Name: Statable Analytics
Author: Statable

Statable is privacy-first, cookie-free web analytics. This plugin adds the Statable tracking script to your site and excludes logged-in admins (and any roles you choose) from your stats.

A tour of Statable itself — the service this plugin connects to. What it shows is what the plugin draws inside wp-admin, on the Statistics tab.

Cookie-free, with no persistent identifier: the visitor hash is keyed with a server-side secret, unique to your website, and changes every day — and neither the IP address nor the user-agent is stored.
Your statistics in wp-admin — visitors, pageviews, a daily chart, your top pages, sources, countries and devices, and your own custom events, goals, properties and funnels, drawn natively rather than framed from elsewhere.
Lightweight (~2 KB compressed), loaded deferred — no impact on page speed.
Excludes administrators from tracking out of the box.
Optional public widget — a visitor map, a 3D globe, top countries or a live counter — placed with the Statable block or a shortcode.
Set up in two steps, without leaving your WordPress dashboard.

Setup happens entirely in your dashboard: enter your email, type the code we send you, and the plugin creates your site and starts tracking. Nothing to copy between tabs. If you already have a Statable account, use the same email and this site is added to it.

What it costs

Statable is a paid service, and this plugin is the WordPress client for it. Every new account starts with a 30-day trial that needs no card; after it, plans run from $9 a month for 10,000 monthly pageviews across all your sites. Sites on a .edu, .github.io or .gitlab.io domain are free for as long as they display one of the public widgets. Current prices are always at https://statable.com/pricing — the plugin itself is free and GPL, and stays useful for as long as the account behind it is active.

External services

This plugin connects to Statable, a third-party analytics service operated by Key Arg B.V. (Netherlands), to collect and display website analytics.

The plugin contacts Statable in five distinct ways.

1. Visitor tracking (every front-end page view)

What it does: loads the Statable tracking script (https://statable.com/js/...) on your front end, which sends pageview and engagement events to https://statable.com/api/event.
What data is sent: the visited URL, the referrer, and the visitor’s IP address and user-agent. No cookies are set. The IP address and user-agent are used in transit only: they are combined with your website’s id and the current date into a hash, keyed with a secret held on our servers, that identifies a visitor for that one day on that one website, and neither is written to the analytics database — what is stored is the hash plus what was derived from them, such as country, browser and device. Because the same person can still be recognised within a day, this is pseudonymous data rather than anonymous data — see the Privacy Policy.
When: on each front-end page view by a visitor who is not excluded.

2. Public widgets (only on pages where you placed one)

What it does: if you add the Statable block or the [statable_widget] shortcode to a page, that page loads the widget’s script from https://statable.com/js/... and the widget then reads the figures it displays — countries, cities, the live visitor count — from https://statable.com/api/widget/.... Those are your site’s own aggregated statistics, the same ones a public share link shows; no visitor is identified by them.
What data is sent: the request for the script and for the aggregated figures carries the visitor’s IP address and user-agent, as any web request does; nothing else. The widget script also contains the tracker, which sends the request described in (1) to https://statable.com/api/event from every page showing a widget — for every visitor, including excluded roles, and also when tracking is switched off in the plugin. The plugin gives that copy of the tracker no site identifier, so Statable does not record it as a pageview.
When: only on pages where you placed a widget. To resolve a widget’s script address, the plugin’s admin screens ask https://statable.com/api/v1/sites/{id}/snippet once and cache the answer; a visitor’s page never makes that request.

3. Setting up your account (only when you connect, from wp-admin)

What it does: creates or signs you in to a Statable account and creates a site for this install, so you never have to copy identifiers between tabs.
What is sent, and when:
- When you submit your email: that address, to https://statable.com/api/v1/auth/send-otp, so a one-time code can be mailed to you.
- When you submit the code: the address, the code, and your acceptance of the Terms, to https://statable.com/api/v1/auth/verify-otp. Statable records the acceptance with its date and the IP the request came from. In return the plugin receives an API key, which it stores in your site’s database.
- Immediately after: your site URL and timezone, to https://statable.com/api/v1/sites, to create the site.
Nothing in this group happens unless an administrator starts the connect flow. You can disconnect at any time on the plugin’s settings screen, which deletes the stored key from your database.

4. Reading your statistics (only while an administrator is looking at them)

What it does: reads the numbers shown on the plugin’s Statistics tab from https://statable.com/api/v1/query, https://statable.com/api/v1/current-visitors, https://statable.com/api/v1/props, https://statable.com/api/v1/funnels, https://statable.com/api/v1/sites and https://statable.com/api/v1/subscription, using the stored API key. The Settings tab additionally reads your site’s tracking-script and hostname settings from https://statable.com/api/v1/sites/{id}/settings/tracking and .../settings/hostnames.
What is sent: your site’s Statable id, the chosen period, and the requested metrics. No visitor data and no content from your WordPress site leaves your server in these requests.
When: when an administrator opens the plugin’s screens. Answers are cached briefly, so a refresh does not repeat the request. Nothing is requested while a visitor loads your site.

5. Changing three of your Statable settings (only when an administrator asks)

What it does: writes the setting you just changed back to Statable — the tracking script’s feature list to https://statable.com/api/v1/sites/{id}/settings/tracking, your site’s timezone to https://statable.com/api/v1/sites/{id}, and your hostname to https://statable.com/api/v1/sites/{id}/settings/hostnames.
What is sent: only the value being changed, with the stored API key. No visitor data.
When: never on its own — only when an administrator presses the corresponding button on the plugin’s Settings tab. Every other Statable setting is a link out to your dashboard, not something this plugin writes.

Statable Terms of Use: https://statable.com/terms
Statable Privacy Policy: https://statable.com/privacy