Turned the analytics tracker off by default in the template.

Services/Website/Sources/App/Extensions/ConfigReader+Properties.swift

@@ -14,19 +14,21 @@ package extension ConfigReader {
 
     // MARK: Computed
 
-    /// The analytics tracker the landing page embeds, built from the `analytics.*` keys, or `nil` when `analytics.websiteID` resolves
-    /// empty — a deployment disables analytics entirely by clearing the identifier.
+    /// The analytics tracker both pages embed, built from the `analytics.*` keys, or `nil` when `analytics.websiteID` resolves empty.
+    ///
+    /// The identifier is empty by default, so the template serves no tracker at all until a deployment sets `analytics.websiteID` — and
+    /// clearing it again disables analytics entirely.
     ///
     /// The script URL is not configurable: its origin is single-sourced in `String.Analytics`, so the tracker tag and the
-    /// `Content-Security-Policy` that must allow it derive from one constant and cannot drift apart.
+    /// `Content-Security-Policy` that must allow it derive from one constant and cannot drift apart. Point that constant at your own
+    /// instance, and extend `security.contentSecurityPolicy` to allow it, before enabling analytics.
     ///
-    /// The `analytics.domains` filter must name the host the pages are served from — i.e. the host of ``siteOrigin``. The two keys are
-    /// independent, so a deployment that overrides `site.origin` without matching `analytics.domains` reports from a host it no longer
-    /// serves and records nothing; change them together.
+    /// The `analytics.domains` filter must name the host the pages are served from; it is empty by default, which reports from every host.
+    /// Set it to a host the deployment does not serve and the tracker silently records nothing.
     ///
-    /// Recorder mode is on by default — the pages embed the session recorder script alongside the tracker — and the `analytics.recorder`
-    /// flag turns it off for a deployment. The recorder loads from the same origin as the tracker, so the `Content-Security-Policy` needs
-    /// no extra allowance.
+    /// Recorder mode is off by default — session recording is the most invasive thing the tracker does, so a deployment opts into it
+    /// deliberately with the `analytics.recorder` flag. When on, the pages embed the session recorder script alongside the tracker; it loads
+    /// from the same origin, so the `Content-Security-Policy` needs no extra allowance.
     var analytics: Analytics? {
         let websiteID = string(
             forKey: .Analytics.websiteID,
@@ -46,7 +48,7 @@ package extension ConfigReader {
             ),
             recorder: bool(
                 forKey: .Analytics.recorder,
-                default: true
+                default: false
             )
         )
     }