dominikshaim

Trackless measures your site’s traffic — and, on WooCommerce stores, your real revenue and margin — entirely server-side. No cookies, no JavaScript snippet, no consent banner slowing your pages down. You read the reports in your Trackless account dashboard.
How visitors are counted (privacy by design):
<ul>
<li>The visitor key is a daily-rotating HMAC-SHA256 hash of IP + User-Agent + day, keyed with a secret salt that exists only on your server. It cannot be reversed and changes every day.</li>
<li>The raw IP address is never stored and never transmitted — only a keyed hash.</li>
<li>Global Privacy Control (the <code>Sec-GPC</code> browser signal) is honoured: opted-out visitors are not tracked at all.</li>
<li>No data is written to the visitor’s browser — no cookies, no localStorage, no fingerprinting scripts.</li>
</ul>
What it measures:
<ul>
<li>Visits and sessions with source / medium / campaign and a GA4-style channel group</li>
<li>Page views and events: product view, category view, search, add to cart, cart, checkout, 404</li>
<li>Device, browser, OS, country and language (one row per visitor per day)</li>
<li>With WooCommerce: orders, revenue, refunds, payment and shipping methods, first-order flag, order attribution (WooCommerce 8.5+ Order Attribution), ordered items — including per-unit purchase cost for margin reporting if you store it (<code>_wc_cog_cost</code>, <code>_alg_wc_cog_cost</code>, <code>_cost</code> or the <code>trackless_wholesale_price</code> filter)</li>
</ul>
Events are collected into a small queue table in your own database and flushed once a day via WP-Cron (or manually with the “Send now” button). The delivery is HMAC-SHA256 signed and idempotent, so retries are safe.
WooCommerce is optional: on a plain WordPress site you get cookieless web analytics; with WooCommerce you also get the e-commerce metrics.
<h4>External service: Trackless (please read)</h4>
This plugin is a connector for Trackless (https://trackless.cz), a hosted analytics service. It is not a standalone statistics plugin — the reports live in your Trackless account, and the plugin sends data to the service’s ingest endpoint at <code>https://trackless.cz/ingest</code>.
When data is sent: only after you enter your API key and explicitly tick the Data Processing Agreement (DPA) consent checkbox in the plugin settings. Until you do both, the plugin collects and sends nothing.
What is sent (once a day, HMAC-signed):
<ul>
<li>Anonymous traffic aggregates: hashed visitor identifiers (keyed HMAC, daily-rotating), hashed IPs, page URLs, referrers, UTM parameters and click IDs, the raw User-Agent (used server-side to derive device/browser/OS and to flag bots — not stored), country code, language</li>
<li>With WooCommerce: order data including order ID, totals and refunds (amounts), currency, payment method, shipping method, order status, attribution, and line items with prices and (if configured) per-unit purchase costs</li>
<li>Site metadata: site name, domain, timezone, currency, order statuses, product categories, carriers, payment gateway names</li>
</ul>
IP→country database: to show visitor country on hosting without a geo header (no Cloudflare / GeoIP module), the plugin downloads a small public IP→country database from <code>https://trackless.cz/api/geoip/country.dat.gz</code> (refreshed about once a week) and resolves the country locally — the visitor IP never leaves your server for this. The database is DB-IP Lite by DB-IP (https://db-ip.com), licensed CC BY 4.0.
Terms and pricing: Trackless is a paid service with a 30-day free trial; you need a Trackless account and API key to use this plugin.
<ul>
<li>Terms of Service: https://trackless.cz/en/obchodni-podminky</li>
<li>Data Processing Agreement (DPA): https://trackless.cz/en/zpracovatelska-smlouva</li>
</ul>

Trackless

Cookieless server-side analytics. No cookies, no JS, no banner: traffic, sources and devices; with WooCommerce also orders, revenue and margin.

james333

VisitStats is a lightweight, privacy-first analytics plugin for WordPress. All your data stays in your own WordPress database — we never see it, no third party sees it.
Why VisitStats?
<ul>
<li>No cookies, no consent banner needed. Tracking is GDPR-friendly by default.</li>
<li>Self-hosted. All data lives in your WordPress database. No external service, no Automattic, no Google.</li>
<li>Lightweight. Frontend tracker is under 2KB. Loads asynchronously. Won’t slow your site.</li>
<li>Zero setup. Install, activate, done. No theme edits, no tag manager, no JS snippets.</li>
<li>Built for WordPress. Reports appear inside your WordPress dashboard — no separate app to log into.</li>
</ul>
Recommended for sites with up to ~10,000 daily pageviews (around 95% of WordPress sites). For very high-traffic sites, consider dedicated analytics services.
What you get (all free, all the time):
<ul>
<li>Real-time visitor count — see who’s on your site right now</li>
<li>Pageviews, unique visitors, sessions</li>
<li>Top pages</li>
<li>Top traffic sources (direct, search, social, AI, referral)</li>
<li>Top referrers — actual URLs sending you traffic</li>
<li>Device breakdown (desktop, mobile, tablet)</li>
<li>Browser & operating system detection</li>
<li>Configurable data retention from 1 day up to 1 year</li>
<li>Date range views: today, 7 days, 30 days, 90 days, 1 year</li>
<li>Engagement signals (scroll depth, time on page)</li>
<li>Cookieless visitor identification using daily-rotating salt + SHA-256 hashing</li>
<li>Bot filtering with built-in bot signature detection</li>
<li>Optional administrator / logged-in user exclusion</li>
<li>Honors Do Not Track browser signal</li>
<li>Automatic data pruning to keep your database lean</li>
<li>Rate-limited tracking endpoint protects against abuse</li>
<li>IP anonymization before hashing — actual IPs never stored</li>
</ul>
Privacy by design
VisitStats never:
<ul>
<li>Sets cookies</li>
<li>Stores IP addresses</li>
<li>Sends data to third parties</li>
<li>Fingerprints visitors</li>
<li>Tracks across days</li>
</ul>
Visitor identification uses a daily-rotating salt hashed with the (anonymized) IP and User Agent to count unique visits within a 24-hour window. The salt regenerates every 24 hours, making cross-day tracking impossible. This is the same approach used by Plausible Analytics and Fathom Analytics.
For developers
<ul>
<li>Clean REST API at <code>/wp-json/visitstats/v1/</code></li>
<li>Filter hooks for customizing behavior (rate limiting, bot detection, etc.)</li>
<li>PSR-style class organization</li>
<li>No external dependencies — pure WordPress core</li>
</ul>

VisitStats

Privacy-first site analytics for self-hosted sites. No cookies, no Google, no data leaves your server. Stats live in your own database.

Trackless vs VisitStats