Trackless – Cookieless Analytics

Trackless measures your site’s traffic — and, on WooCommerce stores, your real revenue and margin — entirely server-side. No own analytics cookies, no JavaScript snippet, and consent-banner needs depend on your site setup. You read the reports in your Trackless account dashboard.

Trackless is part of WooModuly.cz, a collection of WordPress and WooCommerce plugins — see https://woomoduly.cz/produkt/trackless/.

How visitors are counted (privacy by design):

• The visitor key is a daily-rotating HMAC-SHA256 hash of IP + User-Agent + day, keyed with a secret salt that exists only on your server. It cannot be reversed and changes every day.
• The raw IP address is never stored and never transmitted — only a keyed hash.
• Global Privacy Control (the Sec-GPC browser signal) is honoured: opted-out visitors are not tracked at all.
• No data is written to the visitor’s browser — no cookies, no localStorage, no fingerprinting scripts.

What it measures:

• Visits and sessions with source / medium / campaign and a GA4-style channel group
• Page views and events: product view, category view, search, add to cart, cart, checkout, 404
• Device, browser, OS, country and language (one row per visitor per day)
• With WooCommerce: orders, revenue, refunds, payment and shipping methods, first-order flag, order attribution (computed server-side from the cookieless visitor match), ordered items — including per-unit purchase cost for margin reporting if you store it (_wc_cog_cost, _alg_wc_cog_cost, _cost or the trackless_wholesale_price filter)

Events are collected into a small queue table in your own database and flushed once a day via WP-Cron (or manually with the “Send now” button). The delivery is HMAC-SHA256 signed and idempotent, so retries are safe.

WooCommerce is optional: on a plain WordPress site you get cookieless web analytics; with WooCommerce you also get the e-commerce metrics.

External service: Trackless (please read)

This plugin is a connector for Trackless (https://trackless.cz), a hosted analytics service. It is not a standalone statistics plugin — the reports live in your Trackless account, and the plugin sends data to the service’s ingest endpoint at https://trackless.cz/ingest.

When data is sent: only after you enter your API key and explicitly tick the Data Processing Agreement (DPA) consent checkbox in the plugin settings. Until you do both, the plugin collects and sends nothing.

What is sent (once a day, HMAC-signed):

• Pseudonymous traffic aggregates: hashed visitor identifiers (keyed HMAC, daily-rotating), hashed IPs, page URLs, referrers, UTM parameters and click IDs, the raw User-Agent (used server-side to derive device/browser/OS and to flag bots — not stored), country code, language
• With WooCommerce: order data including order ID, totals and refunds (amounts), currency, payment method, shipping method, order status, and line items with prices and (if configured) per-unit purchase costs
• Site metadata: site name, domain, timezone, currency, order statuses, product categories, carriers, payment gateway names

IP→country database: to show visitor country on hosting without a geo header (no Cloudflare / GeoIP module), the plugin downloads a small public IP→country database from https://trackless.cz/api/geoip/country.dat.gz (refreshed about once a week) and resolves the country locally — the visitor IP never leaves your server for this. The database is DB-IP Lite by DB-IP (https://db-ip.com), licensed CC BY 4.0.

IP→hosting database: to keep bot farms out of your statistics, the plugin downloads a second public database from https://trackless.cz/api/geoip/hosting.dat.gz (also refreshed about once a week) listing IP ranges that belong to datacentres, clouds and VPNs, and checks the visitor IP against it locally — again the IP never leaves your server. Consumer ISPs and Apple iCloud Private Relay ranges are excluded from that database, so an ordinary customer is not affected. Built from DB-IP ASN Lite by DB-IP (https://db-ip.com), licensed CC BY 4.0.

Hosting network names: alongside the database above, the plugin downloads https://trackless.cz/api/geoip/hosting-networks.json, a small list naming the network operator each range belongs to. It is what lets a visit that was treated as datacentre traffic be traced back to the network responsible, so a mistake can be found and corrected instead of guessed at. Fetched in the same step as the database itself, and like it, nothing about your visitors is sent anywhere.

CDN edge ranges: the plugin downloads a small JSON list of Cloudflare edge IP ranges from https://trackless.cz/api/geoip/cdn.json (also refreshed about once a week). If your site sits behind a CDN, this is what lets the plugin tell a visitor’s own IP from the CDN’s — without it every visitor would look like the same person. A copy ships with the plugin, so this works from the very first request.

None of these three downloads sends anything about your site or your visitors — they are plain requests for public files.

Terms and pricing: Trackless is a paid service with a 30-day free trial; you need a Trackless account and API key to use this plugin.

• Terms of Service: https://trackless.cz/en/obchodni-podminky
• Data Processing Agreement (DPA): https://trackless.cz/en/zpracovatelska-smlouva