[invisit](https://invisit.dev) · [Docs](https://invisit.dev/docs) · [llms.txt](https://invisit.dev/llms.txt) · [llms-full.txt](https://invisit.dev/llms-full.txt) # Public analytics dashboards: how to share stats without leaking > Publish or embed your stats from GA4, Plausible, Fathom, Simple Analytics, Umami, Matomo, PostHog or invisit, and what to check before you post the link. - Author: Miraç Berk - Published: 2026-11-03 - Page: https://invisit.dev/blog/public-analytics-dashboard - Tags: public-dashboard, embedding, privacy, google-analytics ![A soft 3D dashboard card on a stand behind a glass pane, with a link chain and a small padlock, in violet dithered light and shadows.](https://invisit.dev/_astro/cover.CbrBNBAs.png) To make an analytics dashboard public, turn on your tool's public link, choose which reports go with it, and check what those reports reveal before anyone opens it. Google Analytics 4 has no public view of its own, so you share a Data Studio report built on it, while Plausible, Fathom, Simple Analytics, Umami, Matomo, PostHog and invisit publish straight from their dashboards. They differ on passwords, embedding, what a viewer can filter and the plan required. Facts below come from each vendor's docs as of November 2026. invisit is the tool we build: we tested its public dashboard and embed code on a local build, and on November 3, 2026 checked the other tools' public pages and frame headers with curl and headless Chrome. ## Which analytics tools have a public dashboard? Seven of the eight tools here have a public view built in; GA4 needs Data Studio. How each one publishes: | Tool | How you publish | Password | Embed in your site | What a viewer sees and can change | Plan | | ------------------ | ------------------------------------------ | ----------------------------------------------- | ---------------------------------------------- | ----------------------------------------------------------------------------- | -------------------------------------------------------------- | | Google Analytics 4 | A Data Studio report with link sharing on | No; share with Google accounts instead | Data Studio embed code, watermark always shown | Only the charts you built, plus any filter and date controls you added | Free | | Plausible | Public toggle, or a shared link | On shared links, set once at creation | Shared links without a password only | The whole dashboard with filters; a shared link can be locked to a segment | Shared links and embeds from Growth, $14 a month | | Fathom | A share link per person, or one legacy URL | Optional, 8 characters or more, optional expiry | Not documented | Date range, filters and CSV download (not on a public URL) | Every plan, from $15 a month | | Simple Analytics | Tick Public Website in the site settings | Not documented | A chart script; the dashboard refuses frames | The dashboard, top pages optional; the same stats as JSON without a key | Free plan, with a badge and one month of data | | Umami | A Share URL per website, or a shared board | Not documented | iframe; self-hosted needs `ALLOWED_FRAME_URLS` | Only the views you tick | Self-hosted and Cloud; your branding on Business, $200 a month | | Matomo | View access for the anonymous user | No | Widgets in iframes | Every report of the site, the Visits Log included unless you turn it off | Documented for On-Premise | | PostHog | Share toggle per dashboard or insight | Boost and up, several per link | iframe code | The insight as you set it up; viewers cannot change its date range | Passwords and your branding on Boost, $250 a month | | invisit | Public dashboard switch, one per site | Optional | Embedding switch, iframe | Traffic and web vitals, with opt-in pages, live count and revenue; no filters | Every plan; no invisit watermark from Starter, $14 a month | Each tool's section below links the vendor pages behind its row. ## Can you share Google Analytics 4 publicly? Not from GA4 itself. A GA4 report's Share link opens only for people who already have access to the property, and Google's help sends everyone else to [request access](https://support.google.com/analytics/answer/15146921). To publish GA4 numbers, build a report in Data Studio, Google's free report builder, called Looker Studio until April 2026 ([rename notice](https://docs.cloud.google.com/data-studio/welcome)). 1. On the Data Studio home page, create a reusable data source with the Google Analytics connector, then a report on it with only the charts you mean to publish. 2. Keep Owner's credentials on the data source. [Google's credentials docs](https://docs.cloud.google.com/data-studio/data-credentials-article) say they let people view the data without access of their own; with Viewer's credentials a stranger sees no data. 3. Click Share and, under Link settings, choose "Anyone with the link can view" ([sharing docs](https://docs.cloud.google.com/data-studio/invite-others-to-your-reports)). 4. To put it on your site, choose File > Embed report, click Enable embedding and copy the iframe code. [Embedded reports](https://docs.cloud.google.com/data-studio/embed-a-report) keep their filter and date controls and always show the Data Studio watermark. Owner's credentials plus a public link means anyone with the URL reads that data through your access, so the charts you add are the only boundary. Google [warns](https://docs.cloud.google.com/data-studio/invite-others-to-your-reports) that a publicly linked report also exposes data sources embedded in it, which is why step 1 makes a reusable one. You can also [stop viewers downloading, printing and copying](https://cloud.google.com/looker/docs/studio/data-governance-in-looker-studio-an-overview). Then pick dimensions with care. In [GA4's schema](https://developers.google.com/analytics/devguides/reporting/data/v1/api-schema), Page path stops before the `?`, Page path + query string keeps everything after it, and Page referrer is the full referring URL. ## How do Plausible public dashboards and shared links differ? A Plausible public dashboard puts your whole dashboard at plausible.io/yourdomain for anyone; a shared link is a secret URL with an optional password, and only a shared link can be embedded. Both are under Visibility in the site settings ([public stats](https://plausible.io/docs/visibility), [shared links](https://plausible.io/docs/shared-links)). A shared link's password can only be set when you create the link, and cannot be viewed or changed later. "Limit to segment" pins a link to a saved site segment, such as "Page is not /private": viewers can add filters inside it but never see past it. To embed, generate the code from a shared link with the password left blank; [Plausible's embed guide](https://plausible.io/docs/embed-dashboard) says a password-protected dashboard cannot be embedded. Plausible's own [public dashboard](https://plausible.io/plausible.io) sent `frame-ancestors 'self'` when we checked, which keeps it out of other sites' frames. [Plausible's pricing](https://plausible.io/#pricing) lists shared links and embedded dashboards under Growth, $14 a month for 10K pageviews; Starter, at $9, has neither. ## Fathom share links: a password and expiry per person Fathom shares through share links, one per person, each with an optional password of at least 8 characters and an optional expiry date, up to 100 per site ([Fathom's sharing docs](https://usefathom.com/docs/features/shared-dashboards)). Viewers can change the date range, filter and download the dashboard as CSV files, but cannot change settings, and revoking one link leaves the others working. Legacy sharing gives one URL to everyone, set to Private, Passworded or Public; Fathom's WordPress plugin uses it. A Public URL without a password offers no downloads. Fathom documents no embed code. Its [public demo](https://app.usefathom.com/demo) is a legacy share page with demo data. Sharing comes with Fathom's single plan, from $15 a month. ## Simple Analytics: public stats and an embeddable chart Simple Analytics publishes a site when you tick Public Website in its settings, with an option to hide pages from the public ([setup guide](https://www.simpleanalytics.com/guides/install-simple-analytics)). Its own numbers are public at [dashboard.simpleanalytics.com/simpleanalytics.com](https://dashboard.simpleanalytics.com/simpleanalytics.com). No password option is documented. A public site is also public data. The [Stats API](https://docs.simpleanalytics.com/api/stats) answers for a public site without credentials, and only page data needs a key once top pages are hidden. This returned Simple Analytics' top pages and referrers to us with no key on November 3, 2026: ```sh title="Terminal" curl "https://simpleanalytics.com/simpleanalytics.com.json?version=6&fields=pages,referrers&start=yesterday&end=today" ``` The dashboard sent `X-Frame-Options: sameorigin`, so it cannot be framed. To show numbers on your site, use the [embed chart script](https://docs.simpleanalytics.com/embed-chart-on-your-site), which draws visitors and page views for a public site. Public dashboards work on the Free plan, which keeps one month of data and needs a [Simple Analytics badge](https://docs.simpleanalytics.com/free-plan-badge) on your site. ## Umami share URLs and boards Umami publishes through a [Share URL](https://docs.umami.is/docs/enable-share-url) per website, where you tick the views that go public, from Overview, Events and Sessions to Funnels, UTM and Revenue. Since v3.1.0 you can also share a board you compose from chosen components. Leave Sessions out unless you mean it. Umami's [Sessions view](https://docs.umami.is/docs/sessions) lists recent visitors with their country, browser, operating system and the pages each one viewed. No password is documented. Umami's [embed guide](https://docs.umami.is/docs/guides/create-a-public-dashboard) gives an iframe and says to add your domain to `ALLOWED_FRAME_URLS`, a build-time setting of self-hosted Umami. Replacing Umami's branding on share pages needs [White-label](https://docs.umami.is/docs/cloud/white-label), on the $200 Business plan. ## Matomo anonymous access and embedded widgets Matomo makes a site public by giving its built-in [anonymous user](https://matomo.org/faq/how-to/faq_20130/) View access under Administration > System > Users, documented for On-Premise; anyone with the link then sees every report for that site. Anonymous viewers get no IP addresses, visitor IDs or visitor profiles, but View access includes the Visits Log, with what [Matomo's privacy notes](https://github.com/matomo-org/matomo/blob/6.x-dev/PRIVACY.md) call details of all past visits and actions. On [Matomo's public demo](https://demo.matomo.cloud/), opened without signing in on November 3, 2026, the Visits Log listed single visits with their time to the second, network provider, campaign tags and pages in order. Choose [Turn off Visits Log and Visitor Profiles](https://matomo.org/faq/how-to/how-do-i-disable-the-visits-log-or-the-visitor-profile-feature/) for the site before you grant anonymous access. To embed, use Widgets, which give every report an iframe URL; Matomo [refuses to frame its full app](https://matomo.org/faq/troubleshooting/faq_147/) by default because of clickjacking. A widget on a private page needs a View-access `token_auth` in its URL ([requirements](https://matomo.org/faq/reports/requirements-for-embedding-matomo-reports/)), readable by anyone who views your page's source. ## PostHog shared dashboards and insights PostHog shares any dashboard or single insight through a public link, with iframe code for each ([sharing docs](https://posthog.com/docs/product-analytics/sharing)). An insight is shown exactly as you set it up; PostHog says viewers cannot change its visualization or date range. Turning sharing on or off is recorded in the activity log. A password works on links and embeds alike. You can give each audience its own password and remove one without the others, and a correct one lasts 24 hours in that browser. Passwords belong to access control on the [Boost package](https://posthog.com/platform-packages), $250 a month, which also puts your own branding on shared dashboards. ## What does an invisit public dashboard show? An invisit public dashboard shows a fixed set of traffic reports, a few more you switch on yourself, and no filters. There is one per site, under Settings > General > Public dashboard, at app.invisit.dev/share/ followed by a random id. Rotate link replaces the address and the old one stops working at once. Members and owners of the [workspace](https://invisit.dev/docs/guides/workspaces.md) can change it; viewers cannot. | Always on the dashboard | Your choice, one switch each | Not on the page | | ------------------------------------------------ | ----------------------------------------------------------------------- | -------------------------------------- | | Visits, pageviews, bounce rate, visit duration | Pages: top, entry and exit, on the first time you share | Campaign and UTM tabs | | The traffic chart | Live visits: the active-visit count only | Outbound links | | Referrers and AI referrals | Revenue: net revenue for the range once a payment provider is connected | Custom events, conversions and funnels | | Countries, regions, cities and languages | Site identity: your site's name and favicon | Single visits, heatmaps and feedback | | Devices, browsers, operating systems, web vitals | Embedding in other sites | Your team's chart notes | A viewer switches between Traffic and Web Vitals, picks a preset range from Today to Last 12 months and a time zone, and opens the full lists. They cannot filter, pick a custom range or zoom the chart. The password is optional. Typed once, it lets that browser tab in for 12 hours; each IP address gets 20 tries an hour, and a new password or a rotated link shuts out everyone who typed the old one. The password page says nothing about the site. Embedding is off by default. Framed on another site while it is off, the page shows "This dashboard can't be shown here" with a button to open it. Once it is on, any site can frame it: the check runs in the page and invisit sends no list of allowed sites, so unlike self-hosted Umami you cannot limit embedding to your own domains. Public dashboards work on every plan. On Free, the page carries a "Powered by invisit" link and, on its own page, a Get Started button; paid plans and the 14-day trial drop both. ## What to check before you make analytics public Check five things first: page paths, query strings, referrers, revenue and campaign names, and small numbers. A public dashboard publishes whatever your tracker collected, so read your reports over the longest range a viewer can pick. ### Page paths with tokens or private pages Paths carry password reset and invite tokens (`/reset/7f3a9c2e41b84d6a`), unlisted pages, client names in report URLs, and admin or staging routes. Read to the end of the pages list, where one-view addresses sit, because a token makes every address unique. invisit reports the path without the query string but keeps the path as it was: our test visit to that reset address appeared in full on the public pages list. Stop collecting such paths rather than hiding them. In invisit, `excludePaths: ['/reset/*', '/invite/*']` keeps those [paths](https://invisit.dev/docs/guides/privacy.md#paths) out of every report. If a site's pages tell too much, leave the Pages switch off, or on Plausible use a segment, on Simple Analytics hide pages, and on Umami leave the views out. ### Query strings Query strings hold search terms, order numbers and tokens. Plausible [strips every query parameter](https://plausible.io/docs/custom-query-params) except `ref`, `source` and the five UTM tags. invisit drops `token`, `code`, `email`, `password`, `state` and similar keys from recorded URLs ([what is kept out](https://invisit.dev/docs/guides/privacy.md#what-is-kept-out)). GA4 keeps them unless you list parameters under [data redaction](https://support.google.com/analytics/answer/13544947), which is on for email addresses in new properties. Matomo keeps them in its Pages report until you add [excluded parameters](https://matomo.org/faq/how-to/faq_81/), which apply only from then on. ### Referrers Under the [Referrer Policy](https://w3c.github.io/webappsec-referrer-policy/) default, `strict-origin-when-cross-origin`, browsers tell another site only the origin of the page a visitor came from, so full referring URLs come from pages that loosen it. GA4's Page referrer holds the full URL whenever one arrives. A domain alone can still say too much: a customer's helpdesk host or an internal wiki names who links to you. invisit's referrer list shows domains only, and it is always on its public dashboard. ### Revenue and campaign names Decide on revenue on purpose: invisit's revenue switch shows the net total only, and Umami's Revenue is a view you tick. A conversion count for a product with one price is revenue too. Keep anything secret out of UTM tags in every tool: they travel in every link you send, and some public views list them, such as Umami's UTM view and Matomo's Visits Log. ### Small numbers that identify people One visit from a small town to `/pricing/enterprise` the day after a sales call is a person. Matomo's [CNIL mode](https://matomo.org/faq/how-to/how-do-i-configure-matomo-without-tracking-consent-for-french-visitors-cnil-exemption/) rounds segmented counts to the nearest 10 for this reason. invisit's public dashboard goes down to cities, Umami's Sessions view and Matomo's Visits Log to single visitors. On a low-traffic site, publish totals and sources, leave pages off, and make sure your own visits and bots are not the story ([internal traffic](/blog/exclude-internal-traffic), [bot traffic](/blog/bot-traffic)). ## How to embed an analytics dashboard on your website safely Use the iframe code the tool gives you, sandbox it, allow the tool's origin in your content security policy, and never put a credential in the frame's address. For invisit, turn on Embedding and paste this with your link id: ```html title="stats.html" ``` The first six attributes are what invisit's settings give you. `sandbox` stops the frame from navigating your page; `allow-scripts` and `allow-same-origin` let the dashboard run and fetch its data, and the popup flags let its links open a new tab. The dashboard does not resize itself, so keep a height that fits. Loaded in headless Chrome from another origin against a local build, the snippet rendered with data, and a passworded dashboard took its password inside a plain frame. If your site sends a Content-Security-Policy header, its `frame-src` (or `default-src`, if you set no `frame-src`) must allow `https://app.invisit.dev`. In the same test, a page sending `frame-src 'self'` blocked the frame. The other side is the dashboard's own header. A `frame-ancestors` policy decides which sites may frame a page and, under [CSP Level 3](https://www.w3.org/TR/CSP3/), overrides `X-Frame-Options`. On November 3, 2026, Plausible's public dashboard sent `frame-ancestors 'self'`, Simple Analytics' dashboard `X-Frame-Options: sameorigin`, and Fathom's demo share page neither. Check any link before you build around it: ```sh title="Terminal" curl -sI https://plausible.io/plausible.io | grep -iE 'x-frame-options|frame-ancestors' ``` Whatever is in the `src` is public to anyone who views your source: Matomo's `token_auth`, the hash of a Fathom legacy password that Fathom's docs show appended as `?password=`, a Plausible shared link's `auth` key. With it, someone opens the full dashboard outside your page. ## Public analytics dashboards you can look at These opened without an account on November 3, 2026: - [Plausible's own stats](https://plausible.io/plausible.io), real traffic. - [Simple Analytics' own stats](https://dashboard.simpleanalytics.com/simpleanalytics.com), real traffic, also as JSON. - [Fathom's demo](https://app.usefathom.com/demo), demo data. - [Matomo's demo](https://demo.matomo.cloud/), demo data, Visits Log open. ## Checklist before you post the link - [ ] Only the reports the page needs are on: pages, revenue, Umami's Sessions and Matomo's Visits Log stay off unless you chose them. - [ ] The pages list, read to its last one-view rows over the full range, shows no tokens, client names or unlisted pages. - [ ] Private paths and sensitive query parameters are excluded at collection. - [ ] The referrer list names no internal tools or customers. - [ ] No UTM tag holds anything secret. - [ ] Data Studio: Owner's credentials sit on a reusable data source, and downloads are off. - [ ] The embed is sandboxed, its origin is in your `frame-src`, and its `src` holds no token or password. - [ ] You opened the link in a private window and inside your own page before announcing it. - [ ] You know how to take it back: rotate or revoke the link, or switch the dashboard off.