VisitStats

VisitStats is a lightweight, privacy-first analytics plugin for WordPress. All your data stays in your own WordPress database — we never see it, no third party sees it.

Why VisitStats?

• No cookies, no consent banner needed. Tracking is GDPR-friendly by default.
• Self-hosted. All data lives in your WordPress database. No external service, no Automattic, no Google.
• Lightweight. Frontend tracker is under 2KB. Loads asynchronously. Won’t slow your site.
• Zero setup. Install, activate, done. No theme edits, no tag manager, no JS snippets.
• Built for WordPress. Reports appear inside your WordPress dashboard — no separate app to log into.

Recommended for sites with up to ~10,000 daily pageviews (around 95% of WordPress sites). For very high-traffic sites, consider dedicated analytics services.

What you get (all free, all the time):

• Real-time visitor count — see who’s on your site right now
• Pageviews, unique visitors, sessions
• Top pages
• Top traffic sources (direct, search, social, AI, referral)
• Top referrers — actual URLs sending you traffic
• Device breakdown (desktop, mobile, tablet)
• Browser & operating system detection
• Configurable data retention from 1 day up to 1 year
• Date range views: today, 7 days, 30 days, 90 days, 1 year
• Engagement signals (scroll depth, time on page)
• Cookieless visitor identification using daily-rotating salt + SHA-256 hashing
• Bot filtering with built-in bot signature detection
• Optional administrator / logged-in user exclusion
• Honors Do Not Track browser signal
• Automatic data pruning to keep your database lean
• Rate-limited tracking endpoint protects against abuse
• IP anonymization before hashing — actual IPs never stored

Privacy by design

VisitStats never:

• Sets cookies
• Stores IP addresses
• Sends data to third parties
• Fingerprints visitors
• Tracks across days

Visitor identification uses a daily-rotating salt hashed with the (anonymized) IP and User Agent to count unique visits within a 24-hour window. The salt regenerates every 24 hours, making cross-day tracking impossible. This is the same approach used by Plausible Analytics and Fathom Analytics.

For developers

• Clean REST API at /wp-json/visitstats/v1/
• Filter hooks for customizing behavior (rate limiting, bot detection, etc.)
• PSR-style class organization
• No external dependencies — pure WordPress core