shouldiuse.io

Categories

VERDICT

Site Kit by Google Review

Worth it

Should I use Site Kit by Google?

Site Kit is the one-stop solution for WordPress - sitekit.withgoogle.com

· 1 week ago

WordPress site owners wanting free, official Google Analytics, Search Console, and AdSense dashboards in wp-admin should install it. Agencies, non-WordPress sites, and hardened security environments should not.

Confidence

Medium. Based on 20+ public sources; some 'Sitekit' results refer to an unrelated UK digital-health company.

Ratings

  • Value for money
  • Ease of use
  • Feature depth
  • Support quality
  • Security posture

Pricing

Free

Site Kit

ModelNot disclosed
Monthly feesNot disclosed
HardwareNot disclosed
Free tierYes

Best for

  • WordPress bloggers and small sites
  • Non-technical owners wanting Google dashboards
  • AdSense publishers
  • Basic GA4 + Search Console tracking

Not for

  • Agencies managing multiple client sites
  • Non-WordPress websites
  • Teams needing custom GTM-level tracking
  • Sites enforcing strict CSP or tight security

Gotchas - check before you buy

high

Metrics aren't shareable across client sites — agencies hit a wall

high

Update promptly — several XSS CVEs landed in 2025

medium

Site Kit data can differ significantly from raw GA4 reports

medium

Requires loosening CSP headers; conflicts with hardened setups

Pros and cons

Pros

  • Free, official Google plugin — no license cost
  • One-stop dashboards for Analytics, Search Console, AdSense, PageSpeed
  • Open source and actively maintained by Google
  • Helps earn money via built-in AdSense integration

Cons

  • Recurring stored-XSS vulnerabilities, multiple 2025 CVEs
  • Setup failures reported with no alternate connection path
  • Analytics numbers diverge from direct GA reports
  • Fails under strict CSP configurations
  • Weak fit for multi-client agency workflows

Sources & method

- 10 sources - Active findings: several 2025 stored-XSS CVEs in the WordPress plugin — keep it updated.

official x2review x5security x3
  • CVE-2025-58229 — XSS, Cross-site scripting vulnerability in the Site Kit WordPress plugin.
  • CVE-2025-30776 — Stored XSS, Authenticated contributor+ stored cross-site scripting in Site Kit.
  • CVE-2025-50047 — Improper neutralization, Improper input neutralization recorded in NVD.
  • 2020 Search Console access flaw, Vulnerability granted attackers Search Console access; patched in 1.8.1.

Key stats

  • Value for money: 5/5

    Rating

  • Free

    Starting price

  • 10

    Sources

  • Analyzed

  • Value for money: 5/5. Free, official Google plugin
  • Ease of use: 3/5. Simple for basics; setup dead-ends reported
  • Feature depth: 3/5. Covers GA4, Search Console, AdSense; less flexible than GTM
  • Support quality: 2/5. Forum-based; users report unresolved connection failures
  • Security posture: 2/5. Repeated 2025 XSS CVEs despite Google backing
  • $0 Price Official free Google plugin
  • Yes Free tier All features included
  • 3 2025 CVEs Mostly stored-XSS, since patched
  • WordPress only Works with Open source: google/site-kit-wp

Pricing

Site Kit

Free

  • GA4, Search Console, AdSense, PageSpeed dashboards
  • WordPress conversion tracking
  • Official Google support forums

Security

Active findings: several 2025 stored-XSS CVEs in the WordPress plugin — keep it updated.

  • CVE-2025-58229 — XSSCross-site scripting vulnerability in the Site Kit WordPress plugin.⁵
  • CVE-2025-30776 — Stored XSSAuthenticated contributor+ stored cross-site scripting in Site Kit.
  • CVE-2025-50047 — Improper neutralizationImproper input neutralization recorded in NVD.
  • 2020 Search Console access flawVulnerability granted attackers Search Console access; patched in 1.8.1.³

Companies that use it

  • University of Illinois
Full analysis

Based on 20+ public sources; some 'Sitekit' results refer to an unrelated UK digital-health company.

Free official Google plugin for WordPress analytics — great for simple sites, wrong for agencies and strict setups.

Methodology

Based on 20+ public sources; some 'Sitekit' results refer to an unrelated UK digital-health company.

Read how a report is made.

Sources

  1. Site Kit by Google — official sitesitekit.withgoogle.com
    official
  2. google/site-kit-wp on GitHubgithub.com
    official
  3. Site Kit security patch notice (2020)sitekit.withgoogle.com
    security
  4. Sitekit plugin security vulnerabilities — WPScanwpscan.com
    security
  5. CVE-2025-58229 — XSSsentinelone.com
    security
  6. WordPress.org plugin reviewswordpress.org
    review
  7. r/Wordpress discussion of Site Kitreddit.com
    review
  8. AdSense connection failure threadsupport.google.com
    review
  9. Site Kit vs GTM — MainWP communitycommunity.mainwp.com
    review
  10. Multi-client support issue (#827)github.com
    review

Add this review to your site

Site Kit by Google earned a Worth it check.

Put the badge on your site, pricing page, or docs.

Visitors see an independent review.

The link points here, and search engines follow it.

This is the badge visitors see on your site.

Worth it Site Kit by Google Independent review on Should I Use It

Paste one snippet. Keep the link as it is. A nofollow tag stops search engines from following it.

Rate this review

Anonymous. You can change your vote.

Loading votes…

Comments

One queue. No nested comments. Give a display name first. Limit: 200 words per comment and 7 comments per day. You can edit or delete yours.

Save a name to write a comment.

0 / 200 words

No comments yet.