james333

VisitStats is a lightweight, privacy-first analytics plugin for WordPress. All your data stays in your own WordPress database — we never see it, no third party sees it.
Why VisitStats?
<ul>
<li>No cookies, no consent banner needed. Tracking is GDPR-friendly by default.</li>
<li>Self-hosted. All data lives in your WordPress database. No external service, no Automattic, no Google.</li>
<li>Lightweight. Frontend tracker is under 2KB. Loads asynchronously. Won’t slow your site.</li>
<li>Zero setup. Install, activate, done. No theme edits, no tag manager, no JS snippets.</li>
<li>Built for WordPress. Reports appear inside your WordPress dashboard — no separate app to log into.</li>
</ul>
Recommended for sites with up to ~10,000 daily pageviews (around 95% of WordPress sites). For very high-traffic sites, consider dedicated analytics services.
What you get (all free, all the time):
<ul>
<li>Real-time visitor count — see who’s on your site right now</li>
<li>Pageviews, unique visitors, sessions</li>
<li>Top pages</li>
<li>Top traffic sources (direct, search, social, AI, referral)</li>
<li>Top referrers — actual URLs sending you traffic</li>
<li>Device breakdown (desktop, mobile, tablet)</li>
<li>Browser & operating system detection</li>
<li>Configurable data retention from 1 day up to 1 year</li>
<li>Date range views: today, 7 days, 30 days, 90 days, 1 year</li>
<li>Engagement signals (scroll depth, time on page)</li>
<li>Cookieless visitor identification using daily-rotating salt + SHA-256 hashing</li>
<li>Bot filtering with built-in bot signature detection</li>
<li>Optional administrator / logged-in user exclusion</li>
<li>Honors Do Not Track browser signal</li>
<li>Automatic data pruning to keep your database lean</li>
<li>Rate-limited tracking endpoint protects against abuse</li>
<li>IP anonymization before hashing — actual IPs never stored</li>
</ul>
Privacy by design
VisitStats never:
<ul>
<li>Sets cookies</li>
<li>Stores IP addresses</li>
<li>Sends data to third parties</li>
<li>Fingerprints visitors</li>
<li>Tracks across days</li>
</ul>
Visitor identification uses a daily-rotating salt hashed with the (anonymized) IP and User Agent to count unique visits within a 24-hour window. The salt regenerates every 24 hours, making cross-day tracking impossible. This is the same approach used by Plausible Analytics and Fathom Analytics.
For developers
<ul>
<li>Clean REST API at <code>/wp-json/visitstats/v1/</code></li>
<li>Filter hooks for customizing behavior (rate limiting, bot detection, etc.)</li>
<li>PSR-style class organization</li>
<li>No external dependencies — pure WordPress core</li>
</ul>

VisitStats

Privacy-first site analytics for self-hosted sites. No cookies, no Google, no data leaves your server. Stats live in your own database.

bobvann

This is a plugin which integrates Google Analytics into your blog or website, but in a different way. It does not install any cookie from analytics, but it does use a php ajax backend which stores the data in php SESSION, which is preserved using a cookie, but a first party technical cookie.

CookieLess Google Analytics

Simple plugin which integrates Google Analytics in your website without using third party cookies

VisitStats vs CookieLess Google Analytics