Public analytics dashboards: how to share stats without leaking

To make an analytics dashboard public, turn on your tool’s public link, choose which reports go with it, and check what those reports reveal before anyone opens it. Google Analytics 4 has no public view of its own, so you share a Data Studio report built on it, while Plausible, Fathom, Simple Analytics, Umami, Matomo, PostHog and invisit publish straight from their dashboards.

They differ on passwords, embedding, what a viewer can filter and the plan required. Facts below come from each vendor’s docs as of November 2026. invisit is the tool we build: we tested its public dashboard and embed code on a local build, and on November 3, 2026 checked the other tools’ public pages and frame headers with curl and headless Chrome.

Which analytics tools have a public dashboard?

Seven of the eight tools here have a public view built in; GA4 needs Data Studio. How each one publishes:

Each tool’s section below links the vendor pages behind its row.

Can you share Google Analytics 4 publicly?

Not from GA4 itself. A GA4 report’s Share link opens only for people who already have access to the property, and Google’s help sends everyone else to request access. To publish GA4 numbers, build a report in Data Studio, Google’s free report builder, called Looker Studio until April 2026 (rename notice).

1. On the Data Studio home page, create a reusable data source with the Google Analytics connector, then a report on it with only the charts you mean to publish.
2. Keep Owner’s credentials on the data source. Google’s credentials docs say they let people view the data without access of their own; with Viewer’s credentials a stranger sees no data.
3. Click Share and, under Link settings, choose “Anyone with the link can view” (sharing docs).
4. To put it on your site, choose File > Embed report, click Enable embedding and copy the iframe code. Embedded reports keep their filter and date controls and always show the Data Studio watermark.

Owner’s credentials plus a public link means anyone with the URL reads that data through your access, so the charts you add are the only boundary. Google warns that a publicly linked report also exposes data sources embedded in it, which is why step 1 makes a reusable one. You can also stop viewers downloading, printing and copying.

Then pick dimensions with care. In GA4’s schema, Page path stops before the ?, Page path + query string keeps everything after it, and Page referrer is the full referring URL.

How do Plausible public dashboards and shared links differ?

A Plausible public dashboard puts your whole dashboard at plausible.io/yourdomain for anyone; a shared link is a secret URL with an optional password, and only a shared link can be embedded. Both are under Visibility in the site settings (public stats, shared links).

A shared link’s password can only be set when you create the link, and cannot be viewed or changed later. “Limit to segment” pins a link to a saved site segment, such as “Page is not /private”: viewers can add filters inside it but never see past it.

To embed, generate the code from a shared link with the password left blank; Plausible’s embed guide says a password-protected dashboard cannot be embedded. Plausible’s own public dashboard sent frame-ancestors 'self' when we checked, which keeps it out of other sites’ frames.

Plausible’s pricing lists shared links and embedded dashboards under Growth, $14 a month for 10K pageviews; Starter, at $9, has neither.

Fathom share links: a password and expiry per person

Fathom shares through share links, one per person, each with an optional password of at least 8 characters and an optional expiry date, up to 100 per site (Fathom’s sharing docs). Viewers can change the date range, filter and download the dashboard as CSV files, but cannot change settings, and revoking one link leaves the others working.

Legacy sharing gives one URL to everyone, set to Private, Passworded or Public; Fathom’s WordPress plugin uses it. A Public URL without a password offers no downloads. Fathom documents no embed code. Its public demo is a legacy share page with demo data. Sharing comes with Fathom’s single plan, from $15 a month.

Simple Analytics: public stats and an embeddable chart

Simple Analytics publishes a site when you tick Public Website in its settings, with an option to hide pages from the public (setup guide). Its own numbers are public at dashboard.simpleanalytics.com/simpleanalytics.com. No password option is documented.

A public site is also public data. The Stats API answers for a public site without credentials, and only page data needs a key once top pages are hidden. This returned Simple Analytics’ top pages and referrers to us with no key on November 3, 2026:

curl "https://simpleanalytics.com/simpleanalytics.com.json?version=6&fields=pages,referrers&start=yesterday&end=today"

The dashboard sent X-Frame-Options: sameorigin, so it cannot be framed. To show numbers on your site, use the embed chart script, which draws visitors and page views for a public site. Public dashboards work on the Free plan, which keeps one month of data and needs a Simple Analytics badge on your site.

Umami share URLs and boards

Umami publishes through a Share URL per website, where you tick the views that go public, from Overview, Events and Sessions to Funnels, UTM and Revenue. Since v3.1.0 you can also share a board you compose from chosen components.

Leave Sessions out unless you mean it. Umami’s Sessions view lists recent visitors with their country, browser, operating system and the pages each one viewed. No password is documented. Umami’s embed guide gives an iframe and says to add your domain to ALLOWED_FRAME_URLS, a build-time setting of self-hosted Umami. Replacing Umami’s branding on share pages needs White-label, on the $200 Business plan.

Matomo anonymous access and embedded widgets

Matomo makes a site public by giving its built-in anonymous user View access under Administration > System > Users, documented for On-Premise; anyone with the link then sees every report for that site. Anonymous viewers get no IP addresses, visitor IDs or visitor profiles, but View access includes the Visits Log, with what Matomo’s privacy notes call details of all past visits and actions.

On Matomo’s public demo, opened without signing in on November 3, 2026, the Visits Log listed single visits with their time to the second, network provider, campaign tags and pages in order. Choose Turn off Visits Log and Visitor Profiles for the site before you grant anonymous access.

To embed, use Widgets, which give every report an iframe URL; Matomo refuses to frame its full app by default because of clickjacking. A widget on a private page needs a View-access token_auth in its URL (requirements), readable by anyone who views your page’s source.

PostHog shared dashboards and insights

PostHog shares any dashboard or single insight through a public link, with iframe code for each (sharing docs). An insight is shown exactly as you set it up; PostHog says viewers cannot change its visualization or date range. Turning sharing on or off is recorded in the activity log.

A password works on links and embeds alike. You can give each audience its own password and remove one without the others, and a correct one lasts 24 hours in that browser. Passwords belong to access control on the Boost package, $250 a month, which also puts your own branding on shared dashboards.

What does an invisit public dashboard show?

An invisit public dashboard shows a fixed set of traffic reports, a few more you switch on yourself, and no filters. There is one per site, under Settings > General > Public dashboard, at app.invisit.dev/share/ followed by a random id. Rotate link replaces the address and the old one stops working at once. Members and owners of the workspace can change it; viewers cannot.

A viewer switches between Traffic and Web Vitals, picks a preset range from Today to Last 12 months and a time zone, and opens the full lists. They cannot filter, pick a custom range or zoom the chart.

The password is optional. Typed once, it lets that browser tab in for 12 hours; each IP address gets 20 tries an hour, and a new password or a rotated link shuts out everyone who typed the old one. The password page says nothing about the site.

Embedding is off by default. Framed on another site while it is off, the page shows “This dashboard can’t be shown here” with a button to open it. Once it is on, any site can frame it: the check runs in the page and invisit sends no list of allowed sites, so unlike self-hosted Umami you cannot limit embedding to your own domains.

Public dashboards work on every plan. On Free, the page carries a “Powered by invisit” link and, on its own page, a Get Started button; paid plans and the 14-day trial drop both.

What to check before you make analytics public

Check five things first: page paths, query strings, referrers, revenue and campaign names, and small numbers. A public dashboard publishes whatever your tracker collected, so read your reports over the longest range a viewer can pick.

Page paths with tokens or private pages

Paths carry password reset and invite tokens (/reset/7f3a9c2e41b84d6a), unlisted pages, client names in report URLs, and admin or staging routes. Read to the end of the pages list, where one-view addresses sit, because a token makes every address unique. invisit reports the path without the query string but keeps the path as it was: our test visit to that reset address appeared in full on the public pages list.

Stop collecting such paths rather than hiding them. In invisit, excludePaths: ['/reset/*', '/invite/*'] keeps those paths out of every report. If a site’s pages tell too much, leave the Pages switch off, or on Plausible use a segment, on Simple Analytics hide pages, and on Umami leave the views out.

Query strings

Query strings hold search terms, order numbers and tokens. Plausible strips every query parameter except ref, source and the five UTM tags. invisit drops token, code, email, password, state and similar keys from recorded URLs (what is kept out). GA4 keeps them unless you list parameters under data redaction, which is on for email addresses in new properties. Matomo keeps them in its Pages report until you add excluded parameters, which apply only from then on.

Referrers

Under the Referrer Policy default, strict-origin-when-cross-origin, browsers tell another site only the origin of the page a visitor came from, so full referring URLs come from pages that loosen it. GA4’s Page referrer holds the full URL whenever one arrives. A domain alone can still say too much: a customer’s helpdesk host or an internal wiki names who links to you. invisit’s referrer list shows domains only, and it is always on its public dashboard.

Revenue and campaign names

Decide on revenue on purpose: invisit’s revenue switch shows the net total only, and Umami’s Revenue is a view you tick. A conversion count for a product with one price is revenue too. Keep anything secret out of UTM tags in every tool: they travel in every link you send, and some public views list them, such as Umami’s UTM view and Matomo’s Visits Log.

Small numbers that identify people

One visit from a small town to /pricing/enterprise the day after a sales call is a person. Matomo’s CNIL mode rounds segmented counts to the nearest 10 for this reason. invisit’s public dashboard goes down to cities, Umami’s Sessions view and Matomo’s Visits Log to single visitors. On a low-traffic site, publish totals and sources, leave pages off, and make sure your own visits and bots are not the story (internal traffic, bot traffic).

How to embed an analytics dashboard on your website safely

Use the iframe code the tool gives you, sandbox it, allow the tool’s origin in your content security policy, and never put a credential in the frame’s address. For invisit, turn on Embedding and paste this with your link id:

<iframe
  src="https://app.invisit.dev/share/<link id>"
  title="Analytics"
  width="100%"
  height="1600"
  style="border:0"
  loading="lazy"
  referrerpolicy="no-referrer"
  sandbox="allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox"
></iframe>

The first six attributes are what invisit’s settings give you. sandbox stops the frame from navigating your page; allow-scripts and allow-same-origin let the dashboard run and fetch its data, and the popup flags let its links open a new tab. The dashboard does not resize itself, so keep a height that fits. Loaded in headless Chrome from another origin against a local build, the snippet rendered with data, and a passworded dashboard took its password inside a plain frame.

If your site sends a Content-Security-Policy header, its frame-src (or default-src, if you set no frame-src) must allow https://app.invisit.dev. In the same test, a page sending frame-src 'self' blocked the frame.

The other side is the dashboard’s own header. A frame-ancestors policy decides which sites may frame a page and, under CSP Level 3, overrides X-Frame-Options. On November 3, 2026, Plausible’s public dashboard sent frame-ancestors 'self', Simple Analytics’ dashboard X-Frame-Options: sameorigin, and Fathom’s demo share page neither. Check any link before you build around it:

curl -sI https://plausible.io/plausible.io | grep -iE 'x-frame-options|frame-ancestors'

Whatever is in the src is public to anyone who views your source: Matomo’s token_auth, the hash of a Fathom legacy password that Fathom’s docs show appended as ?password=, a Plausible shared link’s auth key. With it, someone opens the full dashboard outside your page.

Public analytics dashboards you can look at

These opened without an account on November 3, 2026:

• Plausible’s own stats, real traffic.
• Simple Analytics’ own stats, real traffic, also as JSON.
• Fathom’s demo, demo data.
• Matomo’s demo, demo data, Visits Log open.

Checklist before you post the link

• Only the reports the page needs are on: pages, revenue, Umami’s Sessions and Matomo’s Visits Log stay off unless you chose them.
• The pages list, read to its last one-view rows over the full range, shows no tokens, client names or unlisted pages.
• Private paths and sensitive query parameters are excluded at collection.
• The referrer list names no internal tools or customers.
• No UTM tag holds anything secret.
• Data Studio: Owner’s credentials sit on a reusable data source, and downloads are off.
• The embed is sandboxed, its origin is in your frame-src, and its src holds no token or password.
• You opened the link in a private window and inside your own page before announcing it.
• You know how to take it back: rotate or revoke the link, or switch the dashboard off.