james333

VisitStats is a lightweight, privacy-first analytics plugin for WordPress. All your data stays in your own WordPress database — we never see it, no third party sees it.
Why VisitStats?
<ul>
<li>No cookies, no consent banner needed. Tracking is GDPR-friendly by default.</li>
<li>Self-hosted. All data lives in your WordPress database. No external service, no Automattic, no Google.</li>
<li>Lightweight. Frontend tracker is under 2KB. Loads asynchronously. Won’t slow your site.</li>
<li>Zero setup. Install, activate, done. No theme edits, no tag manager, no JS snippets.</li>
<li>Built for WordPress. Reports appear inside your WordPress dashboard — no separate app to log into.</li>
</ul>
Recommended for sites with up to ~10,000 daily pageviews (around 95% of WordPress sites). For very high-traffic sites, consider dedicated analytics services.
What you get (all free, all the time):
<ul>
<li>Real-time visitor count — see who’s on your site right now</li>
<li>Pageviews, unique visitors, sessions</li>
<li>Top pages</li>
<li>Top traffic sources (direct, search, social, AI, referral)</li>
<li>Top referrers — actual URLs sending you traffic</li>
<li>Device breakdown (desktop, mobile, tablet)</li>
<li>Browser & operating system detection</li>
<li>Configurable data retention from 1 day up to 1 year</li>
<li>Date range views: today, 7 days, 30 days, 90 days, 1 year</li>
<li>Engagement signals (scroll depth, time on page)</li>
<li>Cookieless visitor identification using daily-rotating salt + SHA-256 hashing</li>
<li>Bot filtering with built-in bot signature detection</li>
<li>Optional administrator / logged-in user exclusion</li>
<li>Honors Do Not Track browser signal</li>
<li>Automatic data pruning to keep your database lean</li>
<li>Rate-limited tracking endpoint protects against abuse</li>
<li>IP anonymization before hashing — actual IPs never stored</li>
</ul>
Privacy by design
VisitStats never:
<ul>
<li>Sets cookies</li>
<li>Stores IP addresses</li>
<li>Sends data to third parties</li>
<li>Fingerprints visitors</li>
<li>Tracks across days</li>
</ul>
Visitor identification uses a daily-rotating salt hashed with the (anonymized) IP and User Agent to count unique visits within a 24-hour window. The salt regenerates every 24 hours, making cross-day tracking impossible. This is the same approach used by Plausible Analytics and Fathom Analytics.
For developers
<ul>
<li>Clean REST API at <code>/wp-json/visitstats/v1/</code></li>
<li>Filter hooks for customizing behavior (rate limiting, bot detection, etc.)</li>
<li>PSR-style class organization</li>
<li>No external dependencies — pure WordPress core</li>
</ul>

VisitStats

Privacy-first site analytics for self-hosted sites. No cookies, no Google, no data leaves your server. Stats live in your own database.

Pascale

<a href="https://hitkeep.com/" rel="nofollow ugc">HitKeep Analytics</a> connects WordPress to a self-hosted or cloud HitKeep instance. It injects the normal <code>hk.js</code> tracker from your HitKeep instance and keeps data flowing through the core HitKeep ingest pipeline.
The plugin does not add a separate analytics backend, database, queue, or third-party service. It only loads the tracker from the HitKeep instance you configure.
<h3>Privacy-first web analytics for WordPress</h3>
HitKeep is built for teams that want useful web analytics without adopting a heavy analytics stack. The WordPress plugin keeps setup simple: choose your HitKeep instance, save the settings, and the plugin loads the first-party tracker on public pages.
Logged-in WordPress users are skipped by default, so administrators and editors do not pollute public traffic reports. Browser Do Not Track is respected by default.
<h3>Features</h3>
<ul>
<li>EU Cloud, US Cloud, and self-hosted HitKeep options.</li>
<li>Logged-in WordPress users are skipped by default.</li>
<li>Do Not Track is respected by default.</li>
<li>Pageview tracking through HitKeep’s normal <code>hk.js</code> tracker.</li>
<li>Built-in HitKeep automatic events for outbound links, file downloads, and form submissions.</li>
<li>Optional Web Vitals reporting for LCP, INP, CLS, FCP, and TTFB.</li>
<li>Self-hosted URLs may include a path prefix, such as <code>https://www.example.net/hitkeep</code>.</li>
<li>Clear opt-outs for sendBeacon delivery, route changes, outbound links, downloads, and forms.</li>
<li>Shortcut to open the configured HitKeep instance from the settings page.</li>
<li>Snippet preview so site owners can see which tracker attributes will be emitted.</li>
</ul>
<h3>What the plugin does not do</h3>
<ul>
<li>It does not set analytics cookies.</li>
<li>It does not create WordPress analytics tables.</li>
<li>It does not require a tag manager.</li>
<li>It does not load the tracker from a third-party CDN.</li>
<li>It does not collect form field values, request bodies, link text, or URL query strings through automatic events.</li>
</ul>
<h3>Third-party service connection</h3>
This plugin connects to HitKeep. Depending on your settings, it loads JavaScript from and sends analytics data to one of these HitKeep hosts:
<ul>
<li><code>https://cloud.hitkeep.eu</code></li>
<li><code>https://cloud.hitkeep.com</code></li>
<li>Your own self-hosted HitKeep URL</li>
</ul>
<a href="https://hitkeep.com/legal/terms-of-service/" rel="nofollow ugc">HitKeep Cloud terms</a>
<a href="https://hitkeep.com/legal/privacy-policy/" rel="nofollow ugc">HitKeep Cloud privacy policy</a>
Self-hosted installations are controlled by your own HitKeep instance and infrastructure.
<h3>Source code</h3>
The <a href="https://github.com/PascaleBeier/hitkeep" rel="nofollow ugc">main HitKeep project</a> is available on GitHub.

HitKeep Analytics

Adds the first-party HitKeep tracker to WordPress without analytics cookies, third-party CDNs, or a tag manager.

VisitStats vs HitKeep Analytics