SupportFromRichard

SFR Analytics is a self-hosted analytics plugin for WordPress. All visitor data is stored in your own database — nothing is sent to third-party services. No cookies, no external scripts, no tracking pixels.
Get a clear picture of your site’s traffic without compromising your visitors’ privacy.
Need a central multi-site dashboard? Use the free <a href="https://wordpress.org/plugins/sfr-analytics-hub/" rel="ugc">SFR Analytics Hub</a> plugin to aggregate analytics from multiple WordPress sites.
<h4>Dashboard at a Glance</h4>
<ul>
<li>Views, Visitors, Sessions — core metrics with period-over-period comparison</li>
<li>Bounce Rate & Pages per Session — engagement indicators</li>
<li>Traffic Over Time — interactive line chart with date range presets</li>
<li>Top Content — your most viewed posts and pages</li>
<li>Traffic Sources — where your visitors are coming from</li>
<li>Top Referring Sites — individual domains sending you traffic</li>
<li>Entry & Exit Pages — first and last pages in each visit</li>
<li>Device Types — desktop, mobile and tablet breakdown</li>
<li>Browsers & Operating Systems — which browsers and OS your visitors use</li>
<li>Geographic Distribution — visitor countries (only available if using a CDN like Cloudflare that provides country headers; all other tracking works without a CDN)</li>
<li>Campaign Performance — UTM campaign results with source/medium drill-down</li>
<li>Online Now — on-demand live visitor count with optional online-only auto-refresh in the dashboard</li>
</ul>
All dashboard sections are collapsible — show only what matters to you.
<h4>Campaign Manager & UTM Link Builder</h4>
Plan and track marketing campaigns without leaving WordPress:
<ul>
<li>Create campaigns with notes and track their performance over time</li>
<li>Build UTM links with a visual tool — pick a page, choose source/medium/campaign, and get a ready-to-use URL</li>
<li>Smart page picker — search across all your content types with post type and category filtering</li>
<li>Preset sources and mediums — common options (Facebook, Google, newsletter, etc.) with clear descriptions</li>
<li>Save generated links for quick reference and reuse</li>
<li>Custom sources and mediums — add your own and they’re saved for next time</li>
<li>Auto-lowercase campaign names to prevent data fragmentation</li>
</ul>
<h4>Smart Bot Detection</h4>
Not all traffic is human. SFR Analytics filters out noise automatically:
<ul>
<li>200+ known bot patterns — search engines, AI crawlers, SEO tools, monitoring bots, headless browsers, security scanners and more</li>
<li>JavaScript verification — a lightweight inline script confirms real browser execution, so bots that don’t run JavaScript are never counted</li>
<li>Missing header detection — flags requests without User-Agent or Accept-Language headers</li>
<li>Filterable patterns — add your own via the <code>sfran_bot_patterns</code> filter</li>
</ul>
The dashboard shows you exactly how much traffic was filtered: total requests vs verified human visits.
<h4>Privacy First</h4>
<ul>
<li>No cookies — visitor identification uses anonymous hashed fingerprints</li>
<li>No PII stored — IP addresses are hashed (SHA-256), never stored in plain text</li>
<li>Optional IP anonymisation — strip the last octet before hashing</li>
<li>Do Not Track support — respects the browser DNT header when enabled</li>
<li>Local storage only — your data never leaves your server</li>
<li>Configurable retention — automatically delete data after 30 to 3,650 days</li>
<li>GDPR-ready privacy text — copy-paste paragraph for your privacy policy</li>
</ul>
<h4>IP & Country Filtering</h4>
<ul>
<li>Exclude specific IP addresses or CIDR ranges (e.g. <code>192.168.1.0/24</code>)</li>
<li>One-click “Ignore My IP” button</li>
<li>Exclude entire countries by country code</li>
<li>Exclude logged-in users by role (administrators, editors, etc.)</li>
</ul>
<h4>REST API</h4>
A full set of authenticated REST API endpoints lets you access your analytics data programmatically:
<ul>
<li><code>/sfran/v1/summary</code> — overview stats with optional comparison</li>
<li><code>/sfran/v1/top-content</code> — most viewed content with pagination</li>
<li><code>/sfran/v1/traffic-sources</code> — referrer breakdown</li>
<li><code>/sfran/v1/time-series</code> — daily views/visitors/sessions</li>
<li><code>/sfran/v1/campaigns</code> — campaign performance</li>
<li><code>/sfran/v1/entry-pages</code> and <code>/sfran/v1/exit-pages</code></li>
<li><code>/sfran/v1/referrers</code> — top referring domains</li>
<li><code>/sfran/v1/devices</code>, <code>/sfran/v1/browsers</code>, <code>/sfran/v1/geographic</code></li>
<li><code>/sfran/v1/online-now</code> — current active visitor count for the last N minutes (default 5)</li>
</ul>
All endpoints require authentication (WordPress Application Passwords or other REST API auth) and the <code>manage_options</code> capability. Use these to build custom dashboards, export data, or integrate with other tools.
<h4>Performance</h4>
<ul>
<li>Batch processing — pageviews are buffered and written in batches, reducing database load</li>
<li>Indexed tables — optimised queries for fast dashboard rendering</li>
<li>Lightweight frontend — a single inline verification script, no external files loaded for visitors</li>
<li>No impact on page speed — tracking uses <code>navigator.sendBeacon</code> (non-blocking)</li>
</ul>
<h4>Works with SFR Analytics Hub</h4>
SFR Analytics collects data on each individual site.
For cross-site reporting, install the free <a href="https://wordpress.org/plugins/sfr-analytics-hub/" rel="ugc">SFR Analytics Hub</a> on your main site.
With SFR Analytics Hub, you can also view live online visitors across all connected sites from one central dashboard.
The WordPress.org Hub edition supports up to 3 connected sites.
Need more than 3 sites with the same workflow? See <a href="https://supportfromrichard.co.uk/sfr-analytics/" rel="nofollow ugc">SFR Analytics Hub Pro</a>.

SFR Analytics

Lightweight, privacy-focused WordPress analytics. Track pageviews, visitors, campaigns and more — all data stored locally in your own database.

TinkerCoded

Tinker Stats for Rybbit integrates your self-hosted <a href="https://rybbit.io" rel="nofollow ugc">Rybbit Analytics</a> instance with WordPress. It manages your Rybbit tracking script on the frontend and surfaces content traffic stats directly in your admin; post list columns, editor publish box, and dashboard widget.
Tracking Script Management:
<ul>
<li>One-click setup — enter your connection details, click Test Connection, and the tracking script is ready to enable.</li>
<li>Built-in proxy — bypass ad blockers with one toggle. The plugin serves the tracking script and forwards events through your own domain. No webserver config needed.</li>
<li>Script injection — adds the Rybbit tracking script to your frontend via <code>wp_enqueue_script()</code> with configurable script URL, debounce, and session replay.</li>
<li>Role exclusion — exclude specific WordPress roles (e.g. administrators, editors) from being tracked.</li>
<li>User identification — optionally send logged-in user ID, display name, and role to Rybbit via <code>rybbit.identify()</code>.</li>
<li>Custom events — fire per-type events (<code>post_view</code>, <code>page_view</code>, <code>archive_view</code>, <code>search_view</code>, etc.) with WordPress metadata as event properties.</li>
<li>Error suppression — suppress cross-origin “Script error.” messages from the tracking script. This is related to a bit of a bug in Rybbit error reporting and merely cleans up session reports.</li>
</ul>
Admin Content Stats Display:
<ul>
<li>Post list column — see view counts for every post at a glance. Click any count to open a detailed chart.</li>
<li>Chart modal — daily breakdown with Year/Month/Week tabs and period navigation. Shows total count with percentage change vs previous period.</li>
<li>Dashboard widget — site-wide traffic chart, total count with trend indicator, and top 10 pages.</li>
<li>Publish box stat — current month view count right in the editor, clickable to open the chart modal.</li>
<li>Postmeta sync — hourly cron job saves view counts to post meta for use by themes, page builders, and other plugins.</li>
<li>Configurable metric — choose between Pageviews, Visits (sessions), or Users.</li>
</ul>
Security & Privacy:
<ul>
<li>Encrypted API key — your Rybbit API key is stored encrypted in the database.</li>
<li>Caching — configurable transient caching to minimize API calls to your Rybbit instance.</li>
<li>API resilience — automatic backoff on errors prevents cascading failures.</li>
<li>View permissions — restrict who can see stats in the admin.</li>
<li>Privacy-first — Rybbit is cookieless and GDPR-friendly. No data leaves your infrastructure.</li>
</ul>
This plugin is not an official Rybbit product and is not affiliated with or endorsed by Rybbit. Rybbit trademarks, logos, and brand assets remain the property of their respective owner.
Requirements:
<ul>
<li>A running self-hosted <a href="https://rybbit.io" rel="nofollow ugc">Rybbit Analytics</a> instance (tested with v2.5.0)</li>
<li>A Rybbit API key (generated in Settings → Account → API Keys)</li>
<li>WordPress 6.3 or later</li>
</ul>
<h3>Multisite</h3>
The plugin works on WordPress Multisite networks (subdirectory, subdomain, and domain-mapped). The plugin can be activated per-subsite or network-wide; either works. Each subsite has its own Tinker Stats menu and runs its own postmeta sync.
How independently each subsite can be configured depends on Rybbit’s per-domain data model. Subdomain and domain-mapped subsites can each connect to their own Rybbit site. Subdirectory subsites must share the parent domain’s Rybbit configuration (Site ID, Tracking ID, URL, and API key), since Rybbit organizes data per registered domain or subdomain rather than by URL path. The URL patterns section below has the full breakdown.
<h4>Rybbit + Multisite URL patterns</h4>
Rybbit organizes data per registered domain or subdomain, which affects how multisite installs map to Rybbit sites:
<ul>
<li>Subdomain subsites (e.g. <code>sub.example.com</code>) — each can be added as its own Rybbit site for clean separation.</li>
<li>Domain-mapped subsites (e.g. <code>example2.com</code>) — each is added as its own Rybbit site, identical to single-site usage.</li>
<li>Subdirectory subsites (e.g. <code>example.com/sub</code>) — Rybbit doesn’t support path-based site separation, so all subdirectory subsites must be configured with the same Rybbit Site ID, Tracking ID, URL, and API key as the parent domain. In Rybbit’s dashboard, all subdirectory subsite traffic appears under the parent domain’s site; use Rybbit’s URL/path filters to view per-subsite breakdowns.</li>
</ul>
If you proxy the Rybbit script through a relative path (e.g. <code>/api/script.js</code>), make sure the proxy is configured on each subsite’s domain.

Tinker Stats for Rybbit

Rybbit Analytics integration — tracking script management, admin content stats, and postmeta sync for self-hosted Rybbit.

SFR Analytics vs Tinker Stats for Rybbit