Skip to content

Load the tracker script async instead of deferred - #331

Merged
Dan0sz merged 1 commit into
developfrom
async_tracker_script
Oct 1, 2026
Merged

Dan0sz merged 1 commit into
developfrom
async_tracker_script

Conversation

@Dan0sz

@Dan0sz Dan0sz commented Sep 30, 2026 •

Copy link
Copy Markdown
Collaborator

Follow-up to #330: make sure a tracker script that can't be reached can never hold up a page again, whatever the cause.

Why

The tracker script is loaded with defer. That doesn't block rendering, but deferred scripts run before DOMContentLoaded. While the browser waits for a script that doesn't respond (like the proxied script on an offline server in #330), DOMContentLoaded doesn't fire, and everything waiting for it stalls with it: menus, sliders, preloader overlays, etc.

Change

  • Load the tracker async instead, like Plausible's own snippet. data-cfasync='false' and the other optimization-plugin exclusions stay as they are.
  • The tracker handles either order relative to the inline plausible.init(...) that follows it:
    • init first: the options wait in plausible.o, and the tracker picks them up when it loads (plausible.o&&S(plausible.o));
    • tracker first: it installs its own plausible.init, which the inline script then calls.
  • Events sent before the tracker has loaded (e.g. the plugin's integrations, which wait for DOMContentLoaded) are queued, as before.
  • Test for the script tag's attributes; changelog entry under 2.6.3.

Testing

Live, as a logged-out visitor:

tracker DOMContentLoaded events sent
normal page async, loaded ~0.4 s pageview (202)
404 page async, loaded ~0.3 s pageview + 404 event (202, 202)
tracker unreachable (unroutable IP, as in #330) async, not loaded ~0.3 s (with defer on develop: not fired after 30 s) –

Note: #328 and #330 also add a 2.6.3 changelog section, so whichever is merged later needs a trivial readme merge.

Summary by CodeRabbit

  • Bug Fixes
    • The tracking script now loads asynchronously, so an unreachable tracking service won’t hold up the rest of the page.

Deferred scripts run before DOMContentLoaded, so while the browser waits
for a tracker script that can't be reached (e.g. a proxied script on a
server that has gone offline), DOMContentLoaded doesn't fire and
everything waiting for it stalls: menus, sliders, preloader overlays.

Load it async, like Plausible's own snippet. The tracker handles loading
before or after the inline plausible.init(): options set before it loads
are picked up from plausible.o, and afterwards plausible.init is the
tracker's own. Events sent before it has loaded are queued, as before.
@coderabbitai

coderabbitai Bot commented Sep 30, 2026 •

Copy link
Copy Markdown
Contributor

Review in Change Stack →

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 403cb31a-73a9-4635-84b7-3c03440d293f

📥 Commits

Reviewing files that changed from the base of the PR and between 5951eae and 1d80444.

📒 Files selected for processing (3)
  • readme.txt
  • src/Compatibility.php
  • tests/integration/CompatibilityTest.php

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.


📝 Walkthrough

Walkthrough

The compatibility filter now adds async instead of defer to the tracker script tag and retains the Cloudflare exclusion attribute. An integration test checks these attributes, and the changelog records the change in version 2.6.3.

Changes

Tracker script loading

Layer / File(s) Summary
Async tracker script compatibility behavior
src/Compatibility.php, tests/integration/CompatibilityTest.php, readme.txt
The compatibility filter adds async and retains data-cfasync='false'. The test checks that the tag does not contain defer. The changelog describes the change.

Priority: ➖ Normal

Change: Bug fix · Severity of issue fixed: Medium

Merge Risk: ⚪ Minimal · up to 1d804

The tracker now loads asynchronously, and the supported initialization pattern preserves queued calls if it loads first. No merge-blocking issue is established; the change is ready for normal checks.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 1d804

The change reduces the impact of an unreachable tracker without visibly expanding permissions or access. The remaining uncertainty is whether the external tracker applies privacy-sensitive configuration correctly in both possible initialization orders.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

  • inferred — The changed execution ordering affects pages that enqueue this tracker. It does not itself add a caller-selectable script destination, change the tracker handle, or expand server-side privileges.

Security Findings and Attack Paths

  • inferred — No introduced attacker-controlled path to broader authority or a demonstrated privacy-control bypass is established. A tracker-first configuration race remains an unresolved contract question, not a verified vulnerability.

Trust Boundaries and Controls

  • observed — Server-side tracked-role gating occurs before enqueueing. The changed tag retains its Cloudflare Rocket Loader exclusion and existing script-parameter filter; these controls are not removed by the change.

Resilience and Maintainability Implications

  • inferred — The local stub can retain early calls during a delayed fetch. Delivery after recovery, option application during queue draining, and repeated-init semantics still depend on the external implementation and are not demonstrated by the attribute test.

Hardening Proposals

  • proposed — Establish the supported tracker contract for both initialization orders, specifically that exclusions and endpoint options apply before automatic or queued transmissions, and that repeated initialization does not duplicate transmission.
🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly and concisely describes the main change: loading the tracker script with async instead of defer.
Docstring Coverage ✅ Passed Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 2 files. (1 skipped: 1 …
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
📝 Generate docstrings
  • Commit to this branch
  • Create a new PR
🧪 Generate unit tests (beta)
  • Commit to this branch
  • Create a new PR
  • Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.


Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@codecov

codecov Bot commented Sep 30, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

@Dan0sz

Dan0sz commented Sep 30, 2026

Copy link
Copy Markdown
Collaborator Author

@coderabbitai review

@coderabbitai

coderabbitai Bot commented Sep 30, 2026 •

Copy link
Copy Markdown
Contributor
✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

@Dan0sz
Dan0sz merged commit 1d10b1a into develop Oct 1, 2026
7 checks passed
@Dan0sz
Dan0sz deleted the async_tracker_script branch October 1, 2026 10:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant