VisitStats is a lightweight, privacy-first analytics plugin for WordPress. All your data stays in your own WordPress database — we never see it, no third party sees it.

Why VisitStats?

No cookies, no consent banner needed. Tracking is GDPR-friendly by default.
Self-hosted. All data lives in your WordPress database. No external service, no Automattic, no Google.
Lightweight. Frontend tracker is under 2KB. Loads asynchronously. Won’t slow your site.
Zero setup. Install, activate, done. No theme edits, no tag manager, no JS snippets.
Built for WordPress. Reports appear inside your WordPress dashboard — no separate app to log into.

Recommended for sites with up to ~10,000 daily pageviews (around 95% of WordPress sites). For very high-traffic sites, consider dedicated analytics services.

What you get (all free, all the time):

Real-time visitor count — see who’s on your site right now
Pageviews, unique visitors, sessions
Top pages
Top traffic sources (direct, search, social, AI, referral)
Top referrers — actual URLs sending you traffic
Device breakdown (desktop, mobile, tablet)
Browser & operating system detection
Configurable data retention from 1 day up to 1 year
Date range views: today, 7 days, 30 days, 90 days, 1 year
Engagement signals (scroll depth, time on page)
Cookieless visitor identification using daily-rotating salt + SHA-256 hashing
Bot filtering with built-in bot signature detection
Optional administrator / logged-in user exclusion
Honors Do Not Track browser signal
Automatic data pruning to keep your database lean
Rate-limited tracking endpoint protects against abuse
IP anonymization before hashing — actual IPs never stored

Privacy by design

VisitStats never:

Sets cookies
Stores IP addresses
Sends data to third parties
Fingerprints visitors
Tracks across days

Visitor identification uses a daily-rotating salt hashed with the (anonymized) IP and User Agent to count unique visits within a 24-hour window. The salt regenerates every 24 hours, making cross-day tracking impossible. This is the same approach used by Plausible Analytics and Fathom Analytics.

For developers

Clean REST API at /wp-json/visitstats/v1/
Filter hooks for customizing behavior (rate limiting, bot detection, etc.)
PSR-style class organization
No external dependencies — pure WordPress core