Fix the three PostHog installation health warnings - #23
Merged
Conversation
Every sitemap URL now carries a `lastmod`. The date comes from the last commit that touched `src/data.js` rather than from the build clock, so a rebuild that changes nothing does not tell crawlers the whole site was updated. Outside a git checkout the build falls back to today's date.
PostHog's installation health check flagged three gaps in how the site reports. All three are fixed here. Bounce rate and session duration were unreliable because the site never sent `$pageleave`, so PostHog could not tell a one-page visit from a long read. Turn `capture_pageleave` on and let the event through the sanitizer. Core Web Vitals were not measured at all. Turn on web vitals capture for LCP, CLS, FCP and INP, and allow their numeric readings through. The matching `$web_vitals_<metric>_event` objects carry attribution detail, including the DOM element behind each measurement, and stay out: the attribution bundle is switched off and the sanitizer's existing rule that only scalars pass keeps them from being sent even if that changes. Requests went straight to `eu.i.posthog.com`, which tracking-protection lists match on by hostname, so an unknown share of visits never arrived. Route both the library and ingestion through `/e30` on the site's own origin, proxied to PostHog by netlify.toml. The path is derived from `window.location.origin` so each production hostname stays same-origin rather than pointing at one canonical domain. Because nothing now loads from the PostHog domains, they come out of the CSP and `'self'` covers them. A stale redirect would silently 404 every event, so the build checks netlify.toml against the configured proxy path and region and fails if they have drifted.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
PostHog's installation health check for the JavaScript in 30 Words project reported 3 of 6 checks passing. This fixes all three failures.
Reproduced first on the live site: only one
POST https://eu.i.posthog.com/e/per visit, withcapture_pageleave: falseandcapture_performance: falsein the liveposthog.config.$pageleavemissingBounce rate and session duration could not distinguish a bounce from a long read.
capture_pageleaveis now on and the event passes the sanitizer. Verified against the real posthog-js on the live page: the event fires on navigation and survives sanitizing with a stripped$current_url.Core Web Vitals not measured
LCP, CLS, FCP and INP are now captured and their numeric readings pass the sanitizer. The matching
$web_vitals_<metric>_eventobjects carry attribution detail, including the DOM element behind each measurement, and are kept out two ways: the attribution bundle is switched off, and the sanitizer's existing scalars-only rule drops them regardless.No reverse proxy
Requests went straight to
eu.i.posthog.com, which tracking-protection lists match on by hostname. Both the library and ingestion now go through/e30on the site's own origin, proxied bynetlify.toml. The host comes fromwindow.location.origin, so each production hostname stays same-origin instead of pointing at one canonical domain. Nothing loads from the PostHog domains any more, so they come out of the CSP and'self'covers them.A stale redirect would silently 404 every event, so the build now checks
netlify.tomlagainst the configured proxy path and region and fails if they drift. Confirmed the guard fires on a deliberately broken rule.The sitemap
lastmodcommit is unrelated pre-existing work that was sitting uncommitted in the tree; it is split into its own commit.npm test: 73 passing.To verify on the deploy preview
GET /e30/static/array.jsreturns the PostHog libraryGET /e30/array/<token>/config.jsreturns the remote config