內容簡介
Tagsmith 是一款免費的 WordPress 外掛，能在 wp-admin 中顯示 Google Analytics 4 (GA4) 報告，並添加 Consent Mode v2 的 Google 標籤。使用者可以在不離開 WordPress 的情況下查看訪客數據、熱門頁面、流量來源等資訊，適合想快速了解網站表現的站長及自由工作者。
【主要功能】
• GA4 儀表板：在 WordPress 中查看 GA4 報告
• Consent Mode v2：輕鬆設定 Google 標籤
• 搜尋控制台報告：顯示網站流量來源
• 每篇文章統計：查看文章的瀏覽數據
• Microsoft Clarity 整合：追蹤用戶行為
• 廣告像素管理：集中管理多種廣告像素
外掛標籤
開發者團隊
② 後台搜尋「Tagsmith – Google Analytics (GA4) Dashboard, Consent Mode v2 & Ad Pixels」→ 直接安裝（推薦）
原文外掛簡介
Tagsmith is a free WordPress plugin that shows your Google Analytics 4 (GA4) reports inside wp-admin and adds the Google tag with Consent Mode v2. See visitors, top pages, traffic sources, Search Console queries and per-post stats without leaving WordPress. Google access is read-only, and there are no upgrade prompts.
It is for site owners who want a plain answer to “how is my site doing?”, and for freelancers who set up the Google tag, Microsoft Clarity and ad pixels on client sites under one consent setting.
Features
GA4 dashboard in WordPress. An Overview that says what changed since the previous period, then Content, Acquisition, Audience, Search, Behavior and Realtime tabs, and a widget on the wp-admin home screen.
Google tag with Consent Mode v2. Pick your GA4 property and web stream to fill in the Measurement ID, or paste a G- ID. Advanced or Basic mode, defaults by region, WP Consent API support, and your own roles left out of the numbers.
Search Console reports. The Google searches that bring people to your site, site-wide and for each post.
Per-post stats. A “Views (28 days)” column in the Posts list and a block editor panel with views, channels and searches. Both need pretty permalinks.
Microsoft Clarity. When you turn it on, adds the Clarity tag under the same consent rules. With a Data Export token, shows rage clicks, dead clicks and scroll depth by page.
Ad pixels behind one consent gate. Meta Pixel, Google Ads, TikTok Pixel, LinkedIn Insight Tag, Microsoft Advertising UET, Pinterest Tag, Snap Pixel and X Pixel. Each stays off until you switch it on and enter its ID, and follows your consent settings. Form leads from WPForms, Gravity Forms, Fluent Forms and Elementor Pro, and a preview of what each pixel would send.
Health check. Finds duplicate tags, a different Measurement ID on your homepage, another plugin adding a tag, and connection problems.
Safe on staging. Tracking stays off on staging and development sites until you turn it on.
Our pledges
No nags. No upgrade prompts and no admin notices outside the plugin’s own screens, except one telling people who manage plugins that it needs a newer PHP or WordPress.
No bundled plugins. Tagsmith never installs or activates anything else.
No telemetry. The plugin sends us no usage data. The sign-in relay sees your site address, your IP address and the email of the Google account you sign in with, only while you connect or refresh tokens, and keeps none of it on disk.
Free stays free. Nothing in this plugin will be locked or removed later.
Read-only access. Tagsmith can only view your Google data.
Clean uninstall. Deleting the plugin removes its settings, saved reports, Clarity snapshots and tokens from the database and asks Google to revoke its access. If your site cannot reach Google then, or is a copy whose address changed (Tagsmith does not ask Google to revoke), remove the access at myaccount.google.com/permissions. On a site with an external object cache, cached report copies expire by themselves within a week.
Google Analytics, Search Console and the Google tag are trademarks of Google LLC; Microsoft Clarity is a Microsoft product. Tagsmith is not made or endorsed by either.
External services
Tagsmith contacts these services, only for features you turn on.
Google APIs (your site to Google). When you connect, your site calls Google directly to read your Google Analytics reports: analyticsdata.googleapis.com (reports), analyticsadmin.googleapis.com (your properties and web streams), searchconsole.googleapis.com (only if you turn on Search Console) and oauth2.googleapis.com (to revoke access, and to sign in and refresh it if you use your own Google client). Your site sends its access token and the report it wants, and the data comes straight back from Google, never through the plugin author. Google’s sign-in page (accounts.google.com) opens in your browser when you connect.
When you are connected and the health checks run (Settings, Health, and the last setup step), your site also sends one HEAD request to analyticsdata.googleapis.com and only notes whether any answer comes back, with no token, report request or analytics data. It is not sent in tracking-only mode. Google sees your server’s IP address and WordPress’s User-Agent (your WordPress version and site address).
Terms: https://policies.google.com/terms
Privacy: https://policies.google.com/privacy
The Tagsmith sign-in relay (connect.shivaatripathi.com). A relay run by the plugin author holds the sign-in secret Google does not let a plugin ship. Your browser is sent to it when you click “Connect with Google”, and your site calls it directly to refresh its access token: about once an hour while you use the reports, and when a health check runs (the plugin’s, or WordPress’s Site Health). It passes the sign-in code and tokens through without storing or logging them and never sees your analytics data. It sees your site address, your IP address (for rate limiting) and the email of the Google account (passed straight back to your site), and keeps none of it on disk. It is served through Cloudflare, which sees requests like any CDN. It is not contacted in tracking-only mode or with your own Google client. Google shows its “unverified app” screen at sign-in while its review of the app is pending.
Sign-in relay: https://shivaatripathi.com/tagsmith/
Relay privacy: https://shivaatripathi.com/tagsmith/privacy/
Relay terms: https://shivaatripathi.com/tagsmith/terms/
Google’s tag (your visitors to Google). When tracking is on, your visitors’ browsers load Google’s gtag.js from www.googletagmanager.com and send page views and events to Google Analytics, plus generate_lead (form plugin and form ID) and contact (kind of link) events when an ad pixel is on and those events are left on. In Advanced mode (the default) the tag loads for every visitor. Visitors whose default is “not agreed” (by default those in the EEA, the UK and Switzerland) send only cookieless pings until they agree, and Google says nothing is stored on their device. In Basic mode nothing is sent to Google before a visitor agrees. A banner that assumes consent until the visitor declines counts as agreed. Excluded roles and non-production sites load nothing, pixels included. Google Ads, if on, shares this gtag.js, sends page views and, as conversions you create, form leads and contact taps, waits for marketing consent like the other pixels (in Basic mode with the Google tag set up, also for its grant) and uses www.googleadservices.com, googleads.g.doubleclick.net and www.google.com.
Terms: https://policies.google.com/terms
Privacy: https://policies.google.com/privacy
Microsoft Clarity (only if you turn it on). Visitors’ browsers load Clarity’s script from www.clarity.ms and send Microsoft how they use your pages (clicks, scrolling and mouse movements), with device, browser and approximate location, under the Google tag’s consent, role and staging rules. WordPress context tags (on by default) add the page type, post type, first category, the author’s user ID and login state, never names or emails. With a saved Data Export token, your site also asks www.clarity.ms once a day for aggregated behavior metrics (at most 8 calls a day) and keeps the snapshots for 120 days.
Terms: https://clarity.microsoft.com/terms
Privacy: https://privacy.microsoft.com/privacystatement
Ad pixels (only the ones you turn on). Each platform is off until you switch it on and enter its ID in Ads & pixels. Browsers then load its script from its listed hosts and send it page views and the events named in its entry. A form lead is the event only; a contact tap is at most the kind of link, never the number or address. Its script also reads the page address with its query string, the referrer, the IP address and browser details, and sets cookies. Search terms that look like an email address or phone number are dropped, and Tagsmith adds no names, emails or form entries. No other pixel loads until the visitor agrees to marketing cookies where your consent setting asks for it. Google Ads shares the Google tag’s gtag.js, as above. Product names belong to their owners, with no affiliation.
Meta Pixel. Page views, content views (title, category), searches (term), form leads, contact taps. connect.facebook.net, www.facebook.com, www.instagram.com.
Terms: https://www.facebook.com/legal/technology_terms
Privacy: https://www.facebook.com/privacy/policy/
TikTok Pixel. Page views, content views (title, category), searches (term), form leads, contact taps. analytics.tiktok.com, analytics-ipv6.tiktokw.us, analytics.pangle-ads.com.
Terms: https://ads.tiktok.com/i18n/official/policy/business-products-terms
Privacy: https://www.tiktok.com/legal/page/row/privacy-policy/en
LinkedIn Insight Tag. Page views, and form leads and contact taps as conversions you create. snap.licdn.com, px.ads.linkedin.com.
Terms: https://www.linkedin.com/legal/user-agreement
Privacy: https://www.linkedin.com/legal/privacy-policy
Microsoft Advertising UET tag. Page views, content views (title, category), searches (term), form leads, contact taps (the kind of link). bat.bing.com, bat.bing.net.
Terms: https://about.ads.microsoft.com/en/resources/policies/microsoft-advertising-agreement
Privacy: https://privacy.microsoft.com/privacystatement
Pinterest Tag. Page views, content views (the visit only), searches (term), form leads, contact taps. s.pinimg.com, ct.pinterest.com.
Terms: https://policy.pinterest.com/en/terms-of-service
Privacy: https://policy.pinterest.com/en/privacy-policy
Snap Pixel. Page views, content views (title, category), searches (term), form leads; no contact event. sc-static.net, tr.snapchat.com, tr6.snapchat.com, tr-shadow.snapchat.com.
Terms: https://www.snap.com/terms
Privacy: https://values.snap.com/privacy/privacy-policy
X Pixel. Page views, and form leads and contact taps as conversions you create. static.ads-twitter.com, analytics.twitter.com, t.co, ads-twitter.com, ads-api.twitter.com.
Terms: https://x.com/en/tos
Privacy: https://x.com/en/privacy
