PostHog
Product analytics, session replay, and feature flags in one tool with a free tier that lasts.
What it does
| Scope and feature set | PostHog provides a comprehensive product analytics platform including event tracking, session replay, feature flags, A/B testing, and user cohorts for deeper product insights. |
|---|---|
| Script weight and performance | PostHog's broader feature set typically requires a larger JavaScript library to support session recording, feature flags, and advanced event capture. |
| Privacy approach | PostHog offers privacy controls and can be self-hosted, but its session replay and detailed user tracking features may require more careful privacy configuration and consent management. |
| Dashboard design | PostHog provides multiple specialized views and dashboards for different analytics needs, including insights, recordings, experiments, and feature flag management. |
| Target use case | PostHog targets product teams, SaaS companies, and developers who need to understand user behavior, run experiments, and manage feature rollouts. |
| Pricing model | PostHog offers a free tier that lasts, according to its tagline, allowing teams to start without immediate payment. |
Pick PostHog if
- You need product analytics beyond basic web traffic, including user behavior, funnels, and retention analysis
- You want session replay to watch how users interact with your product
- You need feature flags and A/B testing capabilities integrated with your analytics
- You want to start with a free tier before committing to paid analytics
- You're building a SaaS product and need to track in-app events and user journeys
Compare
Security headers: F, 25 out of 100
Number 70 of 95 in the ranking. Missing 7 of the 9 headers we check.
Below the B minimum (70/100) in our RFP clause. A buyer using it would ask for a dated fix for each missing header.
With these headers missing, posthog.com is more exposed to malicious JavaScript, redirected forms, hijacked payments and clickjacking.
Missing 7
-
Content-Security-Policy 0 of 25
Tells the browser which scripts may run on the page, where its forms may submit, and where it may send data.
Without it: This is the main defence against malicious JavaScript. If an attacker gets any script onto the page (through a bug, a compromised analytics tag, chat widget or ad, or a poisoned package), the browser runs it with the signed-in user's full access. It can capture what they type, quietly point a sign-in or checkout form at the attacker's server, and skim card numbers as they are entered. A strict policy blocks scripts it does not list, and its form-action and connect-src rules leave stolen data nowhere to go.
-
X-Content-Type-Options 0 of 10
Stops the browser guessing a file's type instead of trusting the type the server declared.
Without it: A file uploaded as an image or plain text can be reinterpreted as HTML or script and run inside the product's own origin: malicious JavaScript delivered through a harmless-looking upload feature.
-
Frame protection 0 of 10
X-Frame-Options or the CSP frame-ancestors directive: decides which sites may show this one inside a frame.
Without it: Clickjacking. Another site loads the product invisibly in a frame and lines its real buttons up under something the user wants to click, so a signed-in user approves a payment, changes their account email or grants access without seeing it.
-
Referrer-Policy 0 of 10
Limits how much of the current URL is passed to other sites when a user follows a link or the page loads a third-party resource.
Without it: Full URLs, including paths and query strings that can carry document IDs, search terms, customer names or reset tokens, can leak to every outside script, image host and outbound link. Recent browsers default to a safer policy; older ones and embedded webviews do not.
-
Permissions-Policy 0 of 10
Switches off browser features the product does not use, such as camera, microphone, location and payments, for the page and anything embedded in it.
Without it: Any script or iframe on the page, including third-party ads and chat widgets, can ask the user for camera, microphone or location access under the vendor's name.
-
Cross-Origin-Opener-Policy 0 of 5
Cuts the link between the product's window and windows opened by, or opening, other sites.
Without it: A page that opens the product keeps a handle on its window and can later redirect it to a look-alike sign-in or payment page (tab-nabbing) while the user thinks they are still on the real site. It is also part of the isolation browsers need to defend against Spectre-style attacks.
-
Cross-Origin-Resource-Policy 0 of 5
Tells browsers which sites may load this site's resources.
Without it: Other sites can pull the product's responses into their own pages, which makes side-channel leaks of what a signed-in user can see easier.
Sent 2
-
Strict-Transport-Security 20 of 20
max-age=63072000
-
No version disclosure 5 of 5
server: Vercel