When you subscribe to google analytics, it instructs you to use a javascript snippet on every page that you want to track. This code includes an API key that is displayed to anyone who views your source code.
How does this guarantee that the request comes from a real site, and not from a third-party user who wants to mess with his statistics? Does it check the HTTP Referer header? Even this is unsafe because it can be faked.
tuler source
share