Name: Vireo Analytics – Cookieless WordPress Stats & Google Analytics Alternative
Rating: 5 (6 reviews)
Author: RebelCode

Vireo Analytics is self-hosted, cookieless analytics for WordPress. Visitor data stays in your own database. It brings your history with you when you switch, shows the Google searches behind each post, and weighs what AI crawlers take from your site against the readers AI assistants send back.

Bring your history with you

Vireo imports your daily traffic, pages, referrers, countries and devices from Google Analytics 4. It also imports from Koko Analytics, Jetpack Stats, Statify, WP Statistics, Burst Statistics, Independent Analytics, SlimStat, Post Views Counter, Matomo, Plausible, Fathom Analytics, Simple Analytics, Cloudflare Web Analytics and Clicky. On a site connected to Jetpack, that import needs no API key. Imports stop the day before Vireo’s own data begins, so no day is counted twice. The switching guides show what comes across from each tool.

The searches behind each post

Connect Search Console once and every post’s stats screen lists the searches it appeared for, with clicks, impressions and average position.

What AI takes, and what it sends back

Vireo reports ChatGPT, Claude, Gemini, Perplexity and Copilot as their own traffic source. Next to the readers they send, Vireo counts the pages their crawlers fetched, so you can see the ratio for your own site. Assistants that fetch a page because a reader asked get their own list, apart from crawlers.

The AI visibility scan fetches a page the way an AI crawler does and lists what could be keeping crawlers out: robots.txt rules, a firewall answering GPTBot or ClaudeBot with an error, text that only appears with JavaScript, a missing sitemap. Each failed check says how to fix it.

Numbers you can check

Vireo keeps known crawlers, AI trainers, SEO tools, uptime monitors and headless browsers out of your numbers and reports how many it excluded and why. The bot directory lists them all.

When a visit you expected isn’t in the report, “Why wasn’t my visit counted?” under Settings, Tracking checks your browser against every exclusion, Do Not Track, the bot filter and consent, and tests that the tracker loads and the collector answers. Each reason comes with the setting to change. A Privacy check tab marks each privacy setting Good or Worth a look and writes a “what this site collects” statement for your privacy policy.

Headless WordPress and your other sites

If visitors read your posts on an Astro, Next.js or other front end, or you run a static or docs site next to WordPress, paste one script tag into it and switch between sites on the Overview. Pageviews are matched to the WordPress post they show. One connected site is free.

Everything else

An Overview that opens with what changed and why, then top pages, referrers by channel (email included), countries and devices, each filterable.
Average time on page and bounce rate, and Core Web Vitals from your real visitors with Google’s PageSpeed test one click away.
Chart notes that pin the likely cause of a spike or dip (a post update, a plugin or WordPress update), your own notes, and a Year in review for any year with data.
Form submissions and signups from Contact Form 7, Gravity Forms, Ninja Forms, Formidable, Forminator, Fluent Forms, Jetpack Forms and other form plugins, recorded as events with nothing the visitor typed, plus custom events, a most-clicked links report and 404 tracking.
A Popular posts block, widget and shortcode builder, an email digest, and CSV export in plain, Excel-friendly or tab-separated form.
An MCP server, so Claude, Cursor or any other AI assistant can answer questions about your traffic from the real numbers, plus a REST API and WordPress Abilities.
Read-only dashboard access for editors or clients, and multisite support.
Translated into German, Spanish, French, Italian, Japanese, Dutch, Portuguese (Portugal and Brazil) and Russian.

Vireo Pro: see what earns money and report it

For sites that sell, run campaigns or report to clients:

Revenue from WooCommerce, Easy Digital Downloads, FluentCart and Freemius, traced to the page and source that brought each buyer, with goals and funnels.
Orders and revenue for each UTM campaign, QR codes and short links, and affiliate clicks by the page they came from.
Heatmaps of where visitors click and scroll.
A report builder for scheduled email reports, and client dashboards with an expiry date, a password and your logo.
A live view, entry and exit pages, on-site search analytics, and CSV data feeds for spreadsheets.
The pages AI assistants send readers to, alerts when AI crawlers drop off, and weekly scans of what ChatGPT, Claude and Gemini say about your site.

Pro starts at $60 for the first year on one site, with a 30-day money-back guarantee. See Vireo Pro and pricing.

Privacy

Vireo sets no cookies and stores nothing on visitors’ devices. Vireo counts visitors with a salted hash that changes every day and honours Do Not Track and Global Privacy Control. It never sends visitor data to RebelCode or anyone else; the only outside services are the ones you choose to connect, listed under External services below.

External services

This plugin includes an optional importer for historical Jetpack Stats data. When (and only when) a site owner runs that importer from Vireo Analytics Settings Import data, the plugin calls the WordPress.com Stats API to retrieve the site’s existing pageview, referrer, and top-post history. On a site connected to Jetpack it reads https://public-api.wordpress.com/rest/v1.1/sites/{site ID}/stats/ through Jetpack’s own connection; with an API key it reads https://stats.wordpress.com/csv.php.

What is sent:

Over the Jetpack connection: the site’s WordPress.com site ID and the request signed with the connection Jetpack already holds.
With an API key: the WordPress.com API key the site owner pastes into the import screen, and the site address whose stats are being imported.
A requested date range and report name (e.g. views, referrers, top-posts).

What is not sent: no visitor data, no user data, no site content, no credentials beyond Jetpack’s existing connection or the API key the site owner entered.

When it is sent: only while the import is actively running, in response to a site owner clicking “Run Import”. No background or recurring calls are made.

The Stats API is provided by Automattic Inc. (WordPress.com).

The importer is entirely optional.

Google Analytics (optional, importer)

When a site owner runs the Google Analytics importer, the plugin signs a request with the service-account key they pasted and calls https://oauth2.googleapis.com/token for an access token, then https://analyticsdata.googleapis.com to read that property’s history.

What is sent: the service account’s own credentials and a date range. No visitor data, no site content, nothing about anyone reading the site.

When it is sent: while an import is running, in response to a site owner starting one. The key can be removed from the same screen afterwards.

Cloudflare Web Analytics (optional, importer)

When a site owner runs the Cloudflare Web Analytics importer, the plugin calls https://api.cloudflare.com/client/v4/graphql with the API token they entered to read that site’s history.

What is sent: the API token, the account ID, the website and a date range. No visitor data, no site content, nothing about anyone reading the site.

When it is sent: while an import is running, in response to a site owner starting one. The token can be removed from the same screen afterwards.

The API is provided by Cloudflare.

Matomo (optional, importer)

When a site owner runs the Matomo importer, the plugin calls the Reporting API at the Matomo address they entered to read that site’s history. For a self-hosted Matomo, the data goes to the site owner’s own Matomo server and to no third party.

What is sent: the auth token (in the request body), the site ID and a date range. No visitor data, no site content, nothing about anyone reading the site.

When it is sent: while an import is running, in response to a site owner starting one. The token can be removed from the same screen afterwards.

For a Matomo Cloud address, the Matomo Cloud privacy policy applies.

Fathom Analytics (optional, importer)

When a site owner runs the Fathom Analytics importer, the plugin calls https://api.usefathom.com/v1/aggregations with the API token they entered to read that site’s history.

What is sent: the API token, the Fathom site ID and a date range. No visitor data, no site content, nothing about anyone reading the site.

When it is sent: while an import is running, in response to a site owner starting one. The token can be removed from the same screen afterwards.

The API is provided by Fathom Analytics.

Simple Analytics (optional, importer)

When a site owner runs the Simple Analytics importer, the plugin calls the Stats API at https://simpleanalytics.com/ for the website they entered, with their API key, to read its history.

What is sent: the API key, the website’s hostname and a date range. No visitor data, no site content, nothing about anyone reading the site.

When it is sent: while an import is running, in response to a site owner starting one. The key can be removed from the same screen afterwards.

The Stats API is provided by Simple Analytics.

Clicky (optional, importer)

When a site owner runs the Clicky importer, the plugin calls https://api.clicky.com/api/stats/4 with the site ID and sitekey they entered to read that site’s history.

What is sent: the site ID, the sitekey and a date range. No visitor data, no site content, nothing about anyone reading the site.

When it is sent: while an import is running, in response to a site owner starting one. The sitekey can be removed from the same screen afterwards.

The API is provided by Clicky.

Google Search Console (optional)

When a site owner connects Search Console, the plugin authenticates the same way and calls https://searchconsole.googleapis.com to read the searches that led people to the site.

What is sent: the service account’s own credentials, the property address the owner entered, and a date range.

When it is sent: once a day on a schedule, and whenever the owner presses the refresh control. A refresh fetches the last week straight away and then the rest of the requested history in the background, a fortnight at a time over a few minutes, so that one press can produce several calls in a row. This is the one recurring outbound call the plugin makes, and it only happens on sites that have connected Search Console. Disconnecting stops it and removes the schedule.

Both Google APIs are provided by Google LLC.

Google PageSpeed Insights (optional)

The Page speed tab and each post’s stats screen have a button for Google’s PageSpeed Insights lab test. It works one of two ways.

Without an API key (the default), the button is a link. It opens https://pagespeed.web.dev/ in the admin’s own browser, with the address of the page being tested in the link, and Google runs the test there. The plugin’s server sends nothing and stores nothing.

With an API key the site owner adds under Settings, the plugin calls https://www.googleapis.com/pagespeedonline/v5/runPagespeed from the server and shows the result on the dashboard.

What is sent: the address of the page being tested, which is always a page on this site or on a connected site, the device to test as (mobile or desktop), the admin’s language, and, on the API path, the site owner’s API key. No visitor data and nothing about anyone reading the site.

When it is sent: only when someone with access to the Vireo dashboard presses the button. Nothing runs on a schedule or on the front end. API results are kept for a day so the page can show them again without another test.

PageSpeed Insights is provided by Google LLC.

DB-IP (optional, geolocation)

Country-level geolocation needs a local database, and Pro’s city-level detail needs a second one. When a site owner presses the download button, the plugin fetches the current monthly file from https://download.db-ip.com.

What is sent: nothing but the request for the file. No site data, no visitor data, no identifiers. Lookups afterwards happen entirely on your own server against the downloaded file; no address is ever sent anywhere.

When it is sent: only when the owner presses the button.

DB-IP Lite data is provided by DB-IP under CC BY 4.0.

Website: https://db-ip.com/
Privacy Policy: https://db-ip.com/legal/privacy

MaxMind GeoLite2 (optional, geolocation)

A site owner can connect their own free MaxMind account so the plugin downloads and updates the GeoLite2 Country database for them. Nothing is contacted until the owner saves an account ID and license key under Settings, Geo-location.

What is sent: the owner’s MaxMind account ID and license key, as HTTP Basic authentication on the request for the database file to https://download.maxmind.com, plus the usual details of any web request (this server’s IP address). No visitor data, no site content and no identifiers of anyone reading the site. Lookups afterwards happen entirely on your own server against the downloaded file; no visitor address is ever sent anywhere.

When it is sent: when the owner saves the account details or presses Update now, and then once a day to check whether MaxMind has published a newer file. A day with nothing new is a single small request for the file’s checksum.

GeoLite2 data is created by MaxMind and used under the GeoLite End User License Agreement. This product includes GeoLite2 Data created by MaxMind, available from https://www.maxmind.com.

Website: https://www.maxmind.com/
GeoLite End User License Agreement: https://www.maxmind.com/en/geolite2/eula
Privacy Policy: https://www.maxmind.com/en/privacy-policy

A site that imports nothing, connects nothing, adds no PageSpeed API key and downloads no geolocation database contacts none of these services from its own server.

It does make one recurring request to itself: once an hour the plugin posts to its own tracking endpoint to check the fast path is still reachable, because a host rule or a CDN change can break it silently. That request never leaves your server and carries no data about anyone.

None of these paths send visitor data anywhere. Every one of them pulls data in.