Securealy
Check · Analytics · medium · passive

Analytics installed

GA4, Plausible, PostHog, Fathom or equivalent is loaded.

Severity
medium
Tier
Passive: runs on any URL
Category
Analytics
Fix
Summary below; full runbook in the Fix Kit, Module 06: Measure
Id
analytics-present

What this means

Your home page loads a known analytics tool: GA4 through gtag, Plausible, PostHog, Fathom or an equivalent. Passing means visits and the events that matter can be counted from the day you launch. Failing means no analytics tag or script is referenced from the home page, so nothing about your traffic is being recorded.

How we test it

We fetch your home page, following at most 3 redirects, and search the HTML for a known analytics reference: a GA4 measurement ID beginning G- or the googletagmanager.com/gtag/js loader, or a Plausible, PostHog or Fathom script. Any one of those present passes. None found fails.

Why it matters

Launching without measurement means never knowing what worked. The Fix Kit's launch module refuses to start paid traffic until measurement is proven, because ads before measurement is money burned. Even when analytics is installed it can fail quietly: in one case from the kit, a product's sign-up and purchase events ran in code but never arrived, because the script loaded after the component that fired them and the guard dropped every event in silence. The verification is in the browser console, where window.dataLayer must contain your event after the action, or it did not fire.

The fix

Copy templates/analytics.js to public/js/analytics.js, set MEASUREMENT_ID to your GA4 ID (G- followed by letters and numbers, from GA4 Admin, Data streams) and COOKIE_DOMAIN to your apex domain, and add <script src="/js/analytics.js"></script> as the first script in the <head> of every page, with no async or defer, removing any older gtag snippet (Next.js: keep <GoogleAnalytics gaId="G-..." /> from @next/third-parties/google in the root layout and import the helpers from lib/analytics.js). Then confirm with curl -s https://YOUR_DOMAIN/ | grep -c "G-YOUR_ID" that the ID appears at least once and with window.dataLayer.map(e => e[0]) in the console that it starts ["consent", "consent", "js", "config"]. The full runbook is in the Fix Kit, Module 06.

Prompt for your AI

Paste this into the coding agent that built the app. It reproduces the finding and stops before changing anything; the fix steps are in the kit.

Do not change anything yet. This is a verification pass only.
Run: curl -s https://YOUR_DOMAIN/ | grep -oE "G-[A-Z0-9]{6,12}|googletagmanager.com/gtag/js|googletagmanager.com/gtm.js|plausible|posthog|fathom" | sort -u
Print the output and tell me which analytics tool, if any, the home page references.
Run: curl -s https://YOUR_DOMAIN/ | grep -oE "GTM-[A-Z0-9]+" | sort -u and report any Tag Manager container id.
Search the repo for an existing analytics snippet or measurement ID and show me the file and line, or say none exists.
List what it would take to load analytics on every page, without editing anything.
Verify: the first grep prints at least one analytics reference; if it prints nothing, report that no analytics is installed and stop.

Next

Grade your own URL

Every grade lists this check with its evidence for your site. Two free grades a day.