Vireo Analytics – Privacy-First Website Analytics

Vireo Analytics is a self-hosted, privacy-first analytics plugin for WordPress. It gives you the numbers that actually matter: pageviews, visitors, top content, referrers, countries, devices, without cookies, without a consent banner, and without sending a single byte to a third party. All data stays in your own database.

The numbers you see are the numbers that matter. Most analytics tools count uptime monitors (StatusCake, UptimeRobot, Pingdom), SEO crawlers (Ahrefs, Semrush), AI bots (GPTBot, ClaudeBot, PerplexityBot), and headless browsers as “visitors”, inflating your stats by 20 to 40%. Vireo Analytics filters them out at the tracker level against a database of over eight hundred known crawlers, sorted into what each one is doing, plus Cloudflare signals and automation detection. What you see is real humans reading your content.

It’s designed to be a drop-in replacement for Jetpack Stats or Google Analytics for site owners who want clarity over dashboards full of noise. If you’re already running Koko Analytics, Vireo Analytics can import your existing history in one click. If you’re moving off Jetpack Stats, the built-in importer pulls up to 14 months of historical data from the Jetpack API.

Features

• Clean, fast dashboard with pageviews, unique visitors, and trend charts.
• Top content, top referrers, countries, and device breakdowns.
• Cookie-free tracking, so no consent banner is needed for basic analytics.
• Daily-rotating salted hashes for visitor identity, GDPR-compatible out of the box.
• Counts pageviews with or without JavaScript. A no-script pixel catches readers whose browser never runs the tracker, and both paths keep working behind a full-page cache.
• Admin-bar sparkline showing today’s traffic at a glance.
• Per-post analytics column on the Posts list screen.
• Custom events API for tracking button clicks, form submissions, and other interactions.
• 404 tracking so you can spot broken inbound links.
• Weekly email digest delivered to your inbox.
• CSV export of any dashboard view.
• One-click import of your history from Koko Analytics, Jetpack Stats, Statify, WP Statistics, Burst Statistics, Independent Analytics and SlimStat, so switching does not mean starting at zero.
• See what the AI assistants take against what they send back. ChatGPT, Claude, Gemini, Perplexity, Copilot and others are reported as their own traffic source, alongside how many pages their crawlers fetched and the ratio between the two. Works on history you already collected.
• Bot filtering you can actually see. Crawlers, AI trainers, SEO tools, uptime monitors, link previews and headless browsers are sorted into categories and reported back to you, so you can check what was excluded instead of taking it on trust.
• Catches automated browsers that lie about who they are. A headless browser can send any user agent it likes, so the tracker checks the flags the automation tools set on themselves.
• Skips prefetched and prerendered pages, which the reader may never actually look at.
• Honours Do Not Track and Global Privacy Control: visitors who ask not to be tracked are not tracked, with no setting to turn on.
• Core Web Vitals measured from the people actually visiting your site, where a lab tool measures one run on one machine. Loading, responsiveness and visual stability, reported as the 75th percentile Google grades on, because an average hides the slowest quarter of your readers.
• The searches that brought people in, pulled from Search Console. Google strips the query before your site ever sees it, so this is the only place it exists.
• One-click import of your history out of Google Analytics 4, alongside the seven WordPress plugins already supported.
• Notes pinned to a date, so a spike six weeks ago still has an explanation attached to it.
• Let an editor or a client read the dashboard without making them an administrator.
• Works across a multisite network, with a single view of every site for whoever runs them.
• Tells you when it stops recording. Analytics fails silently by nature, and a plugin that has stopped counting looks exactly like a quiet week, so this one raises it in Site Health and in the admin rather than leaving you to notice a flat chart weeks later.
• Per-site “exclude logged-in admins” setting.

External services

This plugin includes an optional one-click importer for historical Jetpack Stats data. When (and only when) a site owner runs that importer from Vireo Analytics → Settings → Import data, the plugin calls the WordPress.com Stats API at https://stats.wordpress.com/csv.php to retrieve the site’s existing pageview, referrer, and top-post history.

What is sent:

• The site’s existing Jetpack blog_id (read from the connected Jetpack install).
• The Jetpack API key (read from the connected Jetpack install).
• A requested date range and table name (e.g. views, referrers, topposts).

What is not sent: no visitor data, no user data, no site content, no credentials beyond the Jetpack API key the site already holds.

When it is sent: only while the import is actively running, in response to a site owner clicking “Run Import”. No background or recurring calls are made.

The Stats API is provided by Automattic Inc. (WordPress.com).

• Terms of Service: https://wordpress.com/tos/
• Privacy Policy: https://automattic.com/privacy/

The importer is entirely optional.

Google Analytics (optional, importer)

When a site owner runs the Google Analytics importer, the plugin signs a request with the service-account key they pasted and calls https://oauth2.googleapis.com/token for an access token, then https://analyticsdata.googleapis.com to read that property’s history.

What is sent: the service account’s own credentials and a date range. No visitor data, no site content, nothing about anyone reading the site.

When it is sent: only while an import is running, in response to a site owner starting one. The key can be removed from the same screen afterwards.

Google Search Console (optional)

When a site owner connects Search Console, the plugin authenticates the same way and calls https://searchconsole.googleapis.com to read the searches that led people to the site.

What is sent: the service account’s own credentials, the property address the owner entered, and a date range.

When it is sent: once a day on a schedule, and whenever the owner presses the refresh control. This is the one recurring outbound call the plugin makes, and it only happens on sites that have connected Search Console. Disconnecting stops it and removes the schedule.

Both Google APIs are provided by Google LLC.

• Terms of Service: https://policies.google.com/terms
• Privacy Policy: https://policies.google.com/privacy

DB-IP (optional, geolocation)

Country-level geolocation needs a local database, and Pro’s city-level detail needs a second one. When a site owner presses the download button, the plugin fetches the current monthly file from https://download.db-ip.com.

What is sent: nothing but the request for the file. No site data, no visitor data, no identifiers. Lookups afterwards happen entirely on your own server against the downloaded file; no address is ever sent anywhere.

When it is sent: only when the owner presses the button.

DB-IP Lite data is provided by DB-IP under CC BY 4.0.

• Website: https://db-ip.com/
• Privacy Policy: https://db-ip.com/legal/privacy

A site that imports nothing, connects nothing and downloads no geolocation database contacts none of these services.

It does make one recurring request to itself: once an hour the plugin posts to its own tracking endpoint to check the fast path is still reachable, because a host rule or a CDN change can break it silently. That request never leaves your server and carries no data about anyone.

None of these paths send visitor data anywhere. Every one of them pulls data in.