Repository navigation
Stream web analytics data to Umami - #656
Conversation
Add the Umami tracker, a Content Security Policy and a privacy notice for the design history site, matching the approach in digital-prevention-services-portfolio#187. - Inject the Umami script into every page, after application.js - Inject a CSP meta tag into every page - Add a privacy notice and link it from the footer - Give redirect pages a head so the transform applies to them
| data-website-id="${analyticsWebsiteId}" | ||
| data-host-url="${analyticsHost}" | ||
| data-domains="design-history.prevention-services.nhs.uk"></script> | ||
| </head>` |
There was a problem hiding this comment.
This feels a bit fragile, and maybe we should add an easier way to insert meta tags and scripts into the template file upstream in https://github.com/x-govuk/nhsuk-eleventy-plugin/blob/main/src/layouts/base.njk ?
In the short term we could override the base.njk template and put the tags there?
There was a problem hiding this comment.
I agree. I've made (albeit rapidly with AI) a PR to address this: x-govuk/nhsuk-eleventy-plugin#105.
In the meantime I'd rather avoid the short term approach of overriding the template as it (a) creates extra maintenance work syncing the template with the upstream template file and (b) adds quite a lot of extra duplicate code to this repo.
Would you mind approving? And let's discuss separately how to get the other PR reviewed. I'm not a frontend developer so I may not be the best person to take that forward though!
There was a problem hiding this comment.
Adding analytics would need a cookie banner, no?
(See x-govuk/govuk-eleventy-plugin#383 (comment) for my previous thoughts on this topic!)
There was a problem hiding this comment.
@paulrobertlloyd Umami does not store any cookies, so no cookie banner is required. In addition our DPIA screening questionnaire does not rely on consent as the basis for processing, so user opt in is not required.
That's different to Google Analytics, where the normal way it is used requires cookies to join up user identity between pageviews, and so does require a cookie opt in under PECR. Although even with Google Analytics it's possible to use it in cookieless mode.
Summary
Streams web analytics for the design history site to the NHSE-hosted Umami instance, so we can understand how the site is used. This replicates the approach in digital-prevention-services-portfolio#187: the tracker, a Content Security Policy (CSP) and a privacy notice are added together because the CSP is needed to constrain what the tracker can load, and the notice is needed to explain what is collected.
The site is hosted on GitHub Pages, where custom headers cannot be set, so the CSP is applied with a
<meta>tag.Changes
Analytics tracker (eleventy.config.js)
analytics.digital-prevention-services.nhs.uk) and a new website ID for this site, restricted todesign-history.prevention-services.nhs.uk.application.jsso it cannot delay the page's own scripts (deferred scripts run in document order).Content Security Policy (eleventy.config.js)
<meta>tag at the top of every page's<head>.assets.nhs.ukfor NHS fonts.user-images.githubusercontent.comfor the embedded videos on six older posts.Privacy notice (app/privacy-notice.md)
Redirect pages (app/redirects.njk)
<head>so the CSP and tracker transform applies to redirect pages.location = ...script, which the CSP would block; the existing meta refresh performs the redirect.Validation
npm run buildsucceeds; all 595 generated HTML pages contain the CSP and the Umami script, with the script afterapplication.js.mainagainst this branch for a random 5% of pages (plus all pages with videos), at 1280px and 390px, using screenshots above the footer: pixel-identical apart from the new footer link, and no CSP violations in the browser console. This caught the GitHub video host missing from the first version of the CSP.Notes for reviewers
vaccinations/2026/09/how-rosie-got-vaccinated.