The answer to the 3 questions is yes.
We need to put the tracking code on every page you want to track. Even if the page has authentication, the Analytics can "see" the relevant data, and provide the features we want, such as number of accesses, length of stay, rejection rate etc... and the most important thing, which is the behavioral flow.
The location indicated by google for the placement of the tracking code is between the tags head
, as in the example below:
<head>
<script>
(function(i,s,o,g,r,a,m){i['GoogleAnalyticsObject']=r;i[r]=i[r]||function(){
(i[r].q=i[r].q||[]).push(arguments)},i[r].l=1*new Date();a=s.createElement(o),
m=s.getElementsByTagName(o)[0];a.async=1;a.src=g;m.parentNode.insertBefore(a,m)
})(window,document,'script','https://www.google-analytics.com/analytics.js','ga');
ga('create', 'UA-XXXXX-Y', 'auto');
ga('send', 'pageview');
</script>
</head>
See help page on Developers.
As indicated by @Ricardo Gaya, in the answer above, it is also possible (and indicated) to use a tag manager such as that of google itself, to make the load asynchronous.
I gave +1 in this answer, for the important tip of the tag maganer, but I did not find that she answered satisfactorily the question, so since it’s been a while since I posted, and already know the answer, I decided to do a tbm with more information.
– gustavox