The line of code you paste contains a public site ID. Anybody can read it in your page source, and that is by design: a visitor's browser has to send it, exactly like an analytics ID. So Pulse is built so that the ID is worth nothing to a stranger.
With your public ID, somebody CAN They can NEVER
Report a page view, from one of your own domains Record a sale or a lead. Only your own plugins and your signed webhook can
Open a chat as a visitor, from one of your own domains Read a name, an email, a lifetime value or anybody's conversation
See the same anonymous dots your public globe shows Open your Chats, your Dashboard, or anything in WordPress
- Locked to your domains. An ID used from a website that is not this site, not on your Your Sites list and not in Allowed origins is refused. Diagnostics, Security lists anybody who was turned away.
- Rate limited. Every browser and every address has a ceiling, so nobody can flood your numbers.
- Private chats are private. Each visitor's chat is tied to a long random ID made by their own browser's cryptography. It cannot be guessed.
- No secrets in a page, ever. Your licence key, your AI keys, your webhook secret and your Commerce token stay on your server. AI keys are stored encrypted.
- Want a fresh ID for one of your other sites? Connections, Your Sites, New key on its row. The old one stops working at once.
The honest limit. A determined person can write a script that pretends to come from your domain, as with every analytics tool ever made. The worst they can do is add some fake page views, slowly, because of the rate limits. They still cannot touch sales, leads, names, chats or your site.