# Troubleshooting Analytics

> What to check when Real User Monitoring shows no data, pages aren't measured, or traffic and security events are missing.

## No RUM data after turning it on

Data appears about a minute after someone visits a page **and** leaves it or switches tab. Then check:

1. **The page carries the script.** Look for `/__waf/rum.js` in the HTML:

   ```sh
   curl -s https://www.example.com/ | grep -o '/__waf/rum.js[^"]*'
   ```

2. **The page qualifies.** Only HTML pages answered with `200` to a `GET` get the script. Excluded paths, pages without a `</head>`, and pages generated by the edge (challenges, block pages, access gate) don't.
3. **The sample rate.** With `rum.sample_rate` below `1`, only that share of page views is measured.
4. **The visitor is a real browser.** Headless browsers and lab tools (Lighthouse, PageSpeed Insights, WebPageTest, Puppeteer, Playwright, Selenium…) are not measured.
5. **The setting reached the edge.** Check **Changes › Propagation** after turning RUM on, and that a per-name setting isn't turning it off for that name.


## Pages are not measured because of the CSP

The report warns that your origin's Content-Security-Policy blocked the script on some page views. Allow `'self'` in `script-src` and `connect-src`, or send a `nonce` in `script-src` (the edge reuses it). See [Content-Security-Policy](https://developers.openwaf.dev/analytics/real-user-monitoring/#csp).

## INP has no data

INP needs an interaction (tap, click or key press). Views without one have no INP; the assessment then uses LCP and CLS only.

## Single-page app: every view is on the home page

A view is attributed to its landing page. Client-side navigations don't start new views, as in Chrome's field data. See [Page views](https://developers.openwaf.dev/analytics/core-web-vitals/#page-views).

## Traffic shows no data

Counters appear once your sites receive requests through the edge. Check that the names are proxied and, for an external zone, that they point at the edge. Days without traffic are left out of the API answer.

## Security events say they aren't available

The dashboard shows *Security analytics aren't available yet* and the API answers `503` when the events store can't be reached. Protection keeps working and traffic counters are unaffected; try again later or contact support@openwaf.dev if it persists.

## The live stream answers 429

An organization can hold up to 10 live event streams at once. Close other dashboard tabs in **Live** mode or other API clients.