YouAnalytics / Connect Google Analytics to WordPress
Connect Google Analytics to WordPress
Connecting Analytics for a report is not the same as adding the GA4 tag. The tag sends hits. YouAnalytics only reads properties you already own, with read-only Google sign-in.
Key takeaways
- Connecting for a report is not the same as installing the GA4 tag.
- YouAnalytics uses read-only
analytics.readonly. Viewer access on the properties is enough. - Google passwords and OAuth tokens are not stored in WordPress. Composio handles sign-in.
- The plugin does not auto-read every property on connect. You tick what belongs on the brief.
Before you connect
Each website still needs collection (Site Kit, Tag Manager, or another tag). If that is not done, see how to add Google Analytics to WordPress. YouAnalytics will not invent traffic that Analytics does not have.
You need a Google account that can view the GA4 properties you care about. Viewer access is enough. YouAnalytics never asks to edit Analytics, tags, or users.
How YouAnalytics connects
- Install the plugin on the WordPress site that should host the brief (often the agency site), so
cumulative-analytics.phpsits at the plugin root. - Create a Composio project and copy the API key.
- Paste the key under YouAnalytics → Connection, or copy
ca-local.example.phptoca-local.phpon the server (never commit keys). - Click Continue with Google and approve read-only Analytics.
- Wait until the connection is actually active. A pending OAuth return is not yet “connected.”
- Choose accounts and properties. The plugin does not auto-read every property on connect.
- Read figures (a few properties at a time), then open Brief.
Figures refresh from Google Analytics every six hours, and you can refresh by hand. A refresh still cannot pull today: the Data API windows end at yesterday. After you connect, wait for an active connection before you treat the site as linked.
Requires WordPress 6.0+, PHP 7.4+, and that Composio key. MIT source: github.com/hlotiim/YouAnalytics.
What permissions does Google Analytics OAuth request?
Only analytics.readonly. YouAnalytics does not write to Google Analytics, does not change tags, and does not manage users in your Google account. That is the whole point of a report plugin: read figures, leave collection alone.
Can a WordPress plugin store my Google password?
YouAnalytics does not. Sign-in is Google OAuth through Composio. Tokens stay with Composio. WordPress keeps an encrypted API key (if you paste one) and a connection id — not the password, not the OAuth tokens, not hit-level Analytics rows. Details: privacy.
After you are connected
Does YouAnalytics auto-read every GA4 property when I connect? No. You tick the properties you want. That keeps large accounts from hanging the request and lets you leave junk properties out of a client brief.
- Skip GA4 roll-up and subproperties so they are not counted twice with their children.
- Failed reads show as unavailable, not as verified zeros.
- Totals are sums — see combine multiple GA4 properties.
- Optional PIN and print: agency Google Analytics report.
Administrators can put the same brief on a private page with [youanalytics].
If Google sign-in does not finish
- Finish the Google screen in the same browser session; do not assume WordPress is connected until the plugin shows an active connection.
- Use the Google account that can see the properties. A personal Gmail that was never added to the Analytics account will list nothing useful.
- Confirm the Composio API key is the one from your project. Do not reuse a key from another site’s
ca-local.php. - If Analytics itself has no data yet, go back to collection: add Google Analytics to WordPress.
Why sign-in goes through Composio
YouAnalytics does not run its own Google Cloud OAuth client in WordPress. Composio holds the Google connection, refreshes tokens, and calls the Analytics APIs. WordPress stores an encrypted Composio API key (if you paste one) and a connection id. That split is why a stolen wp-admin session still does not contain your Google password.
Keep the API key in ca-local.php on the server when you can. Do not commit it. Do not put it in a public gist. Details: privacy.
What Google Analytics access do I need?
A Google account that is a Viewer (or higher) on each GA4 property you will tick. Editor or Administrator is not required and is not requested. If the account cannot see a property in analytics.google.com, YouAnalytics cannot read it either.
Agency pattern: the client keeps Analytics ownership; they add your Google user as Viewer; you connect that user on the agency WordPress site. You still should not invite investors into Analytics if a PDF will do: agency Google Analytics report.
Shortcode vs the admin brief
The same brief can appear on a private WordPress page with [youanalytics] (or [cumulative_analytics]). Only administrators see it. It is not a public “live stats” widget. Use a private page or a logged-in client portal, not a marketing URL.
Frequently asked questions
Can a WordPress plugin store my Google password?
YouAnalytics does not. You sign in with Google through Composio. Tokens stay with Composio.
What permissions does Google Analytics OAuth request?
Read-only: analytics.readonly. YouAnalytics does not write to Google Analytics.
Does YouAnalytics auto-read every GA4 property when I connect?
No. You choose accounts and properties first. Figures are read after you select them.
What Google Analytics access do I need?
Viewer (or higher) on each property. YouAnalytics only requests analytics.readonly.
Where should I keep the Composio API key?
Paste it in YouAnalytics → Connection or put it in ca-local.php on the server. Never commit the key.