feat: add Google Analytics 4 (GA4) measurement tag#81
Merged
Conversation
Closes #78 ## What Add a GA4 measurement tag wired through `_config.yml`. The measurement ID `G-6DK8Y2SBT2` is set in `_config.yml` as `google_analytics_id`. `_includes/footer.html` emits the standard gtag.js snippet only when both conditions hold: `jekyll.environment == "production"` and `site.google_analytics_id` is set. ## Why PR #79 removed the dead `UA-1265430-2` tag because Universal Analytics was sunset by Google on July 1, 2023 and was collecting no data. This PR re-introduces analytics on the modern GA4 platform under a new property. Putting the measurement ID in `_config.yml` keeps future ID changes out of template HTML. The `jekyll.environment == "production"` guard prevents local `jekyll serve` runs from polluting GA4 — GitHub Pages sets `JEKYLL_ENV=production` automatically during deploy builds, so production traffic is captured without needing manual configuration on the server side. ## Notes - GA4 sets cookies and processes visitor IPs. For EU visitors this technically requires a cookie consent banner for GDPR compliance. Adding consent is out of scope for this PR; can be filed as a follow-up if the audience or legal posture changes. - The snippet is gated on both the environment AND the config key being set, so removing `google_analytics_id` from `_config.yml` cleanly disables analytics without touching template code. - The Liquid key `google_analytics_id` uses an underscore to match Jekyll's convention for templated variable names (`site.google_analytics_id`). Signed-off-by: jmeridth <jmeridth@gmail.com>
jmeridth
added a commit
that referenced
this pull request
May 30, 2026
## What Add a hand-rolled GDPR cookie/analytics consent banner that gates GA4 loading on explicit user action. New `_includes/consent_banner.html` ships the dialog markup (hidden by default via the `hidden` attribute). New `assets/js/consent.js` owns show/hide logic, keyboard accessibility, localStorage persistence, and dynamic injection of `gtag.js` only after the user clicks Accept. `assets/css/custom.css` gets the banner styling appended (themed via Bulma CSS variables so it adapts to dark mode automatically). `_includes/footer.html` is rewritten to emit `window.GA_MEASUREMENT_ID` via Liquid's `jsonify` filter, include the banner markup, load consent.js, and add a "Cookie preferences" footer link that re-opens the banner after a choice has been made. ## Why PR #81 added the GA4 measurement tag but loaded gtag.js unconditionally on every production page view — not GDPR-compliant for EU visitors. This commit gates the GA4 script injection on an explicit "Accept all" click; "Decline non-essential" records the choice and never loads any third-party tracking. Escape dismisses without recording, so the banner re-appears on the next visit (consent must be explicit, not implicit). The implementation is hand-rolled to match the codebase's existing posture (theme.js follows the same pattern); if more third-party scripts are added later, switching to a library with category-based consent (cookieconsent v3, Klaro) would scale better. ## Notes - The banner is non-modal (no `aria-modal`): page scrolling is not blocked. `role="dialog"` is declared, Escape closes, focus moves to the Decline button on show and restores on close. Focus trap is intentionally not implemented since the banner is non-modal. - GA4 ID is interpolated via `{{ site.google_analytics_id | jsonify }}` rather than bare string concat, so future `_config.yml` values containing quotes or `</script>` cannot escape the JS string context. - A `window.ANALYTICS_DRY_RUN` flag is set in non-production builds. In that mode, consent.js logs `[consent] dry run: ...` to console instead of injecting gtag.js — local testing of the banner UI does not pollute production analytics. - A three-model security review (opus/sonnet/haiku) flagged three additional findings that were **considered and intentionally not addressed in this PR**: - **localStorage tampering**: any same-origin script can set `localStorage['analytics-consent'] = 'accepted'` and bypass the banner on the next load. Accepted risk — no first-party untrusted scripts run on the site, and HMAC-signing the consent value is overkill for a personal blog. - **Inline scripts block strict CSP**: `_includes/footer.html` and `_includes/head.html` both have inline `<script>` blocks. A future `script-src 'self'` CSP would require nonces or moving the data to meta tags. Deferred — CSP is not currently on the roadmap. - **`JEKYLL_ENV=production` not asserted at build time**: if a future deploy mechanism forgets to set the env var, `ANALYTICS_DRY_RUN` would silently ship to production and analytics would never fire. GitHub Pages currently sets this automatically; deferred. Signed-off-by: jmeridth <jmeridth@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #78
What
Add a GA4 measurement tag wired through `_config.yml`. The measurement ID `G-6DK8Y2SBT2` is stored in `_config.yml` as `google_analytics_id`. `_includes/footer.html` emits the standard gtag.js snippet only when both conditions hold: `jekyll.environment == "production"` and `site.google_analytics_id` is set.
Why
PR #79 removed the dead `UA-1265430-2` tag because Universal Analytics was sunset by Google on July 1, 2023 and was collecting no data. This PR re-introduces analytics on the modern GA4 platform under a new property. Putting the measurement ID in `_config.yml` keeps future ID changes out of template HTML. The `jekyll.environment == "production"` guard prevents local `jekyll serve` runs from polluting GA4 — GitHub Pages sets `JEKYLL_ENV=production` automatically during deploy builds, so production traffic is captured without needing manual configuration on the server side.
Notes
Testing