Week of –
Team access, a CLI, a read API, Uptime, Peak hours and fuller Home cards
Invite members and viewers to a website, read everything on your dashboard from your terminal, the API and MCP, know when your website goes down and when your visitors and buyers are most active, see how fast it is in a daily audit, and tell apart what's behind your Direct traffic.
Platform
Invite your team to a website
From a website's Settings → Team, invite someone by email as a member or a viewer. They get a link, sign in as that email and accept; until then nothing is shared. Members see every report and the Inbox, reply to chats, and manage goals, funnels, segments, notes and day-to-day settings. Viewers see the reports, read-only.
Everyone keeps one login and can be on several websites with different roles. People you invite follow your plan and allowance and never pay; only the owner manages the team, keys, secrets and sharing, and only the owner can delete the website.
- Change a role or remove someone from the team list; it applies at once, to the dashboard, the API, MCP and the CLI.
- Invitations last 7 days and work once; resend or copy a new link if one goes missing.
- Members and viewers can leave a website themselves.
Platform
Sign in with a password
You can now sign up with an email and password, as well as Google or a magic link. We email a 6-digit code to confirm the address before the account is created, and every way in with the same email opens the same account.
Already have an account? Choose Forgot password? on the sign-in page to set a password, or keep using Google or a magic link.
Signing inAnalytics
SuprAnalytics in your terminal
Run npx @supranalytics/cli login, then overview, to see every website's traffic, revenue, uptime and site score in a table. health lists only what needs attention, report sums up what changed, insights shows what to fix with a prompt for your AI coding tool, and peak shows your busiest hours.
It only reads, and it has no commands for visitors' personal data. Sign in through your browser, or use an account API key in scripts and CI, with --json for the data.
- Site audit findings, with a fix prompt for each, are also in the read API and MCP.
- Report options in the API and MCP now match what each report reads.
- Allowing an app or assistant is simpler: one sentence, with personal data still off unless you tick it.
Analytics
Everything on your dashboard, through the API and MCP
A new read API returns every report the dashboard shows, from traffic and goals to retention, peak hours, performance and uptime, with an account API key. The MCP server gets the same reports as new tools, so an AI assistant can answer "is my website up?" or "when do people buy?"
Visitors' names and emails, payments, chats and recordings are off unless you turn them on for a key or connection. Keys and connections you already have keep working, without them.
- Website API keys still only send data: they can't read anything.
- The figures are the dashboard's own, from the same code.
Analytics
Peak hours: when people visit, and when they buy
The Analytics page has a new Peak hours card: your week hour by hour in your website's time zone, for visits, goals, sales and revenue. It has its own date range, all time unless you pick less, and follows your filters, so you can ask when your Google visitors arrive or when people in one country buy.
When something stands out, the card outlines the busiest 3 hours and says how much busier they are than a typical 3 hours.
- Sales and revenue count new payments only: renewals are charged on your provider's schedule, so they say nothing about when people choose to buy.
- It needs at least 30 visits, goals or sales before naming a busiest time.
Analytics
Every website's health at a glance on Home
Home now shows more on each website's card: pageviews, bounce rate, average session time and conversion rate for the period you pick, in the same place on every card so they're easy to compare. Hover one to see the period before.
Below them, each card says whether the website is up, with its uptime and response time over the last 24 hours, and its site audit score. Each opens its own page, and the greeting says when a website is down.
- Cards warn you when an SSL certificate or domain expires within 14 days, when a website has had no visits for 3 days, and when attack mode is on.
- A website whose #1 KPI is a goal shows that goal's completions and conversion rate. Home refreshes itself every minute.
Analytics
An Uptime page: is your website up, and did you hear when it wasn't?
Uptime, in a website's sidebar, checks its homepage every 5 minutes from Mumbai, India, and shows its current status, the last 24 hours, its uptime over 7, 30, 90 and 365 days, its response times, and every outage with its cause.
When a website stops answering, it's checked again each minute. After 3 failures in a row its team gets an email and a Telegram message, and another when it comes back. There's nothing to install, and these alerts can be switched off for a website from the page or in Settings → Reports.
- Bot protection or a login that refuses our check doesn't count as an outage, and the page says so.
- Domain and SSL expiry dates are shown beside the checks.
Analytics
A Performance page: real visitors' speed and a daily site score
Performance, in a website's sidebar, shows how fast the website is for real visitors and how its homepage scores. Real visitor performance gives LCP, INP, CLS, FCP and TTFB at the 75th percentile, measured in visitors' browsers on each page load, over time and by page, device, browser and country.
Once a day the homepage is audited: Google's PageSpeed lab test, HTTPS and security headers, and what search engines and link previews read. You get an overall score, a 90-day score history for each part, and every check, passed or failed, with what it found. Domain Rating from Ahrefs sits beside the scores and isn't part of them.
- Owners and editors can run an audit at any time, at most every 10 minutes.
- A website's first audit runs when someone on its team first opens the page.
Analytics
Direct traffic, told apart
The Referrer list now splits Direct by what each visit most likely was: typed or bookmarked, a shared link, or a return from checkout, for visits since 3 November 2026. These are best guesses from the visit itself, and there's a Direct type filter too.
Visits opened in the browser built into Instagram, Facebook, Messenger, Threads, LinkedIn, TikTok, Snapchat, Pinterest, WeChat or LINE now count as that app, in Social, not Direct, with a row of their own in the list.
Fixes
- A visitor's profile shows where they first came from. A Source card at the top of a visitor's profile names the source of their first visit, with its channel and its campaign or landing page, whatever brought them back later.
- Time on site in the Users table. The Users table has a Time on site column: each visitor's time on the website over all their visits.