Server-side analytics. Sees 100% of traffic (including bots and attackers), real Web Vitals, UTM attribution, rage clicks. Privacy-first.

speedien

Nestify

Core Web Vitals Booster

Core web vitals booster for Nestify.io. This plugin will optimize pagespeed of your sites hosted on Nestify.

LIQUID SEO Inspector

Easily inspect metadata within web pages to visualize and find issues.

SysWP

<p>SysRadar is a <strong>server-side, privacy-first</strong> alternative to Google Analytics and Plausible — built in Brazil, hosted in Brazil, fully LGPD/GDPR-compliant.</p>
<p>Unlike GA4 (which requires cookies and complicated LGPD setup) and Plausible (which only sees human visitors with JavaScript enabled), SysRadar captures <strong>100% of real requests</strong> to your server: humans, AI bots (ClaudeBot, GPTBot, PerplexityBot), SEO crawlers (Ahrefs, Semrush), attackers (sqlmap, nuclei, wpscan), RSS readers, uptime monitors — all categorized in real time.</p>
<h4>Why this matters in 2026</h4>
<ul>
<li><strong>30 to 60% of your traffic</strong> is bots. You never knew — because GA4 and Plausible filter bots automatically. But it’s your server serving those bots, your bandwidth, your cost.</li>
<li><strong>AI crawlers</strong> (Claude, GPT, Perplexity) are indexing your content right now. If you don’t know what they are reading, you can’t optimize. The first sites to appear in AI answers will win the next decade of SEO.</li>
<li><strong>Attackers</strong> are continuously scanning <code>/wp-admin/</code>, <code>/xmlrpc.php</code>, <code>/.env</code>. Wordfence Free does not block them. Cloudflare lets them through. You don’t even know they exist.</li>
<li><strong>Web Vitals</strong> (LCP, CLS, INP) — Google ranks search results by them. Lighthouse on your machine ≠ real user. SysRadar measures with <strong>RUM (Real User Monitoring) data</strong>.</li>
</ul>
<h4>What the plugin does</h4>
<ol>
<li><strong>Injects the tracker</strong> (one line of JS, ~2KB minified, async) into the <code><head></code> of all front-end pages via the <code>wp_head</code> hook</li>
<li><strong>Live Dashboard inside WordPress</strong> (since v1.2.0): your last 24h of traffic, AI crawlers, suspected attacks and a real-time live counter — all visible without leaving wp-admin. Cached locally for 5 min; the fetch fires ONLY when an administrator opens the SysRadar page (zero impact on visitor load times)</li>
<li><strong>Auto-detects</strong> WooCommerce, Elementor, Yoast SEO, Rank Math, Contact Form 7, BuddyPress, LearnDash, bbPress, All-in-One SEO</li>
<li><strong>Auto-excludes:</strong> admin pages, AJAX, REST API, cron jobs, and logged-in users with edit-posts capability (admins/editors)</li>
<li><strong>Honors</strong> <code>DNT: 1</code> (Do Not Track) optionally</li>
<li><strong>Compatible</strong> with cache plugins (WP Rocket, W3 Total Cache, LiteSpeed Cache, Cloudflare APO)</li>
<li><strong>Custom domain support</strong> (Pro+ plan): use <code>analytics.yoursite.com</code> to bypass aggressive ad-blockers</li>
<li><strong>Zero queries</strong> to the WordPress database (settings stored in <code>wp_options</code>)</li>
</ol>
<h4>Who is it for</h4>
<ul>
<li><strong>Bloggers and content creators</strong> — discover which AI crawlers are indexing your content (ChatGPT, Claude, Perplexity)</li>
<li><strong>E-commerce (WooCommerce)</strong> — real channel attribution, price-scraper detection, per-product Web Vitals</li>
<li><strong>Agencies</strong> — manage analytics for multiple client sites in a single dashboard (Agency plan)</li>
<li><strong>Developers</strong> — Web Vitals degradation alerts, automatic JS error capture, REST API access</li>
</ul>
<h4>Privacy & compliance</h4>
<ul>
<li><strong>IP anonymization runs in the plugin, before transmission</strong> — last octet zeroed (IPv4) / last 80 bits zeroed (IPv6) inside your WordPress install, so SysRadar never receives identifiable IP addresses</li>
<li>First-party cookies only (<code>_rdid</code>, <code>_rds</code>) — no cross-site tracking, no fingerprinting. Cookieless mode is available as a one-click toggle</li>
<li>Split tracking toggles (since v1.1.1) — disable the front-end pixel and the server-side beacon independently</li>
<li>GDPR/LGPD-friendly: no data brokers, no impression auctions, no persona-building</li>
<li>Optional Honor DNT (Do Not Track) support</li>
<li>Servers located in Brazil; data processed under LGPD</li>
<li>No dependency on Google, Facebook, or any ad-tech vendor</li>
</ul>
<h4>Privacy policy snippet for site owners</h4>
<p>You are the data controller for visitors of your site. The paragraph below is a starting point you can paste (and adapt) into your own privacy policy when this plugin is active. Replace the example placeholders with your specifics.</p>
<blockquote>
<p><strong>Analytics — SysRadar.</strong> We use SysRadar (operated by SysWP, Brazil) for privacy-first server-side analytics. SysRadar receives the page URL you visit, the referrer URL, your user-agent, anonymized IP (last octet zeroed before it leaves our server), Web Vitals metrics (LCP / FCP / TTFB / CLS / INP), and security telemetry on suspicious requests. SysRadar never sets third-party cookies and is configured here in [cookieless mode / standard mode]. We process this data under [legitimate interest in security monitoring / your consent for analytics], depending on the feature. SysRadar privacy policy: https://radar.syswp.com.br/privacy/. To exercise your LGPD/GDPR rights, contact us at [your email].</p>
</blockquote>
<p>If you enable cookieless mode in the plugin settings, the <code>_rdid</code> and <code>_rds</code> first-party cookies are not set and you typically do not need a cookie consent banner for SysRadar.</p>
<h4>Data subject rights walkthrough</h4>
<p>Under LGPD (Brazil) Art. 18 and GDPR (EU) Art. 15–17, your visitors can request access to, correction of, deletion of, and portability of their personal data. Because SysRadar minimizes data at source (anonymized IPs, no names, no emails, no persistent cross-site identifier), most data subject requests are quick to answer:</p>
<ul>
<li><strong>Access:</strong> show the visitor the categories of data collected — see the table in the plugin’s Settings <span aria-hidden="true" class="wp-exclude-emoji">→</span> SysRadar page and the SysRadar privacy policy at https://radar.syswp.com.br/privacy/.</li>
<li><strong>Correction:</strong> SysRadar does not collect identifiable data that can be “corrected” in the LGPD/GDPR sense. If a visitor still requests correction, document the request and respond confirming the data is anonymized.</li>
<li><strong>Deletion:</strong> events are automatically purged after your plan retention window (7 to 180 days). For earlier deletion of events tied to a specific anonymized IP, the site owner can email contato@syswp.com.br with the timeframe and the IP prefix.</li>
<li><strong>Portability:</strong> the site owner can export all events for their site via the dashboard <span aria-hidden="true" class="wp-exclude-emoji">→</span> Account <span aria-hidden="true" class="wp-exclude-emoji">→</span> Export Data.</li>
<li><strong>Objection / withdrawal of consent:</strong> if the visitor enabled DNT in their browser and you have “Honor DNT” turned on in the plugin, they are automatically not tracked. They can also block first-party cookies in their browser.</li>
</ul>
<h4>Pricing</h4>
<p>Free permanent plan with 1 site. Automatic 7-day Pro trial on signup (no credit card). Full pricing and plan details at https://radar.syswp.com.br/pricing.</p>
<h3>Roadmap</h3>
<h4>v1.2 (Q3 2026)</h4>
<ul>
<li>Mini-dashboard in WP admin showing last 24h numbers</li>
<li>Web Vitals widget in the WP admin</li>
</ul>
<h4>v1.3 (Q3 2026)</h4>
<ul>
<li>Auto-detection of SysWP ecosystem siblings + single sign-on via SSO HMAC</li>
<li>Integration with SysRadar API to fetch config remotely</li>
</ul>
<h4>v1.4 (Q4 2026)</h4>
<ul>
<li>Server-side events (S2S) — captures even with the most aggressive ad-blockers</li>
<li>Block AI crawlers directly from the plugin (optional)</li>
</ul>
<h3>External services</h3>
<p>This plugin connects to the SysRadar service at https://radar.syswp.com.br. There are two distinct outbound transmissions, both fully disclosed below.</p>
<h4>(1) Front-end JS pixel</h4>
<ul>
<li><strong>When it fires:</strong> on every front-end page view from a non-excluded visitor (admins are excluded by default; logged-in users with edit-posts capability are skipped).</li>
<li><strong>Transport:</strong> an async <code><script></code> tag loaded from <code>https://radar.syswp.com.br/p/{site_id}.js</code> runs in the visitor’s browser and sends measurement events back to the same domain.</li>
<li><strong>Data sent:</strong> anonymized IP (last octet zeroed in your server before the script even runs, as the pixel is keyed to your site), page URL, referrer URL, user-agent string, browser locale and timezone, Web Vitals metrics (LCP, FCP, TTFB, CLS, INP).</li>
<li><strong>Cookies set:</strong> <code>_rdid</code> and <code>_rds</code> first-party cookies — unless cookieless mode is enabled in the plugin settings, in which case no cookies are set.</li>
<li><strong>Legal basis:</strong> consent (cookie + analytics) or legitimate interest depending on your jurisdiction. See the “Privacy & compliance” section above.</li>
</ul>
<h4>(2) Server-side beacon (new in v1.1.0+)</h4>
<ul>
<li><strong>When it fires:</strong> only for requests the JS pixel cannot see — unauthenticated requests to <code>/wp-json/</code>, <code>xmlrpc.php</code>, <code>admin-ajax.php</code>, <code>wp-login.php</code>, and direct probes of <code>/wp-admin/</code>. Skipped for cron, WP-CLI, and excluded users.</li>
<li><strong>Transport:</strong> a fire-and-forget <code>wp_remote_post</code> to <code>https://radar.syswp.com.br/api/v1/pixel/server-beacon</code>, dispatched on the WordPress <code>shutdown</code> action AFTER the page response is delivered, using <code>fastcgi_finish_request()</code> + <code>blocking => false</code> for zero added page latency.</li>
<li><strong>Data sent:</strong> site ID, HTTP method, request URI (truncated to 500 chars), anonymized IP (last octet zeroed inside this plugin before transmission), user-agent (truncated to 1000 chars), referer (truncated, escaped), HTTP response status code, request-type label (rest / xmlrpc / ajax / login / admin_unauth / other), plugin version, DNT header value, cookieless-mode flag.</li>
<li><strong>Data NOT sent:</strong> logged-in user identities, post content, form submissions, payment data, cookies, session tokens — none of these ever transit the beacon.</li>
<li><strong>Legal basis:</strong> legitimate interest in security monitoring under LGPD Art. 7º IX / GDPR Art. 6(1)(f). No visitor consent is required for security telemetry of suspicious unauthenticated requests, per regulator guidance. Disclosure remains mandatory and is provided in the privacy policy snippet above.</li>
</ul>
<h4>(3) Install / deactivation ping (new in v1.3.0)</h4>
<ul>
<li><strong>When it fires:</strong> twice in the lifetime of an install — once on <code>register_activation_hook</code> (plugin activation) and once on <code>register_deactivation_hook</code> (plugin deactivation). Never on uninstall (most plugins cannot make HTTP calls during the uninstall hook). No periodic pings, no per-request pings, no scheduled pings.</li>
<li><strong>Transport:</strong> a fire-and-forget <code>wp_remote_post</code> to <code>https://radar.syswp.com.br/api/v1/plugin/install-event</code> (activation) or <code>/api/v1/plugin/install-deactivate</code>, with <code>blocking => false</code> so it never delays activation/deactivation.</li>
<li><strong>Data sent:</strong> anonymous install ID (UUID v4 generated locally on first activation and stored in <code>wp_options</code>; not derived from any user data), site domain (e.g. <code>example.com</code>), plugin version, WordPress version, PHP version, multisite flag.</li>
<li><strong>Data NOT sent:</strong> no admin email, no usernames, no user data, no visitor data, no IP, no cookies, no site title, no post content. The ping is strictly an installed-base counter for the plugin.</li>
<li><strong>How to disable:</strong> Settings <span aria-hidden="true" class="wp-exclude-emoji">→</span> SysRadar <span aria-hidden="true" class="wp-exclude-emoji">→</span> “Plugin telemetry” <span aria-hidden="true" class="wp-exclude-emoji">→</span> check “Disable plugin telemetry” <span aria-hidden="true" class="wp-exclude-emoji">→</span> Save. Once disabled, no further activation/deactivation pings are sent.</li>
<li><strong>Legal basis:</strong> legitimate interest under LGPD Art. 7º IX / GDPR Art. 6(1)(f) — knowing roughly how many installs are active and on which WordPress/PHP versions is necessary to keep the plugin compatible and supported. No visitor consent is involved (the ping originates from the WordPress site itself, not from any visitor).</li>
</ul>
<h4>Common to all three</h4>
<ul>
<li>Servers are located in Brazil.</li>
<li>Data is processed in compliance with LGPD/GDPR.</li>
<li><code>sslverify</code> is always <code>true</code> on outbound HTTP — never relaxed.</li>
<li>No personally identifiable information (no name, no email, no full IP, no cross-site identifier) leaves your WordPress install.</li>
</ul>
<h4>Service links</h4>
<ul>
<li>Service URL: https://radar.syswp.com.br</li>
<li>Privacy policy: https://radar.syswp.com.br/privacy/</li>
<li>Terms of service: https://radar.syswp.com.br/terms/</li>
<li>Plugin setup + LGPD guide: https://radar.syswp.com.br/docs/plugin-setup/</li>
</ul>


Alternatives to SysRadar

Top alternatives