When data-domain attribute and pulseConfig are both unavailable (common with GTM which strips data-* attributes), the script now falls back to location.hostname. This is safe because the backend already validates Origin/Referer against the registered domain. Strips www. prefix on auto-detected hostname to match typical Pulse registration patterns.