Plausible holds website analytics, goals, reports, and campaign data. The user interface often looks simpler than the access model. API keys can be scoped to a team, and a member role determines whether a person may create or use a particular key.
What the observation means
On 2026-11-06 at 22:43 UTC, a ZoomEye count-only query for title="Plausible" returned 9,557 assets with sub_type=all, page 1, and page size 1.
The title is not exclusive to the analytics product. It may appear in documentation, examples, and other web applications. The observation is useful for discovery, not for classifying a site as an exposed analytics installation.
Roles and keys answer different questions
Plausible's user-role documentation describes team roles including owner, admin, editor, billing, and viewer. It also documents that editor-level users can manage their own API keys and that API access depends on role and site access.
The Sites API documentation says a key is scoped to the team selected when it is created. It further notes that API key role restrictions match the Stats API and Sites API. Team scope and user role both matter.
Review the team membership before reviewing individual keys. A key created by an editor in one team does not automatically represent access in another team. Disabling a user also needs a follow-up check for keys, because a credential can remain valid longer than an interactive session.
A practical inventory
For every team, record:
- 1.
Owners and administrators.
- 2.
Members and their roles.
- 3.
Sites and guests visible to the team.
- 4.
API keys, creator, purpose, and creation date.
- 5.
External reporting jobs that use each key.
Test a key against a site outside its team scope and against a permitted site. Confirm that the API rejects the out-of-scope request. An empty result may hide an authorization bug or a misconfigured key.
Review public sharing and dashboard links separately. A public dashboard can reveal traffic patterns without requiring an API key. Its URL, expiry, and revocation path belong in the data-sharing inventory.
Correlate the footprint
The 9,557 title matches can help an organization find analytics instances that are not in its records. Attribute candidates through DNS and certificate data before testing.
Once attributed, compare the product documentation with the actual team roles, key scope, and site access. ZoomEye supplies a public index observation. Plausible supplies the authorization model that determines what a reachable page can expose.