SupportFromRichard

SFR Analytics is a self-hosted analytics plugin for WordPress. All visitor data is stored in your own database — nothing is sent to third-party services. No cookies, no external scripts, no tracking pixels.
Get a clear picture of your site’s traffic without compromising your visitors’ privacy.
Need a central multi-site dashboard? Use the free <a href="https://wordpress.org/plugins/sfr-analytics-hub/" rel="ugc">SFR Analytics Hub</a> plugin to aggregate analytics from multiple WordPress sites.
<h4>Dashboard at a Glance</h4>
<ul>
<li>Views, Visitors, Sessions — core metrics with period-over-period comparison</li>
<li>Bounce Rate & Pages per Session — engagement indicators</li>
<li>Traffic Over Time — interactive line chart with date range presets</li>
<li>Top Content — your most viewed posts and pages</li>
<li>Traffic Sources — where your visitors are coming from</li>
<li>Top Referring Sites — individual domains sending you traffic</li>
<li>Entry & Exit Pages — first and last pages in each visit</li>
<li>Device Types — desktop, mobile and tablet breakdown</li>
<li>Browsers & Operating Systems — which browsers and OS your visitors use</li>
<li>Geographic Distribution — visitor countries (only available if using a CDN like Cloudflare that provides country headers; all other tracking works without a CDN)</li>
<li>Campaign Performance — UTM campaign results with source/medium drill-down</li>
<li>Online Now — on-demand live visitor count with optional online-only auto-refresh in the dashboard</li>
</ul>
All dashboard sections are collapsible — show only what matters to you.
<h4>Campaign Manager & UTM Link Builder</h4>
Plan and track marketing campaigns without leaving WordPress:
<ul>
<li>Create campaigns with notes and track their performance over time</li>
<li>Build UTM links with a visual tool — pick a page, choose source/medium/campaign, and get a ready-to-use URL</li>
<li>Smart page picker — search across all your content types with post type and category filtering</li>
<li>Preset sources and mediums — common options (Facebook, Google, newsletter, etc.) with clear descriptions</li>
<li>Save generated links for quick reference and reuse</li>
<li>Custom sources and mediums — add your own and they’re saved for next time</li>
<li>Auto-lowercase campaign names to prevent data fragmentation</li>
</ul>
<h4>Smart Bot Detection</h4>
Not all traffic is human. SFR Analytics filters out noise automatically:
<ul>
<li>200+ known bot patterns — search engines, AI crawlers, SEO tools, monitoring bots, headless browsers, security scanners and more</li>
<li>JavaScript verification — a lightweight inline script confirms real browser execution, so bots that don’t run JavaScript are never counted</li>
<li>Missing header detection — flags requests without User-Agent or Accept-Language headers</li>
<li>Filterable patterns — add your own via the <code>sfran_bot_patterns</code> filter</li>
</ul>
The dashboard shows you exactly how much traffic was filtered: total requests vs verified human visits.
<h4>Privacy First</h4>
<ul>
<li>No cookies — visitor identification uses anonymous hashed fingerprints</li>
<li>No PII stored — IP addresses are hashed (SHA-256), never stored in plain text</li>
<li>Optional IP anonymisation — strip the last octet before hashing</li>
<li>Do Not Track support — respects the browser DNT header when enabled</li>
<li>Local storage only — your data never leaves your server</li>
<li>Configurable retention — automatically delete data after 30 to 3,650 days</li>
<li>GDPR-ready privacy text — copy-paste paragraph for your privacy policy</li>
</ul>
<h4>IP & Country Filtering</h4>
<ul>
<li>Exclude specific IP addresses or CIDR ranges (e.g. <code>192.168.1.0/24</code>)</li>
<li>One-click “Ignore My IP” button</li>
<li>Exclude entire countries by country code</li>
<li>Exclude logged-in users by role (administrators, editors, etc.)</li>
</ul>
<h4>REST API</h4>
A full set of authenticated REST API endpoints lets you access your analytics data programmatically:
<ul>
<li><code>/sfran/v1/summary</code> — overview stats with optional comparison</li>
<li><code>/sfran/v1/top-content</code> — most viewed content with pagination</li>
<li><code>/sfran/v1/traffic-sources</code> — referrer breakdown</li>
<li><code>/sfran/v1/time-series</code> — daily views/visitors/sessions</li>
<li><code>/sfran/v1/campaigns</code> — campaign performance</li>
<li><code>/sfran/v1/entry-pages</code> and <code>/sfran/v1/exit-pages</code></li>
<li><code>/sfran/v1/referrers</code> — top referring domains</li>
<li><code>/sfran/v1/devices</code>, <code>/sfran/v1/browsers</code>, <code>/sfran/v1/geographic</code></li>
<li><code>/sfran/v1/online-now</code> — current active visitor count for the last N minutes (default 5)</li>
</ul>
All endpoints require authentication (WordPress Application Passwords or other REST API auth) and the <code>manage_options</code> capability. Use these to build custom dashboards, export data, or integrate with other tools.
<h4>Performance</h4>
<ul>
<li>Batch processing — pageviews are buffered and written in batches, reducing database load</li>
<li>Indexed tables — optimised queries for fast dashboard rendering</li>
<li>Lightweight frontend — a single inline verification script, no external files loaded for visitors</li>
<li>No impact on page speed — tracking uses <code>navigator.sendBeacon</code> (non-blocking)</li>
</ul>
<h4>Works with SFR Analytics Hub</h4>
SFR Analytics collects data on each individual site.
For cross-site reporting, install the free <a href="https://wordpress.org/plugins/sfr-analytics-hub/" rel="ugc">SFR Analytics Hub</a> on your main site.
With SFR Analytics Hub, you can also view live online visitors across all connected sites from one central dashboard.
The WordPress.org Hub edition supports up to 3 connected sites.
Need more than 3 sites with the same workflow? See <a href="https://supportfromrichard.co.uk/sfr-analytics/" rel="nofollow ugc">SFR Analytics Hub Pro</a>.

SFR Analytics

Lightweight, privacy-focused WordPress analytics. Track pageviews, visitors, campaigns and more — all data stored locally in your own database.

YEB.to

Google Analytics alternative for WordPress: clean stats, interactions, verified bots, UTM, GeoIP, CSV export. Privacy-first.
<h3>What you get</h3>
<ul>
<li>At-a-glance KPIs: pageviews, sessions, unique visitors, pages per session.</li>
<li>Interactions (sessions): session explorer with landing, referrer, per-session timeline (page history), avg. load, distinct pages, pageviews, expand/collapse.</li>
<li>Content insights: top URLs, titles, post IDs.</li>
<li>Acquisition: referrers (root domains) and UTM (source/medium/campaign).</li>
<li>Audience: countries, regions, cities, languages, common screen sizes.</li>
<li>Tech: device type, OS, browser.</li>
<li>Bots (with verification): separate verified search engine hits (Google, Bing, etc.).</li>
<li>Networks: major networks/ISPs and their CIDR ranges.</li>
<li>CSV export: exports exactly what your current filters show.</li>
<li>SPA-friendly & IPv6-ready.</li>
</ul>
<h3>Why people choose it</h3>
<ul>
<li>Clear and calm: focused reports, no maze of menus.</li>
<li>Actionable filters: time window, path, title, country/city, referrer, device, OS, browser, language, UTM, bot type.</li>
<li>You stay in control: richer info (city, device brand/model, verified bot checks) is optional — enable only what you want.</li>
</ul>
<h3>Setup (optional extras)</h3>
Want richer details like city/region, device brand/model, or verified bot checks?
<ol>
<li>Sign in at https://yeb.to and create an API key (free test credits).</li>
<li>In WordPress, open Analytics (YEB) → Settings, paste your key.</li>
<li>Toggle the extras you want (Geo, Network/ASN, Device details, Bot verification).</li>
</ol>
Nothing is sent to YEB until you add a key and turn on a feature — you choose.
<h3>Usage</h3>
<ul>
<li>Go to Analytics (YEB) → Dashboard for your reports.</li>
<li>Use the tabs to dive into Overview, Interactions, Content, Acquisition, Audience, Tech, Bots, Networks.</li>
<li>Click Export CSV to download exactly what you’re viewing.</li>
</ul>
<h3>Shortcode (public mini-stats)</h3>
Show small, public counters anywhere (pages, posts, widgets, site editor).
Basic: 
 `
[waby_visits_stats] ; whole site, last 7 days 
[waby_visits_stats period=”30d”] ; whole site, last 30 days 
[waby_visits_stats period=”1d” bots=”only”] ; bots only, yesterday 
[waby_visits_stats page=”/pricing”] ; just /pricing page, last 7 days
<pre><code>`
</code></pre>
Auto-detect current page: 
 `
[waby_visits_stats current_page]
<pre><code>`
</code></pre>
If <code>page=""</code> isn’t provided, <code>current_page</code> uses the current request path.
Show exactly what you want: 
 `
[waby_visits_stats show=”visits”] ; only total visits (pageviews) 
[waby_visits_stats show=”uniques”] ; only unique visitors 
[waby_visits_stats show=”both”] ; both (default)
<pre><code>`
</code></pre>
Bot filter: 
– <code>bots="exclude"</code> (default) — show human traffic and unverified bot-like traffic treated as human 
– <code>bots="only"</code> — bot traffic only 
– <code>bots="include"</code> — include everything
Labels, layout & CSS hooks (for custom styling): 
 `
[waby_visits_stats 
current_page 
show=”both” 
label_visits=”Views” 
label_uniques=”Visitors” 
layout=”inline” ; inline | stack 
sep=” • ” 
wrap_tag=”div” ; div | span | p 
item_tag=”span” ; span | div 
wrapper_class=”stats stats–mini” 
item_class=”stats__item” 
label_class=”stats__label” 
value_class=”stats__value” 
]
<pre><code>``
</code></pre>
All attributes: 
– <code>period</code>: <code>1d</code>, <code>7d</code> (default), <code>30d</code> 
– <code>page</code>: limit to a path (e.g. <code>/pricing</code>) 
– <code>current_page</code>: presence-only flag to use the current URL path 
– <code>bots</code>: <code>exclude</code> (default), <code>only</code>, <code>include</code> 
– <code>show</code>: <code>visits</code>, <code>uniques</code>, <code>both</code> (default) 
– <code>label_visits</code> (default <code>Visits</code>), <code>label_uniques</code> (default <code>Unique</code>) 
– <code>layout</code>: <code>inline</code> (default) or <code>stack</code> 
– <code>sep</code>: separator when <code>layout="inline"</code> (default <code>|</code>) 
– <code>wrap_tag</code>: <code>div</code> (default), <code>span</code>, <code>p</code> 
– <code>item_tag</code>: <code>span</code> (default), <code>div</code> 
– <code>wrapper_class</code>, <code>item_class</code>, <code>label_class</code>, <code>value_class</code>: extra CSS classes
<h3>Styling the shortcode</h3>
Paste this CSS into Appearance → Customize → Additional CSS (or your theme stylesheet): 
 `css 
/* YEB Visits – public stats */ 
.yeb-visits-stats { 
 display: inline-flex; 
 gap: .75rem; 
 align-items: baseline; 
 font: 500 14px/1.3 system-ui, -apple-system, Segoe UI, Roboto, Helvetica, Arial, sans-serif; 
} 
.yeb-visits-stats.yeb–layout-stack { 
 display: inline-grid; 
 gap: .35rem; 
} 
.yeb-visits-stats .yeb-metric { 
 display: inline-flex; 
 gap: .35rem; 
 align-items: baseline; 
 white-space: nowrap; 
} 
.yeb-visits-stats .yeb-metric__label { opacity: .7; } 
.yeb-visits-stats .yeb-metric__value { font-weight: 700; } 
.yeb-visits-stats .yeb-sep { opacity: .35; } 
 “
<h3>Privacy, Cookies & Data Flow</h3>
You choose which extras to enable (location, device details, bot verification). IPs are stored in a way that groups them by network (not exact address). You can limit how often extras are called and how much data is kept.
<h3>External Service & Data Flow (Guideline 6)</h3>
This plugin can optionally call the YEB API to enrich your local analytics. Nothing is sent to YEB until you add an API key in Analytics (YEB) → Settings and enable the related toggle.
Endpoints (HTTPS):
<ul>
<li>GeoIP: <code>{base}/country</code>, <code>{base}/city</code>, <code>{base}/asn</code> (default base: <code>https://api.yeb.to/v1/geoip</code>)</li>
<li>Device analyze: <code>{endpoint}</code> (default: <code>https://api.yeb.to/v1/device-analyze</code>)</li>
<li>Bot verification: <code>{base}</code> or <code>{base}/{vendor}</code> (default base: <code>https://api.yeb.to/v1/bot/detect/detect</code>)</li>
</ul>
What is sent and when:
<ul>
<li>GeoIP Country — IP address; only if API key set and “Country” enabled (purpose: country lookup)</li>
<li>GeoIP City/Region — IP address; only if API key set and “Region & City” enabled (purpose: city/region)</li>
<li>ASN/Network — IP address; only if API key set and “ASN & Network” enabled (purpose: ASN/CIDR)</li>
<li>Device analyze — User-Agent; only if API key set and “Parse user-agent strings” enabled (purpose: browser/OS/device parsing, bot type)</li>
<li>Bot verification — IP + User-Agent; only if API key set and “Bot-Detect” enabled and UA looks like a bot (purpose: verify known crawlers)</li>
</ul>
All requests use HTTPS. The plugin stores analytics locally; enrichment results are cached locally.
YEB policies:
<ul>
<li>Privacy Policy: <a href="https://yeb.to/privacy" rel="nofollow ugc">https://yeb.to/privacy</a></li>
<li>Terms of Service: <a href="https://yeb.to/terms" rel="nofollow ugc">https://yeb.to/terms</a></li>
</ul>
<h3>Cookies</h3>
Two first-party cookies (pseudonymous GUIDs):
<ul>
<li><code>yeb_sid</code> — session id, 30 minutes; groups pageviews into sessions.</li>
<li><code>yeb_vid</code> — visitor id, 1 year; counts returning unique visitors.</li>
</ul>
<h3>Consent & Opt-Out (Guidelines 7 & 9)</h3>
By default, the beacon loads for visitors (logged-in admins excluded unless you enable Track logged-in admins). If your jurisdiction or policy requires consent before placing analytics cookies, gate the beacon with your consent tool.
Example (dequeue until consent):
<pre><code>`php
</code></pre>
/** 
 * Stop the YEB beacon until a custom consent flag is set. 
 * Replace the condition with your CMP’s check. 
 */ 
add_action(‘wp_enqueue_scripts’, function () { 
 $consent_given = isset($_COOKIE[‘my_consent_flag’]) && $_COOKIE[‘my_consent_flag’] === ‘yes’; 
 if ( ! $consent_given ) { 
 wp_dequeue_script(‘waby-visits-beacon’); 
 wp_deregister_script(‘waby-visits-beacon’); 
 } 
}, 100); 
 `
<h3>Public REST Endpoint</h3>
The plugin exposes an intentionally public ingest endpoint used by the front-end beacon:
<pre><code>`
</code></pre>
POST /wp-json/waby/v1/visit 
Alias: POST /wp-json/yeb/v1/visit 
 `
It accepts sanitized visit metadata (URL, path, referrer, UTM, screen, language, etc.) and stores it in your site’s database. It does not expose private data or modify content.
<h3>Data Retention & IP Handling</h3>
<ul>
<li>A salted hash of the visitor IP is stored to group traffic by network.</li>
<li>The raw IP is not stored by default. If you enable Store raw IP (packed), it is retained only for the number of days you set (default 7 days) and is visible to admins only.</li>
<li>During enrichment, the raw IP may be encrypted temporarily and then cleared automatically once enrichment is done or after a short fallback window.</li>
<li>You can limit daily external calls and sampling in Analytics (YEB) → Settings.</li>
</ul>
<h3>Uninstall</h3>
<ul>
<li>If you enable Delete all data on uninstall in settings, uninstalling the plugin will remove its custom tables and options.</li>
<li>Leave it off if you want to keep your analytics data.</li>
</ul>
<h3>Filters & Extensibility</h3>
<ul>
<li><code>waby_visits_stats_output</code> — filter the final HTML of the public stats shortcode.</li>
<li><code>waby_visits_cache_ttl</code> — filter select-query cache TTL (seconds) used by the dashboard and shortcode.</li>
</ul>

Website Analytics by YEB

WordPress analytics: pageviews & sessions with interactions, verified bots, GeoIP, CSV export. Privacy-first.

SFR Analytics vs Website Analytics by YEB