Traffic and visitors

Each pageview carries path, referrer, screen size, and browser, OS, and country derived server-side. Nothing is read from the device beyond what any browser already sends.

Sessions use a rolling inactivity window, not a stored cookie. A return visit tomorrow is a new session, not a tracked individual.

Users → Sessions lists each visit newest first, and opens one to show what happened in order. Pages has four tabs: Entry & exit pages with their bounce rates, Scroll depth per page, Breakdowns (bounce rate and visit length for any source, country, device or page, with an optional comparison against the period before, plus language, screen size, region and hostname), and Heatmaps and Replays once you switch them on.

Dashboard → Realtime redraws the last half hour every ten seconds. Events → Attribution credits any event or page visit to the source, campaign, country or device that brought the person, by first visit or by the visit it happened in. A funnel can carry a conversion window, so each step has to follow the last within hours or days.

Account → Security sets up an authenticator app. Once it is on, signing in with Google or GitHub is followed by a six-digit code, and a session without the code is treated as signed out. Account → Display sets the date range dashboards open on and the language of the navigation: English, Spanish, French, German or Portuguese. Only the navigation is translated; reports and settings stay in English.

Overview — headline visitors, pageviews, and trends.

Visitors — breakdowns by source, country, device, and browser. Sources group AI assistants, search, social, email, and referral.

Users — identified visitors when identified mode is on (Settings).

Journeys — paths people actually take through the site.

Funnels — a sequence of steps you define; conversion between steps.

Goals — named outcome events you care about.

Revenue — money attached to visits when Stripe or server events supply amounts.

Events — the raw custom-event stream from the script or API.

Speed — Core Web Vitals for the site.

It will not match, and neither number is “wrong.” GA4 is removed by content blockers on a large share of traffic, samples large reports, and withholds rows for privacy thresholds. A first-party script is blocked differently and counts sessions by different rules.

Connect Google on the Keywords tab (same consent covers Search Console and GA4). Where both series exist, compare them on one axis: a steady ratio means both are working; a moving ratio means something changed.

Settings can turn on a public analytics URL for a site so sponsors or customers can see traffic without a login.

The visitor badge is an image (/b/{domain}), not a script — paste it in a README, footer, or email. Shape options live under the API and MCP get_badge tool.

Settings → Sharing → Private links makes a link for one person or one purpose. Give it a name so you remember who has it, choose when it expires (7, 30 or 90 days, or never) and how far back they may look (7, 30 or 90 days, or any range). It shows this dashboard and nothing else about your account.

The address contains a long random token, which is the whole of the access control, so the page is never listed or indexed, sends no referrer when a link on it is followed, and is not cached. Revoke a link and it stops at once; an expired, revoked or unknown link all answer with the same not-found page, so the address reveals nothing about whether it ever existed. Each link shows how many times it has been opened and when it was last opened.

This is separate from the site-wide Share publicly switch, which puts the dashboard at one public address for everyone.