Limit website analytics to cookieless page statistics

package.json

@@ -45,7 +45,7 @@
   "imports": {
     "#styles": "./scripts/styles.mjs",
     "#liquid-fixture": "./tests/helpers/liquid.mjs",
-    "#analytics-exceptions": "./src/lib/analytics-exceptions.js"
+    "#analytics-privacy": "./src/lib/analytics-privacy.js"
   },
   "scripts": {
     "astro": "astro",

src/components/posthog.astro

@@ -5,7 +5,7 @@
     ""
   )
 
-  if (hostname === siteHostname) {
+  if (!navigator.webdriver && hostname === siteHostname) {
     const startAnalytics = () => {
       void import("../lib/analytics").then(({ startAnalytics }) =>
         startAnalytics()

src/lib/analytics-privacy.js

@@ -1,46 +1,25 @@
-/** Remove URL details from exceptions; redact ambiguous text as a whole. */
-export function sanitizeExceptionUrls(event) {
-  if (event?.event !== "$exception") return event
+/** Keep basic page statistics and remove URL query strings and fragments. */
+export function sanitizeEventUrls(event) {
+  if (!event || !["$pageview", "$pageleave"].includes(event.event)) return null
   const seen = new WeakSet()
-  const clean = (value) => {
-    if (typeof value === "string") {
-      if (!/[?#@]/.test(value)) return value
-      const normalized = value.replace(/\\/g, "/")
-      // Only preserve an unambiguous standalone URL or relative filename.
-      if (
-        /\s|["'<>]/.test(normalized) ||
-        !/^(?:https?:|\/|\.\.?\/|[\w.-]+[?#])/i.test(normalized)
-      ) {
-        return "[redacted-url-details]"
-      }
-      try {
-        const absolute = /^https?:/i.test(normalized)
-        const parsed = new URL(
-          normalized,
-          absolute ? undefined : "https://redacted.invalid"
-        )
-        if (/https?:|\/\/|@/i.test(parsed.pathname))
-          return "[redacted-url-details]"
-        const prefix = absolute
-          ? parsed.protocol + "//" + parsed.host
-          : normalized.startsWith("//")
-            ? "//" + parsed.host
-            : ""
-        const pathname =
-          !absolute && !normalized.startsWith("/")
-            ? parsed.pathname.slice(1)
-            : parsed.pathname
-        return prefix + pathname
-      } catch {
-        return "[redacted-url-details]"
-      }
+  function scrub(value) {
+    if (!value || typeof value !== "object" || seen.has(value)) return
+    seen.add(value)
+    for (const [key, nested] of Object.entries(value)) {
+      if (typeof nested === "string" && /^https?:\/\//i.test(nested)) {
+        try {
+          const url = new URL(nested)
+          if (/referrer/i.test(key)) url.pathname = "/"
+          url.search = ""
+          url.hash = ""
+          value[key] = url.href
+        } catch {
+          value[key] = ""
+        }
+      } else scrub(nested)
     }
-    if (value && typeof value === "object" && !seen.has(value)) {
-      seen.add(value)
-      for (const key of Object.keys(value)) value[key] = clean(value[key])
-    }
-    return value
   }
-  clean(event.properties)
+  for (const values of [event.properties, event.$set, event.$set_once])
+    scrub(values)
   return event
 }

src/lib/analytics.ts

@@ -1,61 +1,35 @@
-import "posthog-js/dist/web-vitals"
-
-import { dropBrowserNoise } from "./analytics-exceptions.js"
-import { sanitizeExceptionUrls } from "./analytics-privacy.js"
-
-import "posthog-js/dist/exception-autocapture"
-
-import {
-  AnalyticsExtensions,
-  ErrorTrackingExtensions,
-} from "posthog-js/dist/extension-bundles"
 import posthog from "posthog-js/dist/module.slim.no-external"
 
-import { trackInteractions } from "./analytics-interactions.js"
+import { sanitizeEventUrls } from "./analytics-privacy.js"
 
 export function startAnalytics() {
+  const fetchOptions: RequestInit = { credentials: "omit", cache: "no-store" }
   posthog.init("phc_txCmZNAK3YueTeNyvtXmnh9JvK2LdbF3hK3kvxRcEJou", {
-    // Netlify forwards /ingest to PostHog (netlify.toml).
-    api_host: "/ingest",
-    ui_host: "https://eu.posthog.com",
+    api_host: "https://eu.i.posthog.com",
+    api_transport: "fetch",
+    disable_beacon: true,
+    fetch_options: fetchOptions,
     defaults: "2025-11-30",
     cookieless_mode: "always",
+    persistence: "memory",
+    persistence_name: "website",
     person_profiles: "never",
-    autocapture: false,
-    __extensionClasses: {
-      ...ErrorTrackingExtensions,
-      webVitalsAutocapture: AnalyticsExtensions.webVitalsAutocapture,
-    },
-    capture_exceptions: {
-      capture_unhandled_errors: true,
-      capture_unhandled_rejections: true,
-      capture_console_errors: true,
-    },
-    capture_performance: { web_vitals: true, web_vitals_attribution: false },
-    mask_personal_data_properties: true,
-    custom_personal_data_properties: [
-      "email",
-      "phone",
-      "name",
-      "password",
-      "token",
-      "access_token",
-      "refresh_token",
-      "code",
-    ],
-    disable_capture_url_hashes: true,
-    property_denylist: [
-      "$referrer",
-      "$initial_referrer",
-      "$session_entry_referrer",
-    ],
-    loaded: trackInteractions,
-    before_send: [dropBrowserNoise, sanitizeExceptionUrls],
+    save_campaign_params: false,
+    property_denylist: ["ph_keyword", "$initial_ph_keyword"],
     capture_pageview: true,
     capture_pageleave: true,
+    disable_scroll_properties: true,
+    autocapture: false,
+    capture_dead_clicks: false,
+    capture_heatmaps: false,
+    capture_exceptions: false,
+    capture_performance: false,
     disable_session_recording: true,
     disable_surveys: true,
+    disable_product_tours: true,
+    disable_conversations: true,
     advanced_disable_flags: true,
     disable_external_dependency_loading: true,
+    before_send: sanitizeEventUrls,
   })
 }

tests/analytics-privacy.test.mjs

@@ -0,0 +1,41 @@
+import assert from "node:assert/strict"
+import { test } from "node:test"
+import { sanitizeEventUrls } from "#analytics-privacy"
+
+test("keeps page statistics without private URL details, including nested metadata", () => {
+  const event = {
+    event: "$pageview",
+    properties: {
+      $current_url: "https://example.com/path?token=secret#private",
+      nested: [
+        {
+          $referrer:
+            "https://source.example/account/orders/private?email=private",
+        },
+      ],
+    },
+    $set_once: { $initial_current_url: "https://example.com/?code=private" },
+  }
+  assert.equal(sanitizeEventUrls(event), event)
+  assert.equal(event.properties.$current_url, "https://example.com/path")
+  assert.equal(event.properties.nested[0].$referrer, "https://source.example/")
+  assert.equal(event.$set_once.$initial_current_url, "https://example.com/")
+  const leave = { event: "$pageleave", properties: {} }
+  assert.equal(sanitizeEventUrls(leave), leave)
+})
+
+test("drops interaction, error and profile events even when enabled remotely", () => {
+  for (const event of [
+    "website_interaction",
+    "$autocapture",
+    "$exception",
+    "$identify",
+    "$snapshot",
+    "$web_vitals",
+  ])
+    assert.equal(
+      sanitizeEventUrls({ event, properties: { text: "private" } }),
+      null
+    )
+  assert.equal(sanitizeEventUrls(null), null)
+})