Turned the analytics tracker off by default in the template.

Services/Website/Sources/App/Extensions/App+Build.swift

@@ -49,6 +49,7 @@ func application(
         router: router(
             staticFilesPath: reader.staticFilesPath,
             assetVersion: fingerprintAssets(reader.staticFilesPath),
+            analytics: reader.analytics,
             cacheControl: reader.cacheControl,
             compressionMinResponseSize: reader.compressionMinResponseSize,
             rateLimit: reader.rateLimit,
@@ -145,9 +146,10 @@ private func logger(
 /// - Parameters:
 ///   - staticFilesPath: the folder, relative to the working directory, the static files are served from.
 ///   - assetVersion: the version token the pages append to their asset URLs, or `nil` to leave them unversioned.
+///   - analytics: the analytics tracker both pages embed, or `nil` to omit it.
 ///   - cacheControl: the cache-control directives applied to the served static files.
 ///   - compressionMinResponseSize: the minimum response body size, in bytes, before compression is applied.
-///   - rateLimit: the rate limit applied to the subscription endpoint.
+///   - rateLimit: the rate limit applied to the rate-limited routes.
 ///   - securityHeaders: the security headers applied to every response.
 ///   - logLevel: the level the request-logging middleware logs at.
 ///   - probe: the probe consulted by the `HealthController` readiness route.
@@ -155,6 +157,7 @@ private func logger(
 private func router(
     staticFilesPath: String,
     assetVersion: String?,
+    analytics: Analytics?,
     cacheControl: CacheControl,
     compressionMinResponseSize: Int,
     rateLimit: RateLimitMiddleware<AppRequestContext>.Configuration,
@@ -180,7 +183,8 @@ private func router(
         )
         LocalizationMiddleware()
         NotFoundMiddleware(
-            assetVersion: assetVersion
+            assetVersion: assetVersion,
+            analytics: analytics
         )
         FileMiddleware(
             staticFilesPath,
@@ -190,7 +194,8 @@ private func router(
 
     router.addController {
         RootController<AppRequestContext>(
-            assetVersion: assetVersion
+            assetVersion: assetVersion,
+            analytics: analytics
         )
         HealthController<AppRequestContext>(
             probe: probe

Services/Website/Sources/App/Extensions/ConfigReader+Properties.swift

@@ -14,19 +14,21 @@ package extension ConfigReader {
 
     // MARK: Computed
 
-    /// The analytics tracker the landing page embeds, built from the `analytics.*` keys, or `nil` when `analytics.websiteID` resolves
-    /// empty — a deployment disables analytics entirely by clearing the identifier.
+    /// The analytics tracker both pages embed, built from the `analytics.*` keys, or `nil` when `analytics.websiteID` resolves empty.
+    ///
+    /// The identifier is empty by default, so the template serves no tracker at all until a deployment sets `analytics.websiteID` — and
+    /// clearing it again disables analytics entirely.
     ///
     /// The script URL is not configurable: its origin is single-sourced in `String.Analytics`, so the tracker tag and the
-    /// `Content-Security-Policy` that must allow it derive from one constant and cannot drift apart.
+    /// `Content-Security-Policy` that must allow it derive from one constant and cannot drift apart. Point that constant at your own
+    /// instance, and extend `security.contentSecurityPolicy` to allow it, before enabling analytics.
     ///
-    /// The `analytics.domains` filter must name the host the pages are served from — i.e. the host of ``siteOrigin``. The two keys are
-    /// independent, so a deployment that overrides `site.origin` without matching `analytics.domains` reports from a host it no longer
-    /// serves and records nothing; change them together.
+    /// The `analytics.domains` filter must name the host the pages are served from; it is empty by default, which reports from every host.
+    /// Set it to a host the deployment does not serve and the tracker silently records nothing.
     ///
-    /// Recorder mode is on by default — the pages embed the session recorder script alongside the tracker — and the `analytics.recorder`
-    /// flag turns it off for a deployment. The recorder loads from the same origin as the tracker, so the `Content-Security-Policy` needs
-    /// no extra allowance.
+    /// Recorder mode is off by default — session recording is the most invasive thing the tracker does, so a deployment opts into it
+    /// deliberately with the `analytics.recorder` flag. When on, the pages embed the session recorder script alongside the tracker; it loads
+    /// from the same origin, so the `Content-Security-Policy` needs no extra allowance.
     var analytics: Analytics? {
         let websiteID = string(
             forKey: .Analytics.websiteID,
@@ -46,7 +48,7 @@ package extension ConfigReader {
             ),
             recorder: bool(
                 forKey: .Analytics.recorder,
-                default: true
+                default: false
             )
         )
     }