Honest Analytics

01 / SOURCE DETAILS

About this tool

Honest Analytics counts your traffic and shows it in the WordPress admin. Nothing is sent anywhere, and nothing is stored that could identify a visitor later. See it running Click around a live dashboard with a year of seeded traffic before you install anything – one-click sign-in, no account needed: demo.honest-analytics.com . What it never stores No IP addresses. Not in a table, not in a log, not in a cache key, not in the write spool. The address exists as a variable inside one function, is hashed, and is gone. No full referrer URLs. Only the host. ?token=… never reaches disk. No full user-agent strings. Parsed into browser, operating system and device type, then discarded. No permanent raw pageview records. Individual hits remain only in the write spool or queue until they are folded into aggregate rollups, then are deleted. No cookies in the default configuration. No third parties in the counting. No telemetry, no CDN, no fonts, no map tiles, no licence check, no update check. Measuring a visit never leaves your server. The only request that goes anywhere else is one you start yourself – importing your history from Google Analytics – and it is described under External services below. How it counts people without identifying them A visitor is a short hash of a random daily salt, the address, the user agent and the site. The salt is overwritten in place every 24 hours, so yesterday’s hashes cannot be recomputed by anybody – including somebody holding your database. Uniqueness is estimated from a fixed-size sketch stored on the rollup row, accurate to about ±1.6%. It holds no identifiers and cannot be asked whether it contains a particular person. This is why unique visitors are daily estimates , not people, and why the plugin says so on every screen that shows the number. The same person visiting on three days counts three times. There is no honest way to produce a cross-day or lifetime unique-visitor figure from this model, so the plugin does not offer one. It works behind a page cache The server counts the requests it sees. A 1.9 KB first-party script confirms the rest from the browser. A nonce reconciles the two – consumed once per visitor , not once per nonce – so one piece of cached HTML served to a thousand people counts a thousand times. No cache exclusions. No hole punching. No cache-plugin add-on. Tested with WP Rocket, W3 Total Cache, LiteSpeed, WP Super Cache, Cache Enabler, SG Optimizer, NitroPack and Cloudflare. It respects opt-out signals A request carrying Sec-GPC: 1 is not counted, not queued, and is sent no tracker at all. On by default. Do Not Track is supported the same way, off by default. Storage that does not grow with your traffic Storage grows with dimensions × time, not pageviews × time. A site with a hundred thousand views a day uses roughly the same disk as one with a hundred. Hourly detail is kept for a week, then compacted to daily; everything is deleted at 36 months at the latest. What is in this free edition Dashboard, with pageviews, daily unique visitors, sessions and bounce rate Real-time visitors Pages, and a detail view for any one page Content, by post type, taxonomy and author Sources, and referring hosts Devices, browsers and operating systems Privacy, which states exactly what this site stores and what it does not CSV and JSON export from every report Import your history from Google Analytics, WP Statistics and others A signed, read-only reporting API, off until you connect a tool to it Two dashboard widgets, a Views column on your post lists, and an analytics panel in the editor WP-CLI commands, and multisite support There are no artificial limits. No row caps, no retention caps, no date-range caps, no nag screens and no countdowns. The free edition is a product, not a trial. What the paid edition adds Campaigns, locations, events, goals, funnels, crawler reporting, client-shareable report links, Search Console query data, scheduled email summaries, and integrations with Contact Form 7, Gravity Forms, WooCommerce, WPForms and Ninja Forms. Details are at the plugin’s homepage. It is a one-off payment with no subscription, and it reads the same tables this edition writes – upgrading moves no data and loses no history. None of it is in this plugin. The paid edition is a separate download, and the code for those reports is removed when this one is packaged rather than switched off – so there is no key to enter here, nothing to unlock, and nothing that stops working. On compliance This plugin is cookieless by default and is designed not to require an analytics consent banner in its default configuration . Whether that is true of your site depends on your site, your jurisdiction and what else you run, and this plugin cannot tell you that – nobody’s plugin can. What it can do is tell you exactly what it stores, which the Privacy screen does, in plain words, so that the person advising you has something factual to work from. Source and releases The free edition’s full source and every release are on GitHub: github.com/Coysh-Digital/wp-honest-analytics . External services This plugin makes no outbound request in the course of measuring your traffic. Nothing about your site or your visitors is sent to us or to anybody else, and there is no telemetry, licence check or update check in the free edition. One feature contacts somewhere else, and one more answers a request from somewhere else. Both are optional, both are started by an administrator, and neither runs unless you use it. Google Analytics, when you import your history If you choose to bring your history over from Google Analytics, the plugin talks to Google on your behalf, using a Google Cloud client that belongs to you and credentials you enter yourself. Nothing happens until you connect an account on the Import screen, and disconnecting revokes the token. What it contacts: accounts.google.com – to send you to Google’s own sign-in screen so you can grant access. oauth2.googleapis.com – to exchange that grant for an access token, and to revoke it when you disconnect. analyticsadmin.googleapis.com – to list the Analytics properties your account can see, so you can pick one. analyticsdata.googleapis.com – to read the historical figures for the property and date range you choose. What is sent: your own OAuth credentials, the property identifier you picked, and the date range and metrics being requested. No data about your WordPress site, its visitors or its content is sent. The access is read-only – the plugin asks for the analytics.readonly scope and nothing more. This is Google’s service, governed by Google’s terms and privacy policy, not ours: terms , privacy policy . The API is documented at Google Analytics Data API . A reporting tool you connect, if you connect one The plugin can let an external reporting tool read this site’s figures. It is off until an administrator pastes a connection code into Analytics -> Reporting API , and clearing that code switches it off again. This one runs the other way round from the one above: the plugin makes no request, it answers one. A tool holding the code can ask for the same aggregate figures the dashboard already shows – pageviews, sessions, bounce rate, top pages, sources, devices – for a date range it names. Requests are signed with the code rather than carrying it, are refused if the signature is older than a few minutes or is replayed, and are read-only. There is no visitor-level data in the reply because there is none in the tables. Which tool that is, and whose terms govern it, is your choice: the plugin has no service of its own at the other end and no address built into it. Nothing is sent anywhere until you save a code. What is not a third party Once a day the plugin asks your own site two questions: whether the collection endpoint still answers, and whether the write spool is readable over the web. Those are HTTP requests, so they show up in a search for wp_remote_get , but they go to your own address and nowhere else. They exist because neither fact can be settled any other way – a security plugin can disable the REST API without saying so, and the rule written at activation does nothing on nginx.

02 / SOURCE DETAILS

Getting started

Upload the plugin and activate it. Visit Analytics in the admin menu. If your site is behind a full-page cache, read Scheduling – WP-Cron barely runs on a cached site, and aggregation needs a real schedule. Requires WordPress 6.4+, PHP 8.1+, MySQL 5.7+ or MariaDB 10.4+.

03 / SOURCE DETAILS

Frequently asked questions

Do I need a cookie banner? In the default configuration no cookie is set, no identifier persists past the day, nothing is stored per person and no third party is involved. Many operators treat that as outside consent requirements. Whether it is outside yours is a question for whoever advises you on it – this plugin will not tell you that you are compliant, because it is not in a position to know. The Privacy screen states exactly what the configuration permits, in as many words, so that conversation can start from facts. Why are my numbers different from Google Analytics? Usually higher, because content blockers do not stop server-side counting. Where they are lower it is normally GPC: visitors who ask not to be counted are not counted, at all. Can I import my history from Google Analytics? Yes, and from the free edition – GA4 import is not held back for the paid one. Analytics -> Import data connects to the property, shows you the range Google has, and brings it across a chunk at a time; progress is saved as it goes, so you can close the tab and come back. Only permission to read is requested, nothing is written back to Google, and the connection can be removed from the same screen. The one-off part is Google’s: nothing may read your analytics until you have registered the thing asking. That is free, needs no card, and takes about five minutes. The Import screen prints each step with your own site’s values already filled in. WP Statistics and Independent Analytics import too, and those need no setup at all – the data is already in your database. Expect pageviews to line up closely and visitor counts not to: GA4 counts users its own way, and a unique visitor here is a daily estimate. Importing the same dates again replaces what was imported before rather than doubling it. Why do unique visitors not add up across days? Because the identity is destroyed every 24 hours. Unique visitors are daily estimates, and adding two days together would double-count anybody who came on both. The plugin merges the underlying sketches rather than summing them, and says so wherever the number appears. Does it work without JavaScript? Yes, in server mode. In the default hybrid mode a visitor without JavaScript is still counted by the server, as long as the page was not served from cache. Can I export my data? Yes. CSV and JSON from every report screen, and through WP-CLI, in the free edition. Exports are protected against spreadsheet formula injection. Do I need cron, or a terminal? Neither. Counting works on hosting with no scheduled tasks at all: ordinary page views drive the drain, the nightly tidy-up runs from the first admin page load of the day, and the identity salt rotates lazily when it falls due. Maintenance also has buttons on the Settings screen, so nothing the plugin needs doing requires WP-CLI. If you do have cron, it makes the figures slightly fresher on a busy site, and that is all it changes. Does it support multisite? Yes. Each site gets its own tables, settings and reports. Does it phone home? No. Nothing about your site, your traffic or your use of the plugin is ever sent anywhere, and there is nothing in it that reports back – no telemetry, no licence check, no update check, no remote configuration. The plugin makes one kind of outbound request, which you start and which sends us nothing: importing your history from Google Analytics. It can also answer a reporting tool you connect to it, which is off unless you do. It calls your own site once a day to check that the collection endpoint answers and that the write spool is not readable over the web. External services below says exactly what each one is. What happens to my data if I upgrade to the paid edition? Nothing. Both editions read and write the same tables, so your history appears unchanged. Downgrading is equally safe: the tables are left alone and the paid reports simply stop being rendered. What happens if I delete the plugin? By default the tables are kept, because the rollups cannot be rebuilt from anything else – there is no raw hit data to replay. Deleting them is an option on the Settings screen that you have to choose deliberately.

Explore related topics