshooting
| Symptom | Cause | Fix |
|---|---|---|
| Client RUM capture is off | RUM Collection is off for the workspace. | Switch it on in step 3. |
| No domain is sampling RUM | The workspace is on but every domain has a sample rate of 0. | Ask your account team to set a rate in step 4. |
| RUM needs the extensions script, and your settings do not load it | Auto-load extensions is off and your page does not load the extensions. | Use either route in step 1. |
| No visitors in this window yet or No RUM data in this window | The window is too short, or no sampled visit arrived. | Widen the range, clear filters, wait for traffic. |
| No RUM data in this window, capture settings could not be read | Backoffice could not read the capture settings. | Open RUM Collection and check the switch. Retry. |
| Visitors with Do Not Track or Global Privacy Control are missing | The domain policy is Honor. | This is the intended behaviour. Change the policy with a recorded legal basis. |
| Save refused: consent-optional capture needs a basis | You turned off Requires consent without a legal basis. | Choose rum_observability, or turn Requires consent on. |
| Save refused: override needs a basis | You chose Documented override without a legal basis. | Choose a legal basis and tick the acknowledgement, or set the policy back to Honor. |
| Vitals by environment shows mostly Unknown | The browser does not expose connection type or device memory. | No fix. Safari and Firefox expose neither. |
Who it fits
Use RUM to see where friction appears, then decide what to change.
- How do visitors move within a page load? Where tracker collection is enabled, the console also offers journeys, funnels and heatmaps. A tracker session covers one page load by design, so they do not follow visitors across pages. See Behavior analytics: heatmaps, journeys and funnels.
How teams connect
RUM runs from the same browser script as the rest of Noxtica and needs no extra code. You connect it in three places:
- Your pages. Use the Noxtica browser collector. See step 1 and Install & Browser Runtime.
- The Noxtica console. Set the sample rate for each domain. It can stay at zero. See step 4.
- Your consent tool. In consent-gated modes, connect it so the page reports analytics consent. See Consent modes, GPC and Google Consent Mode.
Limits
Measurements are samples from browsers that allow collection.
- Controlled availability. Capture and read access are configured separately for each tenant and domain, and access is agreed with Noxtica.
- A missing measurement does not mean a good or a bad visit. Browser support, privacy settings and consent change what is collected.
- You are responsible for notice, consent, sampling and retention. Console output and error detail can contain personal data that your page writes.
- Measurements and any alerts built on them can produce false positives and false negatives. Your team decides what to do. Native mobile app monitoring is not supported.
Common questions
Is RUM the same as session replay?
No. RUM samples performance and error measurements. Session replay records page structure and interactions and has its own consent category. See Session replay: setup, masking and playback.
Can I follow a visitor across pages?
No. Journeys and funnels do not span pages. The reason is in the third item under Who it fits.
Can I turn RUM off for a domain?
Sampling is set per domain and can stay at zero, which sends nothing. See step 4. Capture and read access are configured separately; see Limits.
Related
- Observability overview: RUM, replay, APM and ingest — how RUM fits with the other tools.
- Browser errors, console logs and source maps — error detail and console capture.
- Install & Browser Runtime — core and extensions scripts, consent categories, storage.
- Legal basis register and receipts — tenant-wide receipts.
- Usage, quotas and metering — RUM events and sessions are metered.