Analytics tracking: which platforms a page loads

What this inventory is for

Analytics tells you what happens on a site after someone arrives, which is the half a crawl cannot see. A measurement tag or a privacy-focused alternative does that job; a tag manager does not measure anything itself, it deploys the tags that do.

The reason to inventory them is that they accumulate. A site often ends up carrying three overlapping tools nobody removed. What each one costs depends on how it is implemented: a third-party script is a request to someone else’s host, a self-hosted or cookieless tool need not be, and whether consent is required turns on what is stored and where the visitor is.

What squirrel checks

The rule runs on every crawled page. It matches the raw HTML against three substring tests and reads every script[src] for nine more. It emits a single check named gtm-present:

• Pass when any platform is detected. Message: 2 analytics platform(s) detected, listing the deduplicated names.
• Info when none is. Message: No analytics tracking detected, with Consider adding analytics to measure performance as the value.

From the HTML it detects GTM from googletagmanager.com or gtm.js, GA4 from gtag/js or googletagmanager.com/gtag, and UA (legacy) from analytics.js or ga.js. From script sources it detects Plausible, Fathom, Matomo including its former name Piwik, Segment, Mixpanel, Amplitude, Heap, Hotjar and Microsoft Clarity, each by a substring of the URL.

A tool loaded through a tag manager rather than as its own script tag is not detected separately. Severity info, weight 3.

How to fix it

Nothing to fix when the list is what you expect. When it is longer than you expect, remove the tools nobody reads, since each one costs a request and an entry in your privacy policy.

When nothing is detected, check whether measurement is loaded through a tag manager or injected after render, which this rule cannot see.

Enable / disable

Disable this rule

[rules]
disable = ["analytics/gtm-present"]

Disable all Analytics rules

[rules]
disable = ["analytics/*"]

Enable only this rule

[rules]
enable = ["analytics/gtm-present"]

enable replaces the default ["*"], so this is the only rule selected. Leave disable out: a rule that matches any disable pattern is skipped even when enable names it. Only an enabled setting under a rule’s own [rule_options] table overrides both lists.

Related rules

• analytics/consent-mode: whether Google Consent Mode markers appear in the markup.
• security/third-party-cookies: the same vendors seen from the privacy side.
• adblock/privacy-blocked: which of them privacy filters already block.
• legal/cookie-consent: the banner that should gate them.

Analytics findings ship in every audit next to the SEO, performance and agent experience rules. See Fix SEO issues with AI for how an agent works through a report.

References

• Google Tag Manager developer guide
• Third-party cookies, MDN

Check your site

Run squirrel audit https://example.com and open the Analytics section of the report. Each page is reported with the analytics platforms detected on it. Signed-out local audits need no account and cost nothing. Signed-in audits spend credits.