Real User Monitoring is built to measure pages, not people. It has no cookies, no visitor identifier and no third parties.
What is never collected or stored
- No cookies and no local storage. Nothing is written to or read from the visitor's device.
- No visitor or session identifier. Each page view gets a random identifier that lives only in the page's memory; a page restored from the back/forward cache starts a new one. Nobody can be followed from one page to the next.
- No IP address and no User-Agent. The edge uses them only when the measurement arrives, to derive the country and the device class, and then discards them. They are never stored or sent on.
- No query strings or fragments. Only the path of the landing page is kept; resource and script URLs are stored without query or fragment.
- No page text or form content. Element attributions are CSS selectors (
main>section>img.hero) and script URLs: the page's structure, not its text. - No third parties. The script is served from your own domain (
/__waf/rum.js) and reports to your own domain (/__waf/rum). No cross-site request is made.
What is collected
Per page view:
| Data | Example |
|---|---|
| Host and landing path | www.example.com, /pricing |
| Metrics | LCP, INP, CLS, FCP, TTFB, and the phases of LCP and INP |
| Attribution | LCP element and resource URL, INP target element, interaction type and script, CLS element |
| Context | Navigation type, connection type, viewport size |
| Added by the edge | Device class (mobile, tablet, desktop) and country (from the IP, then discarded) |
| Sampling | The sample rate the view was measured with |
Selectors and URLs come from the pages that were visited. The API, CLI and MCP return them as data.
Retention
RUM data is kept for 30 days and then deleted automatically.
Turning it off
RUM is off by default. When you turn it off, the edge stops injecting the script as soon as the change reaches the edge nodes; data collected before stays readable until it expires. To keep RUM away from some pages, such as account or checkout pages, use excluded paths.