This article covers how the Knock2 script behaves on single-page apps (SPAs) — sites built with frameworks like React Router, TanStack Router, the Next.js App Router, or Vue Router, where moving between pages happens client-side without a full browser page reload.

Knock2 records client-side route changes the same way it records full page loads. When a visitor moves from one route to another inside your app without triggering a browser reload, that navigation is recorded as a new page view, so the page history on a contact or account reflects the routes the visitor actually moved through.

No extra setup is required. The script only needs to be present once, in your app's shell.

The Excluded Pages setting (Settings > Script) is checked on every route change, not only on the page a visitor first lands on. If a visitor navigates client-side into a route that matches an excluded pattern, Knock2 stops sending tracking data for that visitor until they navigate to a route that isn't excluded. The excluded route itself is not recorded.

Excluded Pages controls Knock2's own tracking calls. It does not affect third-party identification tags that have already loaded on the page before the visitor navigates to the excluded route. Once a browser has loaded a third-party tag, a client-side navigation can't unload it — only a full page reload clears it.

For this reason, Excluded Pages is a backstop for routes a visitor might reach by navigating around your app, not a substitute for keeping the Knock2 script off private or authenticated pages entirely.

The recommended way to keep Knock2 out of a private area of your site is to not load the script there in the first place — for example, by including the script only in the public marketing shell of your app, and using a full page navigation rather than a client-side route to enter the authenticated app.

These two settings are easy to mix up:

If your public site and your authenticated app share the same hostname — for example, both live on app.example.com, or your app runs on the same domain as your marketing site — the Domain Allow List can't be used to separate the two. Use Excluded Pages, or keep the script out of the app shell as described above.

Two things suppress person-level identification for a visitor:

Neither stops the underlying session ping or company-level identification. A business can still be identified as having visited your site, even when the individual visitor is not.

Suppressing tracking — on an excluded route, or for an opted-out visitor — stops Knock2 collecting anything further. It does not clear what is already stored in that visitor's browser. Knock2 keeps a small amount of session state in the browser's local storage, plus a first-party visitor identifier stored in local storage and in a cookie.

Clearing that browser-side data is something only the visitor can do, by clearing site data in their own browser. No setting in Knock2 or on your site removes it for them. Requests to remove the data Knock2 holds about a visitor are handled separately — see Adding Knock2 to Your Privacy Policy.

Need help? Contact us at support@knock2.ai or via the chat widget in your dashboard.