google / google/site-kit-wp

Site Kit FPM registration persists after plugin deletion with no way to deregister

Open
#12,504 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
1.4k
Forks
384
Avg merge
4d 14h
Merged PRs (30d)
77

Description

## Bug Description

When Google Site Kit is deleted from WordPress, the First-Party Mode (FPM / "Google tag gateway for advertisers") endpoint registration persists on Google's backend. The Google Tag continues to load a ~183 KiB gtag.js library from the registered FPM path on every page load, even after the plugin has been fully removed from the server.

There is no user-facing UI in Site Kit, Google Analytics, Google Tag Manager, or Google Ads to manually deregister an FPM endpoint. The "Reset Site Kit" function also does not send a deregistration API call. This creates an unremovable performance penalty with no self-service resolution path.

## Steps to reproduce

1. Install Site Kit on a WordPress site with Tag Manager and Analytics connected
2. Enable First-Party Mode (Google tag gateway) through the Ads module or Tag Manager settings
3. Confirm FPM is active (the registered endpoint loads gtag.js on page load)
4. Deactivate and delete the Site Kit plugin from WordPress
5. Flush WordPress rewrite rules (Settings > Permalinks > Save)
6. Purge all server and CDN caches
7. Load the site in an incognito window and check the network tab
8. Observe: the browser still requests the FPM endpoint path and receives a 200 response with the full Google Tag library

**Expected behavior:** Deleting Site Kit should deregister the FPM endpoint from Google's backend, or at minimum, there should be a user-accessible way to deregister it manually.

**Actual behavior:** The FPM registration is permanent and irremovable after plugin deletion. No admin UI exists to manage it.

## Additional steps attempted (all failed to deregister FPM)

- Reinstalled Site Kit and searched all settings pages for an FPM toggle (none found in current version)
- Used "Reset Site Kit" from Admin Settings to disconnect all services
- Deleted Site Kit again after reset
- Checked GA4 Admin > Data Streams > Configure tag settings > Show all (no FPM settings exposed)
- Checked GA4 > Manage data transmission (only consent mode settings)
- Verified the FPM endpoint files and WordPress rewrite rules are completely removed from the server

## Impact

In our case, we migrated to a custom sGTM domain (Cloud Run custom domain mapping with Web Container Client) which correctly serves gtm.js and gtag.js as first-party. However, the orphaned FPM endpoint loads an additional ~183 KiB of redundant JavaScript on every page, directly degrading Core Web Vitals and mobile Lighthouse scores. We cannot remove this overhead because the FPM registration cannot be cleared.

This likely affects any site that has ever used Site Kit with FPM enabled and subsequently migrated away from Site Kit.

## Feature Request

At minimum, one of the following:
1. Plugin deletion should trigger an FPM deregistration API call
2. "Reset Site Kit" should trigger an FPM deregistration API call
3. A manual FPM management toggle should be exposed in Site Kit settings (similar to how "Place Google Analytics code" exists for Analytics)
4. FPM endpoint management should be exposed in the Google Tag settings within GA4 Admin

## Screenshots

(Can provide HAR captures, network waterfalls, and Lighthouse treemaps showing the redundant FPM load if needed)

## Additional Context

- PHP Version: 8.x (Cloudways managed)
- OS: macOS
- Browser: Chrome 146
- Plugin Version: Latest Site Kit version as of April 2026 (reinstalled for testing, then deleted)
- WordPress: 6.9.4
- Hosting: Cloudways with Cloudflare CDN/APO
- The FPM endpoint path is a randomized string registered by Site Kit during initial FPM activation
*

## QA Brief

*

## Changelog entry

*

Contributor guide

Open the contributing guide

Research direction

No files, entry points, or tests are named in the issue. Start by tracing First-Party Mode registration alongside plugin deletion and Reset Site Kit, then determine which supported deregistration path is available. Done means an FPM registration can be removed after deletion or reset and automated tests verify that behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
api, backend
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Quiet
Clarity
Needs clarification
Newbie friendliness
28/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.