diff --git a/Makefile b/Makefile
index 0d3bd4e..85c5adb 100644
--- a/Makefile
+++ b/Makefile
@@ -76,4 +76,5 @@ k8s-sync-content:
 	fi; \
 	echo "-> Target pod: $$POD"; \
 	kubectl cp sample-content/. pengzhan-dev/$$POD:/app/content/; \
+	kubectl exec -n pengzhan-dev $$POD -- chmod -R 775 /app/content; \
 	echo "-> Sync complete. Hot-reload watcher will index new content."
diff --git a/sample-content/plugins/google-analytics/index.js b/sample-content/plugins/google-analytics/index.js
index eabcabb..d1160d1 100644
--- a/sample-content/plugins/google-analytics/index.js
+++ b/sample-content/plugins/google-analytics/index.js
@@ -1,17 +1,40 @@
 module.exports = {
-  injectHead({ pluginConfig }) {
+  injectHead({ pluginConfig, pageType }) {
     const trackingId = pluginConfig.tracking_id;
     if (!trackingId) return '';
 
+    // 1. Never inject analytics on administrative moderation pages
+    if (pageType === 'admin') {
+      return '';
+    }
+
+    // 2. Do not inject in development, staging, or testing modes (unless explicitly enabled)
+    const isProd = process.env.NODE_ENV === 'production' && process.env.APP_ENV !== 'staging';
+    if (!isProd && !pluginConfig.enable_in_dev) {
+      return '';
+    }
+
     return `
     <!-- Google Analytics (GA4 via Plugin) -->
     <script async src="https://www.googletagmanager.com/gtag/js?id=${trackingId}"></script>
     <script>
-      window.dataLayer = window.dataLayer || [];
-      function gtag(){dataLayer.push(arguments);}
-      gtag('js', new Date());
-      gtag('config', '${trackingId}');
+      (function() {
+        // 3. Client-side domain safeguard: only track on production pengzhan.dev domains
+        var host = window.location.hostname;
+        if (host !== 'pengzhan.dev' && !host.endsWith('.pengzhan.dev')) {
+          window['ga-disable-${trackingId}'] = true;
+          window.dataLayer = window.dataLayer || [];
+          window.gtag = function(){};
+          return;
+        }
+        window.dataLayer = window.dataLayer || [];
+        function gtag(){dataLayer.push(arguments);}
+        window.gtag = gtag;
+        gtag('js', new Date());
+        gtag('config', '${trackingId}');
+      })();
     </script>
     `;
   }
 };
+