Everything XrayClick does
One engine, three jobs: identify your anonymous visitors, recover abandoned signups, and give you an honest back office to run it all.
🔎 The lead engine
Anonymous visitor tracking
Every browser gets one first-party cookie token. Page views, sources and timestamps are recorded — no fingerprinting, no third-party scripts, no raw IP storage.
Exit-intent & delay capture
The capture popup appears when a visitor moves to leave or after ~20 seconds of engagement — their choice, always opt-in, never a pop-under or redirect.
Retroactive interest X-ray
The moment an email is captured, we link it to everything that visitor browsed before opting in. You get interests, not just an address.
Abandonment detection
Started a signup or checkout and never finished? The engine flags it automatically — the classic "hot lead" signal, ranked first in your leads table.
One-nudge recovery queue
Each abandonment queues exactly one recovery email — never spam, never repeated, and only ever to visitors who opted in. Send manually or on a schedule.
Device merge
The same person returning on a different browser or device is recognized by email and their histories merged — one visitor, one story.
🧍 Membership & human verification
Three-layer bot defense
A server-generated distorted-SVG captcha, a hidden honeypot field, and a timing trap that rejects impossibly fast submissions. No third-party captcha dependency.
6-digit email verification
Codes are HMAC-hashed at rest, expire in 15 minutes, and allow max 5 attempts. Accounts stay unusable until the inbox is proven real.
18+ age gate
Date of birth is verified server-side — not just a checkbox. Accounts that cannot prove adulthood are terminated.
Member dashboard
Members see their own tracked timeline, retroactive interests, plan status, and profile — including the custom fields you define.
Secure email changes
Changing an email requires the current password plus a fresh verification code sent to the new address — account-takeover resistant.
Password self-service
Forgot-password flow with emailed reset codes, no account enumeration, and automatic re-hash of credentials on change.
🛡️ The admin back office
Full member control
Add, edit, restrict, unrestrict, verify, flag-clear or permanently delete any member — every action recorded.
Custom input-field builder
Create the profile fields your business needs — text, long text, number, dropdown, checkbox — and reorder or retire them without touching code.
Content-policy moderation
Profanity, nudity and harassment filters flag member content automatically; the admin makes the final judgment, and the decision is logged.
Tamper-evident audit log
Every privileged action, failed login and content flag is recorded with actor, detail and a hashed IP — reviewable in one click.
Abandonment sweeper
Run recovery sweeps on demand or on a schedule; the queue, sends and results are all visible in the dashboard.
Contact inbox
Every site contact form lands in the admin inbox, mirrored to your CSR email (csr@xrayclick.com), marked open until handled.
Abuse controls
Rate limits on every sensitive endpoint, login lockouts, and an IP block list — stored hashed, enforced at the auth layer.
Self-service transparency
"My site" shows you this very website running on its own engine — visitors, funnel, top pages — proof that the product works on itself.
⚙️ Platform & compliance
Stripe-secured billing
Subscription checkout with verified webhooks for activations, failures and cancellations — and a demo mode so you can test without keys.
Bring-your-own email
Any SMTP provider works for verification codes, recovery nudges and contact copies. Without SMTP, nothing is lost — mail is logged locally.
Hardened by default
CSRF on every request, strong password hashing, strict CSP/security headers, HttpOnly SameSite cookies and randomized session names.
SEO & sitemap
Sitemap.xml, robots.txt, canonical URLs and per-page meta descriptions out of the box.
Privacy-first design
CAN-SPAM and CCPA aligned: opt-in only, salted-hash IPs, export or delete anytime, and no data sharing with anyone.
Plain-language legal
Terms, Privacy and Content Policy written to be read — dispute resolution aims for satisfaction of all parties, with full details on the Legal page.
See it working on your own traffic
Plans that fit site owners of every size — value-first pricing.
View value pricing