Replace Google Site Kit with a Tag Manager mu-plugin

[jpmckinney]

cc @beneverard or @georgneu for decision. Only reason not to do this is if Ben actively uses the Site Kit pages in the admin instead of visiting Google directly.

google-site-kit loads 319 files / 1,949 KB on every admin request. Its entire front-end contribution is the Tag Manager container snippet.

This can be replaced with a must-use plugin like:

Details

<?php
/**
 * Plugin Name: Open Contracting: Google Tag Manager
 * Description: Adds the Google Tag Manager container snippet, except for logged-in users.
 *
 * You can override the container ID in wp-config.php:
 *   define('GTM_CONTAINER_ID', 'GTM-ABCDEFG');
 *
 * @package OpenContracting
 */

add_action(
  'wp_head',
  function () {
    if ( is_user_logged_in() ) {
      return;
    }

    $container_id = defined( 'GTM_CONTAINER_ID' ) ? GTM_CONTAINER_ID : '{{ GTM_CONTAINER_ID }}';

                // The theme doesn't call wp_body_open(), so there's no place for a <noscript> fallback.
    // phpcs:ignore WordPress.WP.EnqueuedResources.NonEnqueuedScript -- Tag Manager must load before other scripts.
    echo "<script>(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});"
      . "var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;"
      . "j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})"
      . "(window,document,'script','dataLayer'," . wp_json_encode( $container_id ) . ');</script>' . "\n";
  }
);

Then update Pillar:

      plugins:
        - disable-comments-pingbacks
        - google-tag-manager
        - mail-from
      context:
        GTM_CONTAINER_ID: GTM-WMV9C5F

Details

Admin usage

Only theideabureau (user ID 1) authorised the Site Kit admin screens: 13 Site Kit user-meta keys, an access token, and ownership of the search-console module. georg-neumann has a single stray access token. The access logs (only covers 2 weeks) show no Site Kit screen visits (other than my robot account for testing performance).

This just makes available the Search Console and PageSpeed widgets in wp-admin, instead of accessing directly.

Widget	Source
Search Console	https://search.google.com/search-console
PageSpeed Insights	https://pagespeed.web.dev (no login)
Analytics	https://analytics.google.com

Configuration

• googlesitekit_active_modules = pagespeed-insights, tagmanager, analytics, analytics-4
• GTM (tagmanager) is configured: containerID GTM-WMV9C5F, useSnippet true
• GA4 is unconfigured: propertyID, measurementID, webDataStreamID, accountID all empty, so it emits no GA4 tracking code
• Rendered homepage contains one googletagmanager.com/gtm.js loader, wrapped in <!-- Google Tag Manager snippet added by Site Kit -->, but no <noscript> fallback (see below)
• The theme has no reference to googlesitekit, site_kit or the container ID
• Data footprint is small: 13 options, 1.9 KB (1.2 KB autoloaded)
• One cron job: googlesitekit_cron_update_remote_features, every 12 hours
• trackingDisabled: ['loggedinUsers']: This option suggests that logged-in users are excluded from tracking, but when testing, it seems that this isn't happening. That said, I think the must-use plugin should exclude logged-in users so that we're not counting our own editorial traffic (like we do with Fathom Analytics on www.open-spending.eu).

The theme never calls wp_body_open(), so Site Kit emits no <noscript>; the replacement therefore needs only wp_head, and no theme change.

Deployment

• Double-check that site is verified in Google Search Console via e.g. DNS rather than meta tag from Site Kit.
  • Answer: Yes, "Domain name provider" at https://search.google.com/search-console/ownership?resource_id=https%3A%2F%2Fwww.open-contracting.org%2F
• Deploy mu-plugin with google-site-kit active (both will render if logged out, but GTM will ignore the duplicate)
• Verify, while logged out, before and after deactivating Site Kit (first block below)
• Deactivate google-site-kit: google-site-kit
• In a private window, visit the site and confirm the session appears in GA4 Realtime
• Verify, while logged in, that the mu-plugin tracker isn't rendered
• Remove google-site-kit (second block below)

curl -s "https://www.open-contracting.org/?cachebust=$RANDOM" | grep -c "googletagmanager.com/gtm.js"   # 2, after deactivating: 1
curl -s "https://www.open-contracting.org/?cachebust=$RANDOM" | grep -c "added by Site Kit"             # 1, after deactivating: 0

wp plugin delete google-site-kit
wp option delete googlesitekit_credentials googlesitekitpersistent_remote_features
for u in 1 2; do
  wp user meta list $u --format=csv --fields=meta_key | grep googlesitekit | xargs -r -n1 wp user meta delete $u
done