- 2026-05-27
- by LethaldiranMX
- Trends
- 0 Comments
DeveloperPrivacy-first site analytics for self-hosted sites. No cookies, no Google, no data leaves your server. Stats live in your own database.
VisitStats is a lightweight, privacy-first analytics plugin for WordPress. All your data stays in your own WordPress database — we never see it, no third party sees it.
Why VisitStats?
- No cookies, no consent banner needed. Tracking is GDPR-friendly by default.
- Self-hosted. All data lives in your WordPress database. No external service, no Automattic, no Google.
- Lightweight. Frontend tracker is under 2KB. Loads asynchronously. Won’t slow your site.
- Zero setup. Install, activate, done. No theme edits, no tag manager, no JS snippets.
- Built for WordPress. Reports appear inside your WordPress dashboard — no separate app to log into.
Recommended for sites with up to ~10,000 daily pageviews (around 95% of WordPress sites). For very high-traffic sites, consider dedicated analytics services.
What you get (all free, all the time):
- Real-time visitor count — see who’s on your site right now
- Pageviews, unique visitors, sessions
- Top pages
- Top traffic sources (direct, search, social, AI, referral)
- Top referrers — actual URLs sending you traffic
- Device breakdown (desktop, mobile, tablet)
- Browser & operating system detection
- Configurable data retention from 1 day up to 1 year
- Date range views: today, 7 days, 30 days, 90 days, 1 year
- Engagement signals (scroll depth, time on page)
- Cookieless visitor identification using daily-rotating salt + SHA-256 hashing
- Bot filtering with built-in bot signature detection
- Optional administrator / logged-in user exclusion
- Honors Do Not Track browser signal
- Automatic data pruning to keep your database lean
- Rate-limited tracking endpoint protects against abuse
- IP anonymization before hashing — actual IPs never stored
Privacy by design
VisitStats never:
- Sets cookies
- Stores IP addresses
- Sends data to third parties
- Fingerprints visitors
- Tracks across days
Visitor identification uses a daily-rotating salt hashed with the (anonymized) IP and User Agent to count unique visits within a 24-hour window. The salt regenerates every 24 hours, making cross-day tracking impossible. This is the same approach used by Plausible Analytics and Fathom Analytics.
For developers
- Clean REST API at
/wp-json/visitstats/v1/ - Filter hooks for customizing behavior (rate limiting, bot detection, etc.)
- PSR-style class organization
- No external dependencies — pure WordPress core
