fix: improved matomo analytics

Author: stradichenko

layouts/partials/analytics/matomo.html

@@ -16,5 +16,44 @@
       })();
     </script>
     <!-- End Matomo Code -->
+
+    <!-- CSP-Friendly Matomo Tracking Fallback -->
+    <script>
+    // Check if standard Matomo tracking failed due to CSP
+    window.addEventListener('load', function() {
+      // If _paq is defined but matomo.js failed to load, use fallback
+      if (typeof _paq !== 'undefined' && !window.Matomo) {
+        console.warn('Matomo: Standard tracking blocked, using CSP-friendly fallback');
+        
+        // Manual tracking without loading external scripts
+        fetch('{{ .matomoURL }}matomo.php?' + new URLSearchParams({
+          'idsite': '{{ .matomoSiteId }}',
+          'rec': '1',
+          'action_name': document.title,
+          'url': window.location.href,
+          'urlref': document.referrer,
+          'rand': Math.floor(Math.random() * 1000000),
+          'h': new Date().getHours(),
+          'm': new Date().getMinutes(),
+          's': new Date().getSeconds()
+        }), {
+          method: 'GET',
+          mode: 'no-cors'
+        }).catch(function() {
+          // Ultimate fallback: use image pixel for tracking
+          var img = document.createElement('img');
+          img.src = '{{ .matomoURL }}matomo.php?idsite={{ .matomoSiteId }}&rec=1&action_name=' + 
+                    encodeURIComponent(document.title) + '&url=' + 
+                    encodeURIComponent(window.location.href) + '&rand=' + 
+                    Math.floor(Math.random() * 1000000);
+          img.style.position = 'absolute';
+          img.style.left = '-1000px';
+          img.style.width = '1px';
+          img.style.height = '1px';
+          document.body.appendChild(img);
+        });
+      }
+    });
+    </script>
   {{- end -}}
 {{- end -}}

static/_headers

@@ -0,0 +1,9 @@
+/*
+  # Content Security Policy to allow Matomo analytics
+  Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' https://analytics.krotanote.xyz http://localhost:8080; connect-src 'self' https://analytics.krotanote.xyz http://localhost:8080; img-src 'self' data: https://analytics.krotanote.xyz http://localhost:8080; style-src 'self' 'unsafe-inline'; font-src 'self' data:
+  
+  # Security headers
+  X-Frame-Options: DENY
+  X-Content-Type-Options: nosniff
+  X-XSS-Protection: 1; mode=block
+  Referrer-Policy: strict-origin-when-cross-origin