Plausible's 9,526 title matches cross public dashboards and Stats API keys
Plausible Analytics is designed to make website statistics easy to share and query. That flexibility creates several access paths: the private team dashboard, public or shared dashboard links, the Stats API, and the Sites API used to manage sites. A count of Plausible-looking pages is therefore not a count of private analytics accounts.
A ZoomEye SDK count-only query on November 2, 2026 returned 0 matches for app="Plausible" and 9,526 for title="Plausible" with sub_type=all, page 1, and page size 1. A combined title="Plausible" && http.body="Plausible" query returned 9,257. The body-only count was 278,024, which is too broad to support a product claim.
The official documentation separates data access methods. The Stats API queries metrics, the Sites API creates and manages sites, and shared links provide read-only access to a dashboard without requiring a team account. A public dashboard is intentionally visible. A stats API key is not. The review should distinguish a consciously published dashboard from an API credential exposed in client-side code or a repository.
Start with a site inventory. For each site, record whether the dashboard is private, shared with a guest, or public. Check the sharing history and the owner of the shared link. A link that was intended for a short campaign can remain public long after the campaign ends. Confirm that removing public visibility actually changes anonymous access rather than only hiding navigation.
Next, trace API keys. A Stats API key should be limited to the sites and query scope it needs. A Sites API key can manage site configuration and deserves stronger custody. Search for keys in browser bundles, build artifacts, logs, and support tickets. Rotate a key after it appears in a location that cannot be reliably cleaned. Do not treat a site's public dashboard token as equivalent to an account API key.
Plausible's data includes visitor counts, referrers, goals, and custom properties. The sensitivity depends on the site and the organization. A public traffic chart may be harmless. A shared dashboard that reveals internal campaign names, conversion paths, or customer segments may not be. The owner should make that distinction before publishing.
The 9,257 title-and-body matches are a better product-oriented lead than the body-only total, but they still require manual verification. Use the count to prioritize external discovery, then review public sharing and API-key storage on the instances the organization actually owns.
Query evidence
app="Plausible" returned 0 matches, title="Plausible" returned 9,526, and title="Plausible" && http.body="Plausible" returned 9,257. All queries used sub_type=all, page 1, and a page size of 1.
Top comments (0)