DesignerLink ClickFix kit
DesignerLink is a visitor-selection loader that injects a remotely chosen campaign script. We have matched it on 64 sites since 7 September.
DesignerLink in numbers
Since 7 September, the first DesignerLink match in our records, counted on 12 November 2026. How we count.
| Sites with DesignerLink code | 64 |
|---|---|
| Sites with a match in the last 30 days | 42 |
| New sites in October | 10 |
| Still serving it when recaptured at least 25 days later | 31 of 33 sites (94%) |
| Sites running WordPress (captured since 25 September) | 81% |
Administrators leave before the decision request
DesignerLink checks for the WordPress admin bar, logged-in and admin-bar classes, and the /wp-login.php and /wp-admin/ paths. A matching session exits before contacting the campaign service and receives a data-designerlink-admin-skipped marker.
A logged-out visit starts after the DOM is ready. The loader creates or reuses a designerlink_visitor_id in local storage, then sends the page host and path, user agent, browser platform and maximum touch-point count to its decision endpoint. The request omits credentials and bypasses the browser cache.
The server chooses what runs
The reply must set show to true, provide a positive integer campaign_id and supply an HTTPS script_url ending in .js. DesignerLink rejects a reply that misses those checks.
For an accepted reply, it injects the campaign script asynchronously with a no-referrer policy. A successful load records the execution time and sends a second request containing the campaign, visitor and site identifiers. A failed script is removed from the page.
The server also supplies frequency_hours. DesignerLink stores a separate record for each campaign and site. Within that period, the code permits the first display and one page refresh, then waits for the next period. The allowed value ranges from immediate reuse to 8,760 hours.
The same build appears in captures from early September through October.
What we see
| Month | New sites |
|---|---|
| September | 47 |
| October | 10 |
| November so far | 7 |
Of the 33 sites recaptured at least 25 days after their first match, 31 were still serving DesignerLink (94%). 81% of DesignerLink sites captured since 25 September run WordPress.
Of the DesignerLink sites identified as WordPress, 79% report WordPress 7.1.
Checking a WordPress site
Inspect a logged-out response, browser storage and network requests for:
designerlink_visitor_idand keys beginning withdesignerlink_campaign_data-designerlink-admin-skipped,data-designerlink-loader-runningordata-designerlink-loader-executed- a decision request carrying
site_host,path,platformandmax_touch_points - a reply containing
show,campaign_id,script_urlandfrequency_hours - an injected HTTPS script with a
no-referrerpolicy
Compare that response with an administrator session, then trace the injection back through the theme, plugin and cache layers that can alter the logged-out page.