WP Global Site Tag

Description

WP Global Site Tag provides two related tools without mixing their state:

• Tracking installs a Google tag or Google Tag Manager container on the public site.
• Reporting connects an administrator to Google Analytics with read-only access and displays reports inside WordPress.

You can use either tool independently. Connecting Analytics never enables tracking or silently replaces an existing tag.

Free features

• Guided Google Analytics connection and property and website data-stream selection.
• Analytics overview, daily traffic trend, and top-five content reports.
• An inclusive last-7-days range, with one dated trend point per day. Free rejects longer ranges on the server.
• Persistent managed Google connection, plus an advanced self-managed OAuth option.
• Plugin-managed, externally managed, or disabled tag installation modes.
• GT-, G-, AW-, and DC- identifiers through gtag.js.
• Official Google Tag Manager head and body snippets for GTM- identifiers.
• Existing legacy UA- tracking IDs remain visible and continue rendering, including when Google routes the installed tag to a connected GA4 destination.
• Multiple Google tag destinations and optional Consent Mode v2 denied defaults.
• Backward compatibility for existing trusted custom gtag commands.

Settings are available under Settings > WP Global Site Tag. The Analytics dashboard tab contains the recommended connection route. The Tracking settings tab preserves the manual route.

Recommended Google connection

Click Connect with Google, choose an account, approve read-only Analytics access, and return to WordPress to choose a property and website data stream. The recommended connection uses the Digital Apps connection service so administrators do not need to create a Google Cloud project or handle OAuth credentials.

Digital Apps exchanges the authorization code and retains the Google refresh token while the connection is active. WordPress stores an encrypted opaque connection token and short-lived Google access tokens. The plugin then calls the Google Analytics Admin and Data APIs directly, so Analytics property, stream, and report requests and responses do not pass through Digital Apps.

Because Digital Apps retains the refresh token, it is technically able to request Analytics access while the connection remains active. The advanced self-managed route below is available for administrators who do not accept that trust boundary.

Administrators who require no Digital Apps token custody can open Advanced: use your own Google OAuth application. That route provides the Google Cloud instructions and exact callback URL. Credentials may be saved encrypted or defined in wp-config.php as WP_GLOBAL_SITE_TAG_GOOGLE_CLIENT_ID and WP_GLOBAL_SITE_TAG_GOOGLE_CLIENT_SECRET. Constants take precedence.

After Google returns to WordPress, choose an Analytics property and its website data stream. The plugin recommends hostname and exact existing-Measurement-ID matches, but an administrator confirms every selection.

Identifier guide

• Property ID is the numeric GA4 reporting property used by the Data API.
• Data Stream ID is the numeric identifier of one stream inside a property.
• Measurement ID begins with G- and identifies the website tag for that stream.
• Google Tag Manager container ID begins with GTM- and is a separate tracking integration.
• A legacy Universal Analytics tracking ID begins with UA-. Version 2 preserves it as the frontend tag but does not use it as the GA4 reporting Measurement ID.

These values are stored separately. Choosing a reporting stream does not overwrite the generic tracking ID unless the administrator explicitly chooses replacement after a mismatch warning.

Installation modes

• Install with WP Global Site Tag lets this plugin output the saved tag.
• Tracking is installed elsewhere keeps reporting available but prevents duplicate tag output.
• Do not install a tag disables tag output while preserving the reporting connection.

Existing users

Version 2 preserves the existing option name, manual tag ID, additional destinations, Consent Mode setting, trusted custom commands, hooks, and frontend behavior. This includes legacy UA- identifiers that Google may route to a connected GA4 destination. Existing sites default to plugin-managed installation so an update does not stop measurement. Analytics reporting remains disconnected until an administrator completes the new read-only connection.

Consent and privacy

Consent Mode is not a consent banner. You still need a consent management platform or your own consent interface to collect a visitor’s choice and update Google’s consent state.

When Consent Mode defaults are enabled, this plugin still loads gtag.js. Google may receive consent-state and cookieless requests before consent is granted. If your requirements prohibit loading Google before consent, use the wp_global_site_tag_should_render filter to prevent output until your consent system allows it.

When using a GTM container, configure consent initialization and defaults inside Google Tag Manager. The plugin’s Consent Mode setting applies only to gtag.js output.

With the recommended connection, Digital Apps stores the Google refresh token and WordPress stores an opaque connection token and short-lived access tokens. With the advanced self-managed connection, OAuth credentials and Google refresh and access tokens stay on WordPress. Locally stored connection data is encrypted with keys derived from WordPress salts and saved in non-autoloaded options. Administrators can disconnect at any time, which requests revocation and removes local connection data and report caches. The saved frontend tag remains unchanged.

External services

When tracking is enabled, visitors’ browsers request Google tag resources from https://www.googletagmanager.com. These requests disclose standard web request information such as the visitor’s IP address, browser details, and referring page to Google. Configured Google products may send additional measurement or advertising events.

The recommended connection sends the site URL, hostname, plugin and protocol versions, callback URL, a short-lived state and code challenge, and later an opaque connection token to https://connect.digitalapps.com/v1/. Digital Apps uses this information only to complete Google authorization, retain the refresh token, renew short-lived access, and revoke the connection. It does not receive Analytics property, stream, or report requests or responses.

When an administrator views reports, the plugin communicates directly with these Google services:

• Google authorization at accounts.google.com.
• Google Analytics Admin API at analyticsadmin.googleapis.com.
• Google Analytics Data API at analyticsdata.googleapis.com.

The advanced self-managed route additionally communicates directly with Google token and revocation services at oauth2.googleapis.com.

The plugin requests the analytics.readonly scope. Google receives the administrator’s authorization request and normal request metadata. Reporting requests include the selected property, date range, and allowlisted report fields. The plugin does not add telemetry. Review the Digital Apps Privacy Policy and Terms.

Review Google’s Privacy Policy, Terms of Service, OAuth terms, and Google Analytics terms.